dsdb: Audit group membership changes
[nivanova/samba-autobuild/.git] / source4 / dsdb / samdb / ldb_modules / samba_dsdb.c
1 /*
2    Samba4 module loading module
3
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /*
21  *  Name: ldb
22  *
23  *  Component: Samba4 module loading module
24  *
25  *  Description: Implement a single 'module' in the ldb database,
26  *  which loads the remaining modules based on 'choice of configuration' attributes
27  *
28  *  This is to avoid forcing a reprovision of the ldb databases when we change the internal structure of the code
29  *
30  *  Author: Andrew Bartlett
31  */
32
33 #include "includes.h"
34 #include <ldb.h>
35 #include <ldb_errors.h>
36 #include <ldb_module.h>
37 #include "dsdb/samdb/ldb_modules/util.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "auth/credentials/credentials.h"
41 #include "param/secrets.h"
42 #include "lib/ldb-samba/ldb_wrap.h"
43
44 static int read_at_rootdse_record(struct ldb_context *ldb, struct ldb_module *module, TALLOC_CTX *mem_ctx,
45                                   struct ldb_message **msg, struct ldb_request *parent)
46 {
47         int ret;
48         static const char *rootdse_attrs[] = { "defaultNamingContext", "configurationNamingContext", "schemaNamingContext", NULL };
49         struct ldb_result *rootdse_res;
50         struct ldb_dn *rootdse_dn;
51         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
52         if (!tmp_ctx) {
53                 return ldb_oom(ldb);
54         }
55
56         rootdse_dn = ldb_dn_new(tmp_ctx, ldb, "@ROOTDSE");
57         if (!rootdse_dn) {
58                 talloc_free(tmp_ctx);
59                 return ldb_oom(ldb);
60         }
61
62         ret = dsdb_module_search_dn(module, tmp_ctx, &rootdse_res, rootdse_dn,
63                                     rootdse_attrs, DSDB_FLAG_NEXT_MODULE, parent);
64         if (ret != LDB_SUCCESS) {
65                 talloc_free(tmp_ctx);
66                 return ret;
67         }
68
69         talloc_steal(mem_ctx, rootdse_res->msgs);
70         *msg = rootdse_res->msgs[0];
71
72         talloc_free(tmp_ctx);
73
74         return ret;
75 }
76
77 static int prepare_modules_line(struct ldb_context *ldb,
78                                 TALLOC_CTX *mem_ctx,
79                                 const struct ldb_message *rootdse_msg,
80                                 struct ldb_message *msg, const char *backend_attr,
81                                 const char *backend_mod, const char **backend_mod_list)
82 {
83         int ret;
84         const char **backend_full_list;
85         const char *backend_dn;
86         char *mod_list_string;
87         char *full_string;
88         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
89         if (!tmp_ctx) {
90                 return ldb_oom(ldb);
91         }
92
93         if (backend_attr) {
94                 backend_dn = ldb_msg_find_attr_as_string(rootdse_msg, backend_attr, NULL);
95                 if (!backend_dn) {
96                         ldb_asprintf_errstring(ldb,
97                                                "samba_dsdb_init: "
98                                                "unable to read %s from %s:%s",
99                                                backend_attr, ldb_dn_get_linearized(rootdse_msg->dn),
100                                                ldb_errstring(ldb));
101                         return LDB_ERR_CONSTRAINT_VIOLATION;
102                 }
103         } else {
104                 backend_dn = "*";
105         }
106
107         if (backend_mod) {
108                 char **b = str_list_make_single(tmp_ctx, backend_mod);
109                 backend_full_list = discard_const_p(const char *, b);
110         } else {
111                 char **b = str_list_make_empty(tmp_ctx);
112                 backend_full_list = discard_const_p(const char *, b);
113         }
114         if (!backend_full_list) {
115                 talloc_free(tmp_ctx);
116                 return ldb_oom(ldb);
117         }
118
119         backend_full_list = str_list_append_const(backend_full_list, backend_mod_list);
120         if (!backend_full_list) {
121                 talloc_free(tmp_ctx);
122                 return ldb_oom(ldb);
123         }
124
125         mod_list_string = str_list_join(tmp_ctx, backend_full_list, ',');
126         if (!mod_list_string) {
127                 talloc_free(tmp_ctx);
128                 return ldb_oom(ldb);
129         }
130
131         full_string = talloc_asprintf(tmp_ctx, "%s:%s", backend_dn, mod_list_string);
132         ret = ldb_msg_add_steal_string(msg, "modules", full_string);
133         talloc_free(tmp_ctx);
134         return ret;
135 }
136
137 /*
138  * Force overwrite of the credentials with those
139  * specified in secrets.ldb, to connect across the
