source4/libnet/libnet_become_dc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "libcli/composite/composite.h"
  23 #include "libcli/cldap/cldap.h"
  24 #include "lib/ldb/include/ldb.h"
  25 #include "lib/ldb/include/ldb_errors.h"
  26 #include "lib/ldb_wrap.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "../libds/common/flags.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  30 #include "libcli/security/security.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "librpc/gen_ndr/ndr_security.h"
  33 #include "librpc/gen_ndr/ndr_nbt.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "param/param.h"
  37
  38 /*****************************************************************************
  39  * Windows 2003 (w2k3) does the following steps when changing the server role
  40  * from domain member to domain controller
  41  *
  42  * We mostly do the same.
  43  *****************************************************************************/
  44
  45 /*
  46  * lookup DC:
  47  * - using nbt name<1C> request and a samlogon mailslot request
  48  * or
  49  * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
  50  *
  51  * see: becomeDC_recv_cldap() and becomeDC_send_cldap()
  52  */
  53
  54 /*
  55  * Open 1st LDAP connection to the DC using admin credentials
  56  *
  57  * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect()
  58  */
  59
  60 /*
  61  * LDAP search 1st LDAP connection:
  62  *
  63  * see: becomeDC_ldap1_rootdse()
  64  *
  65  * Request:
  66  *      basedn: ""
  67  *      scope:  base
  68  *      filter: (objectClass=*)
  69  *      attrs:  *
  70  * Result:
  71  *      ""
  72  *              currentTime:            20061202155100.0Z
  73  *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
  74  *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  75  *              namingContexts:         <domain_partition>
  76  *                                      CN=Configuration,<domain_partition>
  77  *                                      CN=Schema,CN=Configuration,<domain_partition>
  78  *              defaultNamingContext:   <domain_partition>
  79  *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
  80  *              configurationNamingContext:CN=Configuration,<domain_partition>
  81  *              rootDomainNamingContext:<domain_partition>
  82  *              supportedControl:       ...
  83  *              supportedLDAPVersion:   3
  84  *                                      2
  85  *              supportedLDAPPolicies:  ...
  86  *              highestCommitedUSN:     ...
  87  *              supportedSASLMechanisms:GSSAPI
  88  *                                      GSS-SPNEGO
  89  *                                      EXTERNAL
  90  *                                      DIGEST-MD5
  91  *              dnsHostName:            <dns_host_name>
  92  *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
  93  *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
  94  *              supportedCapabilities:  ...
  95  *              isSyncronized:          TRUE
  96  *              isGlobalCatalogReady:   TRUE
  97  *              domainFunctionality:    0
  98  *              forestFunctionality:    0
  99  *              domainControllerFunctionality: 2
 100  */
 101
 102 /*
 103  * LDAP search 1st LDAP connection:
 104  *
 105  * see: becomeDC_ldap1_crossref_behavior_version()
 106  *
 107  * Request:
 108  *      basedn: CN=Configuration,<domain_partition>
 109  *      scope:  one
 110  *      filter: (cn=Partitions)
 111  *      attrs:  msDS-Behavior-Version
 112  * Result:
 113  *      CN=Partitions,CN=Configuration,<domain_partition>
 114  *              msDS-Behavior-Version:  0
 115  */
 116
 117 /*
 118  * LDAP search 1st LDAP connection:
 119  *
 120  * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 121  *
 122  * not implemented here
 123  *
 124  * Request:
 125  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 126  *      scope:  one
 127  *      filter: (cn=Partitions)
 128  *      attrs:  msDS-Behavior-Version
 129  * Result:
 130  *      <none>
 131  *
 132  */
 133
 134 /*
 135  * LDAP search 1st LDAP connection:
 136  *
 137  * see: becomeDC_ldap1_domain_behavior_version()
 138  *
 139  * Request:
 140  *      basedn: <domain_partition>
 141  *      scope:  base
 142  *      filter: (objectClass=*)
 143  *      attrs:  msDS-Behavior-Version
 144  * Result:
 145  *      <domain_partition>
 146  *              msDS-Behavior-Version:  0
 147  */
 148
 149 /*
 150  * LDAP search 1st LDAP connection:
 151  *
 152  * see: becomeDC_ldap1_schema_object_version()
 153  *
 154  * Request:
 155  *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 156  *      scope:  base
 157  *      filter: (objectClass=*)
 158  *      attrs:  objectVersion
 159  * Result:
 160  *      CN=Schema,CN=Configuration,<domain_partition>
 161  *              objectVersion:  30
 162  */
 163
 164 /*
 165  * LDAP search 1st LDAP connection:
 166  *
 167  * not implemented, because the information is already there
 168  *
 169  * Request:
 170  *      basedn: ""
 171  *      scope:  base
 172  *      filter: (objectClass=*)
 173  *      attrs:  defaultNamingContext
 174  *              dnsHostName
 175  * Result:
 176  *      ""
 177  *              defaultNamingContext:   <domain_partition>
 178  *              dnsHostName:            <dns_host_name>
 179  */
 180
 181 /*
 182  * LDAP search 1st LDAP connection:
 183  *
 184  * see: becomeDC_ldap1_infrastructure_fsmo()
 185  *
 186  * Request:
 187  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 188  *      scope:  base
 189  *      filter: (objectClass=*)
 190  *      attrs:  1.1
 191  * Result:
 192  *      CN=Infrastructure,<domain_partition>
 193  */
 194
 195 /*
 196  * LDAP search 1st LDAP connection:
 197  *
 198  * see: becomeDC_ldap1_w2k3_update_revision()
 199  *
 200  * Request:
 201  *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 202  *      scope:  base
 203  *      filter: (objectClass=*)
 204  *      attrs:  revision
 205  * Result:
 206  *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 207  *              revision:       8
 208  */
 209
 210 /*
 211  * LDAP search 1st LDAP connection:
 212  *
 213  * see: becomeDC_ldap1_infrastructure_fsmo()
 214  *
 215  * Request:
 216  *      basedn: CN=Infrastructure,<domain_partition>
 217  *      scope:  base
 218  *      filter: (objectClass=*)
 219  *      attrs:  fSMORoleOwner
 220  * Result:
 221  *      CN=Infrastructure,<domain_partition>
 222  *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 223  */
 224
 225 /*
 226  * LDAP search 1st LDAP connection:
 227  *
 228  * see: becomeDC_ldap1_infrastructure_fsmo()
 229  *
 230  * Request:
 231  *      basedn: <infrastructure_fsmo_server_object>
 232  *      scope:  base
 233  *      filter: (objectClass=*)
 234  *      attrs:  dnsHostName
 235  * Result:
 236  *      <infrastructure_fsmo_server_object>
 237  *              dnsHostName:    <dns_host_name>
 238  */
 239
 240 /*
 241  * LDAP search 1st LDAP connection:
 242  *
 243  * see: becomeDC_ldap1_infrastructure_fsmo()
 244  *
 245  * Request:
 246  *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 247  *      scope:  base
 248  *      filter: (objectClass=*)
 249  *      attrs:  objectGUID
 250  * Result:
 251  *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 252  *              objectGUID:     <object_guid>
 253  */
 254
 255 /*
 256  * LDAP search 1st LDAP connection:
 257  *
 258  * see: becomeDC_ldap1_rid_manager_fsmo()
 259  *
 260  * Request:
 261  *      basedn: <domain_partition>
 262  *      scope:  base
 263  *      filter: (objectClass=*)
 264  *      attrs:  rIDManagerReference
 265  * Result:
 266  *      <domain_partition>
 267  *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 268  */
 269
 270 /*
 271  * LDAP search 1st LDAP connection:
 272  *
 273  * see: becomeDC_ldap1_rid_manager_fsmo()
 274  *
 275  * Request:
 276  *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 277  *      scope:  base
 278  *      filter: (objectClass=*)
 279  *      attrs:  fSMORoleOwner
 280  * Result:
 281  *      CN=Infrastructure,<domain_partition>
 282  *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 283  */
 284
 285 /*
 286  * LDAP search 1st LDAP connection:
 287  *
 288  * see: becomeDC_ldap1_rid_manager_fsmo()
 289  *
 290  * Request:
 291  *      basedn: <rid_manager_fsmo_server_object>
 292  *      scope:  base
 293  *      filter: (objectClass=*)
 294  *      attrs:  dnsHostName
 295  * Result:
 296  *      <rid_manager_fsmo_server_object>
 297  *              dnsHostName:    <dns_host_name>
 298  */
 299
 300 /*
 301  * LDAP search 1st LDAP connection:
 302  *
 303  * see: becomeDC_ldap1_rid_manager_fsmo()
 304  *
 305  * Request:
 306  *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 307  *      scope:  base
 308  *      filter: (objectClass=*)
 309  *      attrs:  msDs-ReplicationEpoch
 310  * Result:
 311  *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 312  */
 313
 314 /*
 315  * LDAP search 1st LDAP connection:
 316  *
 317  * see: becomeDC_ldap1_site_object()
 318  *
 319  * Request:
 320  *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 321  *      scope:  base
 322  *      filter: (objectClass=*)
 323  *      attrs:
 324  * Result:
 325  *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 326  *              objectClass:    top
 327  *                              site
 328  *              cn:             <new_dc_site_name>
 329  *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 330  *              instanceType:   4
 331  *              whenCreated:    ...
