fd432e202407b1fb565a5c3ec61766124361d934
[sfrench/samba-autobuild/.git] / source4 / dsdb / samdb / ldb_modules / samba_dsdb.c
1 /*
2    Samba4 module loading module
3
4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /*
21  *  Name: ldb
22  *
23  *  Component: Samba4 module loading module
24  *
25  *  Description: Implement a single 'module' in the ldb database,
26  *  which loads the remaining modules based on 'choice of configuration' attributes
27  *
28  *  This is to avoid forcing a reprovision of the ldb databases when we change the internal structure of the code
29  *
30  *  Author: Andrew Bartlett
31  */
32
33 #include "includes.h"
34 #include <ldb.h>
35 #include <ldb_errors.h>
36 #include <ldb_module.h>
37 #include "dsdb/samdb/ldb_modules/util.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "auth/credentials/credentials.h"
41 #include "param/secrets.h"
42 #include "lib/ldb-samba/ldb_wrap.h"
43
44 static int read_at_rootdse_record(struct ldb_context *ldb, struct ldb_module *module, TALLOC_CTX *mem_ctx,
45                                   struct ldb_message **msg, struct ldb_request *parent)
46 {
47         int ret;
48         static const char *rootdse_attrs[] = { "defaultNamingContext", "configurationNamingContext", "schemaNamingContext", NULL };
49         struct ldb_result *rootdse_res;
50         struct ldb_dn *rootdse_dn;
51         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
52         if (!tmp_ctx) {
53                 return ldb_oom(ldb);
54         }
55
56         rootdse_dn = ldb_dn_new(tmp_ctx, ldb, "@ROOTDSE");
57         if (!rootdse_dn) {
58                 talloc_free(tmp_ctx);
59                 return ldb_oom(ldb);
60         }
61
62         ret = dsdb_module_search_dn(module, tmp_ctx, &rootdse_res, rootdse_dn,
63                                     rootdse_attrs, DSDB_FLAG_NEXT_MODULE, parent);
64         if (ret != LDB_SUCCESS) {
65                 talloc_free(tmp_ctx);
66                 return ret;
67         }
68
69         talloc_steal(mem_ctx, rootdse_res->msgs);
70         *msg = rootdse_res->msgs[0];
71
72         talloc_free(tmp_ctx);
73
74         return ret;
75 }
76
77 static int prepare_modules_line(struct ldb_context *ldb,
78                                 TALLOC_CTX *mem_ctx,
79                                 const struct ldb_message *rootdse_msg,
80                                 struct ldb_message *msg, const char *backend_attr,
81                                 const char *backend_mod, const char **backend_mod_list)
82 {
83         int ret;
84         const char **backend_full_list;
85         const char *backend_dn;
86         char *mod_list_string;
87         char *full_string;
88         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
89         if (!tmp_ctx) {
90                 return ldb_oom(ldb);
91         }
92
93         if (backend_attr) {
94                 backend_dn = ldb_msg_find_attr_as_string(rootdse_msg, backend_attr, NULL);
95                 if (!backend_dn) {
96                         ldb_asprintf_errstring(ldb,
97                                                "samba_dsdb_init: "
98                                                "unable to read %s from %s:%s",
99                                                backend_attr, ldb_dn_get_linearized(rootdse_msg->dn),
100                                                ldb_errstring(ldb));
101                         return LDB_ERR_CONSTRAINT_VIOLATION;
102                 }
103         } else {
104                 backend_dn = "*";
105         }
106
107         if (backend_mod) {
108                 char **b = str_list_make_single(tmp_ctx, backend_mod);
109                 backend_full_list = discard_const_p(const char *, b);
110         } else {
111                 char **b = str_list_make_empty(tmp_ctx);
112                 backend_full_list = discard_const_p(const char *, b);
113         }
114         if (!backend_full_list) {
115                 talloc_free(tmp_ctx);
116                 return ldb_oom(ldb);
117         }
118
119         backend_full_list = str_list_append_const(backend_full_list, backend_mod_list);
120         if (!backend_full_list) {
121                 talloc_free(tmp_ctx);
122                 return ldb_oom(ldb);
123         }
124
125         mod_list_string = str_list_join(tmp_ctx, backend_full_list, ',');
126         if (!mod_list_string) {
127                 talloc_free(tmp_ctx);
128                 return ldb_oom(ldb);
129         }
130
131         full_string = talloc_asprintf(tmp_ctx, "%s:%s", backend_dn, mod_list_string);
132         ret = ldb_msg_add_steal_string(msg, "modules", full_string);
133         talloc_free(tmp_ctx);
134         return ret;
135 }
136
137 /*
138  * Force overwrite of the credentials with those
139  * specified in secrets.ldb, to connect across the
140  * ldapi socket to an LDAP backend
141  */
142
143 static int set_ldap_credentials(struct ldb_context *ldb, bool use_external)
144 {
145         const char *secrets_ldb_path, *sam_ldb_path;
146         char *private_dir, *p, *error_string;
147         struct ldb_context *secrets_ldb;
148         struct cli_credentials *cred;