140  * ldapi socket to an LDAP backend
141  */
142
143 static int set_ldap_credentials(struct ldb_context *ldb, bool use_external)
144 {
145         const char *secrets_ldb_path, *sam_ldb_path;
146         char *private_dir, *p, *error_string;
147         struct ldb_context *secrets_ldb;
148         struct cli_credentials *cred;
149         struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
150         TALLOC_CTX *tmp_ctx = talloc_new(ldb);
151
152         if (!tmp_ctx) {
153                 return ldb_oom(ldb);
154         }
155
156         cred = cli_credentials_init(ldb);
157         if (!cred) {
158                 talloc_free(tmp_ctx);
159                 return ldb_oom(ldb);
160         }
161         cli_credentials_set_anonymous(cred);
162         if (use_external) {
163                 cli_credentials_set_forced_sasl_mech(cred, "EXTERNAL");
164         } else {
165                 cli_credentials_set_forced_sasl_mech(cred, "DIGEST-MD5");
166
167                 /*
168                  * We don't want to use krb5 to talk to our samdb - recursion
169                  * here would be bad, and this account isn't in the KDC
170                  * anyway
171                  */
172                 cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
173
174                 /*
175                  * Work out where *our* secrets.ldb is.  It must be in
176                  * the same directory as sam.ldb
177                  */
178                 sam_ldb_path = (const char *)ldb_get_opaque(ldb, "ldb_url");
179                 if (!sam_ldb_path) {
180                         talloc_free(tmp_ctx);
181                         return ldb_operr(ldb);
182                 }
183                 if (strncmp("tdb://", sam_ldb_path, 6) == 0) {
184                         sam_ldb_path += 6;
185                 }
186                 private_dir = talloc_strdup(tmp_ctx, sam_ldb_path);
187                 p = strrchr(private_dir, '/');
188                 if (p) {
189                         *p = '\0';
190                 } else {
191                         private_dir = talloc_strdup(tmp_ctx, ".");
192                 }
193
194                 secrets_ldb_path = talloc_asprintf(private_dir, "tdb://%s/secrets.ldb",
195                                                    private_dir);
196
197                 if (!secrets_ldb_path) {
198                         talloc_free(tmp_ctx);
199                         return ldb_oom(ldb);
200                 }
201
202                 /*
203                  * Now that we have found the location, connect to
204                  * secrets.ldb so we can read the SamDB Credentials
205                  * record
206                  */
207                 secrets_ldb = ldb_wrap_connect(tmp_ctx, NULL, lp_ctx, secrets_ldb_path,
208                                                NULL, NULL, 0);
209
210                 if (!NT_STATUS_IS_OK(cli_credentials_set_secrets(cred, NULL, secrets_ldb, NULL,
211                                                                  SECRETS_LDAP_FILTER, &error_string))) {
212                         ldb_asprintf_errstring(ldb, "Failed to read LDAP backend password from %s", secrets_ldb_path);
213                         talloc_free(tmp_ctx);
214                         return LDB_ERR_STRONG_AUTH_REQUIRED;
215                 }
216         }
217
218         /*
219          * Finally overwrite any supplied credentials with
220          * these ones, as only secrets.ldb contains the magic
221          * credentials to talk on the ldapi socket
222          */
223         if (ldb_set_opaque(ldb, "credentials", cred)) {
224                 talloc_free(tmp_ctx);
225                 return ldb_operr(ldb);
226         }
227         talloc_free(tmp_ctx);
228         return LDB_SUCCESS;
229 }
230
231 static bool check_required_features(struct ldb_message_element *el)
232 {
233         if (el != NULL) {
234                 int k;
235                 DATA_BLOB esf = data_blob_string_const(
236                         SAMBA_ENCRYPTED_SECRETS_FEATURE);
237                 DATA_BLOB lmdbl1 = data_blob_string_const(
238                         SAMBA_LMDB_LEVEL_ONE_FEATURE);
239                 for (k = 0; k < el->num_values; k++) {
240                         if ((data_blob_cmp(&esf, &el->values[k]) != 0) &&
241                             (data_blob_cmp(&lmdbl1, &el->values[k]) != 0)) {
242                                 return false;
243                         }
244                 }
245         }
246         return true;
247 }
248
249 static int samba_dsdb_init(struct ldb_module *module)
250 {
251         struct ldb_context *ldb = ldb_module_get_ctx(module);
252         int ret, lock_ret, len, i, j;
253         TALLOC_CTX *tmp_ctx = talloc_new(module);
254         struct ldb_result *res;