 332  *              whenChanged:    ...
 333  *              uSNCreated:     ...
 334  *              uSNChanged:     ...
 335  *              showInAdvancedViewOnly: TRUE
 336  *              name:           <new_dc_site_name>
 337  *              objectGUID:     <object_guid>
 338  *              systemFlags:    1107296256 <0x42000000>
 339  *              objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
 340  */
 341
 342 /***************************************************************
 343  * Add this stage we call the check_options() callback function
 344  * of the caller, to see if he wants us to continue
 345  *
 346  * see: becomeDC_check_options()
 347  ***************************************************************/
 348
 349 /*
 350  * LDAP search 1st LDAP connection:
 351  *
 352  * see: becomeDC_ldap1_computer_object()
 353  *
 354  * Request:
 355  *      basedn: <domain_partition>
 356  *      scope:  sub
 357  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 358  *      attrs:  distinguishedName
 359  *              userAccountControl
 360  * Result:
 361  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 362  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 363  *              userAccoountControl:    4096 <0x1000>
 364  */
 365
 366 /*
 367  * LDAP search 1st LDAP connection:
 368  *
 369  * see: becomeDC_ldap1_server_object_1()
 370  *
 371  * Request:
 372  *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 373  *      scope:  base
 374  *      filter: (objectClass=*)
 375  *      attrs:
 376  * Result:
 377  *      <noSuchObject>
 378  *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 379  */
 380
 381 /*
 382  * LDAP search 1st LDAP connection:
 383  *
 384  * see: becomeDC_ldap1_server_object_2()
 385  *
 386  * Request:
 387  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 388  *      scope:  base
 389  *      filter: (objectClass=*)
 390  *      attrs:  serverReferenceBL
 391  *      typesOnly: TRUE!!!
 392  * Result:
 393  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 394  */
 395
 396 /*
 397  * LDAP add 1st LDAP connection:
 398  *
 399  * see: becomeDC_ldap1_server_object_add()
 400  *
 401  * Request:
 402  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 403  *      objectClass:    server
 404  *      systemFlags:    50000000 <0x2FAF080>
 405  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 406  * Result:
 407  *      <success>
 408  */
 409
 410 /*
 411  * LDAP search 1st LDAP connection:
 412  *
 413  * not implemented, maybe we can add that later
 414  *
 415  * Request:
 416  *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 417  *      scope:  base
 418  *      filter: (objectClass=*)
 419  *      attrs:
 420  * Result:
 421  *      <noSuchObject>
 422  *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 423  */
 424
 425 /*
 426  * LDAP search 1st LDAP connection:
 427  *
 428  * not implemented because it gives no new information
 429  *
 430  * Request:
 431  *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 432  *      scope:  sub
 433  *      filter: (nCName=<domain_partition>)
 434  *      attrs:  nCName
 435  *              dnsRoot
 436  *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 437  * Result:
 438  *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 439  *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 440  *              dnsRoot:        <domain_dns_name>
 441  */
 442
 443 /*
 444  * LDAP modify 1st LDAP connection:
 445  *
 446  * see: becomeDC_ldap1_server_object_modify()
 447  *
 448  * Request (add):
 449  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 450  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 451  * Result:
 452  *      <attributeOrValueExist>
 453  */
 454
 455 /*
 456  * LDAP modify 1st LDAP connection:
 457  *
 458  * see: becomeDC_ldap1_server_object_modify()
 459  *
 460  * Request (replace):
 461  *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 462  *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 463  * Result:
 464  *      <success>
 465  */
 466
 467 /*
 468  * Open 1st DRSUAPI connection to the DC using admin credentials
 469  * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 470  * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 471  *
 472  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(),
 473  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv()
 474  */
 475
 476 /*
 477  * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 478  * on the 1st DRSUAPI connection
 479  *
 480  * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv()
 481  */
 482
 483 /***************************************************************
 484  * Add this stage we call the prepare_db() callback function
 485  * of the caller, to see if he wants us to continue
 486  *
 487  * see: becomeDC_prepare_db()
 488  ***************************************************************/
 489
 490 /*
 491  * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 492  * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 493  *   on the 2nd connection
 494  *
 495  * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(),
 496  *      becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv()
 497  *      and becomeDC_drsuapi3_connect_recv()
 498  */
 499
 500 /*
 501  * replicate CN=Schema,CN=Configuration,...
 502  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 503  *
 504  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 505  *      becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv()
 506  *
 507  ***************************************************************
 508  * Add this stage we call the schema_chunk() callback function
 509  * for each replication message
 510  ***************************************************************/
 511
 512 /*
 513  * replicate CN=Configuration,...
 514  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 515  *
 516  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 517  *      becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv()
 518  *
 519  ***************************************************************
 520  * Add this stage we call the config_chunk() callback function
 521  * for each replication message
 522  ***************************************************************/
 523
 524 /*
 525  * LDAP unbind on the 1st LDAP connection
 526  *
 527  * not implemented, because it's not needed...
 528  */
 529
 530 /*
 531  * Open 2nd LDAP connection to the DC using admin credentials
 532  *
 533  * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect()
 534  */
 535
 536 /*
 537  * LDAP search 2nd LDAP connection:
 538  *
 539  * not implemented because it gives no new information
 540  * same as becomeDC_ldap1_computer_object()
 541  *
 542  * Request:
 543  *      basedn: <domain_partition>
 544  *      scope:  sub
 545  *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 546  *      attrs:  distinguishedName
 547  *              userAccountControl
 548  * Result:
 549  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 550  *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 551  *              userAccoountControl:    4096 <0x00001000>
 552  */
 553
 554 /*
 555  * LDAP search 2nd LDAP connection:
 556  *
 557  * not implemented because it gives no new information
 558  * same as becomeDC_ldap1_computer_object()
 559  *
 560  * Request:
 561  *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 562  *      scope:  base
 563  *      filter: (objectClass=*)
 564  *      attrs:  userAccountControl
 565  * Result:
 566  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 567  *              userAccoountControl:    4096 <0x00001000>
 568  */
 569
 570 /*
 571  * LDAP modify 2nd LDAP connection:
 572  *
 573  * see: becomeDC_ldap2_modify_computer()
 574  *
 575  * Request (replace):
 576  *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 577  *      userAccoountControl:    532480 <0x82000>
 578  * Result:
 579  *      <success>
 580  */
 581
 582 /*
 583  * LDAP search 2nd LDAP connection:
 584  *
 585  * see: becomeDC_ldap2_move_computer()
 586  *
 587  * Request:
 588  *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>>
 589  *      scope:  base
 590  *      filter: (objectClass=*)
 591  *      attrs:  1.1
 592  * Result:
 593  *      CN=Domain Controllers,<domain_partition>
 594  */
 595
 596 /*
 597  * LDAP search 2nd LDAP connection:
 598  *
 599  * not implemented because it gives no new information
 600  *
 601  * Request:
 602  *      basedn: CN=Domain Controllers,<domain_partition>
 603  *      scope:  base
 604  *      filter: (objectClass=*)
 605  *      attrs:  distinguishedName
 606  * Result:
 607  *      CN=Domain Controller,<domain_partition>
 608  *              distinguishedName:      CN=Domain Controllers,<domain_partition>
 609  */
 610
 611 /*
 612  * LDAP modifyRDN 2nd LDAP connection:
 613  *
 614  * see: becomeDC_ldap2_move_computer()
 615  *
 616  * Request:
 617  *      entry:          CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 618  *      newrdn:         CN=<new_dc_netbios_name>
 619  *      deleteoldrdn:   TRUE
 620  *      newparent:      CN=Domain Controllers,<domain_partition>
 621  * Result:
 622  *      <success>
 623  */
 624
 625 /*
 626  * LDAP unbind on the 2nd LDAP connection
 627  *
 628  * not implemented, because it's not needed...
 629  */
 630
 631 /*
 632  * replicate Domain Partition
 633  * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
 634  *
 635  * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(),
 636  *      becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv()
 637  *
 638  ***************************************************************
 639  * Add this stage we call the domain_chunk() callback function
 640  * for each replication message
 641  ***************************************************************/
 642
 643 /* call DsReplicaUpdateRefs() for all partitions like this:
 644  *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 645  *
 646  *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 647  *                     __ndr_size               : 0x000000ae (174)
 648  *                     __ndr_size_sid           : 0x00000000 (0)
 649  *                     guid                     : 00000000-0000-0000-0000-000000000000
 650  *                     sid                      : S-0-0
 651  *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 652  *
 653  *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 654  *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 655  *           options                  : 0x0000001c (28)
 656  *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 657  *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 658  *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 659  *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 660  *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 661  *
 662  * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 663  * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 664  * on the 2nd!!! DRSUAPI connection
 665  *
 666  * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(),
 667  *      becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv()
 668  */
 669
 670 /*
 671  * Windows does opens the 4th and 5th DRSUAPI connection...
