dsdb: audit samdb and password changes
[nivanova/samba-autobuild/.git] / source4 / dsdb / samdb / ldb_modules / samba_dsdb.c
1 /*
2    Samba4 module loading module
3
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /*
21  *  Name: ldb
22  *
23  *  Component: Samba4 module loading module
24  *
25  *  Description: Implement a single 'module' in the ldb database,
26  *  which loads the remaining modules based on 'choice of configuration' attributes
27  *
28  *  This is to avoid forcing a reprovision of the ldb databases when we change the internal structure of the code
29  *
30  *  Author: Andrew Bartlett
31  */
32
33 #include "includes.h"
34 #include <ldb.h>
35 #include <ldb_errors.h>
36 #include <ldb_module.h>
37 #include "dsdb/samdb/ldb_modules/util.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "auth/credentials/credentials.h"
41 #include "param/secrets.h"
42 #include "lib/ldb-samba/ldb_wrap.h"
43
44 static int read_at_rootdse_record(struct ldb_context *ldb, struct ldb_module *module, TALLOC_CTX *mem_ctx,
45                                   struct ldb_message **msg, struct ldb_request *parent)
46 {
47         int ret;
48         static const char *rootdse_attrs[] = { "defaultNamingContext", "configurationNamingContext", "schemaNamingContext", NULL };
49         struct ldb_result *rootdse_res;
50         struct ldb_dn *rootdse_dn;
51         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
52         if (!tmp_ctx) {
53                 return ldb_oom(ldb);
54         }
55
56         rootdse_dn = ldb_dn_new(tmp_ctx, ldb, "@ROOTDSE");
57         if (!rootdse_dn) {
58                 talloc_free(tmp_ctx);
59                 return ldb_oom(ldb);
60         }
61
62         ret = dsdb_module_search_dn(module, tmp_ctx, &rootdse_res, rootdse_dn,
63                                     rootdse_attrs, DSDB_FLAG_NEXT_MODULE, parent);
64         if (ret != LDB_SUCCESS) {
65                 talloc_free(tmp_ctx);
66                 return ret;
67         }
68
69         talloc_steal(mem_ctx, rootdse_res->msgs);
70         *msg = rootdse_res->msgs[0];
71
72         talloc_free(tmp_ctx);
73
74         return ret;
75 }
76
77 static int prepare_modules_line(struct ldb_context *ldb,
78                                 TALLOC_CTX *mem_ctx,
79                                 const struct ldb_message *rootdse_msg,
80                                 struct ldb_message *msg, const char *backend_attr,
81                                 const char *backend_mod, const char **backend_mod_list)
82 {
83         int ret;
84         const char **backend_full_list;
85         const char *backend_dn;
86         char *mod_list_string;
87         char *full_string;
88         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
89         if (!tmp_ctx) {
90                 return ldb_oom(ldb);
91         }
92
93         if (backend_attr) {
94                 backend_dn = ldb_msg_find_attr_as_string(rootdse_msg, backend_attr, NULL);
95                 if (!backend_dn) {
96                         ldb_asprintf_errstring(ldb,
97                                                "samba_dsdb_init: "
98                                                "unable to read %s from %s:%s",
99                                                backend_attr, ldb_dn_get_linearized(rootdse_msg->dn),
100                                                ldb_errstring(ldb));
101                         return LDB_ERR_CONSTRAINT_VIOLATION;
102                 }
103         } else {
104                 backend_dn = "*";
105         }
106
107         if (backend_mod) {
108                 char **b = str_list_make_single(tmp_ctx, backend_mod);
109                 backend_full_list = discard_const_p(const char *, b);
110         } else {
111                 char **b = str_list_make_empty(tmp_ctx);
112                 backend_full_list = discard_const_p(const char *, b);
113         }
114         if (!backend_full_list) {
115                 talloc_free(tmp_ctx);
116                 return ldb_oom(ldb);
117         }
118
119         backend_full_list = str_list_append_const(backend_full_list, backend_mod_list);
120         if (!backend_full_list) {
121                 talloc_free(tmp_ctx);
122                 return ldb_oom(ldb);
123         }
124
125         mod_list_string = str_list_join(tmp_ctx, backend_full_list, ',');
126         if (!mod_list_string) {
127                 talloc_free(tmp_ctx);
128                 return ldb_oom(ldb);
129         }
130
131         full_string = talloc_asprintf(tmp_ctx, "%s:%s", backend_dn, mod_list_string);
132         ret = ldb_msg_add_steal_string(msg, "modules", full_string);
133         talloc_free(tmp_ctx);
134         return ret;
135 }
136
137 /*
138  * Force overwrite of the credentials with those
139  * specified in secrets.ldb, to connect across the
