source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "libcli/composite/composite.h"
  23 #include "libcli/cldap/cldap.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_errors.h"
  26 #include "lib/ldb_wrap.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "../libds/common/flags.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "librpc/gen_ndr/ndr_security.h"
  33 #include "librpc/gen_ndr/ndr_nbt.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "param/param.h"
  37
  38 /*****************************************************************************
  39  * Windows 2003 (w2k3) does the following steps when changing the server role
  40  * from domain member to domain controller
  41  *
  42  * We mostly do the same.
  43  *****************************************************************************/
  44
  45 /*
  46  * lookup DC:
  47  * - using nbt name<1C> request and a samlogon mailslot request
  48  * or
  49  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
  50  *
  51  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
  52  */
  53
  54 /*
  55  * Open 1st LDAP connection to the DC using admin credentials
  56  *
  57  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
  58  */
  59
  60 /*
  61  * LDAP search 1st LDAP connection:
  62  *
  63  * see: becomeDC_ldap1_rootdse()
  64  *
  65  * Request:
  66  *      basedn: ""
  67  *      scope:  base
  68  *      filter: (objectClass=*)
  69  *      attrs:  *
  70  * Result:
  71  *      ""
  72  *              currentTime:            20061202155100.0Z
  73  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
  74  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  75  *              namingContexts:         <domain_partition>
  76  *                                      CN=Configuration,<domain_partition>
  77  *                                      CN=Schema,CN=Configuration,<domain_partition>
  78  *              defaultNamingContext:   <domain_partition>
  79  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
  80  *              configurationNamingContext:CN=Configuration,<domain_partition>
  81  *              rootDomainNamingContext:<domain_partition>
  82  *              supportedControl:       ...
  83  *              supportedLDAPVersion:   3
  84  *                                      2
  85  *              supportedLDAPPolicies:  ...
  86  *              highestCommitedUSN:     ...
  87  *              supportedSASLMechanisms:GSSAPI
  88  *                                      GSS-SPNEGO
  89  *                                      EXTERNAL
  90  *                                      DIGEST-MD5
  91  *              dnsHostName:            <dns_host_name>
  92  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
  93  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  94  *              supportedCapabilities:  ...
  95  *              isSyncronized:          TRUE
  96  *              isGlobalCatalogReady:   TRUE
  97  *              domainFunctionality:    0
  98  *              forestFunctionality:    0
  99  *              domainControllerFunctionality: 2
 100  */
 101
 102 /*
 103  * LDAP search 1st LDAP connection:
 104  *
 105  * see: becomeDC_ldap1_crossref_behavior_version()
 106  *
 107  * Request:
 108  *      basedn: CN=Configuration,<domain_partition>
 109  *      scope:  one
 110  *      filter: (cn=Partitions)
 111  *      attrs:  msDS-Behavior-Version
 112  * Result:
 113  *      CN=Partitions,CN=Configuration,<domain_partition>
 114  *              msDS-Behavior-Version:  0
 115  */
 116
 117 /*
 118  * LDAP search 1st LDAP connection:
 119  *
 120  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 121  *
 122  * not implemented here
 123  *
 124  * Request:
 125  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 126  *      scope:  one
 127  *      filter: (cn=Partitions)
 128  *      attrs:  msDS-Behavior-Version
 129  * Result:
 130  *      <none>
 131  *
 132  */
 133
 134 /*
 135  * LDAP search 1st LDAP connection:
 136  *
 137  * see: becomeDC_ldap1_domain_behavior_version()
 138  *
 139  * Request:
 140  *      basedn: <domain_partition>
 141  *      scope:  base
 142  *      filter: (objectClass=*)
 143  *      attrs:  msDS-Behavior-Version
 144  * Result:
 145  *      <domain_partition>
 146  *              msDS-Behavior-Version:  0
 147  */
 148
 149 /*
 150  * LDAP search 1st LDAP connection:
 151  *
 152  * see: becomeDC_ldap1_schema_object_version()
 153  *
 154  * Request:
 155  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 156  *      scope:  base
 157  *      filter: (objectClass=*)
 158  *      attrs:  objectVersion
 159  * Result:
 160  *      CN=Schema,CN=Configuration,<domain_partition>
 161  *              objectVersion:  30
 162  */
 163
 164 /*
 165  * LDAP search 1st LDAP connection:
 166  *
 167  * not implemented, because the information is already there
 168  *
 169  * Request:
 170  *      basedn: ""
 171  *      scope:  base
 172  *      filter: (objectClass=*)
 173  *      attrs:  defaultNamingContext
 174  *              dnsHostName
 175  * Result:
 176  *      ""
 177  *              defaultNamingContext:   <domain_partition>
 178  *              dnsHostName:            <dns_host_name>
 179  */
 180
 181 /*
 182  * LDAP search 1st LDAP connection:
 183  *
 184  * see: becomeDC_ldap1_infrastructure_fsmo()
 185  *
 186  * Request:
 187  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 188  *      scope:  base
 189  *      filter: (objectClass=*)
 190  *      attrs:  1.1
 191  * Result:
 192  *      CN=Infrastructure,<domain_partition>
 193  */
 194
 195 /*
 196  * LDAP search 1st LDAP connection:
 197  *
 198  * see: becomeDC_ldap1_w2k3_update_revision()
 199  *
 200  * Request:
 201  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 202  *      scope:  base
 203  *      filter: (objectClass=*)
 204  *      attrs:  revision
 205  * Result:
 206  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 207  *              revision:       8
 208  */
 209
 210 /*
 211  * LDAP search 1st LDAP connection:
 212  *
 213  * see: becomeDC_ldap1_infrastructure_fsmo()
 214  *
 215  * Request:
 216  *      basedn: CN=Infrastructure,<domain_partition>
 217  *      scope:  base
 218  *      filter: (objectClass=*)
 219  *      attrs:  fSMORoleOwner
 220  * Result:
 221  *      CN=Infrastructure,<domain_partition>
 222  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 223  */
 224
 225 /*
 226  * LDAP search 1st LDAP connection:
 227  *
 228  * see: becomeDC_ldap1_infrastructure_fsmo()
 229  *
 230  * Request:
 231  *      basedn: <infrastructure_fsmo_server_object>
 232  *      scope:  base
 233  *      filter: (objectClass=*)
 234  *      attrs:  dnsHostName
 235  * Result:
 236  *      <infrastructure_fsmo_server_object>
 237  *              dnsHostName:    <dns_host_name>
 238  */
 239
 240 /*
 241  * LDAP search 1st LDAP connection:
 242  *
 243  * see: becomeDC_ldap1_infrastructure_fsmo()
 244  *
 245  * Request:
 246  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 247  *      scope:  base
 248  *      filter: (objectClass=*)
 249  *      attrs:  objectGUID
 250  * Result:
 251  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 252  *              objectGUID:     <object_guid>
 253  */
 254
 255 /*
 256  * LDAP search 1st LDAP connection:
 257  *
 258  * see: becomeDC_ldap1_rid_manager_fsmo()
 259  *
 260  * Request:
 261  *      basedn: <domain_partition>
 262  *      scope:  base
 263  *      filter: (objectClass=*)
 264  *      attrs:  rIDManagerReference
 265  * Result:
 266  *      <domain_partition>
 267  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 268  */
 269
 270 /*
 271  * LDAP search 1st LDAP connection:
 272  *
 273  * see: becomeDC_ldap1_rid_manager_fsmo()
 274  *
 275  * Request:
 276  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 277  *      scope:  base
 278  *      filter: (objectClass=*)
 279  *      attrs:  fSMORoleOwner
 280  * Result:
 281  *      CN=Infrastructure,<domain_partition>
 282  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 283  */
 284
 285 /*
 286  * LDAP search 1st LDAP connection:
 287  *
 288  * see: becomeDC_ldap1_rid_manager_fsmo()
 289  *
 290  * Request:
 291  *      basedn: <rid_manager_fsmo_server_object>
 292  *      scope:  base
 293  *      filter: (objectClass=*)
 294  *      attrs:  dnsHostName
 295  * Result:
 296  *      <rid_manager_fsmo_server_object>
 297  *              dnsHostName:    <dns_host_name>
 298  */
 299
 300 /*
 301  * LDAP search 1st LDAP connection:
 302  *
 303  * see: becomeDC_ldap1_rid_manager_fsmo()
 304  *
 305  * Request:
 306  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 307  *      scope:  base
 308  *      filter: (objectClass=*)
 309  *      attrs:  msDs-ReplicationEpoch
 310  * Result:
 311  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 312  */
 313
 314 /*
 315  * LDAP search 1st LDAP connection:
 316  *
 317  * see: becomeDC_ldap1_site_object()
 318  *
 319  * Request:
 320  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 321  *      scope:  base
 322  *      filter: (objectClass=*)
 323  *      attrs:
 324  * Result:
 325  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 326  *              objectClass:    top
 327  *                              site
 328  *              cn:             <new_dc_site_name>
 329  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 330  *              instanceType:   4
 331  *              whenCreated:    ...
 332  *              whenChanged:    ...
 333  *              uSNCreated:     ...
 334  *              uSNChanged:     ...
 335  *              showInAdvancedViewOnly: TRUE
 336  *              name:           <new_dc_site_name>
 337  *              objectGUID:     <object_guid>
 338  *              systemFlags:    1107296256 <0x42000000>
 339  *              objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition>
 340  */
 341
 342 /***************************************************************
 343  * Add this stage we call the check_options() callback function
 344  * of the caller, to see if he wants us to continue
 345  *
 346  * see: becomeDC_check_options()
 347  ***************************************************************/
 348
 349 /*
 350  * LDAP search 1st LDAP connection:
 351  *
 352  * see: becomeDC_ldap1_computer_object()
 353  *
 354  * Request:
 355  *      basedn: <domain_partition>
 356  *      scope:  sub
 357  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 358  *      attrs:  distinguishedName
 359  *              userAccountControl
 360  * Result:
 361  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 362  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 363  *              userAccoountControl:    4096 <0x1000>
 364  */
 365
 366 /*
 367  * LDAP search 1st LDAP connection:
 368  *
 369  * see: becomeDC_ldap1_server_object_1()
 370  *
 371  * Request:
 372  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 373  *      scope:  base
 374  *      filter: (objectClass=*)
 375  *      attrs:
 376  * Result:
 377  *      <noSuchObject>
 378  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 379  */
 380
 381 /*
 382  * LDAP search 1st LDAP connection:
 383  *
 384  * see: becomeDC_ldap1_server_object_2()
 385  *
 386  * Request:
 387  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 388  *      scope:  base
 389  *      filter: (objectClass=*)
 390  *      attrs:  serverReferenceBL
 391  *      typesOnly: TRUE!!!