255         struct ldb_message *rootdse_msg = NULL, *partition_msg;
256         struct ldb_dn *samba_dsdb_dn, *partition_dn, *indexlist_dn;
257         struct ldb_module *backend_module, *module_chain;
258         const char **final_module_list, **reverse_module_list;
259         /*
260           Add modules to the list to activate them by default
261           beware often order is important
262
263           Some Known ordering constraints:
264           - rootdse must be first, as it makes redirects from "" -> cn=rootdse
265           - extended_dn_in must be before objectclass.c, as it resolves the DN
266           - objectclass must be before password_hash and samldb since these LDB
267             modules require the expanded "objectClass" list
268           - objectclass must be before descriptor and acl, as both assume that
269             objectClass values are sorted
270           - objectclass_attrs must be behind operational in order to see all
271             attributes (the operational module protects and therefore
272             suppresses per default some important ones)
273           - partition must be last
274           - each partition has its own module list then
275
276           The list is presented here as a set of declarations to show the
277           stack visually - the code below then handles the creation of the list
278           based on the parameters loaded from the database.
279         */
280         static const char *modules_list1[] = {"resolve_oids",
281                                              "rootdse",
282                                              "dsdb_notification",
283                                              "schema_load",
284                                              "lazy_commit",
285                                              "dirsync",
286                                              "paged_results",
287                                              "vlv",
288                                              "ranged_results",
289                                              "anr",
290                                              "server_sort",
291                                              "asq",
292                                              "extended_dn_store",
293                                              NULL };
294         /* extended_dn_in or extended_dn_in_openldap goes here */
295         static const char *modules_list1a[] = {"audit_log",
296                                              "objectclass",
297                                              "tombstone_reanimate",
298                                              "descriptor",
299                                              "acl",
300                                              "aclread",
301                                              "samldb",
302                                              "password_hash",
303                                              "instancetype",
304                                              "objectclass_attrs",
305                                              NULL };
306
307         const char **link_modules;
308         static const char *fedora_ds_modules[] = {
309                 "rdn_name", NULL };
310         static const char *openldap_modules[] = {
311                 NULL };
312         static const char *tdb_modules_list[] = {
313                 "rdn_name",
314                 "subtree_delete",
315                 "repl_meta_data",
316                 "group_audit_log",
317                 "encrypted_secrets",
318                 "operational",
319                 "unique_object_sids",
320                 "subtree_rename",
321                 "linked_attributes",
322                 NULL};
323
324         const char *extended_dn_module;
325         const char *extended_dn_module_ldb = "extended_dn_out_ldb";
326         const char *extended_dn_module_fds = "extended_dn_out_fds";
327         const char *extended_dn_module_openldap = "extended_dn_out_openldap";
328         const char *extended_dn_in_module = "extended_dn_in";
329
330         static const char *modules_list2[] = {"dns_notify",
331                                               "show_deleted",
332                                               "new_partition",
333                                               "partition",
334                                               NULL };
335
336         const char **backend_modules;
337         static const char *fedora_ds_backend_modules[] = {
338                 "dsdb_flags_ignore", "nsuniqueid", "paged_searches", "simple_dn", NULL };
339         static const char *openldap_backend_modules[] = {
340                 "dsdb_flags_ignore", "entryuuid", "simple_dn", NULL };
341
342         static const char *samba_dsdb_attrs[] = { "backendType",
