source4/libnet/libnet_samsync_ldb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Extract the user/system database from a remote SamSync server
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7    Copyright (C) Andrew Tridgell 2004
   8    Copyright (C) Volker Lendecke 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24
  25 #include "includes.h"
  26 #include "libnet/libnet.h"
  27 #include "libcli/ldap/ldap_ndr.h"
  28 #include "dsdb/samdb/samdb.h"
  29 #include "auth/auth.h"
  30 #include "../lib/util/util_ldb.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "ldb_wrap.h"
  33 #include "libcli/security/security.h"
  34 #include "librpc/rpc/dcerpc.h"
  35 #include "param/param.h"
  36
  37 struct samsync_ldb_secret {
  38         struct samsync_ldb_secret *prev, *next;
  39         DATA_BLOB secret;
  40         char *name;
  41         NTTIME mtime;
  42 };
  43
  44 struct samsync_ldb_trusted_domain {
  45         struct samsync_ldb_trusted_domain *prev, *next;
  46         struct dom_sid *sid;
  47         char *name;
  48 };
  49
  50 struct samsync_ldb_state {
  51         /* Values from the LSA lookup */
  52         const struct libnet_SamSync_state *samsync_state;
  53
  54         struct dom_sid *dom_sid[3];
  55         struct ldb_context *sam_ldb, *remote_ldb;
  56         struct ldb_dn *base_dn[3];
  57         struct samsync_ldb_secret *secrets;
  58         struct samsync_ldb_trusted_domain *trusted_domains;
  59 };
  60
  61 static NTSTATUS samsync_ldb_add_foreignSecurityPrincipal(TALLOC_CTX *mem_ctx,
  62                                                          struct samsync_ldb_state *state,
  63                                                          struct dom_sid *sid,
  64                                                          struct ldb_dn **fsp_dn,
  65                                                          char **error_string)
  66 {
  67         const char *sidstr = dom_sid_string(mem_ctx, sid);
  68         /* We assume that ForeignSecurityPrincipals are under the BASEDN of the main domain */
  69         struct ldb_dn *basedn = samdb_search_dn(state->sam_ldb, mem_ctx,
  70                                                 state->base_dn[SAM_DATABASE_DOMAIN],
  71                                                 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
  72         struct ldb_message *msg;
  73         int ret;
  74
  75         if (!sidstr) {
  76                 return NT_STATUS_NO_MEMORY;
  77         }
  78
  79         if (basedn == NULL) {
  80                 *error_string = talloc_asprintf(mem_ctx,
  81                                                 "Failed to find DN for "
  82                                                 "ForeignSecurityPrincipal container under %s",
  83                                                 ldb_dn_get_linearized(state->base_dn[SAM_DATABASE_DOMAIN]));
  84                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
  85         }
  86
  87         msg = ldb_msg_new(mem_ctx);
  88         if (msg == NULL) {
  89                 return NT_STATUS_NO_MEMORY;
  90         }
  91
  92         /* add core elements to the ldb_message for the alias */
  93         msg->dn = basedn;
  94         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
  95                 return NT_STATUS_UNSUCCESSFUL;
  96
  97         samdb_msg_add_string(state->sam_ldb, mem_ctx, msg,
  98                              "objectClass",
  99                              "foreignSecurityPrincipal");
 100
 101         *fsp_dn = msg->dn;
 102
 103         /* create the alias */
 104         ret = ldb_add(state->sam_ldb, msg);
 105         if (ret != 0) {
 106                 *error_string = talloc_asprintf(mem_ctx, "Failed to create foreignSecurityPrincipal "
 107                                                 "record %s: %s",
 108                                                 ldb_dn_get_linearized(msg->dn),
 109                                                 ldb_errstring(state->sam_ldb));
 110                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 111         }
 112         return NT_STATUS_OK;
 113 }
 114
 115 static NTSTATUS samsync_ldb_handle_domain(TALLOC_CTX *mem_ctx,
 116                                           struct samsync_ldb_state *state,
 117                                           enum netr_SamDatabaseID database,
 118                                           struct netr_DELTA_ENUM *delta,
 119                                           char **error_string)
 120 {
 121         struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
 122         const char *domain_name = domain->domain_name.string;
 123         struct ldb_message *msg;
 124         int ret;
 125
 126         msg = ldb_msg_new(mem_ctx);
 127         if (msg == NULL) {
 128                 return NT_STATUS_NO_MEMORY;
 129         }
 130
 131         if (database == SAM_DATABASE_DOMAIN) {
 132                 struct ldb_dn *partitions_basedn;
 133                 const char *domain_attrs[] =  {"nETBIOSName", "nCName", NULL};
 134                 struct ldb_message **msgs_domain;
 135                 int ret_domain;
 136
 137                 partitions_basedn = samdb_partitions_dn(state->sam_ldb, mem_ctx);
 138
 139                 ret_domain = gendb_search(state->sam_ldb, mem_ctx, partitions_basedn, &msgs_domain, domain_attrs,
 140                                           "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
 141                                           domain_name);
 142                 if (ret_domain == -1) {
 143                         *error_string = talloc_asprintf(mem_ctx, "gendb_search for domain failed: %s", ldb_errstring(state->sam_ldb));
 144                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 145                 }
 146
 147                 if (ret_domain != 1) {
 148                         *error_string = talloc_asprintf(mem_ctx, "Failed to find existing domain record for %s: %d results", domain_name,
 149                                                         ret_domain);
 150                         return NT_STATUS_NO_SUCH_DOMAIN;
 151                 }
 152
 153                 state->base_dn[database] = samdb_result_dn(state->sam_ldb, state, msgs_domain[0], "nCName", NULL);
 154
 155                 if (state->dom_sid[database]) {
 156                         /* Update the domain sid with the incoming
 157                          * domain (found on LSA pipe, database sid may
 158                          * be random) */
 159                         samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx,
 160                                               msg, "objectSid", state->dom_sid[database]);
 161                 } else {
 162                         /* Well, we will have to use the one from the database */
 163                         state->dom_sid[database] = samdb_search_dom_sid(state->sam_ldb, state,
 164                                                                         state->base_dn[database],
 165                                                                         "objectSid", NULL);
 166                 }
 167
 168                 if (state->samsync_state->domain_guid) {
 169                         enum ndr_err_code ndr_err;
 170                         struct ldb_val v;
 171                         ndr_err = ndr_push_struct_blob(&v, msg, NULL,
 172                                                        state->samsync_state->domain_guid,
 173                                                          (ndr_push_flags_fn_t)ndr_push_GUID);