 392  * Result:
 393  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 394  */
 395
 396 /*
 397  * LDAP add 1st LDAP connection:
 398  *
 399  * see: becomeDC_ldap1_server_object_add()
 400  *
 401  * Request:
 402  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 403  *      objectClass:    server
 404  *      systemFlags:    50000000 <0x2FAF080>
 405  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 406  * Result:
 407  *      <success>
 408  */
 409
 410 /*
 411  * LDAP search 1st LDAP connection:
 412  *
 413  * not implemented, maybe we can add that later
 414  *
 415  * Request:
 416  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 417  *      scope:  base
 418  *      filter: (objectClass=*)
 419  *      attrs:
 420  * Result:
 421  *      <noSuchObject>
 422  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 423  */
 424
 425 /*
 426  * LDAP search 1st LDAP connection:
 427  *
 428  * not implemented because it gives no new information
 429  *
 430  * Request:
 431  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 432  *      scope:  sub
 433  *      filter: (nCName=<domain_partition>)
 434  *      attrs:  nCName
 435  *              dnsRoot
 436  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 437  * Result:
 438  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 439  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 440  *              dnsRoot:        <domain_dns_name>
 441  */
 442
 443 /*
 444  * LDAP modify 1st LDAP connection:
 445  *
 446  * see: becomeDC_ldap1_server_object_modify()
 447  *
 448  * Request (add):
 449  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 450  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 451  * Result:
 452  *      <attributeOrValueExist>
 453  */
 454
 455 /*
 456  * LDAP modify 1st LDAP connection:
 457  *
 458  * see: becomeDC_ldap1_server_object_modify()
 459  *
 460  * Request (replace):
 461  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 462  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 463  * Result:
 464  *      <success>
 465  */
 466
 467 /*
 468  * Open 1st DRSUAPI connection to the DC using admin credentials
 469  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 470  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 471  *
 472  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
 473  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
 474  */
 475
 476 /*
 477  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 478  * on the 1st DRSUAPI connection
 479  *
 480  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
 481  */
 482
 483 /***************************************************************
 484  * Add this stage we call the prepare_db() callback function
 485  * of the caller, to see if he wants us to continue
 486  *
 487  * see: becomeDC_prepare_db()
 488  ***************************************************************/
 489
 490 /*
 491  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 492  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 493  *   on the 2nd connection
 494  *
 495  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
 496  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
 497  *      and becomeDC_drsuapi3_connect_recv()
 498  */
 499
 500 /*
 501  * replicate CN=Schema,CN=Configuration,...
 502  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 503  *
 504  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 505  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
 506  *
 507  ***************************************************************
 508  * Add this stage we call the schema_chunk() callback function
 509  * for each replication message
 510  ***************************************************************/
 511
 512 /*
 513  * replicate CN=Configuration,...
 514  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 515  *
 516  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 517  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
 518  *
 519  ***************************************************************
 520  * Add this stage we call the config_chunk() callback function
 521  * for each replication message
 522  ***************************************************************/
 523
 524 /*
 525  * LDAP unbind on the 1st LDAP connection
 526  *
 527  * not implemented, because it's not needed...
 528  */
 529
 530 /*
 531  * Open 2nd LDAP connection to the DC using admin credentials
 532  *
 533  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
 534  */
 535
 536 /*
 537  * LDAP search 2nd LDAP connection:
 538  *
 539  * not implemented because it gives no new information
 540  * same as becomeDC_ldap1_computer_object()
 541  *
 542  * Request:
 543  *      basedn: <domain_partition>
 544  *      scope:  sub
 545  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 546  *      attrs:  distinguishedName
 547  *              userAccountControl
 548  * Result:
 549  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 550  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 551  *              userAccoountControl:    4096 <0x00001000>
 552  */
 553
 554 /*
 555  * LDAP search 2nd LDAP connection:
 556  *
 557  * not implemented because it gives no new information
 558  * same as becomeDC_ldap1_computer_object()
 559  *
 560  * Request:
 561  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 562  *      scope:  base
 563  *      filter: (objectClass=*)
 564  *      attrs:  userAccountControl
 565  * Result:
 566  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 567  *              userAccoountControl:    4096 <0x00001000>
 568  */
 569
 570 /*
 571  * LDAP modify 2nd LDAP connection:
 572  *
 573  * see: becomeDC_ldap2_modify_computer()
 574  *
 575  * Request (replace):
 576  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 577  *      userAccoountControl:    532480 <0x82000>
 578  * Result:
 579  *      <success>
 580  */
 581
 582 /*
 583  * LDAP search 2nd LDAP connection:
 584  *
 585  * see: becomeDC_ldap2_move_computer()
 586  *
 587  * Request:
 588  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
 589  *      scope:  base
 590  *      filter: (objectClass=*)
 591  *      attrs:  1.1
 592  * Result:
 593  *      CN=Domain Controllers,<domain_partition>
 594  */
 595
 596 /*
 597  * LDAP search 2nd LDAP connection:
 598  *
 599  * not implemented because it gives no new information
 600  *
 601  * Request:
 602  *      basedn: CN=Domain Controllers,<domain_partition>
 603  *      scope:  base
 604  *      filter: (objectClass=*)
 605  *      attrs:  distinguishedName
 606  * Result:
 607  *      CN=Domain Controller,<domain_partition>
 608  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
 609  */
 610
 611 /*
 612  * LDAP modifyRDN 2nd LDAP connection:
 613  *
 614  * see: becomeDC_ldap2_move_computer()
 615  *
 616  * Request:
 617  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 618  *      newrdn:         CN=<new_dc_netbios_name>
 619  *      deleteoldrdn:   TRUE
 620  *      newparent:      CN=Domain Controllers,<domain_partition>
 621  * Result:
 622  *      <success>
 623  */
 624
 625 /*
 626  * LDAP unbind on the 2nd LDAP connection
 627  *
 628  * not implemented, because it's not needed...
 629  */
 630
 631 /*
 632  * replicate Domain Partition
 633  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 634  *
 635  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 636  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
 637  *
 638  ***************************************************************
 639  * Add this stage we call the domain_chunk() callback function
 640  * for each replication message
 641  ***************************************************************/
 642
 643 /* call DsReplicaUpdateRefs() for all partitions like this:
 644  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 645  *
 646  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 647  *                     __ndr_size               : 0x000000ae (174)
 648  *                     __ndr_size_sid           : 0x00000000 (0)
 649  *                     guid                     : 00000000-0000-0000-0000-000000000000
 650  *                     sid                      : S-0-0
 651  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 652  *
 653  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 654  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 655  *           options                  : 0x0000001c (28)
 656  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 658  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 661  *
 662  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 663  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 664  * on the 2nd!!! DRSUAPI connection
 665  *
 666  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
 667  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
 668  */
 669
 670 /*
 671  * Windows does opens the 4th and 5th DRSUAPI connection...
 672  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
 673  * on the 4th connection
 674  *
 675  * and then 2 full replications of the domain partition on the 5th connection
 676  * with the bind_handle from the 4th connection
 677  *
 678  * not implemented because it gives no new information
 679  */
 680
 681 struct libnet_BecomeDC_state {
 682         struct composite_context *creq;
 683
 684         struct libnet_context *libnet;
 685
 686         struct dom_sid zero_sid;
 687
 688         struct {
 689                 struct cldap_socket *sock;
 690                 struct cldap_netlogon io;
 691                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
 692         } cldap;
 693
 694         struct becomeDC_ldap {
 695                 struct ldb_context *ldb;
 696                 const struct ldb_message *rootdse;
 697         } ldap1, ldap2;
 698
 699         struct becomeDC_drsuapi {
 700                 struct libnet_BecomeDC_state *s;
 701                 struct dcerpc_binding *binding;
 702                 struct dcerpc_pipe *pipe;
 703                 DATA_BLOB gensec_skey;
 704                 struct drsuapi_DsBind bind_r;
 705                 struct GUID bind_guid;
 706                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
 707                 struct drsuapi_DsBindInfo28 local_info28;
 708                 struct drsuapi_DsBindInfo28 remote_info28;
 709                 struct policy_handle bind_handle;
 710         } drsuapi1, drsuapi2, drsuapi3;
 711
 712         struct libnet_BecomeDC_Domain domain;
 713         struct libnet_BecomeDC_Forest forest;
 714         struct libnet_BecomeDC_SourceDSA source_dsa;
 715         struct libnet_BecomeDC_DestDSA dest_dsa;
 716
 717         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
 718
 719         struct becomeDC_fsmo {
 720                 const char *dns_name;
 721                 const char *server_dn_str;
 722                 const char *ntds_dn_str;
 723                 struct GUID ntds_guid;
 724         } infrastructure_fsmo;
 725
 726         struct becomeDC_fsmo rid_manager_fsmo;
 727
 728         struct libnet_BecomeDC_CheckOptions _co;
 729         struct libnet_BecomeDC_PrepareDB _pp;
 730         struct libnet_BecomeDC_StoreChunk _sc;
 731         struct libnet_BecomeDC_Callbacks callbacks;
 732
 733         bool rodc_join;
 734 };
 735
 736 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
 737 {
 738         /* per default we are (Windows) 2008 compatible */
 739         return lp_parm_int(lp_ctx, NULL, "ads", "dc function level",
 740                 DS_DC_FUNCTION_2008);
 741 }
 742
 743 static int32_t get_min_function_level(struct loadparm_context *lp_ctx)
 744 {
 745         /* per default it is (Windows) 2003 Native compatible */
 746         return lp_parm_int(lp_ctx, NULL, "ads", "min function level",
 747                 DS_DOMAIN_FUNCTION_2003);
 748 }
 749
 750 static void becomeDC_recv_cldap(struct tevent_req *req);
 751
 752 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 753 {
 754         struct composite_context *c = s->creq;
 755         struct tevent_req *req;
 756
 757         s->cldap.io.in.dest_address     = s->source_dsa.address;
 758         s->cldap.io.in.dest_port        = lp_cldap_port(s->libnet->lp_ctx);
 759         s->cldap.io.in.realm            = s->domain.dns_name;
 760         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 761         s->cldap.io.in.user             = NULL;
 762         s->cldap.io.in.domain_guid      = NULL;
 763         s->cldap.io.in.domain_sid       = NULL;
 764         s->cldap.io.in.acct_control     = -1;
 765         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 766         s->cldap.io.in.map_response     = true;
 767
 768         c->status = cldap_socket_init(s, s->libnet->event_ctx,
 769                                       NULL, NULL, &s->cldap.sock);//TODO
 770         if (!composite_is_ok(c)) return;
 771
 772         req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
 773         if (composite_nomem(req, c)) return;
 774         tevent_req_set_callback(req, becomeDC_recv_cldap, s);
 775 }
 776
 777 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 778
 779 static void becomeDC_recv_cldap(struct tevent_req *req)
 780 {
 781         struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
 782                                           struct libnet_BecomeDC_state);
 783         struct composite_context *c = s->creq;
 784
 785         c->status = cldap_netlogon_recv(req,
 786                                         lp_iconv_convenience(s->libnet->lp_ctx),
 787                                         s, &s->cldap.io);
 788         talloc_free(req);
 789         if (!composite_is_ok(c)) {
 790                 DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n",
 791                          s->cldap.io.in.dest_address,
 792                          s->cldap.io.in.host,
 793                          nt_errstr(c->status)));
 794                 return;
 795         }
 796         s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
 797
 798         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
 799         s->domain.netbios_name          = s->cldap.netlogon.domain;
 800         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
 801
 802         s->forest.dns_name              = s->cldap.netlogon.forest;
 803
 804         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
 805         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
 806         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
 807
 808         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
 809
 810         becomeDC_connect_ldap1(s);
 811 }
 812
 813 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
 814                                       struct becomeDC_ldap *ldap)
 815 {
 816         char *url;
 817
 818         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 819         NT_STATUS_HAVE_NO_MEMORY(url);
 820
 821         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
 822                                      NULL,
 823                                      s->libnet->cred,
 824                                      0);
 825         talloc_free(url);
 826         if (ldap->ldb == NULL) {
 827                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 828         }
 829
 830         return NT_STATUS_OK;
 831 }
 832
 833 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 834 {
 835         int ret;
 836         struct ldb_result *r;
 837         struct ldb_dn *basedn;
 838         static const char *attrs[] = {
 839                 "*",
 840                 NULL
 841         };
 842
 843         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 844         NT_STATUS_HAVE_NO_MEMORY(basedn);
 845
 846         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 847                          "(objectClass=*)");
 848         talloc_free(basedn);
 849         if (ret != LDB_SUCCESS) {
 850                 return NT_STATUS_LDAP(ret);
 851         } else if (r->count != 1) {
 852                 talloc_free(r);
 853                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 854         }
 855
 856         s->ldap1.rootdse = r->msgs[0];
 857
 858         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 859         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 860
 861         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 862         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 863         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 864         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 865         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 866         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 867