343                                                   SAMBA_COMPATIBLE_FEATURES_ATTR,
344                                                   SAMBA_REQUIRED_FEATURES_ATTR, NULL };
345         static const char *indexlist_attrs[] = { SAMBA_FEATURES_SUPPORTED_FLAG, NULL };
346         static const char *partition_attrs[] = { "ldapBackend", NULL };
347         const char *backendType, *backendUrl;
348         bool use_sasl_external = false;
349
350         const char *current_supportedFeatures[] = {SAMBA_SORTED_LINKS_FEATURE};
351
352         if (!tmp_ctx) {
353                 return ldb_oom(ldb);
354         }
355
356         ret = ldb_register_samba_handlers(ldb);
357         if (ret != LDB_SUCCESS) {
358                 talloc_free(tmp_ctx);
359                 return ret;
360         }
361
362         samba_dsdb_dn = ldb_dn_new(tmp_ctx, ldb, "@SAMBA_DSDB");
363         if (!samba_dsdb_dn) {
364                 talloc_free(tmp_ctx);
365                 return ldb_oom(ldb);
366         }
367
368         indexlist_dn = ldb_dn_new(tmp_ctx, ldb, "@INDEXLIST");
369         if (!samba_dsdb_dn) {
370                 talloc_free(tmp_ctx);
371                 return ldb_oom(ldb);
372         }
373
374         partition_dn = ldb_dn_new(tmp_ctx, ldb, DSDB_PARTITION_DN);
375         if (!partition_dn) {
376                 talloc_free(tmp_ctx);
377                 return ldb_oom(ldb);
378         }
379
380 #define CHECK_LDB_RET(check_ret)                                \
381         do {                                                    \
382                 if (check_ret != LDB_SUCCESS) {                 \
383                         talloc_free(tmp_ctx);                   \
384                         return check_ret;                       \
385                 }                                               \
386         } while (0)
387
388         ret = dsdb_module_search_dn(module, tmp_ctx, &res, samba_dsdb_dn,
389                                     samba_dsdb_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
390         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
391                 backendType = "ldb";
392         } else if (ret == LDB_SUCCESS) {
393                 struct ldb_message_element *requiredFeatures;
394                 struct ldb_message_element *old_compatibleFeatures;
395
396                 backendType = ldb_msg_find_attr_as_string(res->msgs[0], "backendType", "ldb");
397
398                 requiredFeatures = ldb_msg_find_element(res->msgs[0], SAMBA_REQUIRED_FEATURES_ATTR);
399                 if (!check_required_features(requiredFeatures)) {
400                         ldb_set_errstring(
401                                 ldb,
402                                 "This Samba database was created with "
403                                 "a newer Samba version and is marked "
404                                 "with extra requiredFeatures in "
405                                 "@SAMBA_DSDB. This database can not "
406                                 "safely be read by this Samba version");
407                         return LDB_ERR_OPERATIONS_ERROR;
408                 }
409
410                 old_compatibleFeatures = ldb_msg_find_element(res->msgs[0],
411                                                               SAMBA_COMPATIBLE_FEATURES_ATTR);
412
413                 if (old_compatibleFeatures) {
414                         struct ldb_message *features_msg;
415                         struct ldb_message_element *features_el;
416                         int samba_options_supported = 0;
417                         ret = dsdb_module_search_dn(module, tmp_ctx, &res,
418                                                     indexlist_dn,
419                                                     indexlist_attrs,
420                                                     DSDB_FLAG_NEXT_MODULE, NULL);
421                         if (ret == LDB_SUCCESS) {
422                                 samba_options_supported
423                                         = ldb_msg_find_attr_as_int(res->msgs[0],
424                                                                    SAMBA_FEATURES_SUPPORTED_FLAG,
425                                                                    0);
426
427                         } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
428                                 /*
429                                  * If we don't have @INDEXLIST yet, then we
430                                  * are so early in set-up that we know this is
431                                  * a blank DB, so no need to wripe out old
432                                  * features
433                                  */
434                                 samba_options_supported = 1;
435                         }
436
437                         features_msg = ldb_msg_new(res);
