source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "libcli/composite/composite.h"
  23 #include "libcli/cldap/cldap.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_errors.h"
  26 #include "lib/ldb_wrap.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "dsdb/common/flags.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "librpc/gen_ndr/ndr_security.h"
  33 #include "librpc/gen_ndr/ndr_nbt.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "param/param.h"
  37
  38 /*****************************************************************************
  39  * Windows 2003 (w2k3) does the following steps when changing the server role
  40  * from domain member to domain controller
  41  *
  42  * We mostly do the same.
  43  *****************************************************************************/
  44
  45 /*
  46  * lookup DC:
  47  * - using nbt name<1C> request and a samlogon mailslot request
  48  * or
  49  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
  50  *
  51  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
  52  */
  53
  54 /*
  55  * Open 1st LDAP connection to the DC using admin credentials
  56  *
  57  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
  58  */
  59
  60 /*
  61  * LDAP search 1st LDAP connection:
  62  *
  63  * see: becomeDC_ldap1_rootdse()
  64  *
  65  * Request:
  66  *      basedn: ""
  67  *      scope:  base
  68  *      filter: (objectClass=*)
  69  *      attrs:  *
  70  * Result:
  71  *      ""
  72  *              currentTime:            20061202155100.0Z
  73  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
  74  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  75  *              namingContexts:         <domain_partition>
  76  *                                      CN=Configuration,<domain_partition>
  77  *                                      CN=Schema,CN=Configuration,<domain_partition>
  78  *              defaultNamingContext:   <domain_partition>
  79  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
  80  *              configurationNamingContext:CN=Configuration,<domain_partition>
  81  *              rootDomainNamingContext:<domain_partition>
  82  *              supportedControl:       ...
  83  *              supportedLDAPVersion:   3
  84  *                                      2
  85  *              supportedLDAPPolicies:  ...
  86  *              highestCommitedUSN:     ...
  87  *              supportedSASLMechanisms:GSSAPI
  88  *                                      GSS-SPNEGO
  89  *                                      EXTERNAL
  90  *                                      DIGEST-MD5
  91  *              dnsHostName:            <dns_host_name>
  92  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
  93  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  94  *              supportedCapabilities:  ...
  95  *              isSyncronized:          TRUE
  96  *              isGlobalCatalogReady:   TRUE
  97  *              domainFunctionality:    0
  98  *              forestFunctionality:    0
  99  *              domainControllerFunctionality: 2
 100  */
 101
 102 /*
 103  * LDAP search 1st LDAP connection:
 104  *
 105  * see: becomeDC_ldap1_crossref_behavior_version()
 106  *
 107  * Request:
 108  *      basedn: CN=Configuration,<domain_partition>
 109  *      scope:  one
 110  *      filter: (cn=Partitions)
 111  *      attrs:  msDS-Behavior-Version
 112  * Result:
 113  *      CN=Partitions,CN=Configuration,<domain_partition>
 114  *              msDS-Behavior-Version:  0
 115  */
 116
 117 /*
 118  * LDAP search 1st LDAP connection:
 119  *
 120  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 121  *
 122  * not implemented here
 123  *
 124  * Request:
 125  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 126  *      scope:  one
 127  *      filter: (cn=Partitions)
 128  *      attrs:  msDS-Behavior-Version
 129  * Result:
 130  *      <none>
 131  *
 132  */
 133
 134 /*
 135  * LDAP search 1st LDAP connection:
 136  *
 137  * see: becomeDC_ldap1_domain_behavior_version()
 138  *
 139  * Request:
 140  *      basedn: <domain_partition>
 141  *      scope:  base
 142  *      filter: (objectClass=*)
 143  *      attrs:  msDS-Behavior-Version
 144  * Result:
 145  *      <domain_partition>
 146  *              msDS-Behavior-Version:  0
 147  */
 148
 149 /*
 150  * LDAP search 1st LDAP connection:
 151  *
 152  * see: becomeDC_ldap1_schema_object_version()
 153  *
 154  * Request:
 155  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 156  *      scope:  base
 157  *      filter: (objectClass=*)
 158  *      attrs:  objectVersion
 159  * Result:
 160  *      CN=Schema,CN=Configuration,<domain_partition>
 161  *              objectVersion:  30
 162  */
 163
 164 /*
 165  * LDAP search 1st LDAP connection:
 166  *
 167  * not implemented, because the information is already there
 168  *
 169  * Request:
 170  *      basedn: ""
 171  *      scope:  base
 172  *      filter: (objectClass=*)
 173  *      attrs:  defaultNamingContext
 174  *              dnsHostName
 175  * Result:
 176  *      ""
 177  *              defaultNamingContext:   <domain_partition>
 178  *              dnsHostName:            <dns_host_name>
 179  */
 180
 181 /*
 182  * LDAP search 1st LDAP connection:
 183  *
 184  * see: becomeDC_ldap1_infrastructure_fsmo()
 185  *
 186  * Request:
 187  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 188  *      scope:  base
 189  *      filter: (objectClass=*)
 190  *      attrs:  1.1
 191  * Result:
 192  *      CN=Infrastructure,<domain_partition>
 193  */
 194
 195 /*
 196  * LDAP search 1st LDAP connection:
 197  *
 198  * see: becomeDC_ldap1_w2k3_update_revision()
 199  *
 200  * Request:
 201  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 202  *      scope:  base
 203  *      filter: (objectClass=*)
 204  *      attrs:  revision
 205  * Result:
 206  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 207  *              revision:       8
 208  */
 209
 210 /*
 211  * LDAP search 1st LDAP connection:
 212  *
 213  * see: becomeDC_ldap1_infrastructure_fsmo()
 214  *
 215  * Request:
 216  *      basedn: CN=Infrastructure,<domain_partition>
 217  *      scope:  base
 218  *      filter: (objectClass=*)
 219  *      attrs:  fSMORoleOwner
 220  * Result:
 221  *      CN=Infrastructure,<domain_partition>
 222  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 223  */
 224
 225 /*
 226  * LDAP search 1st LDAP connection:
 227  *
 228  * see: becomeDC_ldap1_infrastructure_fsmo()
 229  *
 230  * Request:
 231  *      basedn: <infrastructure_fsmo_server_object>
 232  *      scope:  base
 233  *      filter: (objectClass=*)
 234  *      attrs:  dnsHostName
 235  * Result:
 236  *      <infrastructure_fsmo_server_object>
 237  *              dnsHostName:    <dns_host_name>
 238  */
 239
 240 /*
 241  * LDAP search 1st LDAP connection:
 242  *
 243  * see: becomeDC_ldap1_infrastructure_fsmo()
 244  *
 245  * Request:
 246  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 247  *      scope:  base
 248  *      filter: (objectClass=*)
 249  *      attrs:  objectGUID
 250  * Result:
 251  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 252  *              objectGUID:     <object_guid>
 253  */
 254
 255 /*
 256  * LDAP search 1st LDAP connection:
 257  *
 258  * see: becomeDC_ldap1_rid_manager_fsmo()
 259  *
 260  * Request:
 261  *      basedn: <domain_partition>
 262  *      scope:  base
 263  *      filter: (objectClass=*)
 264  *      attrs:  rIDManagerReference
 265  * Result:
 266  *      <domain_partition>
 267  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 268  */
 269
 270 /*
 271  * LDAP search 1st LDAP connection:
 272  *
 273  * see: becomeDC_ldap1_rid_manager_fsmo()
 274  *
 275  * Request:
 276  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 277  *      scope:  base
 278  *      filter: (objectClass=*)
 279  *      attrs:  fSMORoleOwner
 280  * Result:
 281  *      CN=Infrastructure,<domain_partition>
 282  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 283  */
 284
 285 /*
 286  * LDAP search 1st LDAP connection:
 287  *
 288  * see: becomeDC_ldap1_rid_manager_fsmo()
 289  *
 290  * Request:
 291  *      basedn: <rid_manager_fsmo_server_object>
 292  *      scope:  base
 293  *      filter: (objectClass=*)
 294  *      attrs:  dnsHostName
 295  * Result:
 296  *      <rid_manager_fsmo_server_object>
 297  *              dnsHostName:    <dns_host_name>
 298  */
 299
 300 /*
 301  * LDAP search 1st LDAP connection:
 302  *
 303  * see: becomeDC_ldap1_rid_manager_fsmo()
 304  *
 305  * Request:
 306  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 307  *      scope:  base
 308  *      filter: (objectClass=*)
 309  *      attrs:  msDs-ReplicationEpoch
 310  * Result:
 311  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 312  */
 313
 314 /*
 315  * LDAP search 1st LDAP connection:
 316  *
 317  * see: becomeDC_ldap1_site_object()
 318  *
 319  * Request:
 320  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 321  *      scope:  base
 322  *      filter: (objectClass=*)
 323  *      attrs:
 324  * Result:
 325  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 326  *              objectClass:    top
 327  *                              site
 328  *              cn:             <new_dc_site_name>
 329  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 330  *              instanceType:   4
 331  *              whenCreated:    ...
 332  *              whenChanged:    ...
 333  *              uSNCreated:     ...
 334  *              uSNChanged:     ...
 335  *              showInAdvancedViewOnly: TRUE
 336  *              name:           <new_dc_site_name>
 337  *              objectGUID:     <object_guid>
 338  *              systemFlags:    1107296256 <0x42000000>
 339  *              objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
 340  */
 341
 342 /***************************************************************
 343  * Add this stage we call the check_options() callback function
 344  * of the caller, to see if he wants us to continue
 345  *
 346  * see: becomeDC_check_options()
 347  ***************************************************************/
 348
 349 /*
 350  * LDAP search 1st LDAP connection:
 351  *
 352  * see: becomeDC_ldap1_computer_object()
 353  *
 354  * Request:
 355  *      basedn: <domain_partition>
 356  *      scope:  sub
 357  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 358  *      attrs:  distinguishedName
 359  *              userAccountControl
 360  * Result:
 361  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 362  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 363  *              userAccoountControl:    4096 <0x1000>
 364  */
 365
 366 /*
 367  * LDAP search 1st LDAP connection:
 368  *
 369  * see: becomeDC_ldap1_server_object_1()
 370  *
 371  * Request:
 372  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 373  *      scope:  base
 374  *      filter: (objectClass=*)
 375  *      attrs:
 376  * Result:
 377  *      <noSuchObject>
 378  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 379  */
 380
 381 /*
 382  * LDAP search 1st LDAP connection:
 383  *
 384  * see: becomeDC_ldap1_server_object_2()
 385  *
 386  * Request:
 387  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 388  *      scope:  base
 389  *      filter: (objectClass=*)
 390  *      attrs:  serverReferenceBL
 391  *      typesOnly: TRUE!!!