 868         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 869         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 870         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 871         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 872
 873         return NT_STATUS_OK;
 874 }
 875
 876 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
 877 {
 878         int ret;
 879         struct ldb_result *r;
 880         struct ldb_dn *basedn;
 881         static const char *attrs[] = {
 882                 "msDs-Behavior-Version",
 883                 NULL
 884         };
 885
 886         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 887         NT_STATUS_HAVE_NO_MEMORY(basedn);
 888
 889         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
 890                          "(cn=Partitions)");
 891         talloc_free(basedn);
 892         if (ret != LDB_SUCCESS) {
 893                 return NT_STATUS_LDAP(ret);
 894         } else if (r->count != 1) {
 895                 talloc_free(r);
 896                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 897         }
 898
 899         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 900         if (s->forest.crossref_behavior_version <
 901                          get_min_function_level(s->libnet->lp_ctx)) {
 902                 talloc_free(r);
 903                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 904                          s->forest.crossref_behavior_version,
 905                          get_min_function_level(s->libnet->lp_ctx)));
 906                 return NT_STATUS_NOT_SUPPORTED;
 907         }
 908         if (s->forest.crossref_behavior_version >
 909                         get_dc_function_level(s->libnet->lp_ctx)) {
 910                 talloc_free(r);
 911                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 912                          s->forest.crossref_behavior_version,
 913                          get_dc_function_level(s->libnet->lp_ctx)));
 914                 return NT_STATUS_NOT_SUPPORTED;
 915         }
 916
 917         talloc_free(r);
 918         return NT_STATUS_OK;
 919 }
 920
 921 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 922 {
 923         int ret;
 924         struct ldb_result *r;
 925         struct ldb_dn *basedn;
 926         static const char *attrs[] = {
 927                 "msDs-Behavior-Version",
 928                 NULL
 929         };
 930
 931         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 932         NT_STATUS_HAVE_NO_MEMORY(basedn);
 933
 934         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 935                          "(objectClass=*)");
 936         talloc_free(basedn);
 937         if (ret != LDB_SUCCESS) {
 938                 return NT_STATUS_LDAP(ret);
 939         } else if (r->count != 1) {
 940                 talloc_free(r);
 941                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 942         }
 943
 944         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 945         if (s->domain.behavior_version <
 946                         get_min_function_level(s->libnet->lp_ctx)) {
 947                 talloc_free(r);
 948                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 949                          s->forest.crossref_behavior_version,
 950                          get_min_function_level(s->libnet->lp_ctx)));
 951                 return NT_STATUS_NOT_SUPPORTED;
 952         }
 953         if (s->domain.behavior_version >
 954                         get_dc_function_level(s->libnet->lp_ctx)) {
 955                 talloc_free(r);
 956                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 957                          s->forest.crossref_behavior_version,
 958                          get_dc_function_level(s->libnet->lp_ctx)));
 959                 return NT_STATUS_NOT_SUPPORTED;
 960         }
 961
 962         talloc_free(r);
 963         return NT_STATUS_OK;
 964 }
 965
 966 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 967 {
 968         int ret;
 969         struct ldb_result *r;
 970         struct ldb_dn *basedn;
 971         static const char *attrs[] = {
 972                 "objectVersion",
 973                 NULL
 974         };
 975
 976         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 977         NT_STATUS_HAVE_NO_MEMORY(basedn);
 978
 979         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 980                          "(objectClass=*)");
 981         talloc_free(basedn);
 982         if (ret != LDB_SUCCESS) {
 983                 return NT_STATUS_LDAP(ret);
 984         } else if (r->count != 1) {
 985                 talloc_free(r);
 986                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 987         }
 988
 989         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
 990
 991         talloc_free(r);
 992         return NT_STATUS_OK;
 993 }
 994
 995 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
 996 {
 997         int ret;
 998         struct ldb_result *r;
 999         struct ldb_dn *basedn;
1000         static const char *attrs[] = {
1001                 "revision",
1002                 NULL
1003         };
1004
1005         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
1006                                 s->domain.dn_str);
1007         NT_STATUS_HAVE_NO_MEMORY(basedn);
1008
1009         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
1010                          "(objectClass=*)");
1011         talloc_free(basedn);
1012         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1013                 /* w2k doesn't have this object */
1014                 s->domain.w2k3_update_revision = 0;
1015                 return NT_STATUS_OK;
1016         } else if (ret != LDB_SUCCESS) {
1017                 return NT_STATUS_LDAP(ret);
1018         } else if (r->count != 1) {
1019                 talloc_free(r);
1020                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1021         }
1022
1023         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1024
1025         talloc_free(r);
1026         return NT_STATUS_OK;
1027 }
1028
1029 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1030 {
1031         int ret;
1032         struct ldb_result *r;
1033         struct ldb_dn *basedn;
1034         struct ldb_dn *ntds_dn;
1035         struct ldb_dn *server_dn;
1036         static const char *dns_attrs[] = {
1037                 "dnsHostName",
1038                 NULL
1039         };
1040         static const char *guid_attrs[] = {
1041                 "objectGUID",
1042                 NULL
1043         };
1044
1045         ret = dsdb_wellknown_dn(s->ldap1.ldb, s, samdb_base_dn(s->ldap1.ldb),
1046                                 DS_GUID_INFRASTRUCTURE_CONTAINER,
1047                                 &basedn);
1048         if (ret != LDB_SUCCESS) {
1049                 return NT_STATUS_LDAP(ret);
1050         }
1051
1052         ret = samdb_reference_dn(s->ldap1.ldb, s, basedn, "fSMORoleOwner", &ntds_dn);
1053         if (ret != LDB_SUCCESS) {
1054                 talloc_free(basedn);
1055                 return NT_STATUS_LDAP(ret);
1056         }
1057
1058         s->infrastructure_fsmo.ntds_dn_str = ldb_dn_get_linearized(ntds_dn);
1059         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.ntds_dn_str);
1060
1061         server_dn = ldb_dn_get_parent(s, ntds_dn);
1062         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1063
1064         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1065         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1066
1067         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1068                          dns_attrs, "(objectClass=*)");
1069         if (ret != LDB_SUCCESS) {
1070                 return NT_STATUS_LDAP(ret);
1071         } else if (r->count != 1) {
1072                 talloc_free(r);
1073                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1074         }
1075
1076         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1077         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1078         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1079
1080         talloc_free(r);
1081
1082         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1083                          guid_attrs, "(objectClass=*)");
1084         if (ret != LDB_SUCCESS) {
1085                 return NT_STATUS_LDAP(ret);
1086         } else if (r->count != 1) {
1087                 talloc_free(r);
1088                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1089         }
1090
1091         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1092
1093         talloc_free(r);
1094
1095         return NT_STATUS_OK;
1096 }
1097
1098 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1099 {
1100         int ret;
1101         struct ldb_result *r;
1102         struct ldb_dn *basedn;
1103         const char *reference_dn_str;
1104         struct ldb_dn *ntds_dn;
1105         struct ldb_dn *server_dn;
1106         static const char *rid_attrs[] = {
1107                 "rIDManagerReference",
1108                 NULL
1109         };
1110         static const char *fsmo_attrs[] = {
1111                 "fSMORoleOwner",
1112                 NULL
1113         };
1114         static const char *dns_attrs[] = {
1115                 "dnsHostName",
1116                 NULL
1117         };
1118         static const char *guid_attrs[] = {
1119                 "objectGUID",
1120                 NULL
1121         };
1122
1123         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1124         NT_STATUS_HAVE_NO_MEMORY(basedn);
1125
1126         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1127                          rid_attrs, "(objectClass=*)");
1128         talloc_free(basedn);
1129         if (ret != LDB_SUCCESS) {
1130                 return NT_STATUS_LDAP(ret);
1131         } else if (r->count != 1) {
1132                 talloc_free(r);
1133                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1134         }
1135
1136         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1137         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1138
1139         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1140         NT_STATUS_HAVE_NO_MEMORY(basedn);
1141
1142         talloc_free(r);
1143
1144         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1145                          fsmo_attrs, "(objectClass=*)");
1146         talloc_free(basedn);
1147         if (ret != LDB_SUCCESS) {
1148                 return NT_STATUS_LDAP(ret);
1149         } else if (r->count != 1) {
1150                 talloc_free(r);
1151                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1152         }
1153
1154         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1155         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1156         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1157
1158         talloc_free(r);
1159
1160         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1161         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1162
1163         server_dn = ldb_dn_get_parent(s, ntds_dn);
1164         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1165
1166         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1167         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1168
1169         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1170                          dns_attrs, "(objectClass=*)");
1171         if (ret != LDB_SUCCESS) {
1172                 return NT_STATUS_LDAP(ret);
1173         } else if (r->count != 1) {
1174                 talloc_free(r);
1175                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1176         }
1177
1178         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1179         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1180         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1181
1182         talloc_free(r);
1183
1184         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1185                          guid_attrs, "(objectClass=*)");
1186         if (ret != LDB_SUCCESS) {
1187                 return NT_STATUS_LDAP(ret);
1188         } else if (r->count != 1) {
1189                 talloc_free(r);
1190                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1191         }
1192
1193         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1194
1195         talloc_free(r);
1196
1197         return NT_STATUS_OK;
1198 }
1199
1200 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1201 {
1202         int ret;
1203         struct ldb_result *r;
1204         struct ldb_dn *basedn;
1205
1206         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1207                                 s->dest_dsa.site_name,
1208                                 s->forest.config_dn_str);
1209         NT_STATUS_HAVE_NO_MEMORY(basedn);
1210
1211         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1212                          NULL, "(objectClass=*)");
1213         talloc_free(basedn);
1214         if (ret != LDB_SUCCESS) {
1215                 return NT_STATUS_LDAP(ret);
1216         } else if (r->count != 1) {
1217                 talloc_free(r);
1218                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1219         }
1220
1221         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1222
1223         talloc_free(r);
1224         return NT_STATUS_OK;
1225 }
1226
1227 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1228 {
1229         if (!s->callbacks.check_options) return NT_STATUS_OK;
1230
1231         s->_co.domain           = &s->domain;
1232         s->_co.forest           = &s->forest;
1233         s->_co.source_dsa       = &s->source_dsa;
1234
1235         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1236 }
1237
1238 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1239 {
1240         int ret;
1241         struct ldb_result *r;
1242         struct ldb_dn *basedn;
1243         static const char *attrs[] = {
1244                 "distinguishedName",
1245                 "userAccountControl",
1246                 NULL
1247         };
1248
1249         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1250         NT_STATUS_HAVE_NO_MEMORY(basedn);
1251
1252         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1253                          "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1254                          s->dest_dsa.netbios_name);
1255         talloc_free(basedn);
1256         if (ret != LDB_SUCCESS) {
1257                 return NT_STATUS_LDAP(ret);
1258         } else if (r->count != 1) {
1259                 talloc_free(r);
1260                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1261         }
1262
1263         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1264         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1265         talloc_steal(s, s->dest_dsa.computer_dn_str);
1266
1267         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1268
1269         talloc_free(r);
1270         return NT_STATUS_OK;
1271 }
1272
1273 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1274 {
1275         int ret;
1276         struct ldb_result *r;
1277         struct ldb_dn *basedn;
1278         const char *server_reference_dn_str;
1279         struct ldb_dn *server_reference_dn;
1280         struct ldb_dn *computer_dn;
1281
1282         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1283                                 s->dest_dsa.netbios_name,
1284                                 s->dest_dsa.site_name,
1285                                 s->forest.config_dn_str);
1286         NT_STATUS_HAVE_NO_MEMORY(basedn);
1287
1288         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1289                          NULL, "(objectClass=*)");
1290         talloc_free(basedn);
1291         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1292                 /* if the object doesn't exist, we'll create it later */
1293                 return NT_STATUS_OK;
1294         } else if (ret != LDB_SUCCESS) {
1295                 return NT_STATUS_LDAP(ret);
1296         } else if (r->count != 1) {
1297                 talloc_free(r);
1298                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1299         }
1300
1301         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1302         if (server_reference_dn_str) {
1303                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1304                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1305
1306                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1307                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1308
1309                 /*
1310                  * if the server object belongs to another DC in another domain
1311                  * in the forest, we should not touch this object!