438                         if (features_msg == NULL) {
439                                 return ldb_module_operr(module);
440                         }
441                         features_msg->dn = samba_dsdb_dn;
442
443                         ldb_msg_add_empty(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
444                                           LDB_FLAG_MOD_DELETE, &features_el);
445
446                         if (samba_options_supported == 1) {
447                                 for (i = 0;
448                                      old_compatibleFeatures && i < old_compatibleFeatures->num_values;
449                                      i++) {
450                                         for (j = 0;
451                                              j < ARRAY_SIZE(current_supportedFeatures); j++) {
452                                                 if (strcmp((char *)old_compatibleFeatures->values[i].data,
453                                                            current_supportedFeatures[j]) == 0) {
454                                                         break;
455                                                 }
456                                         }
457                                         if (j == ARRAY_SIZE(current_supportedFeatures)) {
458                                                 /*
459                                                  * Add to list of features to remove
460                                                  * (rather than all features)
461                                                  */
462                                                 ret = ldb_msg_add_value(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
463                                                                         &old_compatibleFeatures->values[i],
464                                                                         NULL);
465                                                 if (ret != LDB_SUCCESS) {
466                                                         return ret;
467                                                 }
468                                         }
469                                 }
470
471                                 if (features_el->num_values > 0) {
472                                         /* Delete by list */
473                                         ret = ldb_next_start_trans(module);
474                                         if (ret != LDB_SUCCESS) {
475                                                 return ret;
476                                         }
477                                         ret = dsdb_module_modify(module, features_msg, DSDB_FLAG_NEXT_MODULE, NULL);
478                                         if (ret != LDB_SUCCESS) {
479                                                 ldb_next_del_trans(module);
480                                                 return ret;
481                                         }
482                                         ret = ldb_next_end_trans(module);
483                                         if (ret != LDB_SUCCESS) {
484                                                 return ret;
485                                         }
486                                 }
487                         } else {
488                                 /* Delete all */
489                                 ret = ldb_next_start_trans(module);
490                                 if (ret != LDB_SUCCESS) {
491                                         return ret;
492                                 }
493                                 ret = dsdb_module_modify(module, features_msg, DSDB_FLAG_NEXT_MODULE, NULL);
494                                 if (ret != LDB_SUCCESS) {
495                                         ldb_next_del_trans(module);
496                                         return ret;
497                                 }
498                                 ret = ldb_next_end_trans(module);
499                                 if (ret != LDB_SUCCESS) {
500                                         return ret;
501                                 }
502                         }
503                 }
504
505         } else {
506                 talloc_free(tmp_ctx);
507                 return ret;
508         }
509
510         backend_modules = NULL;
511         if (strcasecmp(backendType, "ldb") == 0) {
512                 extended_dn_module = extended_dn_module_ldb;
513                 link_modules = tdb_modules_list;
514         } else {
515                 struct cli_credentials *cred;
516                 bool is_ldapi = false;
517
518                 ret = dsdb_module_search_dn(module, tmp_ctx, &res, partition_dn,
519                                             partition_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