 672  * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
 673  * on the 4th connection
 674  *
 675  * and then 2 full replications of the domain partition on the 5th connection
 676  * with the bind_handle from the 4th connection
 677  *
 678  * not implemented because it gives no new information
 679  */
 680
 681 struct libnet_BecomeDC_state {
 682         struct composite_context *creq;
 683
 684         struct libnet_context *libnet;
 685
 686         struct dom_sid zero_sid;
 687
 688         struct {
 689                 struct cldap_socket *sock;
 690                 struct cldap_netlogon io;
 691                 struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon;
 692         } cldap;
 693
 694         struct becomeDC_ldap {
 695                 struct ldb_context *ldb;
 696                 const struct ldb_message *rootdse;
 697         } ldap1, ldap2;
 698
 699         struct becomeDC_drsuapi {
 700                 struct libnet_BecomeDC_state *s;
 701                 struct dcerpc_binding *binding;
 702                 struct dcerpc_pipe *pipe;
 703                 DATA_BLOB gensec_skey;
 704                 struct drsuapi_DsBind bind_r;
 705                 struct GUID bind_guid;
 706                 struct drsuapi_DsBindInfoCtr bind_info_ctr;
 707                 struct drsuapi_DsBindInfo28 local_info28;
 708                 struct drsuapi_DsBindInfo28 remote_info28;
 709                 struct policy_handle bind_handle;
 710         } drsuapi1, drsuapi2, drsuapi3;
 711
 712         struct libnet_BecomeDC_Domain domain;
 713         struct libnet_BecomeDC_Forest forest;
 714         struct libnet_BecomeDC_SourceDSA source_dsa;
 715         struct libnet_BecomeDC_DestDSA dest_dsa;
 716
 717         struct libnet_BecomeDC_Partition schema_part, config_part, domain_part;
 718
 719         struct becomeDC_fsmo {
 720                 const char *dns_name;
 721                 const char *server_dn_str;
 722                 const char *ntds_dn_str;
 723                 struct GUID ntds_guid;
 724         } infrastructure_fsmo;
 725
 726         struct becomeDC_fsmo rid_manager_fsmo;
 727
 728         struct libnet_BecomeDC_CheckOptions _co;
 729         struct libnet_BecomeDC_PrepareDB _pp;
 730         struct libnet_BecomeDC_StoreChunk _sc;
 731         struct libnet_BecomeDC_Callbacks callbacks;
 732 };
 733
 734 static int32_t get_dc_function_level(struct loadparm_context *lp_ctx)
 735 {
 736         /* per default we are (Windows) 2008 compatible */
 737         return lp_parm_int(lp_ctx, NULL, "ads", "dc function level",
 738                 DS_DC_FUNCTION_2008);
 739 }
 740
 741 static int32_t get_min_function_level(struct loadparm_context *lp_ctx)
 742 {
 743         /* per default it is (Windows) 2003 Native compatible */
 744         return lp_parm_int(lp_ctx, NULL, "ads", "min function level",
 745                 DS_DOMAIN_FUNCTION_2003);
 746 }
 747
 748 static void becomeDC_recv_cldap(struct tevent_req *req);
 749
 750 static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s)
 751 {
 752         struct composite_context *c = s->creq;
 753         struct tevent_req *req;
 754
 755         s->cldap.io.in.dest_address     = s->source_dsa.address;
 756         s->cldap.io.in.dest_port        = lp_cldap_port(s->libnet->lp_ctx);
 757         s->cldap.io.in.realm            = s->domain.dns_name;
 758         s->cldap.io.in.host             = s->dest_dsa.netbios_name;
 759         s->cldap.io.in.user             = NULL;
 760         s->cldap.io.in.domain_guid      = NULL;
 761         s->cldap.io.in.domain_sid       = NULL;
 762         s->cldap.io.in.acct_control     = -1;
 763         s->cldap.io.in.version          = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 764         s->cldap.io.in.map_response     = true;
 765
 766         c->status = cldap_socket_init(s, s->libnet->event_ctx,
 767                                       NULL, NULL, &s->cldap.sock);//TODO
 768         if (!composite_is_ok(c)) return;
 769
 770         req = cldap_netlogon_send(s, s->cldap.sock, &s->cldap.io);
 771         if (composite_nomem(req, c)) return;
 772         tevent_req_set_callback(req, becomeDC_recv_cldap, s);
 773 }
 774
 775 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s);
 776
 777 static void becomeDC_recv_cldap(struct tevent_req *req)
 778 {
 779         struct libnet_BecomeDC_state *s = tevent_req_callback_data(req,
 780                                           struct libnet_BecomeDC_state);
 781         struct composite_context *c = s->creq;
 782
 783         c->status = cldap_netlogon_recv(req,
 784                                         lp_iconv_convenience(s->libnet->lp_ctx),
 785                                         s, &s->cldap.io);
 786         talloc_free(req);
 787         if (!composite_is_ok(c)) return;
 788
 789         s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex;
 790
 791         s->domain.dns_name              = s->cldap.netlogon.dns_domain;
 792         s->domain.netbios_name          = s->cldap.netlogon.domain;
 793         s->domain.guid                  = s->cldap.netlogon.domain_uuid;
 794
 795         s->forest.dns_name              = s->cldap.netlogon.forest;
 796
 797         s->source_dsa.dns_name          = s->cldap.netlogon.pdc_dns_name;
 798         s->source_dsa.netbios_name      = s->cldap.netlogon.pdc_name;
 799         s->source_dsa.site_name         = s->cldap.netlogon.server_site;
 800
 801         s->dest_dsa.site_name           = s->cldap.netlogon.client_site;
 802
 803         becomeDC_connect_ldap1(s);
 804 }
 805
 806 static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s,
 807                                       struct becomeDC_ldap *ldap)
 808 {
 809         char *url;
 810
 811         url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
 812         NT_STATUS_HAVE_NO_MEMORY(url);
 813
 814         ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url,
 815                                      NULL,
 816                                      s->libnet->cred,
 817                                      0, NULL);
 818         talloc_free(url);
 819         if (ldap->ldb == NULL) {
 820                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 821         }
 822
 823         return NT_STATUS_OK;
 824 }
 825
 826 static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s)
 827 {
 828         int ret;
 829         struct ldb_result *r;
 830         struct ldb_dn *basedn;
 831         static const char *attrs[] = {
 832                 "*",
 833                 NULL
 834         };
 835
 836         basedn = ldb_dn_new(s, s->ldap1.ldb, NULL);
 837         NT_STATUS_HAVE_NO_MEMORY(basedn);
 838
 839         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 840                          "(objectClass=*)");
 841         talloc_free(basedn);
 842         if (ret != LDB_SUCCESS) {
 843                 return NT_STATUS_LDAP(ret);
 844         } else if (r->count != 1) {
 845                 talloc_free(r);
 846                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 847         }
 848
 849         s->ldap1.rootdse = r->msgs[0];
 850
 851         s->domain.dn_str        = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL);
 852         if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 853
 854         s->forest.root_dn_str   = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL);
 855         if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 856         s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL);
 857         if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 858         s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL);
 859         if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 860
 861         s->source_dsa.server_dn_str     = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL);
 862         if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 863         s->source_dsa.ntds_dn_str       = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL);
 864         if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
 865
 866         return NT_STATUS_OK;
 867 }
 868
 869 static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s)
 870 {
 871         int ret;
 872         struct ldb_result *r;
 873         struct ldb_dn *basedn;
 874         static const char *attrs[] = {
 875                 "msDs-Behavior-Version",
 876                 NULL
 877         };
 878
 879         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str);
 880         NT_STATUS_HAVE_NO_MEMORY(basedn);
 881
 882         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs,
 883                          "(cn=Partitions)");
 884         talloc_free(basedn);
 885         if (ret != LDB_SUCCESS) {
 886                 return NT_STATUS_LDAP(ret);
 887         } else if (r->count != 1) {
 888                 talloc_free(r);
 889                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 890         }
 891
 892         s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 893         if (s->forest.crossref_behavior_version <
 894                          get_min_function_level(s->libnet->lp_ctx)) {
 895                 talloc_free(r);
 896                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 897                          s->forest.crossref_behavior_version,
 898                          get_min_function_level(s->libnet->lp_ctx)));
 899                 return NT_STATUS_NOT_SUPPORTED;
 900         }
 901         if (s->forest.crossref_behavior_version >
 902                         get_dc_function_level(s->libnet->lp_ctx)) {
 903                 talloc_free(r);
 904                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 905                          s->forest.crossref_behavior_version,
 906                          get_dc_function_level(s->libnet->lp_ctx)));
 907                 return NT_STATUS_NOT_SUPPORTED;
 908         }
 909
 910         talloc_free(r);
 911         return NT_STATUS_OK;
 912 }
 913
 914 static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s)
 915 {
 916         int ret;
 917         struct ldb_result *r;
 918         struct ldb_dn *basedn;
 919         static const char *attrs[] = {
 920                 "msDs-Behavior-Version",
 921                 NULL
 922         };
 923
 924         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
 925         NT_STATUS_HAVE_NO_MEMORY(basedn);
 926
 927         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 928                          "(objectClass=*)");
 929         talloc_free(basedn);
 930         if (ret != LDB_SUCCESS) {
 931                 return NT_STATUS_LDAP(ret);
 932         } else if (r->count != 1) {
 933                 talloc_free(r);
 934                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 935         }
 936
 937         s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0);
 938         if (s->domain.behavior_version <
 939                         get_min_function_level(s->libnet->lp_ctx)) {
 940                 talloc_free(r);
 941                 DEBUG(0,("The servers function level %u is below 'ads:min function level' of %u\n",
 942                          s->forest.crossref_behavior_version,
 943                          get_min_function_level(s->libnet->lp_ctx)));
 944                 return NT_STATUS_NOT_SUPPORTED;
 945         }
 946         if (s->domain.behavior_version >