 392  * Result:
 393  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 394  */
 395
 396 /*
 397  * LDAP add 1st LDAP connection:
 398  *
 399  * see: becomeDC_ldap1_server_object_add()
 400  *
 401  * Request:
 402  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 403  *      objectClass:    server
 404  *      systemFlags:    50000000 <0x2FAF080>
 405  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 406  * Result:
 407  *      <success>
 408  */
 409
 410 /*
 411  * LDAP search 1st LDAP connection:
 412  *
 413  * not implemented, maybe we can add that later
 414  *
 415  * Request:
 416  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 417  *      scope:  base
 418  *      filter: (objectClass=*)
 419  *      attrs:
 420  * Result:
 421  *      <noSuchObject>
 422  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 423  */
 424
 425 /*
 426  * LDAP search 1st LDAP connection:
 427  *
 428  * not implemented because it gives no new information
 429  *
 430  * Request:
 431  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 432  *      scope:  sub
 433  *      filter: (nCName=<domain_partition>)
 434  *      attrs:  nCName
 435  *              dnsRoot
 436  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 437  * Result:
 438  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 439  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 440  *              dnsRoot:        <domain_dns_name>
 441  */
 442
 443 /*
 444  * LDAP modify 1st LDAP connection:
 445  *
 446  * see: becomeDC_ldap1_server_object_modify()
 447  *
 448  * Request (add):
 449  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 450  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 451  * Result:
 452  *      <attributeOrValueExist>
 453  */
 454
 455 /*
 456  * LDAP modify 1st LDAP connection:
 457  *
 458  * see: becomeDC_ldap1_server_object_modify()
 459  *
 460  * Request (replace):
 461  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 462  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 463  * Result:
 464  *      <success>
 465  */
 466
 467 /*
 468  * Open 1st DRSUAPI connection to the DC using admin credentials
 469  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 470  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 471  *
 472  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
 473  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
 474  */
 475
 476 /*
 477  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 478  * on the 1st DRSUAPI connection
 479  *
 480  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
 481  */
 482
 483 /***************************************************************
 484  * Add this stage we call the prepare_db() callback function
 485  * of the caller, to see if he wants us to continue
 486  *
 487  * see: becomeDC_prepare_db()
 488  ***************************************************************/
 489
 490 /*
 491  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 492  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 493  *   on the 2nd connection
 494  *
 495  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
 496  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
 497  *      and becomeDC_drsuapi3_connect_recv()
 498  */
 499
 500 /*
 501  * replicate CN=Schema,CN=Configuration,...
 502  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 503  *
 504  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 505  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
 506  *
 507  ***************************************************************
 508  * Add this stage we call the schema_chunk() callback function
 509  * for each replication message
 510  ***************************************************************/
 511
 512 /*
 513  * replicate CN=Configuration,...
 514  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 515  *
 516  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 517  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
 518  *
 519  ***************************************************************
 520  * Add this stage we call the config_chunk() callback function
 521  * for each replication message
 522  ***************************************************************/
 523
 524 /*
 525  * LDAP unbind on the 1st LDAP connection
 526  *
 527  * not implemented, because it's not needed...
 528  */
 529
 530 /*
 531  * Open 2nd LDAP connection to the DC using admin credentials
 532  *
 533  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
 534  */
 535
 536 /*
 537  * LDAP search 2nd LDAP connection:
 538  *
 539  * not implemented because it gives no new information
 540  * same as becomeDC_ldap1_computer_object()
 541  *
 542  * Request:
 543  *      basedn: <domain_partition>
 544  *      scope:  sub
 545  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 546  *      attrs:  distinguishedName
 547  *              userAccountControl
 548  * Result:
 549  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 550  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 551  *              userAccoountControl:    4096 <0x00001000>
 552  */
 553
 554 /*
 555  * LDAP search 2nd LDAP connection:
 556  *
 557  * not implemented because it gives no new information
 558  * same as becomeDC_ldap1_computer_object()
 559  *
 560  * Request:
 561  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 562  *      scope:  base
 563  *      filter: (objectClass=*)
 564  *      attrs:  userAccountControl
 565  * Result:
 566  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 567  *              userAccoountControl:    4096 <0x00001000>
 568  */
 569
 570 /*
 571  * LDAP modify 2nd LDAP connection:
 572  *
 573  * see: becomeDC_ldap2_modify_computer()
 574  *
 575  * Request (replace):
 576  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 577  *      userAccoountControl:    532480 <0x82000>
 578  * Result:
 579  *      <success>
 580  */
 581
 582 /*
 583  * LDAP search 2nd LDAP connection:
 584  *
 585  * see: becomeDC_ldap2_move_computer()
 586  *
 587  * Request:
 588  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
 589  *      scope:  base
 590  *      filter: (objectClass=*)
 591  *      attrs:  1.1
 592  * Result:
 593  *      CN=Domain Controllers,<domain_partition>
 594  */
 595
 596 /*
 597  * LDAP search 2nd LDAP connection:
 598  *
 599  * not implemented because it gives no new information
 600  *
 601  * Request:
 602  *      basedn: CN=Domain Controllers,<domain_partition>
 603  *      scope:  base
 604  *      filter: (objectClass=*)
 605  *      attrs:  distinguishedName
 606  * Result:
 607  *      CN=Domain Controller,<domain_partition>
 608  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
 609  */
 610
 611 /*
 612  * LDAP modifyRDN 2nd LDAP connection:
 613  *
 614  * see: becomeDC_ldap2_move_computer()
 615  *
 616  * Request:
 617  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 618  *      newrdn:         CN=<new_dc_netbios_name>
 619  *      deleteoldrdn:   TRUE
 620  *      newparent:      CN=Domain Controllers,<domain_partition>
 621  * Result:
 622  *      <success>
 623  */
 624
 625 /*
 626  * LDAP unbind on the 2nd LDAP connection
 627  *
 628  * not implemented, because it's not needed...
 629  */
 630
 631 /*
 632  * replicate Domain Partition
 633  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 634  *
 635  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 636  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
 637  *
 638  ***************************************************************
 639  * Add this stage we call the domain_chunk() callback function
 640  * for each replication message
 641  ***************************************************************/
 642
 643 /* call DsReplicaUpdateRefs() for all partitions like this:
 644  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 645  *
 646  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 647  *                     __ndr_size               : 0x000000ae (174)
 648  *                     __ndr_size_sid           : 0x00000000 (0)
 649  *                     guid                     : 00000000-0000-0000-0000-000000000000
 650  *                     sid                      : S-0-0
 651  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 652  *
 653  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 654  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 655  *           options                  : 0x0000001c (28)
 656  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 658  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 661  *
 662  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 663  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 664  * on the 2nd!!! DRSUAPI connection
 665  *
 666  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
 667  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
 668  */
 669
 670 /*
 671  * Windows does opens the 4th and 5th DRSUAPI connection...
 672  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
 673  * on the 4th connection
 674  *
 675  * and then 2 full replications of the domain partition on the 5th connection
 676  * with the bind_handle from the 4th connection
 677  *
 678  * not implemented because it gives no new information
 679  */
 680
 681 struct libnet_BecomeDC_state {
 682         struct composite_context *creq;
 683
 684         struct libnet_context *libnet;
 685
 686         struct dom_sid zero_sid;
 687
 688         struct {
 689                 struct cldap_socket *sock;
 690                 struct cldap_netlogon io;
 691                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
 692         } cldap;
 693
 694         struct becomeDC_ldap {
 695                 struct ldb_context *ldb;
 696                 const struct ldb_message *rootdse;
 697         } ldap1, ldap2;
 698
 699         struct becomeDC_drsuapi {
 700                 struct libnet_BecomeDC_state *s;
 701                 struct dcerpc_binding *binding;
 702                 struct dcerpc_pipe *pipe;
 703                 DATA_BLOB gensec_skey;
 704                 struct drsuapi_DsBind bind_r;
 705                 struct GUID bind_guid;
 706                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
 707                 struct drsuapi_DsBindInfo28 local_info28;
 708                 struct drsuapi_DsBindInfo28 remote_info28;
 709                 struct policy_handle bind_handle;
 710         } drsuapi1, drsuapi2, drsuapi3;
 711
 712         struct libnet_BecomeDC_Domain domain;
 713         struct libnet_BecomeDC_Forest forest;
 714         struct libnet_BecomeDC_SourceDSA source_dsa;
 715         struct libnet_BecomeDC_DestDSA dest_dsa;
 716
 717         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
 718
 719         struct becomeDC_fsmo {
 720                 const char *dns_name;
 721                 const char *server_dn_str;
 722                 const char *ntds_dn_str;
 723                 struct GUID ntds_guid;
 724         } infrastructure_fsmo;
 725
 726         struct becomeDC_fsmo rid_manager_fsmo;
 727
 728         struct libnet_BecomeDC_CheckOptions _co;
 729         struct libnet_BecomeDC_PrepareDB _pp;
 730         struct libnet_BecomeDC_StoreChunk _sc;
 731         struct libnet_BecomeDC_Callbacks callbacks;
 732 };
 733
 734 static void becomeDC_recv_cldap(struct cldap_request *req);
 735
 736 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 737 {
 738         struct composite_context *c = s->creq;
 739         struct cldap_request *req;
 740
 741         s->cldap.io.in.dest_address     = s->source_dsa.address;
 742         s->cldap.io.in.dest_port        = lp_cldap_port(s->libnet->lp_ctx);
 743         s->cldap.io.in.realm            = s->domain.dns_name;
 744         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 745         s->cldap.io.in.user             = NULL;
 746         s->cldap.io.in.domain_guid      = NULL;
 747         s->cldap.io.in.domain_sid       = NULL;
 748         s->cldap.io.in.acct_control     = -1;
 749         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 750         s->cldap.io.in.map_response     = true;
 751
 752         s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx,
 753                                           lp_iconv_convenience(s->libnet->lp_ctx));
 754         if (composite_nomem(s->cldap.sock, c)) return;
 755
 756         req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
 757         if (composite_nomem(req, c)) return;
 758         req->async.fn           = becomeDC_recv_cldap;
 759         req->async.private      = s;
 760 }
 761
 762 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 763
 764 static void becomeDC_recv_cldap(struct cldap_request *req)
 765 {
 766         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private,
 767                                           struct libnet_BecomeDC_state);
 768         struct composite_context *c = s->creq;
 769
 770         c->status = cldap_netlogon_recv(req, s, &s->cldap.io);
 771         if (!composite_is_ok(c)) return;
 772
 773         s->cldap.netlogon = s->cldap.io.out.netlogon.nt5_ex;
 774
 775         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
 776         s->domain.netbios_name          = s->cldap.netlogon.domain;
 777         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
 778
 779         s->forest.dns_name              = s->cldap.netlogon.forest;
 780
 781         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
 782         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
 783         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
 784
 785         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
 786
 787         becomeDC_connect_ldap1(s);
 788 }
 789
 790 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
 791                                       struct becomeDC_ldap *ldap)
 792 {
 793         char *url;
 794
 795         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 796         NT_STATUS_HAVE_NO_MEMORY(url);
 797
 798         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
 799                                      NULL,
 800                                      s->libnet->cred,
 801                                      0, NULL);
 802         talloc_free(url);
 803         if (ldap->ldb == NULL) {
 804                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 805         }
 806
 807         return NT_STATUS_OK;
 808 }
 809
 810 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 811 {
 812         int ret;
 813         struct ldb_result *r;
 814         struct ldb_dn *basedn;
 815         static const char *attrs[] = {
 816                 "*",
 817                 NULL
 818         };
 819
 820         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 821         NT_STATUS_HAVE_NO_MEMORY(basedn);
 822
 823         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 824                          "(objectClass=*)", attrs, &r);
 825         talloc_free(basedn);
 826         if (ret != LDB_SUCCESS) {
 827                 return NT_STATUS_LDAP(ret);
 828         } else if (r->count != 1) {
 829                 talloc_free(r);
 830                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 831         }
 832         talloc_steal(s, r);
 833
 834         s->ldap1.rootdse = r->msgs[0];
 835
 836         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 837         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 838
 839         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 840         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 841         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 842         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 843         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 844         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 845
 846         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 847         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 848         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 849         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 850
 851         return NT_STATUS_OK;
 852 }
 853
 854 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
 855 {
 856         int ret;