1312                  */
1313                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1314                         talloc_free(r);
1315                         return NT_STATUS_OBJECT_NAME_COLLISION;
1316                 }
1317         }
1318
1319         /* if the server object is already for the dest_dsa, then we don't need to create it */
1320         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1321         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1322         talloc_steal(s, s->dest_dsa.server_dn_str);
1323
1324         talloc_free(r);
1325         return NT_STATUS_OK;
1326 }
1327
1328 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1329 {
1330         int ret;
1331         struct ldb_result *r;
1332         struct ldb_dn *basedn;
1333         const char *server_reference_bl_dn_str;
1334         static const char *attrs[] = {
1335                 "serverReferenceBL",
1336                 NULL
1337         };
1338
1339         /* if the server_dn_str has a valid value, we skip this lookup */
1340         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1341
1342         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1343         NT_STATUS_HAVE_NO_MEMORY(basedn);
1344
1345         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1346                          attrs, "(objectClass=*)");
1347         talloc_free(basedn);
1348         if (ret != LDB_SUCCESS) {
1349                 return NT_STATUS_LDAP(ret);
1350         } else if (r->count != 1) {
1351                 talloc_free(r);
1352                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1353         }
1354
1355         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1356         if (!server_reference_bl_dn_str) {
1357                 /* if no back link is present, we're done for this function */
1358                 talloc_free(r);
1359                 return NT_STATUS_OK;
1360         }
1361
1362         /* if the server object is already for the dest_dsa, then we don't need to create it */
1363         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1364         if (s->dest_dsa.server_dn_str) {
1365                 /* if a back link is present, we know that the server object is present */
1366                 talloc_steal(s, s->dest_dsa.server_dn_str);
1367         }
1368
1369         talloc_free(r);
1370         return NT_STATUS_OK;
1371 }
1372
1373 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1374 {
1375         int ret;
1376         struct ldb_message *msg;
1377         char *server_dn_str;
1378
1379         /* if the server_dn_str has a valid value, we skip this lookup */
1380         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1381
1382         msg = ldb_msg_new(s);
1383         NT_STATUS_HAVE_NO_MEMORY(msg);
1384
1385         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1386                                  s->dest_dsa.netbios_name,
1387                                  s->dest_dsa.site_name,
1388                                  s->forest.config_dn_str);
1389         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1390
1391         ret = ldb_msg_add_string(msg, "objectClass", "server");
1392         if (ret != 0) {
1393                 talloc_free(msg);
1394                 return NT_STATUS_NO_MEMORY;
1395         }
1396         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1397         if (ret != 0) {
1398                 talloc_free(msg);
1399                 return NT_STATUS_NO_MEMORY;
1400         }
1401         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1402         if (ret != 0) {
1403                 talloc_free(msg);
1404                 return NT_STATUS_NO_MEMORY;
1405         }
1406
1407         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1408         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1409
1410         ret = ldb_add(s->ldap1.ldb, msg);
1411         talloc_free(msg);
1412         if (ret != LDB_SUCCESS) {
1413                 talloc_free(server_dn_str);
1414                 return NT_STATUS_LDAP(ret);
1415         }
1416
1417         s->dest_dsa.server_dn_str = server_dn_str;
1418
1419         return NT_STATUS_OK;
1420 }
1421
1422 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1423 {
1424         int ret;
1425         struct ldb_message *msg;
1426         uint32_t i;
1427
1428         /* make a 'modify' msg, and only for serverReference */
1429         msg = ldb_msg_new(s);
1430         NT_STATUS_HAVE_NO_MEMORY(msg);
1431         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1432         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1433
1434         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1435         if (ret != 0) {
1436                 talloc_free(msg);
1437                 return NT_STATUS_NO_MEMORY;
1438         }
1439
1440         /* mark all the message elements (should be just one)
1441            as LDB_FLAG_MOD_ADD */
1442         for (i=0;i<msg->num_elements;i++) {
1443                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1444         }
1445
1446         ret = ldb_modify(s->ldap1.ldb, msg);
1447         if (ret == LDB_SUCCESS) {
1448                 talloc_free(msg);
1449                 return NT_STATUS_OK;
1450         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1451                 /* retry with LDB_FLAG_MOD_REPLACE */
1452         } else {
1453                 talloc_free(msg);
1454                 return NT_STATUS_LDAP(ret);
1455         }
1456
1457         /* mark all the message elements (should be just one)
1458            as LDB_FLAG_MOD_REPLACE */
1459         for (i=0;i<msg->num_elements;i++) {
1460                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1461         }
1462
1463         ret = ldb_modify(s->ldap1.ldb, msg);
1464         talloc_free(msg);
1465         if (ret != LDB_SUCCESS) {
1466                 return NT_STATUS_LDAP(ret);
1467         }
1468
1469         return NT_STATUS_OK;
1470 }
1471
1472 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1473                                           struct becomeDC_drsuapi *drsuapi,
1474                                           void (*recv_fn)(struct composite_context *req));
1475 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1476 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1477
1478 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1479 {
1480         struct composite_context *c = s->creq;
1481
1482         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1483         if (!composite_is_ok(c)) return;
1484
1485         c->status = becomeDC_ldap1_rootdse(s);
1486         if (!composite_is_ok(c)) return;
1487
1488         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1489         if (!composite_is_ok(c)) return;
1490
1491         c->status = becomeDC_ldap1_domain_behavior_version(s);
1492         if (!composite_is_ok(c)) return;
1493
1494         c->status = becomeDC_ldap1_schema_object_version(s);
1495         if (!composite_is_ok(c)) return;
1496
1497         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1498         if (!composite_is_ok(c)) return;
1499
1500         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1501         if (!composite_is_ok(c)) return;
1502
1503         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1504         if (!composite_is_ok(c)) return;
1505
1506         c->status = becomeDC_ldap1_site_object(s);
1507         if (!composite_is_ok(c)) return;
1508
1509         c->status = becomeDC_check_options(s);
1510         if (!composite_is_ok(c)) return;
1511
1512         c->status = becomeDC_ldap1_computer_object(s);
1513         if (!composite_is_ok(c)) return;
1514
1515         c->status = becomeDC_ldap1_server_object_1(s);
1516         if (!composite_is_ok(c)) return;
1517
1518         c->status = becomeDC_ldap1_server_object_2(s);
1519         if (!composite_is_ok(c)) return;
1520
1521         c->status = becomeDC_ldap1_server_object_add(s);
1522         if (!composite_is_ok(c)) return;
1523
1524         c->status = becomeDC_ldap1_server_object_modify(s);
1525         if (!composite_is_ok(c)) return;
1526
1527         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1528 }
1529
1530 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1531                                           struct becomeDC_drsuapi *drsuapi,
1532                                           void (*recv_fn)(struct composite_context *req))
1533 {
1534         struct composite_context *c = s->creq;
1535         struct composite_context *creq;
1536         char *binding_str;
1537
1538         drsuapi->s = s;
1539
1540         if (!drsuapi->binding) {
1541                 const char *krb5_str = "";
1542                 const char *print_str = "";
1543                 /*
1544                  * Note: Replication only works with Windows 2000 when 'krb5' is
1545                  *       passed as auth_type here. If NTLMSSP is used, Windows
1546                  *       2000 returns garbage in the DsGetNCChanges() response
1547                  *       if encrypted password attributes would be in the
1548                  *       response. That means the replication of the schema and
1549                  *       configuration partition works fine, but it fails for
1550                  *       the domain partition.