 947                         get_dc_function_level(s->libnet->lp_ctx)) {
 948                 talloc_free(r);
 949                 DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n",
 950                          s->forest.crossref_behavior_version,
 951                          get_dc_function_level(s->libnet->lp_ctx)));
 952                 return NT_STATUS_NOT_SUPPORTED;
 953         }
 954
 955         talloc_free(r);
 956         return NT_STATUS_OK;
 957 }
 958
 959 static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s)
 960 {
 961         int ret;
 962         struct ldb_result *r;
 963         struct ldb_dn *basedn;
 964         static const char *attrs[] = {
 965                 "objectVersion",
 966                 NULL
 967         };
 968
 969         basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str);
 970         NT_STATUS_HAVE_NO_MEMORY(basedn);
 971
 972         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
 973                          "(objectClass=*)");
 974         talloc_free(basedn);
 975         if (ret != LDB_SUCCESS) {
 976                 return NT_STATUS_LDAP(ret);
 977         } else if (r->count != 1) {
 978                 talloc_free(r);
 979                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 980         }
 981
 982         s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0);
 983
 984         talloc_free(r);
 985         return NT_STATUS_OK;
 986 }
 987
 988 static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s)
 989 {
 990         int ret;
 991         struct ldb_result *r;
 992         struct ldb_dn *basedn;
 993         static const char *attrs[] = {
 994                 "revision",
 995                 NULL
 996         };
 997
 998         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s",
 999                                 s->domain.dn_str);
1000         NT_STATUS_HAVE_NO_MEMORY(basedn);
1001
1002         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
1003                          "(objectClass=*)");
1004         talloc_free(basedn);
1005         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1006                 /* w2k doesn't have this object */
1007                 s->domain.w2k3_update_revision = 0;
1008                 return NT_STATUS_OK;
1009         } else if (ret != LDB_SUCCESS) {
1010                 return NT_STATUS_LDAP(ret);
1011         } else if (r->count != 1) {
1012                 talloc_free(r);
1013                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1014         }
1015
1016         s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0);
1017
1018         talloc_free(r);
1019         return NT_STATUS_OK;
1020 }
1021
1022 static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s)
1023 {
1024         int ret;
1025         struct ldb_result *r;
1026         struct ldb_dn *basedn;
1027         struct ldb_dn *ntds_dn;
1028         struct ldb_dn *server_dn;
1029         static const char *_1_1_attrs[] = {
1030                 "1.1",
1031                 NULL
1032         };
1033         static const char *fsmo_attrs[] = {
1034                 "fSMORoleOwner",
1035                 NULL
1036         };
1037         static const char *dns_attrs[] = {
1038                 "dnsHostName",
1039                 NULL
1040         };
1041         static const char *guid_attrs[] = {
1042                 "objectGUID",
1043                 NULL
1044         };
1045
1046         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "<WKGUID=2fbac1870ade11d297c400c04fd8d5cd,%s>",
1047                                 s->domain.dn_str);
1048         NT_STATUS_HAVE_NO_MEMORY(basedn);
1049
1050         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1051                          _1_1_attrs, "(objectClass=*)");
1052         talloc_free(basedn);
1053         if (ret != LDB_SUCCESS) {
1054                 return NT_STATUS_LDAP(ret);
1055         } else if (r->count != 1) {
1056                 talloc_free(r);
1057                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1058         }
1059
1060         basedn = talloc_steal(s, r->msgs[0]->dn);
1061         talloc_free(r);
1062
1063         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1064                          fsmo_attrs, "(objectClass=*)");
1065         talloc_free(basedn);
1066         if (ret != LDB_SUCCESS) {
1067                 return NT_STATUS_LDAP(ret);
1068         } else if (r->count != 1) {
1069                 talloc_free(r);
1070                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1071         }
1072
1073         s->infrastructure_fsmo.ntds_dn_str      = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1074         if (!s->infrastructure_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1075         talloc_steal(s, s->infrastructure_fsmo.ntds_dn_str);
1076
1077         talloc_free(r);
1078
1079         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->infrastructure_fsmo.ntds_dn_str);
1080         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1081
1082         server_dn = ldb_dn_get_parent(s, ntds_dn);
1083         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1084
1085         s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1086         NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str);
1087
1088         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1089                          dns_attrs, "(objectClass=*)");
1090         if (ret != LDB_SUCCESS) {
1091                 return NT_STATUS_LDAP(ret);
1092         } else if (r->count != 1) {
1093                 talloc_free(r);
1094                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1095         }
1096
1097         s->infrastructure_fsmo.dns_name = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1098         if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1099         talloc_steal(s, s->infrastructure_fsmo.dns_name);
1100
1101         talloc_free(r);
1102
1103         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1104                          guid_attrs, "(objectClass=*)");
1105         if (ret != LDB_SUCCESS) {
1106                 return NT_STATUS_LDAP(ret);
1107         } else if (r->count != 1) {
1108                 talloc_free(r);
1109                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1110         }
1111
1112         s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1113
1114         talloc_free(r);
1115
1116         return NT_STATUS_OK;
1117 }
1118
1119 static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s)
1120 {
1121         int ret;
1122         struct ldb_result *r;
1123         struct ldb_dn *basedn;
1124         const char *reference_dn_str;
1125         struct ldb_dn *ntds_dn;
1126         struct ldb_dn *server_dn;
1127         static const char *rid_attrs[] = {
1128                 "rIDManagerReference",
1129                 NULL
1130         };
1131         static const char *fsmo_attrs[] = {
1132                 "fSMORoleOwner",
1133                 NULL
1134         };
1135         static const char *dns_attrs[] = {
1136                 "dnsHostName",
1137                 NULL
1138         };
1139         static const char *guid_attrs[] = {
1140                 "objectGUID",
1141                 NULL
1142         };
1143
1144         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1145         NT_STATUS_HAVE_NO_MEMORY(basedn);
1146
1147         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1148                          rid_attrs, "(objectClass=*)");
1149         talloc_free(basedn);
1150         if (ret != LDB_SUCCESS) {
1151                 return NT_STATUS_LDAP(ret);
1152         } else if (r->count != 1) {
1153                 talloc_free(r);
1154                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1155         }
1156
1157         reference_dn_str        = samdb_result_string(r->msgs[0], "rIDManagerReference", NULL);
1158         if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1159
1160         basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str);
1161         NT_STATUS_HAVE_NO_MEMORY(basedn);
1162
1163         talloc_free(r);
1164
1165         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1166                          fsmo_attrs, "(objectClass=*)");
1167         talloc_free(basedn);
1168         if (ret != LDB_SUCCESS) {
1169                 return NT_STATUS_LDAP(ret);
1170         } else if (r->count != 1) {
1171                 talloc_free(r);
1172                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1173         }
1174
1175         s->rid_manager_fsmo.ntds_dn_str = samdb_result_string(r->msgs[0], "fSMORoleOwner", NULL);
1176         if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1177         talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str);
1178
1179         talloc_free(r);
1180
1181         ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str);
1182         NT_STATUS_HAVE_NO_MEMORY(ntds_dn);
1183
1184         server_dn = ldb_dn_get_parent(s, ntds_dn);
1185         NT_STATUS_HAVE_NO_MEMORY(server_dn);
1186
1187         s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn);
1188         NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str);
1189
1190         ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE,
1191                          dns_attrs, "(objectClass=*)");
1192         if (ret != LDB_SUCCESS) {
1193                 return NT_STATUS_LDAP(ret);
1194         } else if (r->count != 1) {
1195                 talloc_free(r);
1196                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1197         }
1198
1199         s->rid_manager_fsmo.dns_name    = samdb_result_string(r->msgs[0], "dnsHostName", NULL);
1200         if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1201         talloc_steal(s, s->rid_manager_fsmo.dns_name);
1202
1203         talloc_free(r);
1204
1205         ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE,
1206                          guid_attrs, "(objectClass=*)");
1207         if (ret != LDB_SUCCESS) {
1208                 return NT_STATUS_LDAP(ret);
1209         } else if (r->count != 1) {
1210                 talloc_free(r);
1211                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1212         }
1213
1214         s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1215
1216         talloc_free(r);
1217
1218         return NT_STATUS_OK;
1219 }
1220
1221 static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s)
1222 {
1223         int ret;
1224         struct ldb_result *r;
1225         struct ldb_dn *basedn;
1226
1227         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s",
1228                                 s->dest_dsa.site_name,
1229                                 s->forest.config_dn_str);
1230         NT_STATUS_HAVE_NO_MEMORY(basedn);
1231
1232         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1233                          NULL, "(objectClass=*)");
1234         talloc_free(basedn);
1235         if (ret != LDB_SUCCESS) {
1236                 return NT_STATUS_LDAP(ret);
1237         } else if (r->count != 1) {
1238                 talloc_free(r);
1239                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1240         }
1241
1242         s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID");
1243
1244         talloc_free(r);