 174                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 175                                 *error_string = talloc_asprintf(mem_ctx, "ndr_push of domain GUID failed!");
 176                                 return ndr_map_error2ntstatus(ndr_err);
 177                         }
 178
 179                         ldb_msg_add_value(msg, "objectGUID", &v, NULL);
 180                 }
 181         } else if (database == SAM_DATABASE_BUILTIN) {
 182                 /* work out the builtin_dn - useful for so many calls its worth
 183                    fetching here */
 184                 const char *dnstring = samdb_search_string(state->sam_ldb, mem_ctx, NULL,
 185                                                            "distinguishedName", "objectClass=builtinDomain");
 186                 state->base_dn[database] = ldb_dn_new(state, state->sam_ldb, dnstring);
 187                 if ( ! ldb_dn_validate(state->base_dn[database])) {
 188                         return NT_STATUS_INTERNAL_ERROR;
 189                 }
 190         } else {
 191                 /* PRIVs DB */
 192                 return NT_STATUS_INVALID_PARAMETER;
 193         }
 194
 195         msg->dn = talloc_reference(mem_ctx, state->base_dn[database]);
 196         if (!msg->dn) {
 197                 return NT_STATUS_NO_MEMORY;
 198         }
 199
 200         samdb_msg_add_string(state->sam_ldb, mem_ctx,
 201                              msg, "oEMInformation", domain->oem_information.string);
 202
 203         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 204                             msg, "forceLogoff", domain->force_logoff_time);
 205
 206         samdb_msg_add_uint(state->sam_ldb, mem_ctx,
 207                            msg, "minPwdLen", domain->min_password_length);
 208
 209         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 210                             msg, "maxPwdAge", domain->max_password_age);
 211
 212         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 213                             msg, "minPwdAge", domain->min_password_age);
 214
 215         samdb_msg_add_uint(state->sam_ldb, mem_ctx,
 216                            msg, "pwdHistoryLength", domain->password_history_length);
 217
 218         samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
 219                              msg, "modifiedCount",
 220                              domain->sequence_num);
 221
 222         samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
 223                              msg, "creationTime", domain->domain_create_time);
 224
 225         /* TODO: Account lockout, password properties */
 226
 227         ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 228
 229         if (ret) {
 230                 return NT_STATUS_INTERNAL_ERROR;
 231         }
 232         return NT_STATUS_OK;
 233 }
 234
 235 static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
 236                                         struct samsync_ldb_state *state,
 237                                         enum netr_SamDatabaseID database,
 238                                         struct netr_DELTA_ENUM *delta,
 239                                         char **error_string)
 240 {
 241         uint32_t rid = delta->delta_id_union.rid;
 242         struct netr_DELTA_USER *user = delta->delta_union.user;
 243         const char *container, *obj_class;
 244         char *cn_name;
 245         int cn_name_len;
 246         const struct dom_sid *user_sid;
 247         struct ldb_message *msg;
 248         struct ldb_message **msgs;
 249         struct ldb_message **remote_msgs = NULL;
 250         int ret, i;
 251         uint32_t acb;
 252         bool add = false;
 253         const char *attrs[] = { NULL };
 254         /* we may change this to a global search, then fill in only the things not in ldap later */
 255         const char *remote_attrs[] = { "userPrincipalName", "servicePrincipalName",
 256                                        "msDS-KeyVersionNumber", "objectGUID", NULL};
 257
 258         user_sid = dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid);
 259         if (!user_sid) {
 260                 return NT_STATUS_NO_MEMORY;
 261         }
 262
 263         msg = ldb_msg_new(mem_ctx);
 264         if (msg == NULL) {
 265                 return NT_STATUS_NO_MEMORY;
 266         }
 267
 268         msg->dn = NULL;
 269         /* search for the user, by rid */
 270         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
 271                            &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
 272                            ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
 273
 274         if (ret == -1) {
 275                 *error_string = talloc_asprintf(mem_ctx, "LDB for user %s failed: %s",
 276                                                 dom_sid_string(mem_ctx, user_sid),
 277                                                 ldb_errstring(state->sam_ldb));
 278                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 279         } else if (ret == 0) {
 280                 add = true;
 281         } else if (ret > 1) {
 282                 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s in local LDB",
 283                                                 dom_sid_string(mem_ctx, user_sid));
 284                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 285         } else {
 286                 msg->dn = msgs[0]->dn;
 287                 talloc_steal(msg, msgs[0]->dn);
 288         }
 289
 290         /* and do the same on the remote database */
 291         if (state->remote_ldb) {
 292                 ret = gendb_search(state->remote_ldb, mem_ctx, state->base_dn[database],
 293                                    &remote_msgs, remote_attrs, "(&(objectClass=user)(objectSid=%s))",
 294                                    ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
 295
 296                 if (ret == -1) {
 297                         *error_string = talloc_asprintf(mem_ctx, "remote LDAP for user %s failed: %s",
 298                                                         dom_sid_string(mem_ctx, user_sid),
 299                                                         ldb_errstring(state->remote_ldb));
 300                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 301                 } else if (ret == 0) {
 302                         *error_string = talloc_asprintf(mem_ctx, "User exists in samsync but not in remote LDAP domain! (base: %s, SID: %s)",
 303                                                         ldb_dn_get_linearized(state->base_dn[database]),
 304                                                         dom_sid_string(mem_ctx, user_sid));
 305                         return NT_STATUS_NO_SUCH_USER;
 306                 } else if (ret > 1) {
 307                         *error_string = talloc_asprintf(mem_ctx, "More than one user in remote LDAP domain with SID: %s",
 308                                                         dom_sid_string(mem_ctx, user_sid));
 309                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 310
 311                         /* Try to put things in the same location as the remote server */
 312                 } else if (add) {
 313                         msg->dn = remote_msgs[0]->dn;
 314                         talloc_steal(msg, remote_msgs[0]->dn);
 315                 }
 316         }
 317
 318         cn_name   = talloc_strdup(mem_ctx, user->account_name.string);
 319         NT_STATUS_HAVE_NO_MEMORY(cn_name);
 320         cn_name_len = strlen(cn_name);
 321