149         struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
150         TALLOC_CTX *tmp_ctx = talloc_new(ldb);
151
152         if (!tmp_ctx) {
153                 return ldb_oom(ldb);
154         }
155
156         cred = cli_credentials_init(ldb);
157         if (!cred) {
158                 talloc_free(tmp_ctx);
159                 return ldb_oom(ldb);
160         }
161         cli_credentials_set_anonymous(cred);
162         if (use_external) {
163                 cli_credentials_set_forced_sasl_mech(cred, "EXTERNAL");
164         } else {
165                 cli_credentials_set_forced_sasl_mech(cred, "DIGEST-MD5");
166
167                 /*
168                  * We don't want to use krb5 to talk to our samdb - recursion
169                  * here would be bad, and this account isn't in the KDC
170                  * anyway
171                  */
172                 cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
173
174                 /*
175                  * Work out where *our* secrets.ldb is.  It must be in
176                  * the same directory as sam.ldb
177                  */
178                 sam_ldb_path = (const char *)ldb_get_opaque(ldb, "ldb_url");
179                 if (!sam_ldb_path) {
180                         talloc_free(tmp_ctx);
181                         return ldb_operr(ldb);
182                 }
183                 if (strncmp("tdb://", sam_ldb_path, 6) == 0) {
184                         sam_ldb_path += 6;
185                 }
186                 private_dir = talloc_strdup(tmp_ctx, sam_ldb_path);
187                 p = strrchr(private_dir, '/');
188                 if (p) {
189                         *p = '\0';
190                 } else {
191                         private_dir = talloc_strdup(tmp_ctx, ".");
192                 }
193
194                 secrets_ldb_path = talloc_asprintf(private_dir, "tdb://%s/secrets.ldb",
195                                                    private_dir);
196
197                 if (!secrets_ldb_path) {
198                         talloc_free(tmp_ctx);
199                         return ldb_oom(ldb);
200                 }
201
202                 /*
203                  * Now that we have found the location, connect to
204                  * secrets.ldb so we can read the SamDB Credentials
205                  * record
206                  */
207                 secrets_ldb = ldb_wrap_connect(tmp_ctx, NULL, lp_ctx, secrets_ldb_path,
208                                                NULL, NULL, 0);
209
210                 if (!NT_STATUS_IS_OK(cli_credentials_set_secrets(cred, NULL, secrets_ldb, NULL,
211                                                                  SECRETS_LDAP_FILTER, &error_string))) {
212                         ldb_asprintf_errstring(ldb, "Failed to read LDAP backend password from %s", secrets_ldb_path);
213                         talloc_free(tmp_ctx);
214                         return LDB_ERR_STRONG_AUTH_REQUIRED;
215                 }
216         }
217
218         /*
219          * Finally overwrite any supplied credentials with
220          * these ones, as only secrets.ldb contains the magic
221          * credentials to talk on the ldapi socket
222          */
223         if (ldb_set_opaque(ldb, "credentials", cred)) {
224                 talloc_free(tmp_ctx);
225                 return ldb_operr(ldb);
226         }
227         talloc_free(tmp_ctx);
228         return LDB_SUCCESS;
229 }
230
231 static int samba_dsdb_init(struct ldb_module *module)
232 {
233         struct ldb_context *ldb = ldb_module_get_ctx(module);
234         int ret, len, i, j;
235         TALLOC_CTX *tmp_ctx = talloc_new(module);
236         struct ldb_result *res;
237         struct ldb_message *rootdse_msg = NULL, *partition_msg;
238         struct ldb_dn *samba_dsdb_dn, *partition_dn, *indexlist_dn;
239         struct ldb_module *backend_module, *module_chain;
240         const char **final_module_list, **reverse_module_list;
241         /*
242           Add modules to the list to activate them by default
243           beware often order is important
244
245           Some Known ordering constraints:
246           - rootdse must be first, as it makes redirects from "" -> cn=rootdse
247           - extended_dn_in must be before objectclass.c, as it resolves the DN
248           - objectclass must be before password_hash and samldb since these LDB
249             modules require the expanded "objectClass" list
250           - objectclass must be before descriptor and acl, as both assume that
251             objectClass values are sorted
252           - objectclass_attrs must be behind operational in order to see all
253             attributes (the operational module protects and therefore
254             suppresses per default some important ones)
255           - partition must be last
256           - each partition has its own module list then
257
258           The list is presented here as a set of declarations to show the
259           stack visually - the code below then handles the creation of the list
260           based on the parameters loaded from the database.