1245         return NT_STATUS_OK;
1246 }
1247
1248 static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s)
1249 {
1250         if (!s->callbacks.check_options) return NT_STATUS_OK;
1251
1252         s->_co.domain           = &s->domain;
1253         s->_co.forest           = &s->forest;
1254         s->_co.source_dsa       = &s->source_dsa;
1255
1256         return s->callbacks.check_options(s->callbacks.private_data, &s->_co);
1257 }
1258
1259 static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s)
1260 {
1261         int ret;
1262         struct ldb_result *r;
1263         struct ldb_dn *basedn;
1264         static const char *attrs[] = {
1265                 "distinguishedName",
1266                 "userAccountControl",
1267                 NULL
1268         };
1269
1270         basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str);
1271         NT_STATUS_HAVE_NO_MEMORY(basedn);
1272
1273         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs,
1274                          "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
1275                          s->dest_dsa.netbios_name);
1276         talloc_free(basedn);
1277         if (ret != LDB_SUCCESS) {
1278                 return NT_STATUS_LDAP(ret);
1279         } else if (r->count != 1) {
1280                 talloc_free(r);
1281                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1282         }
1283
1284         s->dest_dsa.computer_dn_str     = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1285         if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1286         talloc_steal(s, s->dest_dsa.computer_dn_str);
1287
1288         s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
1289
1290         talloc_free(r);
1291         return NT_STATUS_OK;
1292 }
1293
1294 static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s)
1295 {
1296         int ret;
1297         struct ldb_result *r;
1298         struct ldb_dn *basedn;
1299         const char *server_reference_dn_str;
1300         struct ldb_dn *server_reference_dn;
1301         struct ldb_dn *computer_dn;
1302
1303         basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1304                                 s->dest_dsa.netbios_name,
1305                                 s->dest_dsa.site_name,
1306                                 s->forest.config_dn_str);
1307         NT_STATUS_HAVE_NO_MEMORY(basedn);
1308
1309         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1310                          NULL, "(objectClass=*)");
1311         talloc_free(basedn);
1312         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1313                 /* if the object doesn't exist, we'll create it later */
1314                 return NT_STATUS_OK;
1315         } else if (ret != LDB_SUCCESS) {
1316                 return NT_STATUS_LDAP(ret);
1317         } else if (r->count != 1) {
1318                 talloc_free(r);
1319                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1320         }
1321
1322         server_reference_dn_str = samdb_result_string(r->msgs[0], "serverReference", NULL);
1323         if (server_reference_dn_str) {
1324                 server_reference_dn     = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str);
1325                 NT_STATUS_HAVE_NO_MEMORY(server_reference_dn);
1326
1327                 computer_dn             = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1328                 NT_STATUS_HAVE_NO_MEMORY(computer_dn);
1329
1330                 /*
1331                  * if the server object belongs to another DC in another domain
1332                  * in the forest, we should not touch this object!
1333                  */
1334                 if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) {
1335                         talloc_free(r);
1336                         return NT_STATUS_OBJECT_NAME_COLLISION;
1337                 }
1338         }
1339
1340         /* if the server object is already for the dest_dsa, then we don't need to create it */
1341         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
1342         if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
1343         talloc_steal(s, s->dest_dsa.server_dn_str);
1344
1345         talloc_free(r);
1346         return NT_STATUS_OK;
1347 }
1348
1349 static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s)
1350 {
1351         int ret;
1352         struct ldb_result *r;
1353         struct ldb_dn *basedn;
1354         const char *server_reference_bl_dn_str;
1355         static const char *attrs[] = {
1356                 "serverReferenceBL",
1357                 NULL
1358         };
1359
1360         /* if the server_dn_str has a valid value, we skip this lookup */
1361         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1362
1363         basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str);
1364         NT_STATUS_HAVE_NO_MEMORY(basedn);
1365
1366         ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE,
1367                          attrs, "(objectClass=*)");
1368         talloc_free(basedn);
1369         if (ret != LDB_SUCCESS) {
1370                 return NT_STATUS_LDAP(ret);
1371         } else if (r->count != 1) {
1372                 talloc_free(r);
1373                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1374         }
1375
1376         server_reference_bl_dn_str = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1377         if (!server_reference_bl_dn_str) {
1378                 /* if no back link is present, we're done for this function */
1379                 talloc_free(r);
1380                 return NT_STATUS_OK;
1381         }
1382
1383         /* if the server object is already for the dest_dsa, then we don't need to create it */
1384         s->dest_dsa.server_dn_str       = samdb_result_string(r->msgs[0], "serverReferenceBL", NULL);
1385         if (s->dest_dsa.server_dn_str) {
1386                 /* if a back link is present, we know that the server object is present */
1387                 talloc_steal(s, s->dest_dsa.server_dn_str);
1388         }
1389
1390         talloc_free(r);
1391         return NT_STATUS_OK;
1392 }
1393
1394 static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s)
1395 {
1396         int ret;
1397         struct ldb_message *msg;
1398         char *server_dn_str;
1399
1400         /* if the server_dn_str has a valid value, we skip this lookup */
1401         if (s->dest_dsa.server_dn_str) return NT_STATUS_OK;
1402
1403         msg = ldb_msg_new(s);
1404         NT_STATUS_HAVE_NO_MEMORY(msg);
1405
1406         msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
1407                                  s->dest_dsa.netbios_name,
1408                                  s->dest_dsa.site_name,
1409                                  s->forest.config_dn_str);
1410         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1411
1412         ret = ldb_msg_add_string(msg, "objectClass", "server");
1413         if (ret != 0) {
1414                 talloc_free(msg);
1415                 return NT_STATUS_NO_MEMORY;
1416         }
1417         ret = ldb_msg_add_string(msg, "systemFlags", "50000000");
1418         if (ret != 0) {
1419                 talloc_free(msg);
1420                 return NT_STATUS_NO_MEMORY;
1421         }
1422         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1423         if (ret != 0) {
1424                 talloc_free(msg);
1425                 return NT_STATUS_NO_MEMORY;
1426         }
1427
1428         server_dn_str = ldb_dn_alloc_linearized(s, msg->dn);
1429         NT_STATUS_HAVE_NO_MEMORY(server_dn_str);
1430
1431         ret = ldb_add(s->ldap1.ldb, msg);
1432         talloc_free(msg);
1433         if (ret != LDB_SUCCESS) {
1434                 talloc_free(server_dn_str);
1435                 return NT_STATUS_LDAP(ret);
1436         }
1437
1438         s->dest_dsa.server_dn_str = server_dn_str;
1439
1440         return NT_STATUS_OK;
1441 }
1442
1443 static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s)
1444 {
1445         int ret;
1446         struct ldb_message *msg;
1447         uint32_t i;
1448
1449         /* make a 'modify' msg, and only for serverReference */
1450         msg = ldb_msg_new(s);
1451         NT_STATUS_HAVE_NO_MEMORY(msg);
1452         msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str);
1453         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
1454
1455         ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str);
1456         if (ret != 0) {
1457                 talloc_free(msg);
1458                 return NT_STATUS_NO_MEMORY;
1459         }
1460
1461         /* mark all the message elements (should be just one)
1462            as LDB_FLAG_MOD_ADD */
1463         for (i=0;i<msg->num_elements;i++) {
1464                 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
1465         }
1466
1467         ret = ldb_modify(s->ldap1.ldb, msg);
1468         if (ret == LDB_SUCCESS) {
1469                 talloc_free(msg);
1470                 return NT_STATUS_OK;
1471         } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1472                 /* retry with LDB_FLAG_MOD_REPLACE */
1473         } else {
1474                 talloc_free(msg);
1475                 return NT_STATUS_LDAP(ret);
1476         }
1477
1478         /* mark all the message elements (should be just one)
1479            as LDB_FLAG_MOD_REPLACE */
1480         for (i=0;i<msg->num_elements;i++) {
1481                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1482         }
1483
1484         ret = ldb_modify(s->ldap1.ldb, msg);
1485         talloc_free(msg);
1486         if (ret != LDB_SUCCESS) {
1487                 return NT_STATUS_LDAP(ret);
1488         }
1489
1490         return NT_STATUS_OK;
1491 }
1492
1493 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1494                                           struct becomeDC_drsuapi *drsuapi,
1495                                           void (*recv_fn)(struct composite_context *req));
1496 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req);
1497 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s);
1498
1499 static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s)
1500 {
1501         struct composite_context *c = s->creq;
1502
1503         c->status = becomeDC_ldap_connect(s, &s->ldap1);
1504         if (!composite_is_ok(c)) return;
1505
1506         c->status = becomeDC_ldap1_rootdse(s);
1507         if (!composite_is_ok(c)) return;
1508
1509         c->status = becomeDC_ldap1_crossref_behavior_version(s);
1510         if (!composite_is_ok(c)) return;
1511
1512         c->status = becomeDC_ldap1_domain_behavior_version(s);
1513         if (!composite_is_ok(c)) return;
1514
1515         c->status = becomeDC_ldap1_schema_object_version(s);
1516         if (!composite_is_ok(c)) return;
1517
1518         c->status = becomeDC_ldap1_w2k3_update_revision(s);
1519         if (!composite_is_ok(c)) return;
1520
1521         c->status = becomeDC_ldap1_infrastructure_fsmo(s);
1522         if (!composite_is_ok(c)) return;
1523
1524         c->status = becomeDC_ldap1_rid_manager_fsmo(s);
1525         if (!composite_is_ok(c)) return;
1526
1527         c->status = becomeDC_ldap1_site_object(s);
1528         if (!composite_is_ok(c)) return;
1529
1530         c->status = becomeDC_check_options(s);
1531         if (!composite_is_ok(c)) return;
1532
1533         c->status = becomeDC_ldap1_computer_object(s);