 322 #define ADD_OR_DEL(type, attrib, field) do {                            \
 323                 if (user->field) {                                      \
 324                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 325                                                attrib, user->field);    \
 326                 } else if (!add) {                                      \
 327                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 328                                              attrib);                   \
 329                 }                                                       \
 330         } while (0);
 331
 332         ADD_OR_DEL(string, "samAccountName", account_name.string);
 333         ADD_OR_DEL(string, "displayName", full_name.string);
 334
 335         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 336                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 337                 return NT_STATUS_NO_MEMORY;
 338         }
 339
 340         ADD_OR_DEL(uint, "primaryGroupID", primary_gid);
 341         ADD_OR_DEL(string, "homeDirectory", home_directory.string);
 342         ADD_OR_DEL(string, "homeDrive", home_drive.string);
 343         ADD_OR_DEL(string, "scriptPath", logon_script.string);
 344         ADD_OR_DEL(string, "description", description.string);
 345         ADD_OR_DEL(string, "userWorkstations", workstations.string);
 346
 347         ADD_OR_DEL(uint64, "lastLogon", last_logon);
 348         ADD_OR_DEL(uint64, "lastLogoff", last_logoff);
 349
 350         if (samdb_msg_add_logon_hours(state->sam_ldb, mem_ctx, msg, "logonHours", &user->logon_hours) != 0) {
 351                 return NT_STATUS_NO_MEMORY;
 352         }
 353
 354         ADD_OR_DEL(uint, "badPwdCount", bad_password_count);
 355         ADD_OR_DEL(uint, "logonCount", logon_count);
 356
 357         ADD_OR_DEL(uint64, "pwdLastSet", last_password_change);
 358         ADD_OR_DEL(uint64, "accountExpires", acct_expiry);
 359
 360         if (samdb_msg_add_acct_flags(state->sam_ldb, mem_ctx, msg,
 361                                      "userAccountControl", user->acct_flags) != 0) {
 362                 return NT_STATUS_NO_MEMORY;
 363         }
 364
 365         if (!add) {
 366                 /* Passwords.  Ensure there is no plaintext stored against
 367                  * this entry, as we only have hashes */
 368                 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 369                                      "userPassword");
 370         }
 371         if (user->lm_password_present) {
 372                 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
 373                                    "dBCSPwd", &user->lmpassword);
 374         } else if (!add) {
 375                 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 376                                      "dBCSPwd");
 377         }
 378         if (user->nt_password_present) {
 379                 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
 380                                    "unicodePwd", &user->ntpassword);
 381         } else if (!add) {
 382                 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 383                                      "unicodePwd");
 384         }
 385
 386         ADD_OR_DEL(string, "comment", comment.string);
 387
 388         if (samdb_msg_add_parameters(state->sam_ldb, mem_ctx, msg, "userParameters", &user->parameters) != 0) {
 389                 return NT_STATUS_NO_MEMORY;
 390         }
 391
 392         ADD_OR_DEL(uint, "countryCode", country_code);
 393         ADD_OR_DEL(uint, "codePage", code_page);
 394
 395         ADD_OR_DEL(string, "profilePath", profile_path.string);
 396
 397 #undef ADD_OR_DEL
 398
 399         for (i=0; remote_attrs[i]; i++) {
 400                 struct ldb_message_element *el = ldb_msg_find_element(remote_msgs[0], remote_attrs[i]);
 401                 if (!el) {
 402                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 403                                              remote_attrs[i]);
 404                 } else {
 405                         ldb_msg_add(msg, el, LDB_FLAG_MOD_REPLACE);
 406                 }
 407         }
 408
 409         acb = user->acct_flags;
 410         if (acb & (ACB_WSTRUST)) {
 411                 cn_name[cn_name_len - 1] = '\0';
 412                 container = "Computers";
 413                 obj_class = "computer";
 414
 415         } else if (acb & ACB_SVRTRUST) {
 416                 if (cn_name[cn_name_len - 1] != '$') {
 417                         return NT_STATUS_FOOBAR;
 418                 }
 419                 cn_name[cn_name_len - 1] = '\0';
 420                 container = "Domain Controllers";
 421                 obj_class = "computer";
 422         } else {
 423                 container = "Users";
 424                 obj_class = "user";
 425         }
 426         if (add) {
 427                 samdb_msg_add_string(state->sam_ldb, mem_ctx, msg,
 428                                      "objectClass", obj_class);
 429                 if (!msg->dn) {
 430                         msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 431                         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 432                         if (!msg->dn) {
 433                                 return NT_STATUS_NO_MEMORY;
 434                         }
 435                 }
 436
 437                 ret = ldb_add(state->sam_ldb, msg);
 438                 if (ret != 0) {
 439                         struct ldb_dn *first_try_dn = msg->dn;
 440                         /* Try again with the default DN */
 441                         if (!remote_msgs) {
 442                                 *error_string = talloc_asprintf(mem_ctx, "Failed to create user record.  Tried %s: %s",
 443                                                                 ldb_dn_get_linearized(first_try_dn),
 444                                                                 ldb_errstring(state->sam_ldb));
 445                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 446                         } else {
 447                                 msg->dn = talloc_steal(msg, remote_msgs[0]->dn);
 448                                 ret = ldb_add(state->sam_ldb, msg);
 449                                 if (ret != 0) {
 450                                         *error_string = talloc_asprintf(mem_ctx, "Failed to create user record.  Tried both %s and %s: %s",
 451                                                                         ldb_dn_get_linearized(first_try_dn),
 452                                                                         ldb_dn_get_linearized(msg->dn),
 453                                                                         ldb_errstring(state->sam_ldb));
 454                                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 455                                 }
 456                         }
 457                 }
 458         } else {
 459                 ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 460                 if (ret != 0) {
 461                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify user record %s: %s",
 462                                                         ldb_dn_get_linearized(msg->dn),
 463                                                         ldb_errstring(state->sam_ldb));
 464                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 465                 }
 466         }
 467
 468         return NT_STATUS_OK;
 469 }
 470
 471 static NTSTATUS samsync_ldb_delete_user(TALLOC_CTX *mem_ctx,