261         */
262         static const char *modules_list1[] = {"resolve_oids",
263                                              "rootdse",
264                                              "dsdb_notification",
265                                              "schema_load",
266                                              "lazy_commit",
267                                              "dirsync",
268                                              "paged_results",
269                                              "vlv",
270                                              "ranged_results",
271                                              "anr",
272                                              "server_sort",
273                                              "asq",
274                                              "extended_dn_store",
275                                              NULL };
276         /* extended_dn_in or extended_dn_in_openldap goes here */
277         static const char *modules_list1a[] = {"objectclass",
278                                              "tombstone_reanimate",
279                                              "descriptor",
280                                              "acl",
281                                              "aclread",
282                                              "samldb",
283                                              "password_hash",
284                                              "instancetype",
285                                              "objectclass_attrs",
286                                              NULL };
287
288         const char **link_modules;
289         static const char *fedora_ds_modules[] = {
290                 "rdn_name", NULL };
291         static const char *openldap_modules[] = {
292                 NULL };
293         static const char *tdb_modules_list[] = {
294                 "rdn_name",
295                 "subtree_delete",
296                 "repl_meta_data",
297                 "operational",
298                 "subtree_rename",
299                 "linked_attributes",
300                 NULL};
301
302         const char *extended_dn_module;
303         const char *extended_dn_module_ldb = "extended_dn_out_ldb";
304         const char *extended_dn_module_fds = "extended_dn_out_fds";
305         const char *extended_dn_module_openldap = "extended_dn_out_openldap";
306         const char *extended_dn_in_module = "extended_dn_in";
307
308         static const char *modules_list2[] = {"dns_notify",
309                                               "show_deleted",
310                                               "new_partition",
311                                               "partition",
312                                               NULL };
313
314         const char **backend_modules;
315         static const char *fedora_ds_backend_modules[] = {
316                 "dsdb_flags_ignore", "nsuniqueid", "paged_searches", "simple_dn", NULL };
317         static const char *openldap_backend_modules[] = {
318                 "dsdb_flags_ignore", "entryuuid", "simple_dn", NULL };
319
320         static const char *samba_dsdb_attrs[] = { "backendType",
321                                                   SAMBA_COMPATIBLE_FEATURES_ATTR,
322                                                   SAMBA_REQUIRED_FEATURES_ATTR, NULL };
323         static const char *indexlist_attrs[] = { SAMBA_FEATURES_SUPPORTED_FLAG, NULL };
324         static const char *partition_attrs[] = { "ldapBackend", NULL };
325         const char *backendType, *backendUrl;
326         bool use_sasl_external = false;
327
328         const char *current_supportedFeatures[] = {};
329
330         if (!tmp_ctx) {
331                 return ldb_oom(ldb);
332         }
333
334         ret = ldb_register_samba_handlers(ldb);
335         if (ret != LDB_SUCCESS) {
336                 talloc_free(tmp_ctx);
337                 return ret;
338         }
339
340         samba_dsdb_dn = ldb_dn_new(tmp_ctx, ldb, "@SAMBA_DSDB");
341         if (!samba_dsdb_dn) {
342                 talloc_free(tmp_ctx);
343                 return ldb_oom(ldb);
344         }
345
346         indexlist_dn = ldb_dn_new(tmp_ctx, ldb, "@INDEXLIST");
347         if (!samba_dsdb_dn) {
348                 talloc_free(tmp_ctx);
349                 return ldb_oom(ldb);
350         }
351
352         partition_dn = ldb_dn_new(tmp_ctx, ldb, DSDB_PARTITION_DN);
353         if (!partition_dn) {
354                 talloc_free(tmp_ctx);
355                 return ldb_oom(ldb);
356         }
357
358 #define CHECK_LDB_RET(check_ret)                                \
359         do {                                                    \
360                 if (check_ret != LDB_SUCCESS) {                 \
361                         talloc_free(tmp_ctx);                   \