 857         struct ldb_result *r;
 858         struct ldb_dn *basedn;
 859         static const char *attrs[] = {
 860                 "msDs-Behavior-Version",
 861                 NULL
 862         };
 863
 864         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 865         NT_STATUS_HAVE_NO_MEMORY(basedn);
 866
 867         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_ONELEVEL,
 868                          "(cn=Partitions)", attrs, &r);
 869         talloc_free(basedn);
 870         if (ret != LDB_SUCCESS) {
 871                 return NT_STATUS_LDAP(ret);
 872         } else if (r->count != 1) {
 873                 talloc_free(r);
 874                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 875         }
 876
 877         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 878
 879         talloc_free(r);
 880         return NT_STATUS_OK;
 881 }
 882
 883 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 884 {
 885         int ret;
 886         struct ldb_result *r;
 887         struct ldb_dn *basedn;
 888         static const char *attrs[] = {
 889                 "msDs-Behavior-Version",
 890                 NULL
 891         };
 892
 893         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 894         NT_STATUS_HAVE_NO_MEMORY(basedn);
 895
 896         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 897                          "(objectClass=*)", attrs, &r);
 898         talloc_free(basedn);
 899         if (ret != LDB_SUCCESS) {
 900                 return NT_STATUS_LDAP(ret);
 901         } else if (r->count != 1) {
 902                 talloc_free(r);
 903                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 904         }
 905
 906         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 907
 908         talloc_free(r);
 909         return NT_STATUS_OK;
 910 }
 911
 912 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 913 {
 914         int ret;
 915         struct ldb_result *r;
 916         struct ldb_dn *basedn;
 917         static const char *attrs[] = {
 918                 "objectVersion",
 919                 NULL
 920         };
 921
 922         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 923         NT_STATUS_HAVE_NO_MEMORY(basedn);
 924
 925         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 926                          "(objectClass=*)", attrs, &r);
 927         talloc_free(basedn);
 928         if (ret != LDB_SUCCESS) {
 929                 return NT_STATUS_LDAP(ret);
 930         } else if (r->count != 1) {
 931                 talloc_free(r);
 932                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 933         }
 934
 935         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
 936
 937         talloc_free(r);
 938         return NT_STATUS_OK;
 939 }
 940
 941 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
 942 {
 943         int ret;
 944         struct ldb_result *r;
 945         struct ldb_dn *basedn;
 946         static const char *attrs[] = {
 947                 "revision",
 948                 NULL
 949         };
 950
 951         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
 952                                 s->domain.dn_str);
 953         NT_STATUS_HAVE_NO_MEMORY(basedn);
 954
 955         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
 956                          "(objectClass=*)", attrs, &r);
 957         talloc_free(basedn);
 958         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 959                 /* w2k doesn't have this object */
 960                 s->domain.w2k3_update_revision = 0;
 961                 return NT_STATUS_OK;
 962         } else if (ret != LDB_SUCCESS) {
 963                 return NT_STATUS_LDAP(ret);
 964         } else if (r->count != 1) {
 965                 talloc_free(r);
 966                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 967         }
 968
 969         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
 970
 971         talloc_free(r);
 972         return NT_STATUS_OK;
 973 }
 974
 975 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
 976 {
 977         int ret;
 978         struct ldb_result *r;
 979         struct ldb_dn *basedn;
 980         struct ldb_dn *ntds_dn;
 981         struct ldb_dn *server_dn;
 982         static const char *_1_1_attrs[] = {
 983                 "1.1",
 984                 NULL
 985         };
 986         static const char *fsmo_attrs[] = {
 987                 "fSMORoleOwner",
 988                 NULL
 989         };
 990         static const char *dns_attrs[] = {
 991                 "dnsHostName",
 992                 NULL
 993         };
 994         static const char *guid_attrs[] = {
 995                 "objectGUID",
 996                 NULL
 997         };
 998
 999         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "<WKGUID=2fbac1870ade11d297c400c04fd8d5cd,%s>",
1000                                 s->domain.dn_str);
1001         NT_STATUS_HAVE_NO_MEMORY(basedn);
1002
1003         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1004                          "(objectClass=*)", _1_1_attrs, &r);
1005         talloc_free(basedn);
1006         if (ret != LDB_SUCCESS) {
1007                 return NT_STATUS_LDAP(ret);
1008         } else if (r->count != 1) {
1009                 talloc_free(r);
1010                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1011         }
1012
1013         basedn = talloc_steal(s, r->msgs[0]->dn);
1014         talloc_free(r);
1015
1016         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1017                          "(objectClass=*)", fsmo_attrs, &r);
1018         talloc_free(basedn);
1019         if (ret != LDB_SUCCESS) {
1020                 return NT_STATUS_LDAP(ret);
1021         } else if (r->count != 1) {
1022                 talloc_free(r);
1023                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1024         }
1025
1026         s->infrastructure_fsmo.ntds_dn_str      = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1027         if (!s->infrastructure_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1028         talloc_steal(s, s->infrastructure_fsmo.ntds_dn_str);
1029
1030         talloc_free(r);
1031
1032         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->infrastructure_fsmo.ntds_dn_str);
1033         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1034
1035         server_dn = ldb_dn_get_parent(s, ntds_dn);
1036         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1037
1038         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1039         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1040
1041         ret = ldb_search(s->ldap1.ldb, server_dn, LDB_SCOPE_BASE,
1042                          "(objectClass=*)", dns_attrs, &r);
1043         if (ret != LDB_SUCCESS) {
1044                 return NT_STATUS_LDAP(ret);
1045         } else if (r->count != 1) {
1046                 talloc_free(r);
1047                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1048         }
1049
1050         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1051         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1052         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1053
1054         talloc_free(r);
1055
1056         ret = ldb_search(s->ldap1.ldb, ntds_dn, LDB_SCOPE_BASE,
1057                          "(objectClass=*)", guid_attrs, &r);
1058         if (ret != LDB_SUCCESS) {
1059                 return NT_STATUS_LDAP(ret);
1060         } else if (r->count != 1) {
1061                 talloc_free(r);
1062                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1063         }
1064
1065         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1066
1067         talloc_free(r);
1068
1069         return NT_STATUS_OK;
1070 }
1071
1072 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1073 {
1074         int ret;
1075         struct ldb_result *r;
1076         struct ldb_dn *basedn;
1077         const char *reference_dn_str;
1078         struct ldb_dn *ntds_dn;
1079         struct ldb_dn *server_dn;
1080         static const char *rid_attrs[] = {
1081                 "rIDManagerReference",
1082                 NULL
1083         };
1084         static const char *fsmo_attrs[] = {
1085                 "fSMORoleOwner",
1086                 NULL
1087         };
1088         static const char *dns_attrs[] = {
1089                 "dnsHostName",
1090                 NULL
1091         };
1092         static const char *guid_attrs[] = {
1093                 "objectGUID",
1094                 NULL
1095         };
1096
1097         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1098         NT_STATUS_HAVE_NO_MEMORY(basedn);
1099
1100         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1101                          "(objectClass=*)", rid_attrs, &r);
1102         talloc_free(basedn);
1103         if (ret != LDB_SUCCESS) {
1104                 return NT_STATUS_LDAP(ret);
1105         } else if (r->count != 1) {
1106                 talloc_free(r);
1107                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1108         }
1109
1110         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1111         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1112
1113         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1114         NT_STATUS_HAVE_NO_MEMORY(basedn);
1115
1116         talloc_free(r);
1117
1118         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1119                          "(objectClass=*)", fsmo_attrs, &r);
1120         talloc_free(basedn);
1121         if (ret != LDB_SUCCESS) {
1122                 return NT_STATUS_LDAP(ret);
1123         } else if (r->count != 1) {
1124                 talloc_free(r);
1125                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1126         }
1127
1128         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1129         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1130         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1131
1132         talloc_free(r);
1133
1134         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1135         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1136
1137         server_dn = ldb_dn_get_parent(s, ntds_dn);
1138         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1139
1140         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1141         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1142
1143         ret = ldb_search(s->ldap1.ldb, server_dn, LDB_SCOPE_BASE,
1144                          "(objectClass=*)", dns_attrs, &r);
1145         if (ret != LDB_SUCCESS) {
1146                 return NT_STATUS_LDAP(ret);
1147         } else if (r->count != 1) {
1148                 talloc_free(r);
1149                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1150         }
1151
1152         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1153         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1154         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1155
1156         talloc_free(r);
1157
1158         ret = ldb_search(s->ldap1.ldb, ntds_dn, LDB_SCOPE_BASE,
1159                          "(objectClass=*)", guid_attrs, &r);
1160         if (ret != LDB_SUCCESS) {
1161                 return NT_STATUS_LDAP(ret);
1162         } else if (r->count != 1) {
1163                 talloc_free(r);
1164                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1165         }
1166
1167         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1168
1169         talloc_free(r);
1170
1171         return NT_STATUS_OK;
1172 }
1173
1174 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1175 {
1176         int ret;
1177         struct ldb_result *r;
1178         struct ldb_dn *basedn;
1179
1180         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1181                                 s->dest_dsa.site_name,
1182                                 s->forest.config_dn_str);
1183         NT_STATUS_HAVE_NO_MEMORY(basedn);
1184
1185         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1186                          "(objectClass=*)", NULL, &r);
1187         talloc_free(basedn);
1188         if (ret != LDB_SUCCESS) {
1189                 return NT_STATUS_LDAP(ret);
1190         } else if (r->count != 1) {
1191                 talloc_free(r);
1192                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1193         }
1194
1195         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1196
1197         talloc_free(r);
1198         return NT_STATUS_OK;
1199 }
1200
1201 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1202 {
1203         if (!s->callbacks.check_options) return NT_STATUS_OK;
1204
1205         s->_co.domain           = &s->domain;
1206         s->_co.forest           = &s->forest;
1207         s->_co.source_dsa       = &s->source_dsa;
1208
1209         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1210 }
1211
1212 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1213 {
1214         int ret;
1215         struct ldb_result *r;
1216         struct ldb_dn *basedn;
1217         char *filter;
1218         static const char *attrs[] = {
1219                 "distinguishedName",
1220                 "userAccountControl",
1221                 NULL
1222         };
1223
1224         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1225         NT_STATUS_HAVE_NO_MEMORY(basedn);
1226
1227         filter = talloc_asprintf(basedn, "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1228                                  s->dest_dsa.netbios_name);
1229         NT_STATUS_HAVE_NO_MEMORY(filter);
1230
1231         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_SUBTREE,
1232                          filter, attrs, &r);
1233         talloc_free(basedn);
1234         if (ret != LDB_SUCCESS) {
1235                 return NT_STATUS_LDAP(ret);
1236         } else if (r->count != 1) {
1237                 talloc_free(r);
1238                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1239         }
1240
1241         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1242         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1243         talloc_steal(s, s->dest_dsa.computer_dn_str);
1244
1245         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1246
1247         talloc_free(r);
1248         return NT_STATUS_OK;
1249 }
1250
1251 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1252 {
1253         int ret;
1254         struct ldb_result *r;
1255         struct ldb_dn *basedn;
1256         const char *server_reference_dn_str;
1257         struct ldb_dn *server_reference_dn;
1258         struct ldb_dn *computer_dn;
1259
1260         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1261                                 s->dest_dsa.netbios_name,
1262                                 s->dest_dsa.site_name,
1263                                 s->forest.config_dn_str);
1264         NT_STATUS_HAVE_NO_MEMORY(basedn);
1265
1266         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1267                          "(objectClass=*)", NULL, &r);
1268         talloc_free(basedn);
1269         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1270                 /* if the object doesn't exist, we'll create it later */
1271                 return NT_STATUS_OK;
1272         } else if (ret != LDB_SUCCESS) {
1273                 return NT_STATUS_LDAP(ret);
1274         } else if (r->count != 1) {
1275                 talloc_free(r);
1276                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1277         }
1278
1279         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1280         if (server_reference_dn_str) {
1281                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1282                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1283
1284                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1285                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1286
1287                 /*
1288                  * if the server object belongs to another DC in another domain in the forest,
1289                  * we should not touch this object!