 472                                         struct samsync_ldb_state *state,
 473                                         enum netr_SamDatabaseID database,
 474                                         struct netr_DELTA_ENUM *delta,
 475                                         char **error_string)
 476 {
 477         uint32_t rid = delta->delta_id_union.rid;
 478         struct ldb_message **msgs;
 479         int ret;
 480         const char *attrs[] = { NULL };
 481
 482         /* search for the user, by rid */
 483         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
 484                            &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
 485                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 486
 487         if (ret == -1) {
 488                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 489                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 490         } else if (ret == 0) {
 491                 return NT_STATUS_NO_SUCH_USER;
 492         } else if (ret > 1) {
 493                 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s",
 494                                                 dom_sid_string(mem_ctx,
 495                                                                dom_sid_add_rid(mem_ctx,
 496                                                                                state->dom_sid[database],
 497                                                                                rid)));
 498                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 499         }
 500
 501         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 502         if (ret != 0) {
 503                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete user record %s: %s",
 504                                                 ldb_dn_get_linearized(msgs[0]->dn),
 505                                                 ldb_errstring(state->sam_ldb));
 506                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 507         }
 508
 509         return NT_STATUS_OK;
 510 }
 511
 512 static NTSTATUS samsync_ldb_handle_group(TALLOC_CTX *mem_ctx,
 513                                          struct samsync_ldb_state *state,
 514                                          enum netr_SamDatabaseID database,
 515                                          struct netr_DELTA_ENUM *delta,
 516                                          char **error_string)
 517 {
 518         uint32_t rid = delta->delta_id_union.rid;
 519         struct netr_DELTA_GROUP *group = delta->delta_union.group;
 520         const char *container, *obj_class;
 521         const char *cn_name;
 522
 523         struct ldb_message *msg;
 524         struct ldb_message **msgs;
 525         int ret;
 526         bool add = false;
 527         const char *attrs[] = { NULL };
 528
 529         msg = ldb_msg_new(mem_ctx);
 530         if (msg == NULL) {
 531                 return NT_STATUS_NO_MEMORY;
 532         }
 533
 534         /* search for the group, by rid */
 535         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 536                            "(&(objectClass=group)(objectSid=%s))",
 537                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 538
 539         if (ret == -1) {
 540                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 541                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 542         } else if (ret == 0) {
 543                 add = true;
 544         } else if (ret > 1) {
 545                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 546                                                 dom_sid_string(mem_ctx,
 547                                                                dom_sid_add_rid(mem_ctx,
 548                                                                                state->dom_sid[database],
 549                                                                                rid)));
 550                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 551         } else {
 552                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 553         }
 554
 555         cn_name   = group->group_name.string;
 556
 557 #define ADD_OR_DEL(type, attrib, field) do {                            \
 558                 if (group->field) {                                     \
 559                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 560                                                attrib, group->field);   \
 561                 } else if (!add) {                                      \
 562                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 563                                              attrib);                   \
 564                 }                                                       \
 565         } while (0);
 566
 567         ADD_OR_DEL(string, "samAccountName", group_name.string);
 568
 569         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 570                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 571                 return NT_STATUS_NO_MEMORY;
 572         }
 573
 574         ADD_OR_DEL(string, "description", description.string);
 575
 576 #undef ADD_OR_DEL
 577
 578         container = "Users";
 579         obj_class = "group";
 580
 581         if (add) {
 582                 samdb_msg_add_string(state->sam_ldb, mem_ctx, msg,
 583                                      "objectClass", obj_class);
 584                 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 585                 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 586                 if (!msg->dn) {
 587                         return NT_STATUS_NO_MEMORY;
 588                 }
 589
 590                 ret = ldb_add(state->sam_ldb, msg);
 591                 if (ret != 0) {
 592                         *error_string = talloc_asprintf(mem_ctx, "Failed to create group record %s: %s",
 593                                                         ldb_dn_get_linearized(msg->dn),
 594                                                         ldb_errstring(state->sam_ldb));
 595                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 596                 }
 597         } else {
 598                 ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 599                 if (ret != 0) {
 600                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 601                                                         ldb_dn_get_linearized(msg->dn),
 602                                                         ldb_errstring(state->sam_ldb));
 603                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 604                 }
 605         }
 606
 607         return NT_STATUS_OK;
 608 }
 609
 610 static NTSTATUS samsync_ldb_delete_group(TALLOC_CTX *mem_ctx,
 611                                          struct samsync_ldb_state *state,
 612                                          enum netr_SamDatabaseID database,
 613                                          struct netr_DELTA_ENUM *delta,
 614                                          char **error_string)
 615 {
 616         uint32_t rid = delta->delta_id_union.rid;
 617         struct ldb_message **msgs;
 618         int ret;
 619         const char *attrs[] = { NULL };
 620
 621         /* search for the group, by rid */
 622         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 623                            "(&(objectClass=group)(objectSid=%s))",
 624                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 625
 626         if (ret == -1) {