140  * ldapi socket to an LDAP backend
141  */
142
143 static int set_ldap_credentials(struct ldb_context *ldb, bool use_external)
144 {
145         const char *secrets_ldb_path, *sam_ldb_path;
146         char *private_dir, *p, *error_string;
147         struct ldb_context *secrets_ldb;
148         struct cli_credentials *cred;
149         struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
150         TALLOC_CTX *tmp_ctx = talloc_new(ldb);
151
152         if (!tmp_ctx) {
153                 return ldb_oom(ldb);
154         }
155
156         cred = cli_credentials_init(ldb);
157         if (!cred) {
158                 talloc_free(tmp_ctx);
159                 return ldb_oom(ldb);
160         }
161         cli_credentials_set_anonymous(cred);
162         if (use_external) {
163                 cli_credentials_set_forced_sasl_mech(cred, "EXTERNAL");
164         } else {
165                 cli_credentials_set_forced_sasl_mech(cred, "DIGEST-MD5");
166
167                 /*
168                  * We don't want to use krb5 to talk to our samdb - recursion
169                  * here would be bad, and this account isn't in the KDC
170                  * anyway
171                  */
172                 cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
173
174                 /*
175                  * Work out where *our* secrets.ldb is.  It must be in
176                  * the same directory as sam.ldb
177                  */
178                 sam_ldb_path = (const char *)ldb_get_opaque(ldb, "ldb_url");
179                 if (!sam_ldb_path) {
180                         talloc_free(tmp_ctx);
181                         return ldb_operr(ldb);
182                 }
183                 if (strncmp("tdb://", sam_ldb_path, 6) == 0) {
184                         sam_ldb_path += 6;
185                 }
186                 private_dir = talloc_strdup(tmp_ctx, sam_ldb_path);
187                 p = strrchr(private_dir, '/');
188                 if (p) {
189                         *p = '\0';
190                 } else {
191                         private_dir = talloc_strdup(tmp_ctx, ".");
192                 }
193
194                 secrets_ldb_path = talloc_asprintf(private_dir, "tdb://%s/secrets.ldb",
195                                                    private_dir);
196
197                 if (!secrets_ldb_path) {
198                         talloc_free(tmp_ctx);
199                         return ldb_oom(ldb);
200                 }
201
202                 /*
203                  * Now that we have found the location, connect to
204                  * secrets.ldb so we can read the SamDB Credentials
205                  * record
206                  */
207                 secrets_ldb = ldb_wrap_connect(tmp_ctx, NULL, lp_ctx, secrets_ldb_path,
208                                                NULL, NULL, 0);
209
210                 if (!NT_STATUS_IS_OK(cli_credentials_set_secrets(cred, NULL, secrets_ldb, NULL,
211                                                                  SECRETS_LDAP_FILTER, &error_string))) {
212                         ldb_asprintf_errstring(ldb, "Failed to read LDAP backend password from %s", secrets_ldb_path);
213                         talloc_free(tmp_ctx);
214                         return LDB_ERR_STRONG_AUTH_REQUIRED;
215                 }
216         }
217
218         /*
219          * Finally overwrite any supplied credentials with
220          * these ones, as only secrets.ldb contains the magic
221          * credentials to talk on the ldapi socket
222          */
223         if (ldb_set_opaque(ldb, "credentials", cred)) {
224                 talloc_free(tmp_ctx);
225                 return ldb_operr(ldb);
226         }
227         talloc_free(tmp_ctx);
228         return LDB_SUCCESS;
229 }
230
231 static bool check_required_features(struct ldb_message_element *el)
232 {
233         if (el != NULL) {
234                 int k;
235                 DATA_BLOB esf = data_blob_string_const(
236                         SAMBA_ENCRYPTED_SECRETS_FEATURE);
237                 DATA_BLOB lmdbl1 = data_blob_string_const(
238                         SAMBA_LMDB_LEVEL_ONE_FEATURE);
239                 for (k = 0; k < el->num_values; k++) {
240                         if ((data_blob_cmp(&esf, &el->values[k]) != 0) &&
241                             (data_blob_cmp(&lmdbl1, &el->values[k]) != 0)) {
242                                 return false;
243                         }
244                 }
245         }
246         return true;
247 }
248
249 static int samba_dsdb_init(struct ldb_module *module)
250 {
251         struct ldb_context *ldb = ldb_module_get_ctx(module);
252         int ret, lock_ret, len, i, j;
253         TALLOC_CTX *tmp_ctx = talloc_new(module);
254         struct ldb_result *res;