1290                  */
1291                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1292                         talloc_free(r);
1293                         return NT_STATUS_OBJECT_NAME_COLLISION;
1294                 }
1295         }
1296
1297         /* if the server object is already for the dest_dsa, then we don't need to create it */
1298         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1299         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1300         talloc_steal(s, s->dest_dsa.server_dn_str);
1301
1302         talloc_free(r);
1303         return NT_STATUS_OK;
1304 }
1305
1306 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1307 {
1308         int ret;
1309         struct ldb_result *r;
1310         struct ldb_dn *basedn;
1311         const char *server_reference_bl_dn_str;
1312         static const char *attrs[] = {
1313                 "serverReferenceBL",
1314                 NULL
1315         };
1316
1317         /* if the server_dn_str has a valid value, we skip this lookup */
1318         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1319
1320         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1321         NT_STATUS_HAVE_NO_MEMORY(basedn);
1322
1323         ret = ldb_search(s->ldap1.ldb, basedn, LDB_SCOPE_BASE,
1324                          "(objectClass=*)", attrs, &r);
1325         talloc_free(basedn);
1326         if (ret != LDB_SUCCESS) {
1327                 return NT_STATUS_LDAP(ret);
1328         } else if (r->count != 1) {
1329                 talloc_free(r);
1330                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1331         }
1332
1333         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1334         if (!server_reference_bl_dn_str) {
1335                 /* if no back link is present, we're done for this function */
1336                 talloc_free(r);
1337                 return NT_STATUS_OK;
1338         }
1339
1340         /* if the server object is already for the dest_dsa, then we don't need to create it */
1341         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1342         if (s->dest_dsa.server_dn_str) {
1343                 /* if a back link is present, we know that the server object is present */
1344                 talloc_steal(s, s->dest_dsa.server_dn_str);
1345         }
1346
1347         talloc_free(r);
1348         return NT_STATUS_OK;
1349 }
1350
1351 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1352 {
1353         int ret;
1354         struct ldb_message *msg;
1355         char *server_dn_str;
1356
1357         /* if the server_dn_str has a valid value, we skip this lookup */
1358         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1359
1360         msg = ldb_msg_new(s);
1361         NT_STATUS_HAVE_NO_MEMORY(msg);
1362
1363         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1364                                  s->dest_dsa.netbios_name,
1365                                  s->dest_dsa.site_name,
1366                                  s->forest.config_dn_str);
1367         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1368
1369         ret = ldb_msg_add_string(msg, "objectClass", "server");
1370         if (ret != 0) {
1371                 talloc_free(msg);
1372                 return NT_STATUS_NO_MEMORY;
1373         }
1374         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1375         if (ret != 0) {
1376                 talloc_free(msg);
1377                 return NT_STATUS_NO_MEMORY;
1378         }
1379         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1380         if (ret != 0) {
1381                 talloc_free(msg);
1382                 return NT_STATUS_NO_MEMORY;
1383         }
1384
1385         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1386         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1387
1388         ret = ldb_add(s->ldap1.ldb, msg);
1389         talloc_free(msg);
1390         if (ret != LDB_SUCCESS) {
1391                 talloc_free(server_dn_str);
1392                 return NT_STATUS_LDAP(ret);
1393         }
1394
1395         s->dest_dsa.server_dn_str = server_dn_str;
1396
1397         return NT_STATUS_OK;
1398 }
1399
1400 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1401 {
1402         int ret;
1403         struct ldb_message *msg;
1404         uint32_t i;
1405
1406         /* make a 'modify' msg, and only for serverReference */
1407         msg = ldb_msg_new(s);
1408         NT_STATUS_HAVE_NO_MEMORY(msg);
1409         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1410         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1411
1412         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1413         if (ret != 0) {
1414                 talloc_free(msg);
1415                 return NT_STATUS_NO_MEMORY;
1416         }
1417
1418         /* mark all the message elements (should be just one)
1419            as LDB_FLAG_MOD_ADD */
1420         for (i=0;i<msg->num_elements;i++) {
1421                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1422         }
1423
1424         ret = ldb_modify(s->ldap1.ldb, msg);
1425         if (ret == LDB_SUCCESS) {
1426                 talloc_free(msg);
1427                 return NT_STATUS_OK;
1428         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1429                 /* retry with LDB_FLAG_MOD_REPLACE */
1430         } else {
1431                 talloc_free(msg);
1432                 return NT_STATUS_LDAP(ret);
1433         }
1434
1435         /* mark all the message elements (should be just one)
1436            as LDB_FLAG_MOD_REPLACE */
1437         for (i=0;i<msg->num_elements;i++) {
1438                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1439         }
1440
1441         ret = ldb_modify(s->ldap1.ldb, msg);
1442         talloc_free(msg);
1443         if (ret != LDB_SUCCESS) {
1444                 return NT_STATUS_LDAP(ret);
1445         }
1446
1447         return NT_STATUS_OK;
1448 }
1449
1450 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1451                                           struct becomeDC_drsuapi *drsuapi,
1452                                           void (*recv_fn)(struct composite_context *req));
1453 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1454 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1455
1456 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1457 {
1458         struct composite_context *c = s->creq;
1459
1460         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1461         if (!composite_is_ok(c)) return;
1462
1463         c->status = becomeDC_ldap1_rootdse(s);
1464         if (!composite_is_ok(c)) return;
1465
1466         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1467         if (!composite_is_ok(c)) return;
1468
1469         c->status = becomeDC_ldap1_domain_behavior_version(s);
1470         if (!composite_is_ok(c)) return;
1471
1472         c->status = becomeDC_ldap1_schema_object_version(s);
1473         if (!composite_is_ok(c)) return;
1474
1475         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1476         if (!composite_is_ok(c)) return;
1477
1478         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1479         if (!composite_is_ok(c)) return;
1480
1481         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1482         if (!composite_is_ok(c)) return;
1483
1484         c->status = becomeDC_ldap1_site_object(s);
1485         if (!composite_is_ok(c)) return;
1486
1487         c->status = becomeDC_check_options(s);
1488         if (!composite_is_ok(c)) return;
1489
1490         c->status = becomeDC_ldap1_computer_object(s);
1491         if (!composite_is_ok(c)) return;
1492
1493         c->status = becomeDC_ldap1_server_object_1(s);
1494         if (!composite_is_ok(c)) return;
1495
1496         c->status = becomeDC_ldap1_server_object_2(s);
1497         if (!composite_is_ok(c)) return;
1498
1499         c->status = becomeDC_ldap1_server_object_add(s);
1500         if (!composite_is_ok(c)) return;
1501
1502         c->status = becomeDC_ldap1_server_object_modify(s);
1503         if (!composite_is_ok(c)) return;
1504
1505         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1506 }
1507
1508 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1509                                           struct becomeDC_drsuapi *drsuapi,
1510                                           void (*recv_fn)(struct composite_context *req))
1511 {
1512         struct composite_context *c = s->creq;
1513         struct composite_context *creq;
1514         char *binding_str;
1515
1516         drsuapi->s = s;
1517
1518         if (!drsuapi->binding) {
1519                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc", "print", false)) {
1520                         binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,print,seal]", s->source_dsa.dns_name);
1521                         if (composite_nomem(binding_str, c)) return;
1522                 } else {
1523                         binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[krb5,seal]", s->source_dsa.dns_name);
1524                         if (composite_nomem(binding_str, c)) return;
1525                 }
1526                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1527                 talloc_free(binding_str);
1528                 if (!composite_is_ok(c)) return;
1529         }
1530
1531         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1532                                           s->libnet->cred, s->libnet->event_ctx,
1533                                           s->libnet->lp_ctx);
1534         composite_continue(c, creq, recv_fn, s);
1535 }
1536
1537 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1538                                        struct becomeDC_drsuapi *drsuapi,
1539                                        void (*recv_fn)(struct rpc_request *req));
1540 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
1541
1542 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1543 {
1544         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1545                                           struct libnet_BecomeDC_state);
1546         struct composite_context *c = s->creq;
1547
1548         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1549         if (!composite_is_ok(c)) return;
1550
1551         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1552                                        &s->drsuapi1.gensec_skey);
1553         if (!composite_is_ok(c)) return;
1554
1555         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1556 }
1557
1558 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1559                                        struct becomeDC_drsuapi *drsuapi,
1560                                        void (*recv_fn)(struct rpc_request *req))
1561 {
1562         struct composite_context *c = s->creq;
1563         struct rpc_request *req;
1564         struct drsuapi_DsBindInfo28 *bind_info28;
1565
1566         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1567
1568         bind_info28                             = &drsuapi->local_info28;
1569         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1570         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1571         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1572         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1573         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1574         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1575         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1576         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1577         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1578         if (s->domain.behavior_version == 2) {
1579                 /* TODO: find out how this is really triggered! */
1580                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1581         }
1582         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1583         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1584         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1585         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1586         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1587         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1588         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1589         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1590         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1591         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
1592         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1593         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1594         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1595         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1596         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1597         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1598         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1599         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1600         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1601 #if 0 /* we don't support XPRESS compression yet */
1602         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1603 #endif
1604         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1605         if (s->domain.behavior_version == 2) {
1606                 /* TODO: find out how this is really triggered! */
1607                 bind_info28->u1                         = 528;
1608         } else {
1609                 bind_info28->u1                         = 516;
1610         }
1611         bind_info28->repl_epoch                 = 0;
1612
1613         drsuapi->bind_info_ctr.length           = 28;
1614         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1615
1616         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1617         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1618         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1619
1620         req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
1621         composite_continue_rpc(c, req, recv_fn, s);
1622 }
1623
1624 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1625                                          struct becomeDC_drsuapi *drsuapi)
1626 {
1627         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1628                 return drsuapi->bind_r.out.result;
1629         }
1630
1631         ZERO_STRUCT(drsuapi->remote_info28);
1632         if (drsuapi->bind_r.out.bind_info) {
1633                 switch (drsuapi->bind_r.out.bind_info->length) {