 627                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 628                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 629         } else if (ret == 0) {
 630                 return NT_STATUS_NO_SUCH_GROUP;
 631         } else if (ret > 1) {
 632                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 633                                                 dom_sid_string(mem_ctx,
 634                                                                dom_sid_add_rid(mem_ctx,
 635                                                                                state->dom_sid[database],
 636                                                                                rid)));
 637                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 638         }
 639
 640         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 641         if (ret != 0) {
 642                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete group record %s: %s",
 643                                                 ldb_dn_get_linearized(msgs[0]->dn),
 644                                                 ldb_errstring(state->sam_ldb));
 645                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 646         }
 647
 648         return NT_STATUS_OK;
 649 }
 650
 651 static NTSTATUS samsync_ldb_handle_group_member(TALLOC_CTX *mem_ctx,
 652                                                 struct samsync_ldb_state *state,
 653                                                 enum netr_SamDatabaseID database,
 654                                                 struct netr_DELTA_ENUM *delta,
 655                                                 char **error_string)
 656 {
 657         uint32_t rid = delta->delta_id_union.rid;
 658         struct netr_DELTA_GROUP_MEMBER *group_member = delta->delta_union.group_member;
 659         struct ldb_message *msg;
 660         struct ldb_message **msgs;
 661         int ret;
 662         const char *attrs[] = { NULL };
 663         int i;
 664
 665         msg = ldb_msg_new(mem_ctx);
 666         if (msg == NULL) {
 667                 return NT_STATUS_NO_MEMORY;
 668         }
 669
 670         /* search for the group, by rid */
 671         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 672                            "(&(objectClass=group)(objectSid=%s))",
 673                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 674
 675         if (ret == -1) {
 676                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 677                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 678         } else if (ret == 0) {
 679                 return NT_STATUS_NO_SUCH_GROUP;
 680         } else if (ret > 1) {
 681                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 682                                                 dom_sid_string(mem_ctx,
 683                                                                dom_sid_add_rid(mem_ctx,
 684                                                                                state->dom_sid[database],
 685                                                                                rid)));
 686                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 687         } else {
 688                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 689         }
 690
 691         talloc_free(msgs);
 692
 693         for (i=0; i<group_member->num_rids; i++) {
 694                 /* search for the group, by rid */
 695                 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 696                                    "(&(objectClass=user)(objectSid=%s))",
 697                                    ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], group_member->rids[i])));
 698
 699                 if (ret == -1) {
 700                         *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 701                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 702                 } else if (ret == 0) {
 703                         return NT_STATUS_NO_SUCH_USER;
 704                 } else if (ret > 1) {
 705                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 706                 } else {
 707                         samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_alloc_linearized(mem_ctx, msgs[0]->dn));
 708                 }
 709
 710                 talloc_free(msgs);
 711         }
 712
 713         ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 714         if (ret != 0) {
 715                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 716                                                 ldb_dn_get_linearized(msg->dn),
 717                                                 ldb_errstring(state->sam_ldb));
 718                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 719         }
 720
 721         return NT_STATUS_OK;
 722 }
 723
 724 static NTSTATUS samsync_ldb_handle_alias(TALLOC_CTX *mem_ctx,
 725                                          struct samsync_ldb_state *state,
 726                                          enum netr_SamDatabaseID database,
 727                                          struct netr_DELTA_ENUM *delta,
 728                                          char **error_string)
 729 {
 730         uint32_t rid = delta->delta_id_union.rid;
 731         struct netr_DELTA_ALIAS *alias = delta->delta_union.alias;
 732         const char *container, *obj_class;
 733         const char *cn_name;
 734
 735         struct ldb_message *msg;
 736         struct ldb_message **msgs;
 737         int ret;
 738         bool add = false;
 739         const char *attrs[] = { NULL };
 740
 741         msg = ldb_msg_new(mem_ctx);
 742         if (msg == NULL) {
 743                 return NT_STATUS_NO_MEMORY;
 744         }
 745
 746         /* search for the alias, by rid */
 747         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 748                            "(&(objectClass=group)(objectSid=%s))",
 749                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 750
 751         if (ret == -1) {
 752                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 753                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 754         } else if (ret == 0) {
 755                 add = true;
 756         } else if (ret > 1) {
 757                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 758                                                 dom_sid_string(mem_ctx,
 759                                                                dom_sid_add_rid(mem_ctx,
 760                                                                                state->dom_sid[database],
 761                                                                                rid)));
 762                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 763         } else {
 764                 msg->dn = talloc_steal(mem_ctx, msgs[0]->dn);
 765         }
 766
 767         cn_name   = alias->alias_name.string;
 768
 769 #define ADD_OR_DEL(type, attrib, field) do {                            \
 770                 if (alias->field) {                                     \
 771                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 772                                                attrib, alias->field);   \
 773                 } else if (!add) {                                      \
 774                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 775                                              attrib);                   \
 776                 }                                                       \