1551                  */
1552                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1553                                  "force krb5", true))
1554                 {
1555                         krb5_str = "krb5,";
1556                 }
1557                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1558                                  "print", false))
1559                 {
1560                         print_str = "print,";
1561                 }
1562                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1563                                               s->source_dsa.dns_name,
1564                                               krb5_str, print_str);
1565                 if (composite_nomem(binding_str, c)) return;
1566                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1567                 talloc_free(binding_str);
1568                 if (!composite_is_ok(c)) return;
1569         }
1570
1571         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1572                                           s->libnet->cred, s->libnet->event_ctx,
1573                                           s->libnet->lp_ctx);
1574         composite_continue(c, creq, recv_fn, s);
1575 }
1576
1577 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1578                                        struct becomeDC_drsuapi *drsuapi,
1579                                        void (*recv_fn)(struct rpc_request *req));
1580 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
1581
1582 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1583 {
1584         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1585                                           struct libnet_BecomeDC_state);
1586         struct composite_context *c = s->creq;
1587
1588         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1589         if (!composite_is_ok(c)) return;
1590
1591         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1592                                        &s->drsuapi1.gensec_skey);
1593         if (!composite_is_ok(c)) return;
1594
1595         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1596 }
1597
1598 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1599                                        struct becomeDC_drsuapi *drsuapi,
1600                                        void (*recv_fn)(struct rpc_request *req))
1601 {
1602         struct composite_context *c = s->creq;
1603         struct rpc_request *req;
1604         struct drsuapi_DsBindInfo28 *bind_info28;
1605
1606         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1607
1608         bind_info28                             = &drsuapi->local_info28;
1609         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1610         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1611         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1612         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1613         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1614         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1615         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1616         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1617         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1618         if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1619                 /* TODO: find out how this is really triggered! */
1620                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1621         }
1622         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1623         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1624         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1625         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1626         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1627         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1628         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1629         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1630         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1631         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5;
1632         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1633         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1634         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1635         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1636         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1637         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1638         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1639         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1640         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1641 #if 0 /* we don't support XPRESS compression yet */
1642         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1643 #endif
1644         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1645         bind_info28->pid                        = 0;
1646         bind_info28->repl_epoch                 = 0;
1647
1648         drsuapi->bind_info_ctr.length           = 28;
1649         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1650
1651         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1652         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1653         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1654
1655         req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
1656         composite_continue_rpc(c, req, recv_fn, s);
1657 }
1658
1659 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1660                                          struct becomeDC_drsuapi *drsuapi)
1661 {
1662         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1663                 return drsuapi->bind_r.out.result;
1664         }
1665
1666         ZERO_STRUCT(drsuapi->remote_info28);
1667         if (drsuapi->bind_r.out.bind_info) {
1668                 switch (drsuapi->bind_r.out.bind_info->length) {
1669                 case 24: {
1670                         struct drsuapi_DsBindInfo24 *info24;
1671                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1672                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1673                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1674                         drsuapi->remote_info28.pid                      = info24->pid;
1675                         drsuapi->remote_info28.repl_epoch               = 0;
1676                         break;
1677                 }
1678                 case 48: {
1679                         struct drsuapi_DsBindInfo48 *info48;
1680                         info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1681                         drsuapi->remote_info28.supported_extensions     = info48->supported_extensions;
1682                         drsuapi->remote_info28.site_guid                = info48->site_guid;
1683                         drsuapi->remote_info28.pid                      = info48->pid;
1684                         drsuapi->remote_info28.repl_epoch               = info48->repl_epoch;
1685                         break;
1686                 }
1687                 case 28:
1688                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1689                         break;
1690                 }
1691         }
1692
1693         return WERR_OK;
1694 }
1695
1696 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1697
1698 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1699 {
1700         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1701                                           struct libnet_BecomeDC_state);
1702         struct composite_context *c = s->creq;
1703         WERROR status;
1704
1705         bool print = false;
1706
1707         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
1708                 print = true;
1709         }
1710
1711         c->status = dcerpc_ndr_request_recv(req);
1712         if (!composite_is_ok(c)) return;
1713
1714         if (print) {
1715                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi1.bind_r);
1716         }
1717
1718         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1719         if (!W_ERROR_IS_OK(status)) {
1720                 composite_error(c, werror_to_ntstatus(status));
1721                 return;
1722         }
1723
1724         becomeDC_drsuapi1_add_entry_send(s);
1725 }
1726
1727 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1728
1729 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1730 {
1731         struct composite_context *c = s->creq;
1732         struct rpc_request *req;
1733         struct drsuapi_DsAddEntry *r;
1734         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1735         uint32_t num_attrs, i = 0;
1736         struct drsuapi_DsReplicaAttribute *attrs;
1737         struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1738         enum ndr_err_code ndr_err;
1739         bool w2k3;
1740
1741         /* choose a random invocationId */
1742         s->dest_dsa.invocation_id = GUID_random();
1743
1744         /*
1745          * if the schema version indicates w2k3, then also send some w2k3
1746          * specific attributes.
1747          */
1748         if (s->forest.schema_object_version >= 30) {
1749                 w2k3 = true;
1750         } else {
1751                 w2k3 = false;
1752         }
1753
1754         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1755         if (composite_nomem(r, c)) return;
1756
1757         /* setup identifier */
1758         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1759         if (composite_nomem(identifier, c)) return;
1760         identifier->guid        = GUID_zero();
1761         identifier->sid         = s->zero_sid;
1762         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1763                                                   s->dest_dsa.server_dn_str);
1764         if (composite_nomem(identifier->dn, c)) return;
1765
1766         /* allocate attribute array */
1767         num_attrs       = 12;
1768         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1769         if (composite_nomem(attrs, c)) return;
1770
1771         /* ntSecurityDescriptor */
1772         {
1773                 struct drsuapi_DsAttributeValue *vs;
1774                 DATA_BLOB *vd;
1775                 struct security_descriptor *v;
1776                 struct dom_sid *domain_admins_sid;
1777                 const char *domain_admins_sid_str;
1778
1779                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1780                 if (composite_nomem(vs, c)) return;
1781
1782                 vd = talloc_array(vs, DATA_BLOB, 1);
1783                 if (composite_nomem(vd, c)) return;
1784
1785                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1786                 if (composite_nomem(domain_admins_sid, c)) return;
1787
1788                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1789                 if (composite_nomem(domain_admins_sid_str, c)) return;
1790
1791                 v = security_descriptor_dacl_create(vd,
1792                                                0,
1793                                                /* owner: domain admins */
1794                                                domain_admins_sid_str,
1795                                                /* owner group: domain admins */
1796                                                domain_admins_sid_str,
1797                                                /* authenticated users */
1798                                                SID_NT_AUTHENTICATED_USERS,
1799                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1800                                                SEC_STD_READ_CONTROL |
1801                                                SEC_ADS_LIST |
1802                                                SEC_ADS_READ_PROP |
1803                                                SEC_ADS_LIST_OBJECT,
1804                                                0,
1805                                                /* domain admins */
1806                                                domain_admins_sid_str,
1807                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1808                                                SEC_STD_REQUIRED |
1809                                                SEC_ADS_CREATE_CHILD |
1810                                                SEC_ADS_LIST |
1811                                                SEC_ADS_SELF_WRITE |
1812                                                SEC_ADS_READ_PROP |
1813                                                SEC_ADS_WRITE_PROP |
1814                                                SEC_ADS_DELETE_TREE |
1815                                                SEC_ADS_LIST_OBJECT |
1816                                                SEC_ADS_CONTROL_ACCESS,
1817                                                0,
1818                                                /* system */
1819                                                SID_NT_SYSTEM,
1820                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1821                                                SEC_STD_REQUIRED |
1822                                                SEC_ADS_CREATE_CHILD |
1823                                                SEC_ADS_DELETE_CHILD |
1824                                                SEC_ADS_LIST |
1825                                                SEC_ADS_SELF_WRITE |
1826                                                SEC_ADS_READ_PROP |
1827                                                SEC_ADS_WRITE_PROP |
1828                                                SEC_ADS_DELETE_TREE |
1829                                                SEC_ADS_LIST_OBJECT |
1830                                                SEC_ADS_CONTROL_ACCESS,
1831                                                0,
1832                                                /* end */
1833                                                NULL);
1834                 if (composite_nomem(v, c)) return;
1835
1836                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1837                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1838                         c->status = ndr_map_error2ntstatus(ndr_err);
1839                         if (!composite_is_ok(c)) return;
1840                 }
1841
1842                 vs[0].blob              = &vd[0];
1843
1844                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1845                 attrs[i].value_ctr.num_values   = 1;
1846                 attrs[i].value_ctr.values       = vs;
1847
1848                 i++;
1849         }
1850
1851         /* objectClass: nTDSDSA or nTDSDSARO*/
1852         {
1853                 struct drsuapi_DsAttributeValue *vs;
1854                 DATA_BLOB *vd;
1855
1856                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1857                 if (composite_nomem(vs, c)) return;
1858
1859                 vd = talloc_array(vs, DATA_BLOB, 1);
1860                 if (composite_nomem(vd, c)) return;
1861
1862                 vd[0] = data_blob_talloc(vd, NULL, 4);
1863                 if (composite_nomem(vd[0].data, c)) return;
1864
1865                 /* value for nTDSDSA */
1866                 SIVAL(vd[0].data, 0, 0x0017002F);
1867
1868                 vs[0].blob              = &vd[0];
1869
1870                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectClass;
1871                 attrs[i].value_ctr.num_values   = 1;
1872                 attrs[i].value_ctr.values       = vs;
1873
1874                 i++;
1875         }
1876
1877         /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */
1878         {
1879                 struct drsuapi_DsAttributeValue *vs;
1880                 DATA_BLOB *vd;
1881                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1882
1883                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1884                 if (composite_nomem(vs, c)) return;
1885
1886                 vd = talloc_array(vs, DATA_BLOB, 1);
1887                 if (composite_nomem(vd, c)) return;
1888
1889                 v[0].guid               = GUID_zero();
1890                 v[0].sid                = s->zero_sid;
1891
1892                 if (s->rodc_join) {
1893                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA-RO,%s",
1894                                                           s->forest.schema_dn_str);
1895                 } else {
1896                     v[0].dn             = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1897                                                           s->forest.schema_dn_str);