255         struct ldb_message *rootdse_msg = NULL, *partition_msg;
256         struct ldb_dn *samba_dsdb_dn, *partition_dn, *indexlist_dn;
257         struct ldb_module *backend_module, *module_chain;
258         const char **final_module_list, **reverse_module_list;
259         /*
260           Add modules to the list to activate them by default
261           beware often order is important
262
263           Some Known ordering constraints:
264           - rootdse must be first, as it makes redirects from "" -> cn=rootdse
265           - extended_dn_in must be before objectclass.c, as it resolves the DN
266           - objectclass must be before password_hash and samldb since these LDB
267             modules require the expanded "objectClass" list
268           - objectclass must be before descriptor and acl, as both assume that
269             objectClass values are sorted
270           - objectclass_attrs must be behind operational in order to see all
271             attributes (the operational module protects and therefore
272             suppresses per default some important ones)
273           - partition must be last
274           - each partition has its own module list then
275
276           The list is presented here as a set of declarations to show the
277           stack visually - the code below then handles the creation of the list
278           based on the parameters loaded from the database.
279         */
280         static const char *modules_list1[] = {"resolve_oids",
281                                              "rootdse",
282                                              "dsdb_notification",
283                                              "schema_load",
284                                              "lazy_commit",
285                                              "dirsync",
286                                              "paged_results",
287                                              "vlv",
288                                              "ranged_results",
289                                              "anr",
290                                              "server_sort",
291                                              "asq",
292                                              "extended_dn_store",
293                                              NULL };
294         /* extended_dn_in or extended_dn_in_openldap goes here */
295         static const char *modules_list1a[] = {"audit_log",
296                                              "objectclass",
297                                              "tombstone_reanimate",
298                                              "descriptor",
299                                              "acl",
300                                              "aclread",
301                                              "samldb",
302                                              "password_hash",
303                                              "instancetype",
304                                              "objectclass_attrs",
305                                              NULL };
306
307         const char **link_modules;
308         static const char *fedora_ds_modules[] = {
309                 "rdn_name", NULL };
310         static const char *openldap_modules[] = {
311                 NULL };
312         static const char *tdb_modules_list[] = {
313                 "rdn_name",
314                 "subtree_delete",
315                 "repl_meta_data",
316                 "encrypted_secrets",
317                 "operational",
318                 "unique_object_sids",
319                 "subtree_rename",
320                 "linked_attributes",
321                 NULL};
322
323         const char *extended_dn_module;
324         const char *extended_dn_module_ldb = "extended_dn_out_ldb";
325         const char *extended_dn_module_fds = "extended_dn_out_fds";
326         const char *extended_dn_module_openldap = "extended_dn_out_openldap";
327         const char *extended_dn_in_module = "extended_dn_in";
328
329         static const char *modules_list2[] = {"dns_notify",
330                                               "show_deleted",
331                                               "new_partition",
332                                               "partition",
333                                               NULL };
334
335         const char **backend_modules;
336         static const char *fedora_ds_backend_modules[] = {
337                 "dsdb_flags_ignore", "nsuniqueid", "paged_searches", "simple_dn", NULL };
338         static const char *openldap_backend_modules[] = {
339                 "dsdb_flags_ignore", "entryuuid", "simple_dn", NULL };
340
341         static const char *samba_dsdb_attrs[] = { "backendType",
342                                                   SAMBA_COMPATIBLE_FEATURES_ATTR,