520                 if (ret == LDB_SUCCESS) {
521                         backendUrl = ldb_msg_find_attr_as_string(res->msgs[0], "ldapBackend", "ldapi://");
522                         if (!strncasecmp(backendUrl, "ldapi://", sizeof("ldapi://")-1)) {
523                                 is_ldapi = true;
524                         }
525                 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
526                         talloc_free(tmp_ctx);
527                         return ret;
528                 }
529                 if (strcasecmp(backendType, "fedora-ds") == 0) {
530                         link_modules = fedora_ds_modules;
531                         backend_modules = fedora_ds_backend_modules;
532                         extended_dn_module = extended_dn_module_fds;
533                 } else if (strcasecmp(backendType, "openldap") == 0) {
534                         link_modules = openldap_modules;
535                         backend_modules = openldap_backend_modules;
536                         extended_dn_module = extended_dn_module_openldap;
537                         extended_dn_in_module = "extended_dn_in_openldap";
538                         if (is_ldapi) {
539                                 use_sasl_external = true;
540                         }
541                 } else {
542                         return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "invalid backend type");
543                 }
544                 ret = ldb_set_opaque(ldb, "readOnlySchema", (void*)1);
545                 if (ret != LDB_SUCCESS) {
546                         ldb_set_errstring(ldb, "Failed to set readOnlySchema opaque");
547                 }
548
549                 cred = ldb_get_opaque(ldb, "credentials");
550                 if (!cred || !cli_credentials_authentication_requested(cred)) {
551                         ret = set_ldap_credentials(ldb, use_sasl_external);
552                         if (ret != LDB_SUCCESS) {
553                                 return ret;
554                         }
555                 }
556         }
557
558 #define CHECK_MODULE_LIST \
559         do {                                                    \
560                 if (!final_module_list) {                       \
561                         talloc_free(tmp_ctx);                   \
562                         return ldb_oom(ldb);                    \
563                 }                                               \
564         } while (0)
565
566         final_module_list = str_list_copy_const(tmp_ctx, modules_list1);
567         CHECK_MODULE_LIST;
568
569         final_module_list = str_list_add_const(final_module_list, extended_dn_in_module);
570         CHECK_MODULE_LIST;
571
572         final_module_list = str_list_append_const(final_module_list, modules_list1a);
573         CHECK_MODULE_LIST;
574
575         final_module_list = str_list_append_const(final_module_list, link_modules);
576         CHECK_MODULE_LIST;
577
578         final_module_list = str_list_add_const(final_module_list, extended_dn_module);
579         CHECK_MODULE_LIST;
580
581         final_module_list = str_list_append_const(final_module_list, modules_list2);
582         CHECK_MODULE_LIST;
583
584
585         ret = read_at_rootdse_record(ldb, module, tmp_ctx, &rootdse_msg, NULL);
586         CHECK_LDB_RET(ret);
587
588         partition_msg = ldb_msg_new(tmp_ctx);
589         partition_msg->dn = ldb_dn_new(partition_msg, ldb, "@" DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME);
590
591         ret = prepare_modules_line(ldb, tmp_ctx,
592                                    rootdse_msg,
593                                    partition_msg, "schemaNamingContext",
594                                    "schema_data", backend_modules);
595         CHECK_LDB_RET(ret);
596
597         ret = prepare_modules_line(ldb, tmp_ctx,
598                                    rootdse_msg,
599                                    partition_msg, NULL,
600                                    NULL, backend_modules);
601         CHECK_LDB_RET(ret);
602
603         ret = ldb_set_opaque(ldb, DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME, partition_msg);
604         CHECK_LDB_RET(ret);
605
606         talloc_steal(ldb, partition_msg);
607
608         /* Now prepare the module chain.  Oddly, we must give it to ldb_load_modules_list in REVERSE */
609         for (len = 0; final_module_list[len]; len++) { /* noop */};
610
611         reverse_module_list = talloc_array(tmp_ctx, const char *, len+1);
612         if (!reverse_module_list) {
613                 talloc_free(tmp_ctx);
614                 return ldb_oom(ldb);
615         }
616         for (i=0; i < len; i++) {
617                 reverse_module_list[i] = final_module_list[(len - 1) - i];