1634                 case 24: {
1635                         struct drsuapi_DsBindInfo24 *info24;
1636                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1637                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1638                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1639                         drsuapi->remote_info28.u1                       = info24->u1;
1640                         drsuapi->remote_info28.repl_epoch               = 0;
1641                         break;
1642                 }
1643                 case 28:
1644                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1645                         break;
1646                 }
1647         }
1648
1649         return WERR_OK;
1650 }
1651
1652 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1653
1654 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1655 {
1656         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1657                                           struct libnet_BecomeDC_state);
1658         struct composite_context *c = s->creq;
1659         WERROR status;
1660
1661         bool print = false;
1662
1663         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
1664                 print = true;
1665         }
1666
1667         c->status = dcerpc_ndr_request_recv(req);
1668         if (!composite_is_ok(c)) return;
1669
1670         if (print) {
1671                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi1.bind_r);
1672         }
1673
1674         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1675         if (!W_ERROR_IS_OK(status)) {
1676                 composite_error(c, werror_to_ntstatus(status));
1677                 return;
1678         }
1679
1680         becomeDC_drsuapi1_add_entry_send(s);
1681 }
1682
1683 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1684
1685 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1686 {
1687         struct composite_context *c = s->creq;
1688         struct rpc_request *req;
1689         struct drsuapi_DsAddEntry *r;
1690         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1691         uint32_t num_attrs, i = 0;
1692         struct drsuapi_DsReplicaAttribute *attrs;
1693         struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1694         enum ndr_err_code ndr_err;
1695         bool w2k3;
1696
1697         /* choose a random invocationId */
1698         s->dest_dsa.invocation_id = GUID_random();
1699
1700         /*
1701          * if the schema version indicates w2k3, then
1702          * also send some w2k3 specific attributes
1703          */
1704         if (s->forest.schema_object_version >= 30) {
1705                 w2k3 = true;
1706         } else {
1707                 w2k3 = false;
1708         }
1709
1710         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1711         if (composite_nomem(r, c)) return;
1712
1713         /* setup identifier */
1714         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1715         if (composite_nomem(identifier, c)) return;
1716         identifier->guid        = GUID_zero();
1717         identifier->sid         = s->zero_sid;
1718         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1719                                                   s->dest_dsa.server_dn_str);
1720         if (composite_nomem(identifier->dn, c)) return;
1721
1722         /* allocate attribute array */
1723         num_attrs       = 11;
1724         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1725         if (composite_nomem(attrs, c)) return;
1726
1727         /* ntSecurityDescriptor */
1728         {
1729                 struct drsuapi_DsAttributeValue *vs;
1730                 DATA_BLOB *vd;
1731                 struct security_descriptor *v;
1732                 struct dom_sid *domain_admins_sid;
1733                 const char *domain_admins_sid_str;
1734
1735                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1736                 if (composite_nomem(vs, c)) return;
1737
1738                 vd = talloc_array(vs, DATA_BLOB, 1);
1739                 if (composite_nomem(vd, c)) return;
1740
1741                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1742                 if (composite_nomem(domain_admins_sid, c)) return;
1743
1744                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1745                 if (composite_nomem(domain_admins_sid_str, c)) return;
1746
1747                 v = security_descriptor_dacl_create(vd,
1748                                                0,
1749                                                /* owner: domain admins */
1750                                                domain_admins_sid_str,
1751                                                /* owner group: domain admins */
1752                                                domain_admins_sid_str,
1753                                                /* authenticated users */
1754                                                SID_NT_AUTHENTICATED_USERS,
1755                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1756                                                SEC_STD_READ_CONTROL |
1757                                                SEC_ADS_LIST |
1758                                                SEC_ADS_READ_PROP |
1759                                                SEC_ADS_LIST_OBJECT,
1760                                                0,
1761                                                /* domain admins */
1762                                                domain_admins_sid_str,
1763                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1764                                                SEC_STD_REQUIRED |
1765                                                SEC_ADS_CREATE_CHILD |
1766                                                SEC_ADS_LIST |
1767                                                SEC_ADS_SELF_WRITE |
1768                                                SEC_ADS_READ_PROP |
1769                                                SEC_ADS_WRITE_PROP |
1770                                                SEC_ADS_DELETE_TREE |
1771                                                SEC_ADS_LIST_OBJECT |
1772                                                SEC_ADS_CONTROL_ACCESS,
1773                                                0,
1774                                                /* system */
1775                                                SID_NT_SYSTEM,
1776                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1777                                                SEC_STD_REQUIRED |
1778                                                SEC_ADS_CREATE_CHILD |
1779                                                SEC_ADS_DELETE_CHILD |
1780                                                SEC_ADS_LIST |
1781                                                SEC_ADS_SELF_WRITE |
1782                                                SEC_ADS_READ_PROP |
1783                                                SEC_ADS_WRITE_PROP |
1784                                                SEC_ADS_DELETE_TREE |
1785                                                SEC_ADS_LIST_OBJECT |
1786                                                SEC_ADS_CONTROL_ACCESS,
1787                                                0,
1788                                                /* end */
1789                                                NULL);
1790                 if (composite_nomem(v, c)) return;
1791
1792                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1793                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1794                         c->status = ndr_map_error2ntstatus(ndr_err);
1795                         if (!composite_is_ok(c)) return;
1796                 }
1797
1798                 vs[0].blob              = &vd[0];
1799
1800                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1801                 attrs[i].value_ctr.num_values   = 1;
1802                 attrs[i].value_ctr.values       = vs;
1803
1804                 i++;
1805         }
1806
1807         /* objectClass: nTDSDSA */
1808         {
1809                 struct drsuapi_DsAttributeValue *vs;
1810                 DATA_BLOB *vd;
1811
1812                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1813                 if (composite_nomem(vs, c)) return;
1814
1815                 vd = talloc_array(vs, DATA_BLOB, 1);
1816                 if (composite_nomem(vd, c)) return;
1817
1818                 vd[0] = data_blob_talloc(vd, NULL, 4);
1819                 if (composite_nomem(vd[0].data, c)) return;
1820
1821                 /* value for nTDSDSA */
1822                 SIVAL(vd[0].data, 0, 0x0017002F);
1823
1824                 vs[0].blob              = &vd[0];
1825
1826                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectClass;
1827                 attrs[i].value_ctr.num_values   = 1;
1828                 attrs[i].value_ctr.values       = vs;
1829
1830                 i++;
1831         }
1832
1833         /* objectCategory: CN=NTDS-DSA,CN=Schema,... */
1834         {
1835                 struct drsuapi_DsAttributeValue *vs;
1836                 DATA_BLOB *vd;
1837                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1838
1839                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1840                 if (composite_nomem(vs, c)) return;
1841
1842                 vd = talloc_array(vs, DATA_BLOB, 1);
1843                 if (composite_nomem(vd, c)) return;
1844
1845                 v[0].guid               = GUID_zero();
1846                 v[0].sid                = s->zero_sid;
1847                 v[0].dn                 = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1848                                                           s->forest.schema_dn_str);
1849                 if (composite_nomem(v[0].dn, c)) return;
1850
1851                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1852                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1853                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1854                         c->status = ndr_map_error2ntstatus(ndr_err);
1855                         if (!composite_is_ok(c)) return;
1856                 }
1857
1858                 vs[0].blob              = &vd[0];
1859
1860                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectCategory;
1861                 attrs[i].value_ctr.num_values   = 1;
1862                 attrs[i].value_ctr.values       = vs;
1863
1864                 i++;
1865         }
1866
1867         /* invocationId: random guid */
1868         {
1869                 struct drsuapi_DsAttributeValue *vs;
1870                 DATA_BLOB *vd;
1871                 const struct GUID *v;
1872
1873                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1874                 if (composite_nomem(vs, c)) return;
1875
1876                 vd = talloc_array(vs, DATA_BLOB, 1);
1877                 if (composite_nomem(vd, c)) return;
1878
1879                 v = &s->dest_dsa.invocation_id;
1880
1881                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v, (ndr_push_flags_fn_t)ndr_push_GUID);
1882                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1883                         c->status = ndr_map_error2ntstatus(ndr_err);
1884                         if (!composite_is_ok(c)) return;
1885                 }
1886
1887                 vs[0].blob              = &vd[0];
1888
1889                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_invocationId;
1890                 attrs[i].value_ctr.num_values   = 1;
1891                 attrs[i].value_ctr.values       = vs;
1892
1893                 i++;
1894         }
1895
1896         /* hasMasterNCs: ... */
1897         {
1898                 struct drsuapi_DsAttributeValue *vs;
1899                 DATA_BLOB *vd;
1900                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1901
1902                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1903                 if (composite_nomem(vs, c)) return;
1904
1905                 vd = talloc_array(vs, DATA_BLOB, 3);
1906                 if (composite_nomem(vd, c)) return;
1907
1908                 v[0].guid               = GUID_zero();
1909                 v[0].sid                = s->zero_sid;
1910                 v[0].dn                 = s->forest.config_dn_str;
1911
1912                 v[1].guid               = GUID_zero();
1913                 v[1].sid                = s->zero_sid;
1914                 v[1].dn                 = s->domain.dn_str;
1915
1916                 v[2].guid               = GUID_zero();
1917                 v[2].sid                = s->zero_sid;
1918                 v[2].dn                 = s->forest.schema_dn_str;
1919
1920                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1921                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1922                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1923                         c->status = ndr_map_error2ntstatus(ndr_err);
1924                         if (!composite_is_ok(c)) return;
1925                 }
1926
1927                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1928                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1929                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1930                         c->status = ndr_map_error2ntstatus(ndr_err);
1931                         if (!composite_is_ok(c)) return;
1932                 }
1933
1934                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1935                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1936                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1937                         c->status = ndr_map_error2ntstatus(ndr_err);
1938                         if (!composite_is_ok(c)) return;
1939                 }
1940
1941                 vs[0].blob              = &vd[0];
1942                 vs[1].blob              = &vd[1];
1943                 vs[2].blob              = &vd[2];
1944
1945                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
1946                 attrs[i].value_ctr.num_values   = 3;
1947                 attrs[i].value_ctr.values       = vs;
1948
1949                 i++;
1950         }
1951
1952         /* msDS-hasMasterNCs: ... */
1953         if (w2k3) {
1954                 struct drsuapi_DsAttributeValue *vs;
1955                 DATA_BLOB *vd;