343                                                   SAMBA_REQUIRED_FEATURES_ATTR, NULL };
344         static const char *indexlist_attrs[] = { SAMBA_FEATURES_SUPPORTED_FLAG, NULL };
345         static const char *partition_attrs[] = { "ldapBackend", NULL };
346         const char *backendType, *backendUrl;
347         bool use_sasl_external = false;
348
349         const char *current_supportedFeatures[] = {SAMBA_SORTED_LINKS_FEATURE};
350
351         if (!tmp_ctx) {
352                 return ldb_oom(ldb);
353         }
354
355         ret = ldb_register_samba_handlers(ldb);
356         if (ret != LDB_SUCCESS) {
357                 talloc_free(tmp_ctx);
358                 return ret;
359         }
360
361         samba_dsdb_dn = ldb_dn_new(tmp_ctx, ldb, "@SAMBA_DSDB");
362         if (!samba_dsdb_dn) {
363                 talloc_free(tmp_ctx);
364                 return ldb_oom(ldb);
365         }
366
367         indexlist_dn = ldb_dn_new(tmp_ctx, ldb, "@INDEXLIST");
368         if (!samba_dsdb_dn) {
369                 talloc_free(tmp_ctx);
370                 return ldb_oom(ldb);
371         }
372
373         partition_dn = ldb_dn_new(tmp_ctx, ldb, DSDB_PARTITION_DN);
374         if (!partition_dn) {
375                 talloc_free(tmp_ctx);
376                 return ldb_oom(ldb);
377         }
378
379 #define CHECK_LDB_RET(check_ret)                                \
380         do {                                                    \
381                 if (check_ret != LDB_SUCCESS) {                 \
382                         talloc_free(tmp_ctx);                   \
383                         return check_ret;                       \
384                 }                                               \
385         } while (0)
386
387         ret = dsdb_module_search_dn(module, tmp_ctx, &res, samba_dsdb_dn,
388                                     samba_dsdb_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
389         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
390                 backendType = "ldb";
391         } else if (ret == LDB_SUCCESS) {
392                 struct ldb_message_element *requiredFeatures;
393                 struct ldb_message_element *old_compatibleFeatures;
394
395                 backendType = ldb_msg_find_attr_as_string(res->msgs[0], "backendType", "ldb");
396
397                 requiredFeatures = ldb_msg_find_element(res->msgs[0], SAMBA_REQUIRED_FEATURES_ATTR);
398                 if (!check_required_features(requiredFeatures)) {
399                         ldb_set_errstring(
400                                 ldb,
401                                 "This Samba database was created with "
402                                 "a newer Samba version and is marked "
403                                 "with extra requiredFeatures in "
404                                 "@SAMBA_DSDB. This database can not "
405                                 "safely be read by this Samba version");
406                         return LDB_ERR_OPERATIONS_ERROR;
407                 }
408
409                 old_compatibleFeatures = ldb_msg_find_element(res->msgs[0],
410                                                               SAMBA_COMPATIBLE_FEATURES_ATTR);
411
412                 if (old_compatibleFeatures) {
413                         struct ldb_message *features_msg;
414                         struct ldb_message_element *features_el;
415                         int samba_options_supported = 0;
416                         ret = dsdb_module_search_dn(module, tmp_ctx, &res,
417                                                     indexlist_dn,
418                                                     indexlist_attrs,
419                                                     DSDB_FLAG_NEXT_MODULE, NULL);
420                         if (ret == LDB_SUCCESS) {
421                                 samba_options_supported
422                                         = ldb_msg_find_attr_as_int(res->msgs[0],
423                                                                    SAMBA_FEATURES_SUPPORTED_FLAG,
424                                                                    0);
425
426                         } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
427                                 /*
428                                  * If we don't have @INDEXLIST yet, then we
429                                  * are so early in set-up that we know this is
430                                  * a blank DB, so no need to wripe out old
431                                  * features
432                                  */
433                                 samba_options_supported = 1;
434                         }
435
436                         features_msg = ldb_msg_new(res);