618         }
619         reverse_module_list[i] = NULL;
620
621         /* The backend (at least until the partitions module
622          * reconfigures things) is the next module in the currently
623          * loaded chain */
624         backend_module = ldb_module_next(module);
625         ret = ldb_module_load_list(ldb, reverse_module_list, backend_module, &module_chain);
626         CHECK_LDB_RET(ret);
627
628         talloc_free(tmp_ctx);
629         /* Set this as the 'next' module, so that we effectivly append it to module chain */
630         ldb_module_set_next(module, module_chain);
631
632         ret = ldb_next_read_lock(module);
633         if (ret != LDB_SUCCESS) {
634                 return ret;
635         }
636
637         ret = ldb_next_init(module);
638
639         lock_ret = ldb_next_read_unlock(module);
640
641         if (lock_ret != LDB_SUCCESS) {
642                 return lock_ret;
643         }
644
645         return ret;
646 }
647
648 static const struct ldb_module_ops ldb_samba_dsdb_module_ops = {
649         .name              = "samba_dsdb",
650         .init_context      = samba_dsdb_init,
651 };
652
653 static struct ldb_message *dsdb_flags_ignore_fixup(TALLOC_CTX *mem_ctx,
654                                                 const struct ldb_message *_msg)
655 {
656         struct ldb_message *msg = NULL;
657         unsigned int i;
658
659         /* we have to copy the message as the caller might have it as a const */
660         msg = ldb_msg_copy_shallow(mem_ctx, _msg);
661         if (msg == NULL) {
662                 return NULL;
663         }
664
665         for (i=0; i < msg->num_elements;) {
666                 struct ldb_message_element *e = &msg->elements[i];
667
668                 if (!(e->flags & DSDB_FLAG_INTERNAL_FORCE_META_DATA)) {
669                         i++;
670                         continue;
671                 }
672
673                 e->flags &= ~DSDB_FLAG_INTERNAL_FORCE_META_DATA;
674
675                 if (e->num_values != 0) {
676                         i++;
677                         continue;
678                 }
679
680                 ldb_msg_remove_element(msg, e);
681         }
682
683         return msg;
684 }
685
686 static int dsdb_flags_ignore_add(struct ldb_module *module, struct ldb_request *req)
687 {
688         struct ldb_context *ldb = ldb_module_get_ctx(module);
689         struct ldb_request *down_req = NULL;
690         struct ldb_message *msg = NULL;
691         int ret;
692
693         msg = dsdb_flags_ignore_fixup(req, req->op.add.message);
694         if (msg == NULL) {
695                 return ldb_module_oom(module);
696         }
697
698         ret = ldb_build_add_req(&down_req, ldb, req,
699                                 msg,
700                                 req->controls,
701                                 req, dsdb_next_callback,
702                                 req);
703         LDB_REQ_SET_LOCATION(down_req);
704         if (ret != LDB_SUCCESS) {
705                 return ret;
706         }
707
708         /* go on with the call chain */
709         return ldb_next_request(module, down_req);
710 }
711
712 static int dsdb_flags_ignore_modify(struct ldb_module *module, struct ldb_request *req)
713 {
714         struct ldb_context *ldb = ldb_module_get_ctx(module);
715         struct ldb_request *down_req = NULL;
716         struct ldb_message *msg = NULL;
717         int ret;
718
719         msg = dsdb_flags_ignore_fixup(req, req->op.mod.message);
720         if (msg == NULL) {
721                 return ldb_module_oom(module);
722         }
723
724         ret = ldb_build_mod_req(&down_req, ldb, req,
725                                 msg,
726                                 req->controls,
727                                 req, dsdb_next_callback,
728                                 req);
729         LDB_REQ_SET_LOCATION(down_req);
730         if (ret != LDB_SUCCESS) {
731                 return ret;
732         }
733
734         /* go on with the call chain */
735         return ldb_next_request(module, down_req);
736 }
737
738 static const struct ldb_module_ops ldb_dsdb_flags_ignore_module_ops = {
739         .name   = "dsdb_flags_ignore",
740         .add    = dsdb_flags_ignore_add,
741         .modify = dsdb_flags_ignore_modify,
742 };
743
744 int ldb_samba_dsdb_module_init(const char *version)
745 {
746         int ret;
747         LDB_MODULE_CHECK_VERSION(version);
748         ret = ldb_register_module(&ldb_samba_dsdb_module_ops);
749         if (ret != LDB_SUCCESS) {
750                 return ret;
751         }
752         ret = ldb_register_module(&ldb_dsdb_flags_ignore_module_ops);
753         if (ret != LDB_SUCCESS) {
754                 return ret;
755         }
756         return LDB_SUCCESS;
757 }