1534         if (!composite_is_ok(c)) return;
1535
1536         c->status = becomeDC_ldap1_server_object_1(s);
1537         if (!composite_is_ok(c)) return;
1538
1539         c->status = becomeDC_ldap1_server_object_2(s);
1540         if (!composite_is_ok(c)) return;
1541
1542         c->status = becomeDC_ldap1_server_object_add(s);
1543         if (!composite_is_ok(c)) return;
1544
1545         c->status = becomeDC_ldap1_server_object_modify(s);
1546         if (!composite_is_ok(c)) return;
1547
1548         becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv);
1549 }
1550
1551 static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s,
1552                                           struct becomeDC_drsuapi *drsuapi,
1553                                           void (*recv_fn)(struct composite_context *req))
1554 {
1555         struct composite_context *c = s->creq;
1556         struct composite_context *creq;
1557         char *binding_str;
1558
1559         drsuapi->s = s;
1560
1561         if (!drsuapi->binding) {
1562                 const char *krb5_str = "";
1563                 const char *print_str = "";
1564                 /*
1565                  * Note: Replication only works with Windows 2000 when 'krb5' is
1566                  *       passed as auth_type here. If NTLMSSP is used, Windows
1567                  *       2000 returns garbage in the DsGetNCChanges() response
1568                  *       if encrypted password attributes would be in the
1569                  *       response. That means the replication of the schema and
1570                  *       configuration partition works fine, but it fails for
1571                  *       the domain partition.
1572                  */
1573                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1574                                  "force krb5", true))
1575                 {
1576                         krb5_str = "krb5,";
1577                 }
1578                 if (lp_parm_bool(s->libnet->lp_ctx, NULL, "become_dc",
1579                                  "print", false))
1580                 {
1581                         print_str = "print,";
1582                 }
1583                 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal]",
1584                                               s->source_dsa.dns_name,
1585                                               krb5_str, print_str);
1586                 if (composite_nomem(binding_str, c)) return;
1587                 c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding);
1588                 talloc_free(binding_str);
1589                 if (!composite_is_ok(c)) return;
1590         }
1591
1592         creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi,
1593                                           s->libnet->cred, s->libnet->event_ctx,
1594                                           s->libnet->lp_ctx);
1595         composite_continue(c, creq, recv_fn, s);
1596 }
1597
1598 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1599                                        struct becomeDC_drsuapi *drsuapi,
1600                                        void (*recv_fn)(struct rpc_request *req));
1601 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req);
1602
1603 static void becomeDC_drsuapi1_connect_recv(struct composite_context *req)
1604 {
1605         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1606                                           struct libnet_BecomeDC_state);
1607         struct composite_context *c = s->creq;
1608
1609         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe);
1610         if (!composite_is_ok(c)) return;
1611
1612         c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state,
1613                                        &s->drsuapi1.gensec_skey);
1614         if (!composite_is_ok(c)) return;
1615
1616         becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv);
1617 }
1618
1619 static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s,
1620                                        struct becomeDC_drsuapi *drsuapi,
1621                                        void (*recv_fn)(struct rpc_request *req))
1622 {
1623         struct composite_context *c = s->creq;
1624         struct rpc_request *req;
1625         struct drsuapi_DsBindInfo28 *bind_info28;
1626
1627         GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid);
1628
1629         bind_info28                             = &drsuapi->local_info28;
1630         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_BASE;
1631         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION;
1632         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI;
1633         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2;
1634         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS;
1635         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1;
1636         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION;
1637         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE;
1638         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2;
1639         if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) {
1640                 /* TODO: find out how this is really triggered! */
1641                 bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION;
1642         }
1643         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2;
1644         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD;
1645         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND;
1646         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO;
1647         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION;
1648         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01;
1649         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP;
1650         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY;
1651         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3;
1652         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_00100000;
1653         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2;
1654         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6;
1655         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS;
1656         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8;
1657         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5;
1658         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6;
1659         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3;
1660         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7;
1661         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT;
1662 #if 0 /* we don't support XPRESS compression yet */
1663         bind_info28->supported_extensions       |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS;
1664 #endif
1665         bind_info28->site_guid                  = s->dest_dsa.site_guid;
1666         bind_info28->pid                        = 0;
1667         bind_info28->repl_epoch                 = 0;
1668
1669         drsuapi->bind_info_ctr.length           = 28;
1670         drsuapi->bind_info_ctr.info.info28      = *bind_info28;
1671
1672         drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid;
1673         drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr;
1674         drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle;
1675
1676         req = dcerpc_drsuapi_DsBind_send(drsuapi->pipe, s, &drsuapi->bind_r);
1677         composite_continue_rpc(c, req, recv_fn, s);
1678 }
1679
1680 static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s,
1681                                          struct becomeDC_drsuapi *drsuapi)
1682 {
1683         if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) {
1684                 return drsuapi->bind_r.out.result;
1685         }
1686
1687         ZERO_STRUCT(drsuapi->remote_info28);
1688         if (drsuapi->bind_r.out.bind_info) {
1689                 switch (drsuapi->bind_r.out.bind_info->length) {
1690                 case 24: {
1691                         struct drsuapi_DsBindInfo24 *info24;
1692                         info24 = &drsuapi->bind_r.out.bind_info->info.info24;
1693                         drsuapi->remote_info28.supported_extensions     = info24->supported_extensions;
1694                         drsuapi->remote_info28.site_guid                = info24->site_guid;
1695                         drsuapi->remote_info28.pid                      = info24->pid;
1696                         drsuapi->remote_info28.repl_epoch               = 0;
1697                         break;
1698                 }
1699                 case 48: {
1700                         struct drsuapi_DsBindInfo48 *info48;
1701                         info48 = &drsuapi->bind_r.out.bind_info->info.info48;
1702                         drsuapi->remote_info28.supported_extensions     = info48->supported_extensions;
1703                         drsuapi->remote_info28.site_guid                = info48->site_guid;
1704                         drsuapi->remote_info28.pid                      = info48->pid;
1705                         drsuapi->remote_info28.repl_epoch               = info48->repl_epoch;
1706                         break;
1707                 }
1708                 case 28:
1709                         drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28;
1710                         break;
1711                 }
1712         }
1713
1714         return WERR_OK;
1715 }
1716
1717 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s);
1718
1719 static void becomeDC_drsuapi1_bind_recv(struct rpc_request *req)
1720 {
1721         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
1722                                           struct libnet_BecomeDC_state);
1723         struct composite_context *c = s->creq;
1724         WERROR status;
1725
1726         bool print = false;
1727
1728         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
1729                 print = true;
1730         }
1731
1732         c->status = dcerpc_ndr_request_recv(req);
1733         if (!composite_is_ok(c)) return;
1734
1735         if (print) {
1736                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi1.bind_r);
1737         }
1738
1739         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1);
1740         if (!W_ERROR_IS_OK(status)) {
1741                 composite_error(c, werror_to_ntstatus(status));
1742                 return;
1743         }
1744
1745         becomeDC_drsuapi1_add_entry_send(s);
1746 }
1747
1748 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req);
1749
1750 static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s)
1751 {
1752         struct composite_context *c = s->creq;
1753         struct rpc_request *req;
1754         struct drsuapi_DsAddEntry *r;
1755         struct drsuapi_DsReplicaObjectIdentifier *identifier;
1756         uint32_t num_attrs, i = 0;
1757         struct drsuapi_DsReplicaAttribute *attrs;
1758         struct smb_iconv_convenience *iconv_convenience = lp_iconv_convenience(s->libnet->lp_ctx);
1759         enum ndr_err_code ndr_err;
1760         bool w2k3;
1761
1762         /* choose a random invocationId */
1763         s->dest_dsa.invocation_id = GUID_random();
1764
1765         /*
1766          * if the schema version indicates w2k3, then also send some w2k3
1767          * specific attributes.