437                         if (features_msg == NULL) {
438                                 return ldb_module_operr(module);
439                         }
440                         features_msg->dn = samba_dsdb_dn;
441
442                         ldb_msg_add_empty(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
443                                           LDB_FLAG_MOD_DELETE, &features_el);
444
445                         if (samba_options_supported == 1) {
446                                 for (i = 0;
447                                      old_compatibleFeatures && i < old_compatibleFeatures->num_values;
448                                      i++) {
449                                         for (j = 0;
450                                              j < ARRAY_SIZE(current_supportedFeatures); j++) {
451                                                 if (strcmp((char *)old_compatibleFeatures->values[i].data,
452                                                            current_supportedFeatures[j]) == 0) {
453                                                         break;
454                                                 }
455                                         }
456                                         if (j == ARRAY_SIZE(current_supportedFeatures)) {
457                                                 /*
458                                                  * Add to list of features to remove
459                                                  * (rather than all features)
460                                                  */
461                                                 ret = ldb_msg_add_value(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
462                                                                         &old_compatibleFeatures->values[i],
463                                                                         NULL);
464                                                 if (ret != LDB_SUCCESS) {
465                                                         return ret;
466                                                 }
467                                         }
468                                 }
469
470                                 if (features_el->num_values > 0) {
471                                         /* Delete by list */
472                                         ret = ldb_next_start_trans(module);
473                                         if (ret != LDB_SUCCESS) {
474                                                 return ret;
475                                         }
476                                         ret = dsdb_module_modify(module, features_msg, DSDB_FLAG_NEXT_MODULE, NULL);
477                                         if (ret != LDB_SUCCESS) {
478                                                 ldb_next_del_trans(module);
479                                                 return ret;
480                                         }
481                                         ret = ldb_next_end_trans(module);
482                                         if (ret != LDB_SUCCESS) {
483                                                 return ret;
484                                         }
485                                 }
486                         } else {
487                                 /* Delete all */
488                                 ret = ldb_next_start_trans(module);
489                                 if (ret != LDB_SUCCESS) {
490                                         return ret;
491                                 }
492                                 ret = dsdb_module_modify(module, features_msg, DSDB_FLAG_NEXT_MODULE, NULL);
493                                 if (ret != LDB_SUCCESS) {
494                                         ldb_next_del_trans(module);
495                                         return ret;
496                                 }
497                                 ret = ldb_next_end_trans(module);
498                                 if (ret != LDB_SUCCESS) {
499                                         return ret;
500                                 }
501                         }
502                 }
503
504         } else {
505                 talloc_free(tmp_ctx);
506                 return ret;
507         }
508
509         backend_modules = NULL;
510         if (strcasecmp(backendType, "ldb") == 0) {
511                 extended_dn_module = extended_dn_module_ldb;
512                 link_modules = tdb_modules_list;
513         } else {
514                 struct cli_credentials *cred;
515                 bool is_ldapi = false;
516
517                 ret = dsdb_module_search_dn(module, tmp_ctx, &res, partition_dn,
518                                             partition_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