1898                 }
1899                 if (composite_nomem(v[0].dn, c)) return;
1900
1901                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1902                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1903                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1904                         c->status = ndr_map_error2ntstatus(ndr_err);
1905                         if (!composite_is_ok(c)) return;
1906                 }
1907
1908                 vs[0].blob              = &vd[0];
1909
1910                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectCategory;
1911                 attrs[i].value_ctr.num_values   = 1;
1912                 attrs[i].value_ctr.values       = vs;
1913
1914                 i++;
1915         }
1916
1917         /* invocationId: random guid */
1918         {
1919                 struct drsuapi_DsAttributeValue *vs;
1920                 DATA_BLOB *vd;
1921                 const struct GUID *v;
1922
1923                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1924                 if (composite_nomem(vs, c)) return;
1925
1926                 vd = talloc_array(vs, DATA_BLOB, 1);
1927                 if (composite_nomem(vd, c)) return;
1928
1929                 v = &s->dest_dsa.invocation_id;
1930
1931                 c->status = GUID_to_ndr_blob(v, vd, &vd[0]);
1932                 if (!composite_is_ok(c)) return;
1933
1934                 vs[0].blob              = &vd[0];
1935
1936                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_invocationId;
1937                 attrs[i].value_ctr.num_values   = 1;
1938                 attrs[i].value_ctr.values       = vs;
1939
1940                 i++;
1941         }
1942
1943         /* hasMasterNCs: ... */
1944         {
1945                 struct drsuapi_DsAttributeValue *vs;
1946                 DATA_BLOB *vd;
1947                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1948
1949                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1950                 if (composite_nomem(vs, c)) return;
1951
1952                 vd = talloc_array(vs, DATA_BLOB, 3);
1953                 if (composite_nomem(vd, c)) return;
1954
1955                 v[0].guid               = GUID_zero();
1956                 v[0].sid                = s->zero_sid;
1957                 v[0].dn                 = s->forest.config_dn_str;
1958
1959                 v[1].guid               = GUID_zero();
1960                 v[1].sid                = s->zero_sid;
1961                 v[1].dn                 = s->domain.dn_str;
1962
1963                 v[2].guid               = GUID_zero();
1964                 v[2].sid                = s->zero_sid;
1965                 v[2].dn                 = s->forest.schema_dn_str;
1966
1967                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1968                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1969                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1970                         c->status = ndr_map_error2ntstatus(ndr_err);
1971                         if (!composite_is_ok(c)) return;
1972                 }
1973
1974                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1975                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1976                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1977                         c->status = ndr_map_error2ntstatus(ndr_err);
1978                         if (!composite_is_ok(c)) return;
1979                 }
1980
1981                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1982                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1983                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1984                         c->status = ndr_map_error2ntstatus(ndr_err);
1985                         if (!composite_is_ok(c)) return;
1986                 }
1987
1988                 vs[0].blob              = &vd[0];
1989                 vs[1].blob              = &vd[1];
1990                 vs[2].blob              = &vd[2];
1991
1992                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
1993                 attrs[i].value_ctr.num_values   = 3;
1994                 attrs[i].value_ctr.values       = vs;
1995
1996                 i++;
1997         }
1998
1999         /* msDS-hasMasterNCs: ... */
2000         if (w2k3) {
2001                 struct drsuapi_DsAttributeValue *vs;
2002                 DATA_BLOB *vd;
2003                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2004
2005                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2006                 if (composite_nomem(vs, c)) return;
2007
2008                 vd = talloc_array(vs, DATA_BLOB, 3);
2009                 if (composite_nomem(vd, c)) return;
2010
2011                 v[0].guid               = GUID_zero();
2012                 v[0].sid                = s->zero_sid;
2013                 v[0].dn                 = s->forest.config_dn_str;
2014
2015                 v[1].guid               = GUID_zero();
2016                 v[1].sid                = s->zero_sid;
2017                 v[1].dn                 = s->domain.dn_str;
2018
2019                 v[2].guid               = GUID_zero();
2020                 v[2].sid                = s->zero_sid;
2021                 v[2].dn                 = s->forest.schema_dn_str;
2022
2023                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2024                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2025                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2026                         c->status = ndr_map_error2ntstatus(ndr_err);
2027                         if (!composite_is_ok(c)) return;
2028                 }
2029
2030                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
2031                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2032                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2033                         c->status = ndr_map_error2ntstatus(ndr_err);
2034                         if (!composite_is_ok(c)) return;
2035                 }
2036
2037                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2038                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2039                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2040                         c->status = ndr_map_error2ntstatus(ndr_err);
2041                         if (!composite_is_ok(c)) return;
2042                 }
2043
2044                 vs[0].blob              = &vd[0];
2045                 vs[1].blob              = &vd[1];
2046                 vs[2].blob              = &vd[2];
2047
2048                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2049                 attrs[i].value_ctr.num_values   = 3;
2050                 attrs[i].value_ctr.values       = vs;
2051
2052                 i++;
2053         }
2054
2055         /* dMDLocation: CN=Schema,... */
2056         {
2057                 struct drsuapi_DsAttributeValue *vs;
2058                 DATA_BLOB *vd;
2059                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2060
2061                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2062                 if (composite_nomem(vs, c)) return;
2063
2064                 vd = talloc_array(vs, DATA_BLOB, 1);
2065                 if (composite_nomem(vd, c)) return;
2066
2067                 v[0].guid               = GUID_zero();
2068                 v[0].sid                = s->zero_sid;
2069                 v[0].dn                 = s->forest.schema_dn_str;
2070
2071                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2072                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2073                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2074                         c->status = ndr_map_error2ntstatus(ndr_err);
2075                         if (!composite_is_ok(c)) return;
2076                 }
2077
2078                 vs[0].blob              = &vd[0];
2079
2080                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_dMDLocation;
2081                 attrs[i].value_ctr.num_values   = 1;
2082                 attrs[i].value_ctr.values       = vs;
2083
2084                 i++;
2085         }
2086
2087         /* msDS-HasDomainNCs: <domain_partition> */
2088         if (w2k3) {
2089                 struct drsuapi_DsAttributeValue *vs;
2090                 DATA_BLOB *vd;
2091                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2092
2093                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2094                 if (composite_nomem(vs, c)) return;
2095
2096                 vd = talloc_array(vs, DATA_BLOB, 1);
2097                 if (composite_nomem(vd, c)) return;
2098
2099                 v[0].guid               = GUID_zero();
2100                 v[0].sid                = s->zero_sid;
2101                 v[0].dn                 = s->domain.dn_str;
2102
2103                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2104                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2105                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2106                         c->status = ndr_map_error2ntstatus(ndr_err);
2107                         if (!composite_is_ok(c)) return;
2108                 }
2109
2110                 vs[0].blob              = &vd[0];
2111
2112                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2113                 attrs[i].value_ctr.num_values   = 1;
2114                 attrs[i].value_ctr.values       = vs;
2115
2116                 i++;
2117         }
2118
2119         /* msDS-Behavior-Version */
2120         if (w2k3) {
2121                 struct drsuapi_DsAttributeValue *vs;
2122                 DATA_BLOB *vd;
2123
2124                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2125                 if (composite_nomem(vs, c)) return;
2126
2127                 vd = talloc_array(vs, DATA_BLOB, 1);
2128                 if (composite_nomem(vd, c)) return;
2129
2130                 vd[0] = data_blob_talloc(vd, NULL, 4);
2131                 if (composite_nomem(vd[0].data, c)) return;
2132
2133                 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2134
2135                 vs[0].blob              = &vd[0];
2136
2137                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2138                 attrs[i].value_ctr.num_values   = 1;
2139                 attrs[i].value_ctr.values       = vs;
2140
2141                 i++;
2142         }
2143
2144         /* systemFlags */
2145         {
2146                 struct drsuapi_DsAttributeValue *vs;
2147                 DATA_BLOB *vd;
2148
2149                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2150                 if (composite_nomem(vs, c)) return;
2151
2152                 vd = talloc_array(vs, DATA_BLOB, 1);
2153                 if (composite_nomem(vd, c)) return;
2154
2155                 vd[0] = data_blob_talloc(vd, NULL, 4);
2156                 if (composite_nomem(vd[0].data, c)) return;
2157
2158                 if (s->rodc_join) {
2159                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
2160                 } else {
2161                     SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2162                 }
2163
2164                 vs[0].blob              = &vd[0];
2165
2166                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_systemFlags;
2167                 attrs[i].value_ctr.num_values   = 1;
2168                 attrs[i].value_ctr.values       = vs;
2169
2170                 i++;
2171         }
2172
2173         /* serverReference: ... */
2174         {
2175                 struct drsuapi_DsAttributeValue *vs;
2176                 DATA_BLOB *vd;
2177                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2178
2179                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2180                 if (composite_nomem(vs, c)) return;
2181
2182                 vd = talloc_array(vs, DATA_BLOB, 1);
2183                 if (composite_nomem(vd, c)) return;
2184
2185                 v[0].guid               = GUID_zero();
2186                 v[0].sid                = s->zero_sid;
2187                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2188
2189                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2190                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2191                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2192                         c->status = ndr_map_error2ntstatus(ndr_err);
2193                         if (!composite_is_ok(c)) return;
2194                 }
2195
2196                 vs[0].blob              = &vd[0];
2197
2198                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_serverReference;
2199                 attrs[i].value_ctr.num_values   = 1;
2200                 attrs[i].value_ctr.values       = vs;
2201
2202                 i++;
2203         }
2204
2205         /* options:... */
2206         if (s->rodc_join) {
2207                 struct drsuapi_DsAttributeValue *vs;
2208                 DATA_BLOB *vd;
2209
2210                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2211                 if (composite_nomem(vs, c)) return;
2212
2213                 vd = talloc_array(vs, DATA_BLOB, 1);
2214                 if (composite_nomem(vd, c)) return;
2215
2216                 vd[0] = data_blob_talloc(vd, NULL, 4);
2217                 if (composite_nomem(vd[0].data, c)) return;
2218
2219                 SIVAL(vd[0].data, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
2220
2221                 vs[0].blob              = &vd[0];
2222
2223                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_options;
2224                 attrs[i].value_ctr.num_values   = 1;
2225                 attrs[i].value_ctr.values       = vs;
2226
2227                 i++;
2228         }
2229
2230         /* truncate the attribute list to the attribute count we have filled in */
2231         num_attrs = i;
2232
2233         /* setup request structure */
2234         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2235         r->in.level                                                     = 2;
2236         r->in.req                                                       = talloc(s, union drsuapi_DsAddEntryRequest);
2237         r->in.req->req2.first_object.next_object                        = NULL;
2238         r->in.req->req2.first_object.object.identifier                  = identifier;
2239         r->in.req->req2.first_object.object.flags                       = 0x00000000;
2240         r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2241         r->in.req->req2.first_object.object.attribute_ctr.attributes    = attrs;
2242
2243         r->out.level_out        = talloc(s, int32_t);
2244         r->out.ctr              = talloc(s, union drsuapi_DsAddEntryCtr);
2245
2246         req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
2247         composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
2248 }
2249
2250 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2251 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2252
2253 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
2254 {
2255         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2256                                           struct libnet_BecomeDC_state);
2257         struct composite_context *c = s->creq;
2258         struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
2259                                        struct drsuapi_DsAddEntry);
2260         char *binding_str;
2261         bool print = false;
2262
2263         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2264                 print = true;
2265         }
2266
2267         c->status = dcerpc_ndr_request_recv(req);
2268         if (!composite_is_ok(c)) return;
2269
2270         if (print) {
2271                 NDR_PRINT_OUT_DEBUG(drsuapi_DsAddEntry, r);
2272         }
2273
2274         if (!W_ERROR_IS_OK(r->out.result)) {
2275                 composite_error(c, werror_to_ntstatus(r->out.result));
2276                 return;
2277         }
2278
2279         if (*r->out.level_out == 3) {
2280                 if (r->out.ctr->ctr3.count != 1) {
2281                         WERROR status;
2282
2283                         if (r->out.ctr->ctr3.level != 1) {
2284                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2285                                 return;
2286                         }
2287
2288                         if (!r->out.ctr->ctr3.error) {