 777         } while (0);
 778
 779         ADD_OR_DEL(string, "samAccountName", alias_name.string);
 780
 781         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 782                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 783                 return NT_STATUS_NO_MEMORY;
 784         }
 785
 786         ADD_OR_DEL(string, "description", description.string);
 787
 788 #undef ADD_OR_DEL
 789
 790         samdb_msg_add_uint(state->sam_ldb, mem_ctx, msg, "groupType", 0x80000004);
 791
 792         container = "Users";
 793         obj_class = "group";
 794
 795         if (add) {
 796                 samdb_msg_add_string(state->sam_ldb, mem_ctx, msg,
 797                                      "objectClass", obj_class);
 798                 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 799                 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 800                 if (!msg->dn) {
 801                         return NT_STATUS_NO_MEMORY;
 802                 }
 803
 804                 ret = ldb_add(state->sam_ldb, msg);
 805                 if (ret != 0) {
 806                         *error_string = talloc_asprintf(mem_ctx, "Failed to create alias record %s: %s",
 807                                                         ldb_dn_get_linearized(msg->dn),
 808                                                         ldb_errstring(state->sam_ldb));
 809                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 810                 }
 811         } else {
 812                 ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 813                 if (ret != 0) {
 814                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify alias record %s: %s",
 815                                                         ldb_dn_get_linearized(msg->dn),
 816                                                         ldb_errstring(state->sam_ldb));
 817                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 818                 }
 819         }
 820
 821         return NT_STATUS_OK;
 822 }
 823
 824 static NTSTATUS samsync_ldb_delete_alias(TALLOC_CTX *mem_ctx,
 825                                          struct samsync_ldb_state *state,
 826                                          enum netr_SamDatabaseID database,
 827                                          struct netr_DELTA_ENUM *delta,
 828                                          char **error_string)
 829 {
 830         uint32_t rid = delta->delta_id_union.rid;
 831         struct ldb_message **msgs;
 832         int ret;
 833         const char *attrs[] = { NULL };
 834
 835         /* search for the alias, by rid */
 836         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 837                            "(&(objectClass=group)(objectSid=%s))",
 838                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 839
 840         if (ret == -1) {
 841                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 842                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 843         } else if (ret == 0) {
 844                 return NT_STATUS_NO_SUCH_ALIAS;
 845         } else if (ret > 1) {
 846                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 847         }
 848
 849         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 850         if (ret != 0) {
 851                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete alias record %s: %s",
 852                                                 ldb_dn_get_linearized(msgs[0]->dn),
 853                                                 ldb_errstring(state->sam_ldb));
 854                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 855         }
 856
 857         return NT_STATUS_OK;
 858 }
 859
 860 static NTSTATUS samsync_ldb_handle_alias_member(TALLOC_CTX *mem_ctx,
 861                                                 struct samsync_ldb_state *state,
 862                                                 enum netr_SamDatabaseID database,
 863                                                 struct netr_DELTA_ENUM *delta,
 864                                                 char **error_string)
 865 {
 866         uint32_t rid = delta->delta_id_union.rid;
 867         struct netr_DELTA_ALIAS_MEMBER *alias_member = delta->delta_union.alias_member;
 868         struct ldb_message *msg;
 869         struct ldb_message **msgs;
 870         int ret;
 871         const char *attrs[] = { NULL };
 872         int i;
 873
 874         msg = ldb_msg_new(mem_ctx);
 875         if (msg == NULL) {
 876                 return NT_STATUS_NO_MEMORY;
 877         }
 878
 879         /* search for the alias, by rid */
 880         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 881                            "(&(objectClass=group)(objectSid=%s))",
 882                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 883
 884         if (ret == -1) {
 885                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 886                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 887         } else if (ret == 0) {
 888                 return NT_STATUS_NO_SUCH_GROUP;
 889         } else if (ret > 1) {
 890                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 891                                                 dom_sid_string(mem_ctx,
 892                                                                dom_sid_add_rid(mem_ctx,
 893                                                                                state->dom_sid[database],
 894                                                                                rid)));
 895                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 896         } else {
 897                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 898         }
 899
 900         talloc_free(msgs);
 901
 902         for (i=0; i<alias_member->sids.num_sids; i++) {
 903                 struct ldb_dn *alias_member_dn;
 904                 /* search for members, in the top basedn (normal users are builtin aliases) */
 905                 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
 906                                    "(objectSid=%s)",
 907                                    ldap_encode_ndr_dom_sid(mem_ctx, alias_member->sids.sids[i].sid));
 908
 909                 if (ret == -1) {
 910                         *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 911                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 912                 } else if (ret == 0) {
 913                         NTSTATUS nt_status;
 914                         nt_status = samsync_ldb_add_foreignSecurityPrincipal(mem_ctx, state,
 915                                                                              alias_member->sids.sids[i].sid,
 916                                                                              &alias_member_dn,
 917                                                                              error_string);
 918                         if (!NT_STATUS_IS_OK(nt_status)) {
 919                                 return nt_status;
 920                         }
 921                 } else if (ret > 1) {
 922                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 923                 } else {
 924                         alias_member_dn = msgs[0]->dn;
 925                 }
 926                 samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_alloc_linearized(mem_ctx, alias_member_dn));
 927
 928                 talloc_free(msgs);
 929         }
 930
 931         ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 932         if (ret != 0) {