1768          */
1769         if (s->forest.schema_object_version >= 30) {
1770                 w2k3 = true;
1771         } else {
1772                 w2k3 = false;
1773         }
1774
1775         r = talloc_zero(s, struct drsuapi_DsAddEntry);
1776         if (composite_nomem(r, c)) return;
1777
1778         /* setup identifier */
1779         identifier              = talloc(r, struct drsuapi_DsReplicaObjectIdentifier);
1780         if (composite_nomem(identifier, c)) return;
1781         identifier->guid        = GUID_zero();
1782         identifier->sid         = s->zero_sid;
1783         identifier->dn          = talloc_asprintf(identifier, "CN=NTDS Settings,%s",
1784                                                   s->dest_dsa.server_dn_str);
1785         if (composite_nomem(identifier->dn, c)) return;
1786
1787         /* allocate attribute array */
1788         num_attrs       = 11;
1789         attrs           = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs);
1790         if (composite_nomem(attrs, c)) return;
1791
1792         /* ntSecurityDescriptor */
1793         {
1794                 struct drsuapi_DsAttributeValue *vs;
1795                 DATA_BLOB *vd;
1796                 struct security_descriptor *v;
1797                 struct dom_sid *domain_admins_sid;
1798                 const char *domain_admins_sid_str;
1799
1800                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1801                 if (composite_nomem(vs, c)) return;
1802
1803                 vd = talloc_array(vs, DATA_BLOB, 1);
1804                 if (composite_nomem(vd, c)) return;
1805
1806                 domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS);
1807                 if (composite_nomem(domain_admins_sid, c)) return;
1808
1809                 domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid);
1810                 if (composite_nomem(domain_admins_sid_str, c)) return;
1811
1812                 v = security_descriptor_dacl_create(vd,
1813                                                0,
1814                                                /* owner: domain admins */
1815                                                domain_admins_sid_str,
1816                                                /* owner group: domain admins */
1817                                                domain_admins_sid_str,
1818                                                /* authenticated users */
1819                                                SID_NT_AUTHENTICATED_USERS,
1820                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1821                                                SEC_STD_READ_CONTROL |
1822                                                SEC_ADS_LIST |
1823                                                SEC_ADS_READ_PROP |
1824                                                SEC_ADS_LIST_OBJECT,
1825                                                0,
1826                                                /* domain admins */
1827                                                domain_admins_sid_str,
1828                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1829                                                SEC_STD_REQUIRED |
1830                                                SEC_ADS_CREATE_CHILD |
1831                                                SEC_ADS_LIST |
1832                                                SEC_ADS_SELF_WRITE |
1833                                                SEC_ADS_READ_PROP |
1834                                                SEC_ADS_WRITE_PROP |
1835                                                SEC_ADS_DELETE_TREE |
1836                                                SEC_ADS_LIST_OBJECT |
1837                                                SEC_ADS_CONTROL_ACCESS,
1838                                                0,
1839                                                /* system */
1840                                                SID_NT_SYSTEM,
1841                                                SEC_ACE_TYPE_ACCESS_ALLOWED,
1842                                                SEC_STD_REQUIRED |
1843                                                SEC_ADS_CREATE_CHILD |
1844                                                SEC_ADS_DELETE_CHILD |
1845                                                SEC_ADS_LIST |
1846                                                SEC_ADS_SELF_WRITE |
1847                                                SEC_ADS_READ_PROP |
1848                                                SEC_ADS_WRITE_PROP |
1849                                                SEC_ADS_DELETE_TREE |
1850                                                SEC_ADS_LIST_OBJECT |
1851                                                SEC_ADS_CONTROL_ACCESS,
1852                                                0,
1853                                                /* end */
1854                                                NULL);
1855                 if (composite_nomem(v, c)) return;
1856
1857                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v,(ndr_push_flags_fn_t)ndr_push_security_descriptor);
1858                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1859                         c->status = ndr_map_error2ntstatus(ndr_err);
1860                         if (!composite_is_ok(c)) return;
1861                 }
1862
1863                 vs[0].blob              = &vd[0];
1864
1865                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_ntSecurityDescriptor;
1866                 attrs[i].value_ctr.num_values   = 1;
1867                 attrs[i].value_ctr.values       = vs;
1868
1869                 i++;
1870         }
1871
1872         /* objectClass: nTDSDSA */
1873         {
1874                 struct drsuapi_DsAttributeValue *vs;
1875                 DATA_BLOB *vd;
1876
1877                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1878                 if (composite_nomem(vs, c)) return;
1879
1880                 vd = talloc_array(vs, DATA_BLOB, 1);
1881                 if (composite_nomem(vd, c)) return;
1882
1883                 vd[0] = data_blob_talloc(vd, NULL, 4);
1884                 if (composite_nomem(vd[0].data, c)) return;
1885
1886                 /* value for nTDSDSA */
1887                 SIVAL(vd[0].data, 0, 0x0017002F);
1888
1889                 vs[0].blob              = &vd[0];
1890
1891                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectClass;
1892                 attrs[i].value_ctr.num_values   = 1;
1893                 attrs[i].value_ctr.values       = vs;
1894
1895                 i++;
1896         }
1897
1898         /* objectCategory: CN=NTDS-DSA,CN=Schema,... */
1899         {
1900                 struct drsuapi_DsAttributeValue *vs;
1901                 DATA_BLOB *vd;
1902                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
1903
1904                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1905                 if (composite_nomem(vs, c)) return;
1906
1907                 vd = talloc_array(vs, DATA_BLOB, 1);
1908                 if (composite_nomem(vd, c)) return;
1909
1910                 v[0].guid               = GUID_zero();
1911                 v[0].sid                = s->zero_sid;
1912                 v[0].dn                 = talloc_asprintf(vd, "CN=NTDS-DSA,%s",
1913                                                           s->forest.schema_dn_str);
1914                 if (composite_nomem(v[0].dn, c)) return;
1915
1916                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1917                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1918                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1919                         c->status = ndr_map_error2ntstatus(ndr_err);
1920                         if (!composite_is_ok(c)) return;
1921                 }
1922
1923                 vs[0].blob              = &vd[0];
1924
1925                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_objectCategory;
1926                 attrs[i].value_ctr.num_values   = 1;
1927                 attrs[i].value_ctr.values       = vs;
1928
1929                 i++;
1930         }
1931
1932         /* invocationId: random guid */
1933         {
1934                 struct drsuapi_DsAttributeValue *vs;
1935                 DATA_BLOB *vd;
1936                 const struct GUID *v;
1937
1938                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
1939                 if (composite_nomem(vs, c)) return;
1940
1941                 vd = talloc_array(vs, DATA_BLOB, 1);
1942                 if (composite_nomem(vd, c)) return;
1943
1944                 v = &s->dest_dsa.invocation_id;
1945
1946                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, v, (ndr_push_flags_fn_t)ndr_push_GUID);
1947                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1948                         c->status = ndr_map_error2ntstatus(ndr_err);
1949                         if (!composite_is_ok(c)) return;
1950                 }
1951
1952                 vs[0].blob              = &vd[0];
1953
1954                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_invocationId;
1955                 attrs[i].value_ctr.num_values   = 1;
1956                 attrs[i].value_ctr.values       = vs;
1957
1958                 i++;
1959         }
1960
1961         /* hasMasterNCs: ... */
1962         {
1963                 struct drsuapi_DsAttributeValue *vs;
1964                 DATA_BLOB *vd;
1965                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
1966
1967                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
1968                 if (composite_nomem(vs, c)) return;
1969
1970                 vd = talloc_array(vs, DATA_BLOB, 3);
1971                 if (composite_nomem(vd, c)) return;
1972
1973                 v[0].guid               = GUID_zero();
1974                 v[0].sid                = s->zero_sid;
1975                 v[0].dn                 = s->forest.config_dn_str;
1976
1977                 v[1].guid               = GUID_zero();
1978                 v[1].sid                = s->zero_sid;
1979                 v[1].dn                 = s->domain.dn_str;
1980
1981                 v[2].guid               = GUID_zero();
1982                 v[2].sid                = s->zero_sid;
1983                 v[2].dn                 = s->forest.schema_dn_str;
1984
1985                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
1986                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1987                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1988                         c->status = ndr_map_error2ntstatus(ndr_err);
1989                         if (!composite_is_ok(c)) return;
1990                 }
1991
1992                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
1993                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
1994                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1995                         c->status = ndr_map_error2ntstatus(ndr_err);