1956                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1957
1958                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1959                 if (composite_nomem(vs, c)) return;
1960
1961                 vd = talloc_array(vs, DATA_BLOB, 3);
1962                 if (composite_nomem(vd, c)) return;
1963
1964                 v[0].guid               = GUID_zero();
1965                 v[0].sid                = s->zero_sid;
1966                 v[0].dn                 = s->forest.config_dn_str;
1967
1968                 v[1].guid               = GUID_zero();
1969                 v[1].sid                = s->zero_sid;
1970                 v[1].dn                 = s->domain.dn_str;
1971
1972                 v[2].guid               = GUID_zero();
1973                 v[2].sid                = s->zero_sid;
1974                 v[2].dn                 = s->forest.schema_dn_str;
1975
1976                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1977                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1978                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1979                         c->status = ndr_map_error2ntstatus(ndr_err);
1980                         if (!composite_is_ok(c)) return;
1981                 }
1982
1983                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1984                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1985                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1986                         c->status = ndr_map_error2ntstatus(ndr_err);
1987                         if (!composite_is_ok(c)) return;
1988                 }
1989
1990                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
1991                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1992                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1993                         c->status = ndr_map_error2ntstatus(ndr_err);
1994                         if (!composite_is_ok(c)) return;
1995                 }
1996
1997                 vs[0].blob              = &vd[0];
1998                 vs[1].blob              = &vd[1];
1999                 vs[2].blob              = &vd[2];
2000
2001                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2002                 attrs[i].value_ctr.num_values   = 3;
2003                 attrs[i].value_ctr.values       = vs;
2004
2005                 i++;
2006         }
2007
2008         /* dMDLocation: CN=Schema,... */
2009         {
2010                 struct drsuapi_DsAttributeValue *vs;
2011                 DATA_BLOB *vd;
2012                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2013
2014                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2015                 if (composite_nomem(vs, c)) return;
2016
2017                 vd = talloc_array(vs, DATA_BLOB, 1);
2018                 if (composite_nomem(vd, c)) return;
2019
2020                 v[0].guid               = GUID_zero();
2021                 v[0].sid                = s->zero_sid;
2022                 v[0].dn                 = s->forest.schema_dn_str;
2023
2024                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2025                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2026                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2027                         c->status = ndr_map_error2ntstatus(ndr_err);
2028                         if (!composite_is_ok(c)) return;
2029                 }
2030
2031                 vs[0].blob              = &vd[0];
2032
2033                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_dMDLocation;
2034                 attrs[i].value_ctr.num_values   = 1;
2035                 attrs[i].value_ctr.values       = vs;
2036
2037                 i++;
2038         }
2039
2040         /* msDS-HasDomainNCs: <domain_partition> */
2041         if (w2k3) {
2042                 struct drsuapi_DsAttributeValue *vs;
2043                 DATA_BLOB *vd;
2044                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2045
2046                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2047                 if (composite_nomem(vs, c)) return;
2048
2049                 vd = talloc_array(vs, DATA_BLOB, 1);
2050                 if (composite_nomem(vd, c)) return;
2051
2052                 v[0].guid               = GUID_zero();
2053                 v[0].sid                = s->zero_sid;
2054                 v[0].dn                 = s->domain.dn_str;
2055
2056                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2057                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2058                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2059                         c->status = ndr_map_error2ntstatus(ndr_err);
2060                         if (!composite_is_ok(c)) return;
2061                 }
2062
2063                 vs[0].blob              = &vd[0];
2064
2065                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2066                 attrs[i].value_ctr.num_values   = 1;
2067                 attrs[i].value_ctr.values       = vs;
2068
2069                 i++;
2070         }
2071
2072         /* msDS-Behavior-Version */
2073         if (w2k3) {
2074                 struct drsuapi_DsAttributeValue *vs;
2075                 DATA_BLOB *vd;
2076
2077                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2078                 if (composite_nomem(vs, c)) return;
2079
2080                 vd = talloc_array(vs, DATA_BLOB, 1);
2081                 if (composite_nomem(vd, c)) return;
2082
2083                 vd[0] = data_blob_talloc(vd, NULL, 4);
2084                 if (composite_nomem(vd[0].data, c)) return;
2085
2086                 SIVAL(vd[0].data, 0, DS_BEHAVIOR_WIN2003);
2087
2088                 vs[0].blob              = &vd[0];
2089
2090                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2091                 attrs[i].value_ctr.num_values   = 1;
2092                 attrs[i].value_ctr.values       = vs;
2093
2094                 i++;
2095         }
2096
2097         /* systemFlags */
2098         {
2099                 struct drsuapi_DsAttributeValue *vs;
2100                 DATA_BLOB *vd;
2101
2102                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2103                 if (composite_nomem(vs, c)) return;
2104
2105                 vd = talloc_array(vs, DATA_BLOB, 1);
2106                 if (composite_nomem(vd, c)) return;
2107
2108                 vd[0] = data_blob_talloc(vd, NULL, 4);
2109                 if (composite_nomem(vd[0].data, c)) return;
2110
2111                 SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2112
2113                 vs[0].blob              = &vd[0];
2114
2115                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_systemFlags;
2116                 attrs[i].value_ctr.num_values   = 1;
2117                 attrs[i].value_ctr.values       = vs;
2118
2119                 i++;
2120         }
2121
2122         /* serverReference: ... */
2123         {
2124                 struct drsuapi_DsAttributeValue *vs;
2125                 DATA_BLOB *vd;
2126                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2127
2128                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2129                 if (composite_nomem(vs, c)) return;
2130
2131                 vd = talloc_array(vs, DATA_BLOB, 1);
2132                 if (composite_nomem(vd, c)) return;
2133
2134                 v[0].guid               = GUID_zero();
2135                 v[0].sid                = s->zero_sid;
2136                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2137
2138                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2139                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2140                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2141                         c->status = ndr_map_error2ntstatus(ndr_err);
2142                         if (!composite_is_ok(c)) return;
2143                 }
2144
2145                 vs[0].blob              = &vd[0];
2146
2147                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_serverReference;
2148                 attrs[i].value_ctr.num_values   = 1;
2149                 attrs[i].value_ctr.values       = vs;
2150
2151                 i++;
2152         }
2153
2154         /* truncate the attribute list to the attribute count we have filled in */
2155         num_attrs = i;
2156
2157         /* setup request structure */
2158         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2159         r->in.level                                                     = 2;
2160         r->in.req.req2.first_object.next_object                         = NULL;
2161         r->in.req.req2.first_object.object.identifier                   = identifier;
2162         r->in.req.req2.first_object.object.flags                        = 0x00000000;
2163         r->in.req.req2.first_object.object.attribute_ctr.num_attributes = num_attrs;
2164         r->in.req.req2.first_object.object.attribute_ctr.attributes     = attrs;
2165
2166         req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
2167         composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
2168 }
2169
2170 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2171 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2172
2173 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
2174 {
2175         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2176                                           struct libnet_BecomeDC_state);
2177         struct composite_context *c = s->creq;
2178         struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
2179                                        struct drsuapi_DsAddEntry);
2180         char *binding_str;
2181         bool print = false;
2182
2183         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2184                 print = true;
2185         }
2186
2187         c->status = dcerpc_ndr_request_recv(req);
2188         if (!composite_is_ok(c)) return;
2189
2190         if (print) {
2191                 NDR_PRINT_OUT_DEBUG(drsuapi_DsAddEntry, r);
2192         }
2193
2194         if (!W_ERROR_IS_OK(r->out.result)) {
2195                 composite_error(c, werror_to_ntstatus(r->out.result));
2196                 return;
2197         }
2198
2199         if (r->out.level == 3) {
2200                 if (r->out.ctr.ctr3.count != 1) {
2201                         WERROR status;
2202
2203                         if (r->out.ctr.ctr3.level != 1) {
2204                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2205                                 return;
2206                         }
2207
2208                         if (!r->out.ctr.ctr3.error) {
2209                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2210                                 return;
2211                         }
2212
2213                         status = r->out.ctr.ctr3.error->info1.status;
2214
2215                         if (!r->out.ctr.ctr3.error->info1.info) {
2216                                 composite_error(c, werror_to_ntstatus(status));
2217                                 return;
2218                         }
2219
2220                         /* see if we can get a more detailed error */
2221                         switch (r->out.ctr.ctr3.error->info1.level) {
2222                         case 1:
2223                                 status = r->out.ctr.ctr3.error->info1.info->error1.status;
2224                                 break;
2225                         case 4:
2226                         case 5:
2227                         case 6:
2228                         case 7:
2229                                 status = r->out.ctr.ctr3.error->info1.info->errorX.status;
2230                                 break;
2231                         }
2232
2233                         composite_error(c, werror_to_ntstatus(status));
2234                         return;
2235                 }
2236
2237                 s->dest_dsa.ntds_guid   = r->out.ctr.ctr3.objects[0].guid;
2238         } else if (r->out.level == 2) {
2239                 if (r->out.ctr.ctr2.count != 1) {
2240                         composite_error(c, werror_to_ntstatus(r->out.ctr.ctr2.error.status));
2241                         return;
2242                 }
2243
2244                 s->dest_dsa.ntds_guid   = r->out.ctr.ctr2.objects[0].guid;
2245         } else {
2246                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2247                 return;
2248         }
2249
2250         talloc_free(r);
2251
2252         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2253                                                   s->dest_dsa.server_dn_str);
2254         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2255
2256         c->status = becomeDC_prepare_db(s);
2257         if (!composite_is_ok(c)) return;
2258
2259         /* this avoids the epmapper lookup on the 2nd connection */
2260         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2261         if (composite_nomem(binding_str, c)) return;
2262
2263         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2264         talloc_free(binding_str);
2265         if (!composite_is_ok(c)) return;
2266
2267         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2268         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2269
2270         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2271 }
2272
2273 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2274 {
2275         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2276
2277         s->_pp.domain           = &s->domain;
2278         s->_pp.forest           = &s->forest;
2279         s->_pp.source_dsa       = &s->source_dsa;
2280         s->_pp.dest_dsa         = &s->dest_dsa;
2281
2282         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2283 }
2284
2285 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
2286
2287 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2288 {
2289         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2290                                           struct libnet_BecomeDC_state);
2291         struct composite_context *c = s->creq;
2292
2293         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2294         if (!composite_is_ok(c)) return;
2295
2296         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2297                                        &s->drsuapi2.gensec_skey);
2298         if (!composite_is_ok(c)) return;
2299