2289                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2290                                 return;
2291                         }
2292
2293                         status = r->out.ctr->ctr3.error->info1.status;
2294
2295                         if (!r->out.ctr->ctr3.error->info1.info) {
2296                                 composite_error(c, werror_to_ntstatus(status));
2297                                 return;
2298                         }
2299
2300                         /* see if we can get a more detailed error */
2301                         switch (r->out.ctr->ctr3.error->info1.level) {
2302                         case 1:
2303                                 status = r->out.ctr->ctr3.error->info1.info->error1.status;
2304                                 break;
2305                         case 4:
2306                         case 5:
2307                         case 6:
2308                         case 7:
2309                                 status = r->out.ctr->ctr3.error->info1.info->errorX.status;
2310                                 break;
2311                         }
2312
2313                         composite_error(c, werror_to_ntstatus(status));
2314                         return;
2315                 }
2316
2317                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr3.objects[0].guid;
2318         } else if (*r->out.level_out == 2) {
2319                 if (r->out.ctr->ctr2.count != 1) {
2320                         composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.error.status));
2321                         return;
2322                 }
2323
2324                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr2.objects[0].guid;
2325         } else {
2326                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2327                 return;
2328         }
2329
2330         talloc_free(r);
2331
2332         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2333                                                   s->dest_dsa.server_dn_str);
2334         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2335
2336         c->status = becomeDC_prepare_db(s);
2337         if (!composite_is_ok(c)) return;
2338
2339         /* this avoids the epmapper lookup on the 2nd connection */
2340         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2341         if (composite_nomem(binding_str, c)) return;
2342
2343         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2344         talloc_free(binding_str);
2345         if (!composite_is_ok(c)) return;
2346
2347         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2348         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2349
2350         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2351 }
2352
2353 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2354 {
2355         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2356
2357         s->_pp.domain           = &s->domain;
2358         s->_pp.forest           = &s->forest;
2359         s->_pp.source_dsa       = &s->source_dsa;
2360         s->_pp.dest_dsa         = &s->dest_dsa;
2361
2362         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2363 }
2364
2365 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
2366
2367 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2368 {
2369         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2370                                           struct libnet_BecomeDC_state);
2371         struct composite_context *c = s->creq;
2372
2373         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2374         if (!composite_is_ok(c)) return;
2375
2376         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2377                                        &s->drsuapi2.gensec_skey);
2378         if (!composite_is_ok(c)) return;
2379
2380         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2381 }
2382
2383 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2384
2385 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
2386 {
2387         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2388                                           struct libnet_BecomeDC_state);
2389         struct composite_context *c = s->creq;
2390         char *binding_str;
2391         WERROR status;
2392
2393         bool print = false;
2394
2395         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2396                 print = true;
2397         }
2398
2399         c->status = dcerpc_ndr_request_recv(req);
2400         if (!composite_is_ok(c)) return;
2401
2402         if (print) {
2403                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi2.bind_r);
2404         }
2405
2406         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2407         if (!W_ERROR_IS_OK(status)) {
2408                 composite_error(c, werror_to_ntstatus(status));
2409                 return;
2410         }
2411
2412         /* this avoids the epmapper lookup on the 3rd connection */
2413         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2414         if (composite_nomem(binding_str, c)) return;
2415
2416         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2417         talloc_free(binding_str);
2418         if (!composite_is_ok(c)) return;
2419
2420         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2421         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2422         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2423         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2424
2425         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2426 }
2427
2428 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2429
2430 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2431 {
2432         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2433                                           struct libnet_BecomeDC_state);
2434         struct composite_context *c = s->creq;
2435
2436         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2437         if (!composite_is_ok(c)) return;
2438
2439         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2440                                        &s->drsuapi3.gensec_skey);
2441         if (!composite_is_ok(c)) return;
2442
2443         becomeDC_drsuapi3_pull_schema_send(s);
2444 }
2445
2446 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2447                                                  struct becomeDC_drsuapi *drsuapi_h,
2448                                                  struct becomeDC_drsuapi *drsuapi_p,
2449                                                  struct libnet_BecomeDC_Partition *partition,
2450                                                  void (*recv_fn)(struct rpc_request *req))
2451 {
2452         struct composite_context *c = s->creq;
2453         struct rpc_request *req;
2454         struct drsuapi_DsGetNCChanges *r;
2455
2456         r = talloc(s, struct drsuapi_DsGetNCChanges);
2457         if (composite_nomem(r, c)) return;
2458
2459         r->out.level_out = talloc(r, int32_t);
2460         if (composite_nomem(r->out.level_out, c)) return;
2461         r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2462         if (composite_nomem(r->in.req, c)) return;
2463         r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2464         if (composite_nomem(r->out.ctr, c)) return;
2465
2466         r->in.bind_handle       = &drsuapi_h->bind_handle;
2467         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2468                 r->in.level                             = 8;
2469                 r->in.req->req8.destination_dsa_guid    = partition->destination_dsa_guid;
2470                 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2471                 r->in.req->req8.naming_context          = &partition->nc;
2472                 r->in.req->req8.highwatermark           = partition->highwatermark;
2473                 r->in.req->req8.uptodateness_vector     = NULL;
2474                 r->in.req->req8.replica_flags           = partition->replica_flags;
2475                 r->in.req->req8.max_object_count        = 133;
2476                 r->in.req->req8.max_ndr_size            = 1336811;
2477                 r->in.req->req8.extended_op             = DRSUAPI_EXOP_NONE;
2478                 r->in.req->req8.fsmo_info               = 0;
2479                 r->in.req->req8.partial_attribute_set   = NULL;
2480                 r->in.req->req8.partial_attribute_set_ex= NULL;
2481                 r->in.req->req8.mapping_ctr.num_mappings= 0;
2482                 r->in.req->req8.mapping_ctr.mappings    = NULL;
2483         } else {
2484                 r->in.level                             = 5;
2485                 r->in.req->req5.destination_dsa_guid    = partition->destination_dsa_guid;
2486                 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2487                 r->in.req->req5.naming_context          = &partition->nc;
2488                 r->in.req->req5.highwatermark           = partition->highwatermark;
2489                 r->in.req->req5.uptodateness_vector     = NULL;
2490                 r->in.req->req5.replica_flags           = partition->replica_flags;
2491                 r->in.req->req5.max_object_count        = 133;
2492                 r->in.req->req5.max_ndr_size            = 1336770;
2493                 r->in.req->req5.extended_op             = DRSUAPI_EXOP_NONE;
2494                 r->in.req->req5.fsmo_info               = 0;
2495         }
2496
2497         /*
2498          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2499          * but it seems that some extra flags in the DCERPC Bind call
2500          * are needed for it. Or the same KRB5 TGS is needed on both
2501          * connections.
2502          */
2503         req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_p->pipe, r, r);
2504         composite_continue_rpc(c, req, recv_fn, s);
2505 }
2506
2507 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2508                                                    struct becomeDC_drsuapi *drsuapi_h,
2509                                                    struct becomeDC_drsuapi *drsuapi_p,
2510                                                    struct libnet_BecomeDC_Partition *partition,
2511                                                    struct drsuapi_DsGetNCChanges *r)
2512 {
2513         uint32_t ctr_level = 0;
2514         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2515         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2516         struct GUID *source_dsa_guid = NULL;
2517         struct GUID *source_dsa_invocation_id = NULL;
2518         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2519         bool more_data = false;
2520         NTSTATUS nt_status;
2521
2522         if (!W_ERROR_IS_OK(r->out.result)) {
2523                 return r->out.result;
2524         }
2525
2526         if (*r->out.level_out == 1) {
2527                 ctr_level = 1;
2528                 ctr1 = &r->out.ctr->ctr1;
2529         } else if (*r->out.level_out == 2 &&
2530                    r->out.ctr->ctr2.mszip1.ts) {
2531                 ctr_level = 1;
2532                 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2533         } else if (*r->out.level_out == 6) {
2534                 ctr_level = 6;
2535                 ctr6 = &r->out.ctr->ctr6;
2536         } else if (*r->out.level_out == 7 &&
2537                    r->out.ctr->ctr7.level == 6 &&
2538                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2539                    r->out.ctr->ctr7.ctr.mszip6.ts) {
2540                 ctr_level = 6;
2541                 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2542         } else if (*r->out.level_out == 7 &&
2543                    r->out.ctr->ctr7.level == 6 &&
2544                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2545                    r->out.ctr->ctr7.ctr.xpress6.ts) {
2546                 ctr_level = 6;
2547                 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2548         } else {
2549                 return WERR_BAD_NET_RESP;
2550         }
2551
2552         if (!ctr1 && ! ctr6) {
2553                 return WERR_BAD_NET_RESP;
2554         }
2555
2556         if (ctr_level == 6) {
2557                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2558                         return ctr6->drs_error;
2559                 }
2560         }
2561
2562         switch (ctr_level) {
2563         case 1:
2564                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2565                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2566                 new_highwatermark               = &ctr1->new_highwatermark;
2567                 more_data                       = ctr1->more_data;
2568                 break;
2569         case 6:
2570                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2571                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2572                 new_highwatermark               = &ctr6->new_highwatermark;
2573                 more_data                       = ctr6->more_data;
2574                 break;
2575         }
2576
2577         partition->highwatermark                = *new_highwatermark;
2578         partition->source_dsa_guid              = *source_dsa_guid;
2579         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2580         partition->more_data                    = more_data;
2581
2582         if (!partition->store_chunk) return WERR_OK;
2583
2584         s->_sc.domain           = &s->domain;
2585         s->_sc.forest           = &s->forest;
2586         s->_sc.source_dsa       = &s->source_dsa;
2587         s->_sc.dest_dsa         = &s->dest_dsa;
2588         s->_sc.partition        = partition;
2589         s->_sc.ctr_level        = ctr_level;
2590         s->_sc.ctr1             = ctr1;
2591         s->_sc.ctr6             = ctr6;
2592         /*
2593          * we need to use the drsuapi_p->gensec_skey here,
2594          * when we use drsuapi_p->pipe in the for this request
2595          */
2596         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2597
2598         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2599         if (!NT_STATUS_IS_OK(nt_status)) {
2600                 return ntstatus_to_werror(nt_status);
2601         }
2602
2603         return WERR_OK;
2604 }
2605
2606 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
2607
2608 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2609 {
2610         s->schema_part.nc.guid  = GUID_zero();
2611         s->schema_part.nc.sid   = s->zero_sid;
2612         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2613
2614         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2615
2616         s->schema_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2617                                         | DRSUAPI_DRS_INIT_SYNC
2618                                         | DRSUAPI_DRS_PER_SYNC
2619                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2620                                         | DRSUAPI_DRS_NEVER_SYNCED
2621                                         | DRSUAPI_DRS_USE_COMPRESSION;
2622         if (s->rodc_join) {
2623             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2624         }
2625
2626         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2627
2628         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2629                                              becomeDC_drsuapi3_pull_schema_recv);
2630 }
2631
2632 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2633
2634 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
2635 {
2636         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2637                                           struct libnet_BecomeDC_state);
2638         struct composite_context *c = s->creq;
2639         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2640                                            struct drsuapi_DsGetNCChanges);
2641         WERROR status;
2642
2643         bool print = false;
2644
2645         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2646                 print = true;
2647         }
2648
2649         c->status = dcerpc_ndr_request_recv(req);
2650         if (!composite_is_ok(c)) return;
2651
2652         if (print) {
2653                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2654         }
2655
2656         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2657         if (!W_ERROR_IS_OK(status)) {
2658                 composite_error(c, werror_to_ntstatus(status));
2659                 return;
2660         }
2661
2662         talloc_free(r);
2663
2664         if (s->schema_part.more_data) {