519                 if (ret == LDB_SUCCESS) {
520                         backendUrl = ldb_msg_find_attr_as_string(res->msgs[0], "ldapBackend", "ldapi://");
521                         if (!strncasecmp(backendUrl, "ldapi://", sizeof("ldapi://")-1)) {
522                                 is_ldapi = true;
523                         }
524                 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
525                         talloc_free(tmp_ctx);
526                         return ret;
527                 }
528                 if (strcasecmp(backendType, "fedora-ds") == 0) {
529                         link_modules = fedora_ds_modules;
530                         backend_modules = fedora_ds_backend_modules;
531                         extended_dn_module = extended_dn_module_fds;
532                 } else if (strcasecmp(backendType, "openldap") == 0) {
533                         link_modules = openldap_modules;
534                         backend_modules = openldap_backend_modules;
535                         extended_dn_module = extended_dn_module_openldap;
536                         extended_dn_in_module = "extended_dn_in_openldap";
537                         if (is_ldapi) {
538                                 use_sasl_external = true;
539                         }
540                 } else {
541                         return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "invalid backend type");
542                 }
543                 ret = ldb_set_opaque(ldb, "readOnlySchema", (void*)1);
544                 if (ret != LDB_SUCCESS) {
545                         ldb_set_errstring(ldb, "Failed to set readOnlySchema opaque");
546                 }
547
548                 cred = ldb_get_opaque(ldb, "credentials");
549                 if (!cred || !cli_credentials_authentication_requested(cred)) {
550                         ret = set_ldap_credentials(ldb, use_sasl_external);
551                         if (ret != LDB_SUCCESS) {
552                                 return ret;
553                         }
554                 }
555         }
556
557 #define CHECK_MODULE_LIST \
558         do {                                                    \
559                 if (!final_module_list) {                       \
560                         talloc_free(tmp_ctx);                   \
561                         return ldb_oom(ldb);                    \
562                 }                                               \
563         } while (0)
564
565         final_module_list = str_list_copy_const(tmp_ctx, modules_list1);
566         CHECK_MODULE_LIST;
567
568         final_module_list = str_list_add_const(final_module_list, extended_dn_in_module);
569         CHECK_MODULE_LIST;
570
571         final_module_list = str_list_append_const(final_module_list, modules_list1a);
572         CHECK_MODULE_LIST;
573
574         final_module_list = str_list_append_const(final_module_list, link_modules);
575         CHECK_MODULE_LIST;
576
577         final_module_list = str_list_add_const(final_module_list, extended_dn_module);
578         CHECK_MODULE_LIST;
579
580         final_module_list = str_list_append_const(final_module_list, modules_list2);
581         CHECK_MODULE_LIST;
582
583
584         ret = read_at_rootdse_record(ldb, module, tmp_ctx, &rootdse_msg, NULL);
585         CHECK_LDB_RET(ret);
586
587         partition_msg = ldb_msg_new(tmp_ctx);
588         partition_msg->dn = ldb_dn_new(partition_msg, ldb, "@" DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME);
589
590         ret = prepare_modules_line(ldb, tmp_ctx,
591                                    rootdse_msg,
592                                    partition_msg, "schemaNamingContext",
593                                    "schema_data", backend_modules);
594         CHECK_LDB_RET(ret);
595
596         ret = prepare_modules_line(ldb, tmp_ctx,
597                                    rootdse_msg,
598                                    partition_msg, NULL,
599                                    NULL, backend_modules);
600         CHECK_LDB_RET(ret);
601
602         ret = ldb_set_opaque(ldb, DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME, partition_msg);
603         CHECK_LDB_RET(ret);
604
605         talloc_steal(ldb, partition_msg);
606
607         /* Now prepare the module chain.  Oddly, we must give it to ldb_load_modules_list in REVERSE */
608         for (len = 0; final_module_list[len]; len++) { /* noop */};
609
610         reverse_module_list = talloc_array(tmp_ctx, const char *, len+1);
611         if (!reverse_module_list) {
612                 talloc_free(tmp_ctx);
613                 return ldb_oom(ldb);
614         }
615         for (i=0; i < len; i++) {
616                 reverse_module_list[i] = final_module_list[(len - 1) - i];