2300         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2301 }
2302
2303 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2304
2305 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
2306 {
2307         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2308                                           struct libnet_BecomeDC_state);
2309         struct composite_context *c = s->creq;
2310         char *binding_str;
2311         WERROR status;
2312
2313         bool print = false;
2314
2315         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2316                 print = true;
2317         }
2318
2319         c->status = dcerpc_ndr_request_recv(req);
2320         if (!composite_is_ok(c)) return;
2321
2322         if (print) {
2323                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi2.bind_r);
2324         }
2325
2326         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2327         if (!W_ERROR_IS_OK(status)) {
2328                 composite_error(c, werror_to_ntstatus(status));
2329                 return;
2330         }
2331
2332         /* this avoids the epmapper lookup on the 3rd connection */
2333         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2334         if (composite_nomem(binding_str, c)) return;
2335
2336         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2337         talloc_free(binding_str);
2338         if (!composite_is_ok(c)) return;
2339
2340         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2341         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2342         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2343         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2344
2345         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2346 }
2347
2348 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2349
2350 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2351 {
2352         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2353                                           struct libnet_BecomeDC_state);
2354         struct composite_context *c = s->creq;
2355
2356         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2357         if (!composite_is_ok(c)) return;
2358
2359         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2360                                        &s->drsuapi3.gensec_skey);
2361         if (!composite_is_ok(c)) return;
2362
2363         becomeDC_drsuapi3_pull_schema_send(s);
2364 }
2365
2366 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2367                                                  struct becomeDC_drsuapi *drsuapi_h,
2368                                                  struct becomeDC_drsuapi *drsuapi_p,
2369                                                  struct libnet_BecomeDC_Partition *partition,
2370                                                  void (*recv_fn)(struct rpc_request *req))
2371 {
2372         struct composite_context *c = s->creq;
2373         struct rpc_request *req;
2374         struct drsuapi_DsGetNCChanges *r;
2375
2376         r = talloc(s, struct drsuapi_DsGetNCChanges);
2377         if (composite_nomem(r, c)) return;
2378
2379         r->in.level = talloc(r, int32_t);
2380         if (composite_nomem(r->in.level, c)) return;
2381         r->out.level = talloc(r, int32_t);
2382         if (composite_nomem(r->out.level, c)) return;
2383
2384         r->in.bind_handle       = &drsuapi_h->bind_handle;
2385         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2386                 *r->in.level                            = 8;
2387                 r->in.req.req8.destination_dsa_guid     = partition->destination_dsa_guid;
2388                 r->in.req.req8.source_dsa_invocation_id = partition->source_dsa_invocation_id;
2389                 r->in.req.req8.naming_context           = &partition->nc;
2390                 r->in.req.req8.highwatermark            = partition->highwatermark;
2391                 r->in.req.req8.uptodateness_vector      = NULL;
2392                 r->in.req.req8.replica_flags            = partition->replica_flags;
2393                 r->in.req.req8.max_object_count         = 133;
2394                 r->in.req.req8.max_ndr_size             = 1336811;
2395                 r->in.req.req8.extended_op              = DRSUAPI_EXOP_NONE;
2396                 r->in.req.req8.fsmo_info                = 0;
2397                 r->in.req.req8.partial_attribute_set    = NULL;
2398                 r->in.req.req8.partial_attribute_set_ex = NULL;
2399                 r->in.req.req8.mapping_ctr.num_mappings = 0;
2400                 r->in.req.req8.mapping_ctr.mappings     = NULL;
2401         } else {
2402                 *r->in.level                            = 5;
2403                 r->in.req.req5.destination_dsa_guid     = partition->destination_dsa_guid;
2404                 r->in.req.req5.source_dsa_invocation_id = partition->source_dsa_invocation_id;
2405                 r->in.req.req5.naming_context           = &partition->nc;
2406                 r->in.req.req5.highwatermark            = partition->highwatermark;
2407                 r->in.req.req5.uptodateness_vector      = NULL;
2408                 r->in.req.req5.replica_flags            = partition->replica_flags;
2409                 r->in.req.req5.max_object_count         = 133;
2410                 r->in.req.req5.max_ndr_size             = 1336770;
2411                 r->in.req.req5.extended_op              = DRSUAPI_EXOP_NONE;
2412                 r->in.req.req5.fsmo_info                = 0;
2413         }
2414
2415         /*
2416          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2417          * but it seems that some extra flags in the DCERPC Bind call
2418          * are needed for it. Or the same KRB5 TGS is needed on both
2419          * connections.
2420          */
2421         req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_p->pipe, r, r);
2422         composite_continue_rpc(c, req, recv_fn, s);
2423 }
2424
2425 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2426                                                    struct becomeDC_drsuapi *drsuapi_h,
2427                                                    struct becomeDC_drsuapi *drsuapi_p,
2428                                                    struct libnet_BecomeDC_Partition *partition,
2429                                                    struct drsuapi_DsGetNCChanges *r)
2430 {
2431         uint32_t ctr_level = 0;
2432         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2433         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2434         struct GUID *source_dsa_guid;
2435         struct GUID *source_dsa_invocation_id;
2436         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark;
2437         bool more_data = false;
2438         NTSTATUS nt_status;
2439
2440         if (!W_ERROR_IS_OK(r->out.result)) {
2441                 return r->out.result;
2442         }
2443
2444         if (*r->out.level == 1) {
2445                 ctr_level = 1;
2446                 ctr1 = &r->out.ctr.ctr1;
2447         } else if (*r->out.level == 2) {
2448                 ctr_level = 1;
2449                 ctr1 = r->out.ctr.ctr2.ctr.mszip1.ctr1;
2450         } else if (*r->out.level == 6) {
2451                 ctr_level = 6;
2452                 ctr6 = &r->out.ctr.ctr6;
2453         } else if (*r->out.level == 7 &&
2454                    r->out.ctr.ctr7.level == 6 &&
2455                    r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP) {
2456                 ctr_level = 6;
2457                 ctr6 = r->out.ctr.ctr7.ctr.mszip6.ctr6;
2458         } else if (*r->out.level == 7 &&
2459                    r->out.ctr.ctr7.level == 6 &&
2460                    r->out.ctr.ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS) {
2461                 ctr_level = 6;
2462                 ctr6 = r->out.ctr.ctr7.ctr.xpress6.ctr6;
2463         } else {
2464                 return WERR_BAD_NET_RESP;
2465         }
2466
2467         if (ctr_level == 6) {
2468                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2469                         return ctr6->drs_error;
2470                 }
2471         }
2472
2473         switch (ctr_level) {
2474         case 1:
2475                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2476                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2477                 new_highwatermark               = &ctr1->new_highwatermark;
2478                 more_data                       = ctr1->more_data;
2479                 break;
2480         case 6:
2481                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2482                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2483                 new_highwatermark               = &ctr6->new_highwatermark;
2484                 more_data                       = ctr6->more_data;
2485                 break;
2486         }
2487
2488         partition->highwatermark                = *new_highwatermark;
2489         partition->source_dsa_guid              = *source_dsa_guid;
2490         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2491         partition->more_data                    = more_data;
2492
2493         if (!partition->store_chunk) return WERR_OK;
2494
2495         s->_sc.domain           = &s->domain;
2496         s->_sc.forest           = &s->forest;
2497         s->_sc.source_dsa       = &s->source_dsa;
2498         s->_sc.dest_dsa         = &s->dest_dsa;
2499         s->_sc.partition        = partition;
2500         s->_sc.ctr_level        = ctr_level;
2501         s->_sc.ctr1             = ctr1;
2502         s->_sc.ctr6             = ctr6;
2503         /*
2504          * we need to use the drsuapi_p->gensec_skey here,
2505          * when we use drsuapi_p->pipe in the for this request
2506          */
2507         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2508
2509         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2510         if (!NT_STATUS_IS_OK(nt_status)) {
2511                 return ntstatus_to_werror(nt_status);
2512         }
2513
2514         return WERR_OK;
2515 }
2516
2517 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
2518
2519 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2520 {
2521         s->schema_part.nc.guid  = GUID_zero();
2522         s->schema_part.nc.sid   = s->zero_sid;
2523         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2524
2525         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2526
2527         s->schema_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2528                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2529                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2530                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2531                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2532                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2533
2534         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2535
2536         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2537                                              becomeDC_drsuapi3_pull_schema_recv);
2538 }
2539
2540 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2541
2542 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
2543 {
2544         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2545                                           struct libnet_BecomeDC_state);
2546         struct composite_context *c = s->creq;
2547         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2548                                            struct drsuapi_DsGetNCChanges);
2549         WERROR status;
2550
2551         bool print = false;
2552
2553         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2554                 print = true;
2555         }
2556
2557         c->status = dcerpc_ndr_request_recv(req);
2558         if (!composite_is_ok(c)) return;
2559
2560         if (print) {
2561                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2562         }
2563
2564         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2565         if (!W_ERROR_IS_OK(status)) {
2566                 composite_error(c, werror_to_ntstatus(status));
2567                 return;
2568         }
2569
2570         talloc_free(r);
2571
2572         if (s->schema_part.more_data) {
2573                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2574                                                      becomeDC_drsuapi3_pull_schema_recv);
2575                 return;
2576         }
2577
2578         becomeDC_drsuapi3_pull_config_send(s);
2579 }
2580
2581 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
2582
2583 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2584 {
2585         s->config_part.nc.guid  = GUID_zero();
2586         s->config_part.nc.sid   = s->zero_sid;
2587         s->config_part.nc.dn    = s->forest.config_dn_str;
2588
2589         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2590
2591         s->config_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2592                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2593                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2594                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2595                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2596                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2597
2598         s->config_part.store_chunk      = s->callbacks.config_chunk;
2599
2600         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2601                                              becomeDC_drsuapi3_pull_config_recv);
2602 }
2603
2604 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
2605 {
2606         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2607                                           struct libnet_BecomeDC_state);
2608         struct composite_context *c = s->creq;
2609         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2610                                            struct drsuapi_DsGetNCChanges);
2611         WERROR status;
2612
2613         bool print = false;
2614
2615         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2616                 print = true;
2617         }
2618
2619         c->status = dcerpc_ndr_request_recv(req);
2620         if (!composite_is_ok(c)) return;
2621
2622         if (print) {
2623                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2624         }
2625
2626         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2627         if (!W_ERROR_IS_OK(status)) {