 933                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 934                                                 ldb_dn_get_linearized(msg->dn),
 935                                                 ldb_errstring(state->sam_ldb));
 936                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 937         }
 938
 939         return NT_STATUS_OK;
 940 }
 941
 942 static NTSTATUS samsync_ldb_handle_account(TALLOC_CTX *mem_ctx,
 943                                            struct samsync_ldb_state *state,
 944                                            enum netr_SamDatabaseID database,
 945                                            struct netr_DELTA_ENUM *delta,
 946                                            char **error_string)
 947 {
 948         struct dom_sid *sid = delta->delta_id_union.sid;
 949         struct netr_DELTA_ACCOUNT *account = delta->delta_union.account;
 950
 951         struct ldb_message *msg;
 952         struct ldb_message **msgs;
 953         struct ldb_dn *privilege_dn;
 954         int ret;
 955         const char *attrs[] = { NULL };
 956         int i;
 957
 958         msg = ldb_msg_new(mem_ctx);
 959         if (msg == NULL) {
 960                 return NT_STATUS_NO_MEMORY;
 961         }
 962
 963         /* search for the account, by sid, in the top basedn */
 964         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
 965                            "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
 966
 967         if (ret == -1) {
 968                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 969                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 970         } else if (ret == 0) {
 971                 NTSTATUS nt_status;
 972                 nt_status = samsync_ldb_add_foreignSecurityPrincipal(mem_ctx, state,
 973                                                                      sid,
 974                                                                      &privilege_dn,
 975                                                                      error_string);
 976                 privilege_dn = talloc_steal(msg, privilege_dn);
 977                 if (!NT_STATUS_IS_OK(nt_status)) {
 978                         return nt_status;
 979                 }
 980         } else if (ret > 1) {
 981                 *error_string = talloc_asprintf(mem_ctx, "More than one account with SID: %s",
 982                                                 dom_sid_string(mem_ctx, sid));
 983                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 984         } else {
 985                 privilege_dn = talloc_steal(msg, msgs[0]->dn);
 986         }
 987
 988         msg->dn = privilege_dn;
 989
 990         for (i=0; i< account->privilege_entries; i++) {
 991                 samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "privilege",
 992                                      account->privilege_name[i].string);
 993         }
 994
 995         ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 996         if (ret != 0) {
 997                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
 998                                                 ldb_dn_get_linearized(msg->dn));
 999                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1000         }
1001
1002         return NT_STATUS_OK;
1003 }
1004
1005 static NTSTATUS samsync_ldb_delete_account(TALLOC_CTX *mem_ctx,
1006                                            struct samsync_ldb_state *state,
1007                                            enum netr_SamDatabaseID database,
1008                                            struct netr_DELTA_ENUM *delta,
1009                                            char **error_string)
1010 {
1011         struct dom_sid *sid = delta->delta_id_union.sid;
1012
1013         struct ldb_message *msg;
1014         struct ldb_message **msgs;
1015         int ret;
1016         const char *attrs[] = { NULL };
1017
1018         msg = ldb_msg_new(mem_ctx);
1019         if (msg == NULL) {
1020                 return NT_STATUS_NO_MEMORY;
1021         }
1022
1023         /* search for the account, by sid, in the top basedn */
1024         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
1025                            "(objectSid=%s)",
1026                            ldap_encode_ndr_dom_sid(mem_ctx, sid));
1027
1028         if (ret == -1) {
1029                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
1030                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1031         } else if (ret == 0) {
1032                 return NT_STATUS_NO_SUCH_USER;
1033         } else if (ret > 1) {
1034                 *error_string = talloc_asprintf(mem_ctx, "More than one account with SID: %s",
1035                                                 dom_sid_string(mem_ctx, sid));
1036                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1037         } else {
1038                 msg->dn = talloc_steal(msg, msgs[0]->dn);
1039         }
1040
1041         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
1042                              "privilage");
1043
1044         ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
1045         if (ret != 0) {
1046                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
1047                                                 ldb_dn_get_linearized(msg->dn));
1048                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1049         }
1050
1051         return NT_STATUS_OK;
1052 }
1053
1054 static NTSTATUS libnet_samsync_ldb_fn(TALLOC_CTX *mem_ctx,
1055                                       void *private,
1056                                       enum netr_SamDatabaseID database,
1057                                       struct netr_DELTA_ENUM *delta,
1058                                       char **error_string)
1059 {
1060         NTSTATUS nt_status = NT_STATUS_OK;
1061         struct samsync_ldb_state *state = talloc_get_type(private, struct samsync_ldb_state);
1062
1063         *error_string = NULL;
1064         switch (delta->delta_type) {
1065         case NETR_DELTA_DOMAIN:
1066         {
1067                 nt_status = samsync_ldb_handle_domain(mem_ctx,
1068                                                       state,
1069                                                       database,
1070                                                       delta,
1071                                                       error_string);
1072                 break;
1073         }
1074         case NETR_DELTA_USER:
1075         {
1076                 nt_status = samsync_ldb_handle_user(mem_ctx,
1077                                                     state,
1078                                                     database,
1079                                                     delta,
1080                                                     error_string);
1081                 break;
1082         }
1083         case NETR_DELTA_DELETE_USER:
1084         {
1085                 nt_status = samsync_ldb_delete_user(mem_ctx,
1086                                                     state,
1087                                                     database,
1088                                                     delta,
1089                                                     error_string);
1090                 break;
1091         }
1092         case NETR_DELTA_GROUP:
1093         {
1094                 nt_status = samsync_ldb_handle_group(mem_ctx,
1095                                                      state,