617         }
618         reverse_module_list[i] = NULL;
619
620         /* The backend (at least until the partitions module
621          * reconfigures things) is the next module in the currently
622          * loaded chain */
623         backend_module = ldb_module_next(module);
624         ret = ldb_module_load_list(ldb, reverse_module_list, backend_module, &module_chain);
625         CHECK_LDB_RET(ret);
626
627         talloc_free(tmp_ctx);
628         /* Set this as the 'next' module, so that we effectivly append it to module chain */
629         ldb_module_set_next(module, module_chain);
630
631         ret = ldb_next_read_lock(module);
632         if (ret != LDB_SUCCESS) {
633                 return ret;
634         }
635
636         ret = ldb_next_init(module);
637
638         lock_ret = ldb_next_read_unlock(module);
639
640         if (lock_ret != LDB_SUCCESS) {
641                 return lock_ret;
642         }
643
644         return ret;
645 }
646
647 static const struct ldb_module_ops ldb_samba_dsdb_module_ops = {
648         .name              = "samba_dsdb",
649         .init_context      = samba_dsdb_init,
650 };
651
652 static struct ldb_message *dsdb_flags_ignore_fixup(TALLOC_CTX *mem_ctx,
653                                                 const struct ldb_message *_msg)
654 {
655         struct ldb_message *msg = NULL;
656         unsigned int i;
657
658         /* we have to copy the message as the caller might have it as a const */
659         msg = ldb_msg_copy_shallow(mem_ctx, _msg);
660         if (msg == NULL) {
661                 return NULL;
662         }
663
664         for (i=0; i < msg->num_elements;) {
665                 struct ldb_message_element *e = &msg->elements[i];
666
667                 if (!(e->flags & DSDB_FLAG_INTERNAL_FORCE_META_DATA)) {
668                         i++;
669                         continue;
670                 }
671
672                 e->flags &= ~DSDB_FLAG_INTERNAL_FORCE_META_DATA;
673
674                 if (e->num_values != 0) {
675                         i++;
676                         continue;
677                 }
678
679                 ldb_msg_remove_element(msg, e);
680         }
681
682         return msg;
683 }
684
685 static int dsdb_flags_ignore_add(struct ldb_module *module, struct ldb_request *req)
686 {
687         struct ldb_context *ldb = ldb_module_get_ctx(module);
688         struct ldb_request *down_req = NULL;
689         struct ldb_message *msg = NULL;
690         int ret;
691
692         msg = dsdb_flags_ignore_fixup(req, req->op.add.message);
693         if (msg == NULL) {
694                 return ldb_module_oom(module);
695         }
696
697         ret = ldb_build_add_req(&down_req, ldb, req,
698                                 msg,
699                                 req->controls,
700                                 req, dsdb_next_callback,
701                                 req);
702         LDB_REQ_SET_LOCATION(down_req);
703         if (ret != LDB_SUCCESS) {
704                 return ret;
705         }
706
707         /* go on with the call chain */
708         return ldb_next_request(module, down_req);
709 }
710
711 static int dsdb_flags_ignore_modify(struct ldb_module *module, struct ldb_request *req)
712 {
713         struct ldb_context *ldb = ldb_module_get_ctx(module);
714         struct ldb_request *down_req = NULL;
715         struct ldb_message *msg = NULL;
716         int ret;
717
718         msg = dsdb_flags_ignore_fixup(req, req->op.mod.message);
719         if (msg == NULL) {
720                 return ldb_module_oom(module);
721         }
722
723         ret = ldb_build_mod_req(&down_req, ldb, req,
724                                 msg,
725                                 req->controls,
726                                 req, dsdb_next_callback,
727                                 req);
728         LDB_REQ_SET_LOCATION(down_req);
729         if (ret != LDB_SUCCESS) {
730                 return ret;
731         }
732
733         /* go on with the call chain */
734         return ldb_next_request(module, down_req);
735 }
736
737 static const struct ldb_module_ops ldb_dsdb_flags_ignore_module_ops = {
738         .name   = "dsdb_flags_ignore",
739         .add    = dsdb_flags_ignore_add,
740         .modify = dsdb_flags_ignore_modify,
741 };
742
743 int ldb_samba_dsdb_module_init(const char *version)
744 {
745         int ret;
746         LDB_MODULE_CHECK_VERSION(version);
747         ret = ldb_register_module(&ldb_samba_dsdb_module_ops);
748         if (ret != LDB_SUCCESS) {
749                 return ret;
750         }
751         ret = ldb_register_module(&ldb_dsdb_flags_ignore_module_ops);
752         if (ret != LDB_SUCCESS) {
753                 return ret;
754         }
755         return LDB_SUCCESS;
756 }