2665                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2666                                                      becomeDC_drsuapi3_pull_schema_recv);
2667                 return;
2668         }
2669
2670         becomeDC_drsuapi3_pull_config_send(s);
2671 }
2672
2673 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
2674
2675 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2676 {
2677         s->config_part.nc.guid  = GUID_zero();
2678         s->config_part.nc.sid   = s->zero_sid;
2679         s->config_part.nc.dn    = s->forest.config_dn_str;
2680
2681         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2682
2683         s->config_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2684                                         | DRSUAPI_DRS_INIT_SYNC
2685                                         | DRSUAPI_DRS_PER_SYNC
2686                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2687                                         | DRSUAPI_DRS_NEVER_SYNCED
2688                                         | DRSUAPI_DRS_USE_COMPRESSION;
2689         if (s->rodc_join) {
2690             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2691         }
2692
2693         s->config_part.store_chunk      = s->callbacks.config_chunk;
2694
2695         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2696                                              becomeDC_drsuapi3_pull_config_recv);
2697 }
2698
2699 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
2700 {
2701         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2702                                           struct libnet_BecomeDC_state);
2703         struct composite_context *c = s->creq;
2704         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2705                                            struct drsuapi_DsGetNCChanges);
2706         WERROR status;
2707
2708         bool print = false;
2709
2710         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2711                 print = true;
2712         }
2713
2714         c->status = dcerpc_ndr_request_recv(req);
2715         if (!composite_is_ok(c)) return;
2716
2717         if (print) {
2718                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2719         }
2720
2721         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2722         if (!W_ERROR_IS_OK(status)) {
2723                 composite_error(c, werror_to_ntstatus(status));
2724                 return;
2725         }
2726
2727         talloc_free(r);
2728
2729         if (s->config_part.more_data) {
2730                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2731                                                      becomeDC_drsuapi3_pull_config_recv);
2732                 return;
2733         }
2734
2735         becomeDC_connect_ldap2(s);
2736 }
2737
2738 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
2739
2740 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2741 {
2742         s->domain_part.nc.guid  = GUID_zero();
2743         s->domain_part.nc.sid   = s->zero_sid;
2744         s->domain_part.nc.dn    = s->domain.dn_str;
2745
2746         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2747
2748         s->domain_part.replica_flags    = DRSUAPI_DRS_WRIT_REP
2749                                         | DRSUAPI_DRS_INIT_SYNC
2750                                         | DRSUAPI_DRS_PER_SYNC
2751                                         | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS
2752                                         | DRSUAPI_DRS_NEVER_SYNCED
2753                                         | DRSUAPI_DRS_USE_COMPRESSION;
2754         if (s->rodc_join) {
2755             s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2756         }
2757
2758         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2759
2760         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2761                                              becomeDC_drsuapi3_pull_domain_recv);
2762 }
2763
2764 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2765                                               struct becomeDC_drsuapi *drsuapi,
2766                                               struct libnet_BecomeDC_Partition *partition,
2767                                               void (*recv_fn)(struct rpc_request *req));
2768 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
2769
2770 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
2771 {
2772         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2773                                           struct libnet_BecomeDC_state);
2774         struct composite_context *c = s->creq;
2775         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2776                                            struct drsuapi_DsGetNCChanges);
2777         WERROR status;
2778         bool print = false;
2779
2780         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2781                 print = true;
2782         }
2783
2784         c->status = dcerpc_ndr_request_recv(req);
2785         if (!composite_is_ok(c)) return;
2786
2787         if (print) {
2788                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2789         }
2790
2791         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2792         if (!W_ERROR_IS_OK(status)) {
2793                 composite_error(c, werror_to_ntstatus(status));
2794                 return;
2795         }
2796
2797         talloc_free(r);
2798
2799         if (s->domain_part.more_data) {
2800                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2801                                                      becomeDC_drsuapi3_pull_domain_recv);
2802                 return;
2803         }
2804
2805         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2806                                           becomeDC_drsuapi2_update_refs_schema_recv);
2807 }
2808
2809 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2810                                               struct becomeDC_drsuapi *drsuapi,
2811                                               struct libnet_BecomeDC_Partition *partition,
2812                                               void (*recv_fn)(struct rpc_request *req))
2813 {
2814         struct composite_context *c = s->creq;
2815         struct rpc_request *req;
2816         struct drsuapi_DsReplicaUpdateRefs *r;
2817         const char *ntds_guid_str;
2818         const char *ntds_dns_name;
2819
2820         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2821         if (composite_nomem(r, c)) return;
2822
2823         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2824         if (composite_nomem(ntds_guid_str, c)) return;
2825
2826         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2827                                         ntds_guid_str,
2828                                         s->domain.dns_name);
2829         if (composite_nomem(ntds_dns_name, c)) return;
2830
2831         r->in.bind_handle               = &drsuapi->bind_handle;
2832         r->in.level                     = 1;
2833         r->in.req.req1.naming_context   = &partition->nc;
2834         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2835         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2836         r->in.req.req1.options          = DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_DEL_REF;
2837
2838         /* I think this is how we mark ourselves as a RODC */
2839         if (!lp_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2840                 r->in.req.req1.options |= DRSUAPI_DRS_WRIT_REP;
2841         }
2842
2843         req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
2844         composite_continue_rpc(c, req, recv_fn, s);
2845 }
2846
2847 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
2848
2849 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
2850 {
2851         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2852                                           struct libnet_BecomeDC_state);
2853         struct composite_context *c = s->creq;
2854         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2855                                            struct drsuapi_DsReplicaUpdateRefs);
2856         bool print = false;
2857
2858         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2859                 print = true;
2860         }
2861
2862         c->status = dcerpc_ndr_request_recv(req);
2863         if (!composite_is_ok(c)) return;
2864
2865         if (print) {
2866                 NDR_PRINT_OUT_DEBUG(drsuapi_DsReplicaUpdateRefs, r);
2867         }
2868
2869         if (!W_ERROR_IS_OK(r->out.result)) {
2870                 composite_error(c, werror_to_ntstatus(r->out.result));
2871                 return;
2872         }
2873
2874         talloc_free(r);
2875
2876         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2877                                           becomeDC_drsuapi2_update_refs_config_recv);
2878 }
2879
2880 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
2881
2882 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
2883 {
2884         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2885                                           struct libnet_BecomeDC_state);
2886         struct composite_context *c = s->creq;
2887         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2888                                            struct drsuapi_DsReplicaUpdateRefs);
2889
2890         c->status = dcerpc_ndr_request_recv(req);
2891         if (!composite_is_ok(c)) return;
2892
2893         if (!W_ERROR_IS_OK(r->out.result)) {
2894                 composite_error(c, werror_to_ntstatus(r->out.result));
2895                 return;
2896         }
2897
2898         talloc_free(r);
2899
2900         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2901                                           becomeDC_drsuapi2_update_refs_domain_recv);
2902 }
2903
2904 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
2905 {
2906         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2907                                           struct libnet_BecomeDC_state);
2908         struct composite_context *c = s->creq;
2909         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2910                                            struct drsuapi_DsReplicaUpdateRefs);
2911
2912         c->status = dcerpc_ndr_request_recv(req);
2913         if (!composite_is_ok(c)) return;
2914
2915         if (!W_ERROR_IS_OK(r->out.result)) {
2916                 composite_error(c, werror_to_ntstatus(r->out.result));
2917                 return;
2918         }
2919
2920         talloc_free(r);
2921
2922         /* TODO: use DDNS updates and register dns names */
2923         composite_done(c);
2924 }
2925
2926 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2927 {
2928         int ret;
2929         struct ldb_message *msg;
2930         uint32_t i;
2931         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2932                                         UF_TRUSTED_FOR_DELEGATION;
2933
2934         /* as the value is already as we want it to be, we're done */
2935         if (s->dest_dsa.user_account_control == user_account_control) {
2936                 return NT_STATUS_OK;
2937         }
2938
2939         /* make a 'modify' msg, and only for serverReference */
2940         msg = ldb_msg_new(s);
2941         NT_STATUS_HAVE_NO_MEMORY(msg);
2942         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2943         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2944
2945         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2946         if (ret != 0) {
2947                 talloc_free(msg);
2948                 return NT_STATUS_NO_MEMORY;
2949         }
2950
2951         /* mark all the message elements (should be just one)
2952            as LDB_FLAG_MOD_REPLACE */
2953         for (i=0;i<msg->num_elements;i++) {
2954                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2955         }
2956
2957         ret = ldb_modify(s->ldap2.ldb, msg);
2958         talloc_free(msg);
2959         if (ret != LDB_SUCCESS) {
2960                 return NT_STATUS_LDAP(ret);
2961         }
2962
2963         s->dest_dsa.user_account_control = user_account_control;
2964
2965         return NT_STATUS_OK;
2966 }
2967
2968 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2969 {
2970         int ret;
2971         struct ldb_dn *old_dn;
2972         struct ldb_dn *new_dn;
2973
2974         ret = dsdb_wellknown_dn(s->ldap2.ldb, s, samdb_base_dn(s->ldap2.ldb),
2975                                 DS_GUID_DOMAIN_CONTROLLERS_CONTAINER,
2976                                 &new_dn);
2977         if (ret != LDB_SUCCESS) {
2978                 return NT_STATUS_LDAP(ret);
2979         }
2980
2981         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2982                 talloc_free(new_dn);
2983                 return NT_STATUS_NO_MEMORY;
2984         }
2985
2986         old_dn = ldb_dn_new(new_dn, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2987         NT_STATUS_HAVE_NO_MEMORY(old_dn);
2988
2989         if (ldb_dn_compare(old_dn, new_dn) == 0) {
2990                 /* we don't need to rename if the old and new dn match */
2991                 talloc_free(new_dn);
2992                 return NT_STATUS_OK;
2993         }
2994
2995         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
2996         if (ret != LDB_SUCCESS) {
2997                 talloc_free(new_dn);
2998                 return NT_STATUS_LDAP(ret);
2999         }
3000
3001         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
3002         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
3003
3004         talloc_free(new_dn);
3005
3006         return NT_STATUS_OK;
3007 }
3008
3009 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
3010 {
3011         struct composite_context *c = s->creq;
3012
3013         c->status = becomeDC_ldap_connect(s, &s->ldap2);
3014         if (!composite_is_ok(c)) return;
3015
3016         c->status = becomeDC_ldap2_modify_computer(s);
3017         if (!composite_is_ok(c)) return;
3018
3019         c->status = becomeDC_ldap2_move_computer(s);
3020         if (!composite_is_ok(c)) return;
3021
3022         becomeDC_drsuapi3_pull_domain_send(s);
3023 }
3024
3025 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3026 {
3027         struct composite_context *c;
3028         struct libnet_BecomeDC_state *s;
3029         char *tmp_name;
3030
3031         c = composite_create(mem_ctx, ctx->event_ctx);
3032         if (c == NULL) return NULL;
3033
3034         s = talloc_zero(c, struct libnet_BecomeDC_state);
3035         if (composite_nomem(s, c)) return c;
3036         c->private_data = s;
3037         s->creq         = c;
3038         s->libnet       = ctx;
3039
3040         /* Domain input */
3041         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
3042         if (composite_nomem(s->domain.dns_name, c)) return c;
3043         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
3044         if (composite_nomem(s->domain.netbios_name, c)) return c;
3045         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
3046         if (composite_nomem(s->domain.sid, c)) return c;
3047
3048         /* Source DSA input */
3049         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
3050         if (composite_nomem(s->source_dsa.address, c)) return c;
3051
3052         /* Destination DSA input */
3053         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3054         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3055
3056         /* Destination DSA dns_name construction */
3057         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
3058         if (composite_nomem(tmp_name, c)) return c;
3059         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3060         if (composite_nomem(tmp_name, c)) return c;
3061         s->dest_dsa.dns_name    = tmp_name;
3062
3063         /* Callback function pointers */
3064         s->callbacks = r->in.callbacks;
3065
3066         /* RODC join*/
3067         s->rodc_join = r->in.rodc_join;
3068
3069         becomeDC_send_cldap(s);
3070         return c;
3071 }
3072
3073 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3074 {
3075         NTSTATUS status;
3076
3077         status = composite_wait(c);
3078
3079         ZERO_STRUCT(r->out);
3080
3081         talloc_free(c);
3082         return status;
3083 }
3084
3085 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3086 {
3087         NTSTATUS status;
3088         struct composite_context *c;
3089         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3090         status = libnet_BecomeDC_recv(c, mem_ctx, r);
3091         return status;
3092 }