362                         return check_ret;                       \
363                 }                                               \
364         } while (0)
365
366         ret = dsdb_module_search_dn(module, tmp_ctx, &res, samba_dsdb_dn,
367                                     samba_dsdb_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
368         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
369                 backendType = "ldb";
370         } else if (ret == LDB_SUCCESS) {
371                 struct ldb_message_element *requiredFeatures;
372                 struct ldb_message_element *old_compatibleFeatures;
373
374                 backendType = ldb_msg_find_attr_as_string(res->msgs[0], "backendType", "ldb");
375
376                 requiredFeatures = ldb_msg_find_element(res->msgs[0], SAMBA_REQUIRED_FEATURES_ATTR);
377                 if (requiredFeatures != NULL) {
378                         ldb_set_errstring(ldb, "This Samba database was created with "
379                                           "a newer Samba version and is marked with "
380                                           "requiredFeatures in @SAMBA_DSDB.  "
381                                           "This database can not safely be read by this Samba version");
382                         return LDB_ERR_OPERATIONS_ERROR;
383                 }
384
385                 old_compatibleFeatures = ldb_msg_find_element(res->msgs[0],
386                                                               SAMBA_COMPATIBLE_FEATURES_ATTR);
387
388                 if (old_compatibleFeatures) {
389                         struct ldb_message *features_msg;
390                         struct ldb_message_element *features_el;
391
392                         features_msg = ldb_msg_new(res);
393                         if (features_msg == NULL) {
394                                 return ldb_module_operr(module);
395                         }
396                         features_msg->dn = samba_dsdb_dn;
397
398                         ldb_msg_add_empty(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
399                                           LDB_FLAG_MOD_DELETE, &features_el);
400
401                         for (i = 0;
402                              old_compatibleFeatures && i < old_compatibleFeatures->num_values;
403                              i++) {
404                                 for (j = 0;
405                                      j < ARRAY_SIZE(current_supportedFeatures); j++) {
406                                         if (strcmp((char *)old_compatibleFeatures->values[i].data,
407                                                    current_supportedFeatures[j]) == 0) {
408                                                 break;
409                                         }
410                                 }
411                                 if (j == ARRAY_SIZE(current_supportedFeatures)) {
412                                         /*
413                                          * Add to list of features to remove
414                                          * (rather than all features)
415                                          */
416                                         ret = ldb_msg_add_value(features_msg, SAMBA_COMPATIBLE_FEATURES_ATTR,
417                                                                 &old_compatibleFeatures->values[i],
418                                                                 NULL);
419                                         if (ret != LDB_SUCCESS) {
420                                                 return ret;
421                                         }
422                                 }
423                         }
424                         if (features_el->num_values > 0) {
425                                 /* Delete by list */
426                                 ret = ldb_next_start_trans(module);
427                                 if (ret != LDB_SUCCESS) {
428                                         return ret;
429                                 }
430                                 ret = dsdb_module_modify(module, features_msg, DSDB_FLAG_NEXT_MODULE, NULL);
431                                 if (ret != LDB_SUCCESS) {
432                                         ldb_next_del_trans(module);
433                                         return ret;
434                                 }
435                                 ret = ldb_next_end_trans(module);
436                                 if (ret != LDB_SUCCESS) {
437                                         return ret;
438                                 }
439                         }
440                 }
441
442         } else {
443                 talloc_free(tmp_ctx);
444                 return ret;
445         }
446
447         backend_modules = NULL;
448         if (strcasecmp(backendType, "ldb") == 0) {