2628                 composite_error(c, werror_to_ntstatus(status));
2629                 return;
2630         }
2631
2632         talloc_free(r);
2633
2634         if (s->config_part.more_data) {
2635                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2636                                                      becomeDC_drsuapi3_pull_config_recv);
2637                 return;
2638         }
2639
2640         becomeDC_connect_ldap2(s);
2641 }
2642
2643 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
2644
2645 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2646 {
2647         s->domain_part.nc.guid  = GUID_zero();
2648         s->domain_part.nc.sid   = s->zero_sid;
2649         s->domain_part.nc.dn    = s->domain.dn_str;
2650
2651         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2652
2653         s->domain_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2654                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2655                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2656                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2657                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2658                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2659
2660         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2661
2662         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2663                                              becomeDC_drsuapi3_pull_domain_recv);
2664 }
2665
2666 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2667                                               struct becomeDC_drsuapi *drsuapi,
2668                                               struct libnet_BecomeDC_Partition *partition,
2669                                               void (*recv_fn)(struct rpc_request *req));
2670 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
2671
2672 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
2673 {
2674         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2675                                           struct libnet_BecomeDC_state);
2676         struct composite_context *c = s->creq;
2677         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2678                                            struct drsuapi_DsGetNCChanges);
2679         WERROR status;
2680         bool print = false;
2681
2682         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2683                 print = true;
2684         }
2685
2686         c->status = dcerpc_ndr_request_recv(req);
2687         if (!composite_is_ok(c)) return;
2688
2689         if (print) {
2690                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2691         }
2692
2693         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2694         if (!W_ERROR_IS_OK(status)) {
2695                 composite_error(c, werror_to_ntstatus(status));
2696                 return;
2697         }
2698
2699         talloc_free(r);
2700
2701         if (s->domain_part.more_data) {
2702                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2703                                                      becomeDC_drsuapi3_pull_domain_recv);
2704                 return;
2705         }
2706
2707         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2708                                           becomeDC_drsuapi2_update_refs_schema_recv);
2709 }
2710
2711 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2712                                               struct becomeDC_drsuapi *drsuapi,
2713                                               struct libnet_BecomeDC_Partition *partition,
2714                                               void (*recv_fn)(struct rpc_request *req))
2715 {
2716         struct composite_context *c = s->creq;
2717         struct rpc_request *req;
2718         struct drsuapi_DsReplicaUpdateRefs *r;
2719         const char *ntds_guid_str;
2720         const char *ntds_dns_name;
2721
2722         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2723         if (composite_nomem(r, c)) return;
2724
2725         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2726         if (composite_nomem(ntds_guid_str, c)) return;
2727
2728         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2729                                         ntds_guid_str,
2730                                         s->domain.dns_name);
2731         if (composite_nomem(ntds_dns_name, c)) return;
2732
2733         r->in.bind_handle               = &drsuapi->bind_handle;
2734         r->in.level                     = 1;
2735         r->in.req.req1.naming_context   = &partition->nc;
2736         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2737         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2738         r->in.req.req1.options          = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
2739                                         | DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
2740                                         | DRSUAPI_DS_REPLICA_UPDATE_0x00000010;
2741
2742         req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
2743         composite_continue_rpc(c, req, recv_fn, s);
2744 }
2745
2746 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
2747
2748 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
2749 {
2750         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2751                                           struct libnet_BecomeDC_state);
2752         struct composite_context *c = s->creq;
2753         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2754                                            struct drsuapi_DsReplicaUpdateRefs);
2755         bool print = false;
2756
2757         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2758                 print = true;
2759         }
2760
2761         c->status = dcerpc_ndr_request_recv(req);
2762         if (!composite_is_ok(c)) return;
2763
2764         if (print) {
2765                 NDR_PRINT_OUT_DEBUG(drsuapi_DsReplicaUpdateRefs, r);
2766         }
2767
2768         if (!W_ERROR_IS_OK(r->out.result)) {
2769                 composite_error(c, werror_to_ntstatus(r->out.result));
2770                 return;
2771         }
2772
2773         talloc_free(r);
2774
2775         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2776                                           becomeDC_drsuapi2_update_refs_config_recv);
2777 }
2778
2779 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
2780
2781 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
2782 {
2783         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2784                                           struct libnet_BecomeDC_state);
2785         struct composite_context *c = s->creq;
2786         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2787                                            struct drsuapi_DsReplicaUpdateRefs);
2788
2789         c->status = dcerpc_ndr_request_recv(req);
2790         if (!composite_is_ok(c)) return;
2791
2792         if (!W_ERROR_IS_OK(r->out.result)) {
2793                 composite_error(c, werror_to_ntstatus(r->out.result));
2794                 return;
2795         }
2796
2797         talloc_free(r);
2798
2799         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2800                                           becomeDC_drsuapi2_update_refs_domain_recv);
2801 }
2802
2803 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
2804 {
2805         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2806                                           struct libnet_BecomeDC_state);
2807         struct composite_context *c = s->creq;
2808         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2809                                            struct drsuapi_DsReplicaUpdateRefs);
2810
2811         c->status = dcerpc_ndr_request_recv(req);
2812         if (!composite_is_ok(c)) return;
2813
2814         if (!W_ERROR_IS_OK(r->out.result)) {
2815                 composite_error(c, werror_to_ntstatus(r->out.result));
2816                 return;
2817         }
2818
2819         talloc_free(r);
2820
2821         /* TODO: use DDNS updates and register dns names */
2822         composite_done(c);
2823 }
2824
2825 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2826 {
2827         int ret;
2828         struct ldb_message *msg;
2829         uint32_t i;
2830         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2831                                         UF_TRUSTED_FOR_DELEGATION;
2832
2833         /* as the value is already as we want it to be, we're done */
2834         if (s->dest_dsa.user_account_control == user_account_control) {
2835                 return NT_STATUS_OK;
2836         }
2837
2838         /* make a 'modify' msg, and only for serverReference */
2839         msg = ldb_msg_new(s);
2840         NT_STATUS_HAVE_NO_MEMORY(msg);
2841         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2842         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2843
2844         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2845         if (ret != 0) {
2846                 talloc_free(msg);
2847                 return NT_STATUS_NO_MEMORY;
2848         }
2849
2850         /* mark all the message elements (should be just one)
2851            as LDB_FLAG_MOD_REPLACE */
2852         for (i=0;i<msg->num_elements;i++) {
2853                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2854         }
2855
2856         ret = ldb_modify(s->ldap2.ldb, msg);
2857         talloc_free(msg);
2858         if (ret != LDB_SUCCESS) {
2859                 return NT_STATUS_LDAP(ret);
2860         }
2861
2862         s->dest_dsa.user_account_control = user_account_control;
2863
2864         return NT_STATUS_OK;
2865 }
2866
2867 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2868 {
2869         int ret;
2870         struct ldb_result *r;
2871         struct ldb_dn *basedn;
2872         struct ldb_dn *old_dn;
2873         struct ldb_dn *new_dn;
2874         static const char *_1_1_attrs[] = {
2875                 "1.1",
2876                 NULL
2877         };
2878
2879         basedn = ldb_dn_new_fmt(s, s->ldap2.ldb, "<WKGUID=a361b2ffffd211d1aa4b00c04fd7d83a,%s>",
2880                                 s->domain.dn_str);
2881         NT_STATUS_HAVE_NO_MEMORY(basedn);
2882
2883         ret = ldb_search(s->ldap2.ldb, basedn, LDB_SCOPE_BASE,
2884                          "(objectClass=*)", _1_1_attrs, &r);
2885         talloc_free(basedn);
2886         if (ret != LDB_SUCCESS) {
2887                 return NT_STATUS_LDAP(ret);
2888         } else if (r->count != 1) {
2889                 talloc_free(r);
2890                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2891         }
2892
2893         old_dn = ldb_dn_new(r, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2894         NT_STATUS_HAVE_NO_MEMORY(old_dn);
2895
2896         new_dn = r->msgs[0]->dn;
2897
2898         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2899                 talloc_free(r);
2900                 return NT_STATUS_NO_MEMORY;
2901         }
2902
2903         if (ldb_dn_compare(old_dn, new_dn) == 0) {
2904                 /* we don't need to rename if the old and new dn match */
2905                 talloc_free(r);
2906                 return NT_STATUS_OK;
2907         }
2908
2909         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
2910         if (ret != LDB_SUCCESS) {
2911                 talloc_free(r);
2912                 return NT_STATUS_LDAP(ret);
2913         }
2914
2915         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
2916         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
2917
2918         talloc_free(r);
2919
2920         return NT_STATUS_OK;
2921 }
2922
2923 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
2924 {
2925         struct composite_context *c = s->creq;
2926
2927         c->status = becomeDC_ldap_connect(s, &s->ldap2);
2928         if (!composite_is_ok(c)) return;
2929
2930         c->status = becomeDC_ldap2_modify_computer(s);
2931         if (!composite_is_ok(c)) return;
2932
2933         c->status = becomeDC_ldap2_move_computer(s);
2934         if (!composite_is_ok(c)) return;
2935
2936         becomeDC_drsuapi3_pull_domain_send(s);
2937 }
2938
2939 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
2940 {
2941         struct composite_context *c;
2942         struct libnet_BecomeDC_state *s;
2943         char *tmp_name;
2944
2945         c = composite_create(mem_ctx, ctx->event_ctx);
2946         if (c == NULL) return NULL;
2947
2948         s = talloc_zero(c, struct libnet_BecomeDC_state);
2949         if (composite_nomem(s, c)) return c;
2950         c->private_data = s;
2951         s->creq         = c;
2952         s->libnet       = ctx;
2953
2954         /* Domain input */
2955         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
2956         if (composite_nomem(s->domain.dns_name, c)) return c;
2957         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
2958         if (composite_nomem(s->domain.netbios_name, c)) return c;
2959         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
2960         if (composite_nomem(s->domain.sid, c)) return c;
2961
2962         /* Source DSA input */
2963         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
2964         if (composite_nomem(s->source_dsa.address, c)) return c;
2965
2966         /* Destination DSA input */
2967         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
2968         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
2969
2970         /* Destination DSA dns_name construction */
2971         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
2972         if (composite_nomem(tmp_name, c)) return c;
2973         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
2974         if (composite_nomem(tmp_name, c)) return c;
2975         s->dest_dsa.dns_name    = tmp_name;
2976
2977         /* Callback function pointers */
2978         s->callbacks = r->in.callbacks;
2979
2980         becomeDC_send_cldap(s);
2981         return c;
2982 }
2983
2984 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
2985 {
2986         NTSTATUS status;
2987
2988         status = composite_wait(c);
2989
2990         ZERO_STRUCT(r->out);
2991
2992         talloc_free(c);
2993         return status;
2994 }
2995
2996 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
2997 {
2998         NTSTATUS status;
2999         struct composite_context *c;
3000         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3001         status = libnet_BecomeDC_recv(c, mem_ctx, r);
3002         return status;
3003 }