1096                                                      database,
1097                                                      delta,
1098                                                      error_string);
1099                 break;
1100         }
1101         case NETR_DELTA_DELETE_GROUP:
1102         {
1103                 nt_status = samsync_ldb_delete_group(mem_ctx,
1104                                                      state,
1105                                                      database,
1106                                                      delta,
1107                                                      error_string);
1108                 break;
1109         }
1110         case NETR_DELTA_GROUP_MEMBER:
1111         {
1112                 nt_status = samsync_ldb_handle_group_member(mem_ctx,
1113                                                             state,
1114                                                             database,
1115                                                             delta,
1116                                                             error_string);
1117                 break;
1118         }
1119         case NETR_DELTA_ALIAS:
1120         {
1121                 nt_status = samsync_ldb_handle_alias(mem_ctx,
1122                                                      state,
1123                                                      database,
1124                                                      delta,
1125                                                      error_string);
1126                 break;
1127         }
1128         case NETR_DELTA_DELETE_ALIAS:
1129         {
1130                 nt_status = samsync_ldb_delete_alias(mem_ctx,
1131                                                      state,
1132                                                      database,
1133                                                      delta,
1134                                                      error_string);
1135                 break;
1136         }
1137         case NETR_DELTA_ALIAS_MEMBER:
1138         {
1139                 nt_status = samsync_ldb_handle_alias_member(mem_ctx,
1140                                                             state,
1141                                                             database,
1142                                                             delta,
1143                                                             error_string);
1144                 break;
1145         }
1146         case NETR_DELTA_ACCOUNT:
1147         {
1148                 nt_status = samsync_ldb_handle_account(mem_ctx,
1149                                                        state,
1150                                                        database,
1151                                                        delta,
1152                                                        error_string);
1153                 break;
1154         }
1155         case NETR_DELTA_DELETE_ACCOUNT:
1156         {
1157                 nt_status = samsync_ldb_delete_account(mem_ctx,
1158                                                        state,
1159                                                        database,
1160                                                        delta,
1161                                                        error_string);
1162                 break;
1163         }
1164         default:
1165                 /* Can't dump them all right now */
1166                 break;
1167         }
1168         if (!NT_STATUS_IS_OK(nt_status) && !*error_string) {
1169                 *error_string = talloc_asprintf(mem_ctx, "Failed to handle samsync delta: %s", nt_errstr(nt_status));
1170         }
1171         return nt_status;
1172 }
1173
1174 static NTSTATUS libnet_samsync_ldb_init(TALLOC_CTX *mem_ctx,
1175                                         void *private,
1176                                         struct libnet_SamSync_state *samsync_state,
1177                                         char **error_string)
1178 {
1179         struct samsync_ldb_state *state = talloc_get_type(private, struct samsync_ldb_state);
1180         const char *server = dcerpc_server_name(samsync_state->netlogon_pipe);
1181         char *ldap_url;
1182
1183         state->samsync_state = samsync_state;
1184
1185         ZERO_STRUCT(state->dom_sid);
1186         if (state->samsync_state->domain_sid) {
1187                 state->dom_sid[SAM_DATABASE_DOMAIN] = dom_sid_dup(state, state->samsync_state->domain_sid);
1188         }
1189
1190         state->dom_sid[SAM_DATABASE_BUILTIN] = dom_sid_parse_talloc(state, SID_BUILTIN);
1191
1192         if (state->samsync_state->realm) {
1193                 if (!server || !*server) {
1194                         /* huh?  how do we not have a server name?  */
1195                         *error_string = talloc_strdup(mem_ctx, "No DCE/RPC server name available.  How did we connect?");
1196                         return NT_STATUS_INVALID_PARAMETER;
1197                 }
1198                 ldap_url = talloc_asprintf(state, "ldap://%s", server);
1199
1200                 state->remote_ldb = ldb_wrap_connect(mem_ctx,
1201                                                      state->samsync_state->machine_net_ctx->event_ctx,
1202                                                      state->samsync_state->machine_net_ctx->lp_ctx,
1203                                                      ldap_url,
1204                                                      NULL, state->samsync_state->machine_net_ctx->cred,
1205                                                      0, NULL);
1206                 if (!state->remote_ldb) {
1207                         *error_string = talloc_asprintf(mem_ctx, "Failed to connect to remote LDAP server at %s (used to extract additional data in SamSync replication)", ldap_url);
1208                         return NT_STATUS_NO_LOGON_SERVERS;
1209                 }
1210         } else {
1211                 state->remote_ldb = NULL;
1212         }
1213         return NT_STATUS_OK;
1214 }
1215
1216 NTSTATUS libnet_samsync_ldb(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_samsync_ldb *r)
1217 {
1218         NTSTATUS nt_status;
1219         struct libnet_SamSync r2;
1220         struct samsync_ldb_state *state = talloc(mem_ctx, struct samsync_ldb_state);
1221
1222         if (!state) {
1223                 return NT_STATUS_NO_MEMORY;
1224         }
1225
1226         state->secrets         = NULL;
1227         state->trusted_domains = NULL;
1228
1229         state->sam_ldb         = samdb_connect(mem_ctx,
1230                                                ctx->event_ctx,
1231                                                ctx->lp_ctx,
1232                                                r->in.session_info);
1233
1234         r2.out.error_string    = NULL;
1235         r2.in.binding_string   = r->in.binding_string;
1236         r2.in.rid_crypt        = true;
1237         r2.in.init_fn          = libnet_samsync_ldb_init;
1238         r2.in.delta_fn         = libnet_samsync_ldb_fn;
1239         r2.in.fn_ctx           = state;
1240         r2.in.machine_account  = NULL; /* TODO:  Create a machine account, fill this in, and the delete it */
1241         nt_status              = libnet_SamSync_netlogon(ctx, state, &r2);
1242         r->out.error_string    = r2.out.error_string;
1243         talloc_steal(mem_ctx, r->out.error_string);
1244
1245         if (!NT_STATUS_IS_OK(nt_status)) {
1246                 talloc_free(state);
1247                 return nt_status;
1248         }
1249         talloc_free(state);
1250         return nt_status;
1251 }