449                 extended_dn_module = extended_dn_module_ldb;
450                 link_modules = tdb_modules_list;
451         } else {
452                 struct cli_credentials *cred;
453                 bool is_ldapi = false;
454
455                 ret = dsdb_module_search_dn(module, tmp_ctx, &res, partition_dn,
456                                             partition_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
457                 if (ret == LDB_SUCCESS) {
458                         backendUrl = ldb_msg_find_attr_as_string(res->msgs[0], "ldapBackend", "ldapi://");
459                         if (!strncasecmp(backendUrl, "ldapi://", sizeof("ldapi://")-1)) {
460                                 is_ldapi = true;
461                         }
462                 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
463                         talloc_free(tmp_ctx);
464                         return ret;
465                 }
466                 if (strcasecmp(backendType, "fedora-ds") == 0) {
467                         link_modules = fedora_ds_modules;
468                         backend_modules = fedora_ds_backend_modules;
469                         extended_dn_module = extended_dn_module_fds;
470                 } else if (strcasecmp(backendType, "openldap") == 0) {
471                         link_modules = openldap_modules;
472                         backend_modules = openldap_backend_modules;
473                         extended_dn_module = extended_dn_module_openldap;
474                         extended_dn_in_module = "extended_dn_in_openldap";
475                         if (is_ldapi) {
476                                 use_sasl_external = true;
477                         }
478                 } else {
479                         return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "invalid backend type");
480                 }
481                 ret = ldb_set_opaque(ldb, "readOnlySchema", (void*)1);
482                 if (ret != LDB_SUCCESS) {
483                         ldb_set_errstring(ldb, "Failed to set readOnlySchema opaque");
484                 }
485
486                 cred = ldb_get_opaque(ldb, "credentials");
487                 if (!cred || !cli_credentials_authentication_requested(cred)) {
488                         ret = set_ldap_credentials(ldb, use_sasl_external);
489                         if (ret != LDB_SUCCESS) {
490                                 return ret;
491                         }
492                 }
493         }
494
495 #define CHECK_MODULE_LIST \
496         do {                                                    \
497                 if (!final_module_list) {                       \
498                         talloc_free(tmp_ctx);                   \
499                         return ldb_oom(ldb);                    \
500                 }                                               \
501         } while (0)
502
503         final_module_list = str_list_copy_const(tmp_ctx, modules_list1);
504         CHECK_MODULE_LIST;
505
506         final_module_list = str_list_add_const(final_module_list, extended_dn_in_module);
507         CHECK_MODULE_LIST;
508
509         final_module_list = str_list_append_const(final_module_list, modules_list1a);
510         CHECK_MODULE_LIST;
511
512         final_module_list = str_list_append_const(final_module_list, link_modules);
513         CHECK_MODULE_LIST;
514
515         final_module_list = str_list_add_const(final_module_list, extended_dn_module);
516         CHECK_MODULE_LIST;
517
518         final_module_list = str_list_append_const(final_module_list, modules_list2);
519         CHECK_MODULE_LIST;
520
521
522         ret = read_at_rootdse_record(ldb, module, tmp_ctx, &rootdse_msg, NULL);
523         CHECK_LDB_RET(ret);
524
525         partition_msg = ldb_msg_new(tmp_ctx);
526         partition_msg->dn = ldb_dn_new(partition_msg, ldb, "@" DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME);
527
528         ret = prepare_modules_line(ldb, tmp_ctx,
529                                    rootdse_msg,
530                                    partition_msg, "schemaNamingContext",
531                                    "schema_data", backend_modules);
532         CHECK_LDB_RET(ret);
533
534         ret = prepare_modules_line(ldb, tmp_ctx,
535                                    rootdse_msg,
536                                    partition_msg, NULL,
537                                    NULL, backend_modules);
538         CHECK_LDB_RET(ret);
539
540         ret = ldb_set_opaque(ldb, DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME, partition_msg);
541         CHECK_LDB_RET(ret);
542
543         talloc_steal(ldb, partition_msg);
544
545         /* Now prepare the module chain.  Oddly, we must give it to ldb_load_modules_list in REVERSE */
546         for (len = 0; final_module_list[len]; len++) { /* noop */};
547
548         reverse_module_list = talloc_array(tmp_ctx, const char *, len+1);
549         if (!reverse_module_list) {
550                 talloc_free(tmp_ctx);
551                 return ldb_oom(ldb);
552         }
553         for (i=0; i < len; i++) {
554                 reverse_module_list[i] = final_module_list[(len - 1) - i];
555         }
556         reverse_module_list[i] = NULL;
557
558         /* The backend (at least until the partitions module
559          * reconfigures things) is the next module in the currently
560          * loaded chain */
561         backend_module = ldb_module_next(module);
562         ret = ldb_module_load_list(ldb, reverse_module_list, backend_module, &module_chain);
563         CHECK_LDB_RET(ret);
564
565         talloc_free(tmp_ctx);
566         /* Set this as the 'next' module, so that we effectivly append it to module chain */
567         ldb_module_set_next(module, module_chain);
568
569         return ldb_next_init(module);
570 }
571
572 static const struct ldb_module_ops ldb_samba_dsdb_module_ops = {
573         .name              = "samba_dsdb",
574         .init_context      = samba_dsdb_init,
575 };
576
577 static struct ldb_message *dsdb_flags_ignore_fixup(TALLOC_CTX *mem_ctx,
578                                                 const struct ldb_message *_msg)
579 {
580         struct ldb_message *msg = NULL;
581         unsigned int i;
582
583         /* we have to copy the message as the caller might have it as a const */
584         msg = ldb_msg_copy_shallow(mem_ctx, _msg);
585         if (msg == NULL) {
586                 return NULL;
587         }
588
589         for (i=0; i < msg->num_elements;) {
590                 struct ldb_message_element *e = &msg->elements[i];
591
592                 if (!(e->flags & DSDB_FLAG_INTERNAL_FORCE_META_DATA)) {
593                         i++;
594                         continue;
595                 }
596
597                 e->flags &= ~DSDB_FLAG_INTERNAL_FORCE_META_DATA;
598
599                 if (e->num_values != 0) {
600                         i++;
601                         continue;
602                 }
603
604                 ldb_msg_remove_element(msg, e);
605         }
606
607         return msg;
608 }
609
610 static int dsdb_flags_ignore_add(struct ldb_module *module, struct ldb_request *req)
611 {
612         struct ldb_context *ldb = ldb_module_get_ctx(module);
613         struct ldb_request *down_req = NULL;
614         struct ldb_message *msg = NULL;
615         int ret;
616
617         msg = dsdb_flags_ignore_fixup(req, req->op.add.message);
618         if (msg == NULL) {
619                 return ldb_module_oom(module);
620         }
621
622         ret = ldb_build_add_req(&down_req, ldb, req,
623                                 msg,
624                                 req->controls,
625                                 req, dsdb_next_callback,
626                                 req);
627         LDB_REQ_SET_LOCATION(down_req);
628         if (ret != LDB_SUCCESS) {
629                 return ret;
630         }
631
632         /* go on with the call chain */
633         return ldb_next_request(module, down_req);
634 }
635
636 static int dsdb_flags_ignore_modify(struct ldb_module *module, struct ldb_request *req)
637 {
638         struct ldb_context *ldb = ldb_module_get_ctx(module);
639         struct ldb_request *down_req = NULL;
640         struct ldb_message *msg = NULL;
641         int ret;
642
643         msg = dsdb_flags_ignore_fixup(req, req->op.mod.message);
644         if (msg == NULL) {
645                 return ldb_module_oom(module);
646         }
647
648         ret = ldb_build_mod_req(&down_req, ldb, req,
649                                 msg,
650                                 req->controls,
651                                 req, dsdb_next_callback,
652                                 req);
653         LDB_REQ_SET_LOCATION(down_req);
654         if (ret != LDB_SUCCESS) {
655                 return ret;
656         }
657
658         /* go on with the call chain */
659         return ldb_next_request(module, down_req);
660 }
661
662 static const struct ldb_module_ops ldb_dsdb_flags_ignore_module_ops = {
663         .name   = "dsdb_flags_ignore",
664         .add    = dsdb_flags_ignore_add,
665         .modify = dsdb_flags_ignore_modify,
666 };
667
668 int ldb_samba_dsdb_module_init(const char *version)
669 {
670         int ret;
671         LDB_MODULE_CHECK_VERSION(version);
672         ret = ldb_register_module(&ldb_samba_dsdb_module_ops);
673         if (ret != LDB_SUCCESS) {
674                 return ret;
675         }
676         ret = ldb_register_module(&ldb_dsdb_flags_ignore_module_ops);
677         if (ret != LDB_SUCCESS) {
678                 return ret;
679         }
680         return LDB_SUCCESS;
681 }