1996                         if (!composite_is_ok(c)) return;
1997                 }
1998
1999                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2000                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2001                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2002                         c->status = ndr_map_error2ntstatus(ndr_err);
2003                         if (!composite_is_ok(c)) return;
2004                 }
2005
2006                 vs[0].blob              = &vd[0];
2007                 vs[1].blob              = &vd[1];
2008                 vs[2].blob              = &vd[2];
2009
2010                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_hasMasterNCs;
2011                 attrs[i].value_ctr.num_values   = 3;
2012                 attrs[i].value_ctr.values       = vs;
2013
2014                 i++;
2015         }
2016
2017         /* msDS-hasMasterNCs: ... */
2018         if (w2k3) {
2019                 struct drsuapi_DsAttributeValue *vs;
2020                 DATA_BLOB *vd;
2021                 struct drsuapi_DsReplicaObjectIdentifier3 v[3];
2022
2023                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3);
2024                 if (composite_nomem(vs, c)) return;
2025
2026                 vd = talloc_array(vs, DATA_BLOB, 3);
2027                 if (composite_nomem(vd, c)) return;
2028
2029                 v[0].guid               = GUID_zero();
2030                 v[0].sid                = s->zero_sid;
2031                 v[0].dn                 = s->forest.config_dn_str;
2032
2033                 v[1].guid               = GUID_zero();
2034                 v[1].sid                = s->zero_sid;
2035                 v[1].dn                 = s->domain.dn_str;
2036
2037                 v[2].guid               = GUID_zero();
2038                 v[2].sid                = s->zero_sid;
2039                 v[2].dn                 = s->forest.schema_dn_str;
2040
2041                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2042                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2043                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2044                         c->status = ndr_map_error2ntstatus(ndr_err);
2045                         if (!composite_is_ok(c)) return;
2046                 }
2047
2048                 ndr_err = ndr_push_struct_blob(&vd[1], vd, iconv_convenience, &v[1],
2049                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2050                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2051                         c->status = ndr_map_error2ntstatus(ndr_err);
2052                         if (!composite_is_ok(c)) return;
2053                 }
2054
2055                 ndr_err = ndr_push_struct_blob(&vd[2], vd, iconv_convenience, &v[2],
2056                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2057                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2058                         c->status = ndr_map_error2ntstatus(ndr_err);
2059                         if (!composite_is_ok(c)) return;
2060                 }
2061
2062                 vs[0].blob              = &vd[0];
2063                 vs[1].blob              = &vd[1];
2064                 vs[2].blob              = &vd[2];
2065
2066                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_hasMasterNCs;
2067                 attrs[i].value_ctr.num_values   = 3;
2068                 attrs[i].value_ctr.values       = vs;
2069
2070                 i++;
2071         }
2072
2073         /* dMDLocation: CN=Schema,... */
2074         {
2075                 struct drsuapi_DsAttributeValue *vs;
2076                 DATA_BLOB *vd;
2077                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2078
2079                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2080                 if (composite_nomem(vs, c)) return;
2081
2082                 vd = talloc_array(vs, DATA_BLOB, 1);
2083                 if (composite_nomem(vd, c)) return;
2084
2085                 v[0].guid               = GUID_zero();
2086                 v[0].sid                = s->zero_sid;
2087                 v[0].dn                 = s->forest.schema_dn_str;
2088
2089                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2090                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2091                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2092                         c->status = ndr_map_error2ntstatus(ndr_err);
2093                         if (!composite_is_ok(c)) return;
2094                 }
2095
2096                 vs[0].blob              = &vd[0];
2097
2098                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_dMDLocation;
2099                 attrs[i].value_ctr.num_values   = 1;
2100                 attrs[i].value_ctr.values       = vs;
2101
2102                 i++;
2103         }
2104
2105         /* msDS-HasDomainNCs: <domain_partition> */
2106         if (w2k3) {
2107                 struct drsuapi_DsAttributeValue *vs;
2108                 DATA_BLOB *vd;
2109                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2110
2111                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2112                 if (composite_nomem(vs, c)) return;
2113
2114                 vd = talloc_array(vs, DATA_BLOB, 1);
2115                 if (composite_nomem(vd, c)) return;
2116
2117                 v[0].guid               = GUID_zero();
2118                 v[0].sid                = s->zero_sid;
2119                 v[0].dn                 = s->domain.dn_str;
2120
2121                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2122                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2123                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2124                         c->status = ndr_map_error2ntstatus(ndr_err);
2125                         if (!composite_is_ok(c)) return;
2126                 }
2127
2128                 vs[0].blob              = &vd[0];
2129
2130                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_HasDomainNCs;
2131                 attrs[i].value_ctr.num_values   = 1;
2132                 attrs[i].value_ctr.values       = vs;
2133
2134                 i++;
2135         }
2136
2137         /* msDS-Behavior-Version */
2138         if (w2k3) {
2139                 struct drsuapi_DsAttributeValue *vs;
2140                 DATA_BLOB *vd;
2141
2142                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2143                 if (composite_nomem(vs, c)) return;
2144
2145                 vd = talloc_array(vs, DATA_BLOB, 1);
2146                 if (composite_nomem(vd, c)) return;
2147
2148                 vd[0] = data_blob_talloc(vd, NULL, 4);
2149                 if (composite_nomem(vd[0].data, c)) return;
2150
2151                 SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx));
2152
2153                 vs[0].blob              = &vd[0];
2154
2155                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_msDS_Behavior_Version;
2156                 attrs[i].value_ctr.num_values   = 1;
2157                 attrs[i].value_ctr.values       = vs;
2158
2159                 i++;
2160         }
2161
2162         /* systemFlags */
2163         {
2164                 struct drsuapi_DsAttributeValue *vs;
2165                 DATA_BLOB *vd;
2166
2167                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2168                 if (composite_nomem(vs, c)) return;
2169
2170                 vd = talloc_array(vs, DATA_BLOB, 1);
2171                 if (composite_nomem(vd, c)) return;
2172
2173                 vd[0] = data_blob_talloc(vd, NULL, 4);
2174                 if (composite_nomem(vd[0].data, c)) return;
2175
2176                 SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2177
2178                 vs[0].blob              = &vd[0];
2179
2180                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_systemFlags;
2181                 attrs[i].value_ctr.num_values   = 1;
2182                 attrs[i].value_ctr.values       = vs;
2183
2184                 i++;
2185         }
2186
2187         /* serverReference: ... */
2188         {
2189                 struct drsuapi_DsAttributeValue *vs;
2190                 DATA_BLOB *vd;
2191                 struct drsuapi_DsReplicaObjectIdentifier3 v[1];
2192
2193                 vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1);
2194                 if (composite_nomem(vs, c)) return;
2195
2196                 vd = talloc_array(vs, DATA_BLOB, 1);
2197                 if (composite_nomem(vd, c)) return;
2198
2199                 v[0].guid               = GUID_zero();
2200                 v[0].sid                = s->zero_sid;
2201                 v[0].dn                 = s->dest_dsa.computer_dn_str;
2202
2203                 ndr_err = ndr_push_struct_blob(&vd[0], vd, iconv_convenience, &v[0],
2204                                                (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3);
2205                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2206                         c->status = ndr_map_error2ntstatus(ndr_err);
2207                         if (!composite_is_ok(c)) return;
2208                 }
2209
2210                 vs[0].blob              = &vd[0];
2211
2212                 attrs[i].attid                  = DRSUAPI_ATTRIBUTE_serverReference;
2213                 attrs[i].value_ctr.num_values   = 1;
2214                 attrs[i].value_ctr.values       = vs;
2215
2216                 i++;
2217         }
2218
2219         /* truncate the attribute list to the attribute count we have filled in */
2220         num_attrs = i;
2221
2222         /* setup request structure */
2223         r->in.bind_handle                                               = &s->drsuapi1.bind_handle;
2224         r->in.level                                                     = 2;
2225         r->in.req                                                       = talloc(s, union drsuapi_DsAddEntryRequest);
2226         r->in.req->req2.first_object.next_object                        = NULL;
2227         r->in.req->req2.first_object.object.identifier                  = identifier;
2228         r->in.req->req2.first_object.object.flags                       = 0x00000000;
2229         r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs;
2230         r->in.req->req2.first_object.object.attribute_ctr.attributes    = attrs;
2231
2232         r->out.level_out        = talloc(s, int32_t);
2233         r->out.ctr              = talloc(s, union drsuapi_DsAddEntryCtr);
2234
2235         req = dcerpc_drsuapi_DsAddEntry_send(s->drsuapi1.pipe, r, r);
2236         composite_continue_rpc(c, req, becomeDC_drsuapi1_add_entry_recv, s);
2237 }
2238
2239 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req);
2240 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s);
2241
2242 static void becomeDC_drsuapi1_add_entry_recv(struct rpc_request *req)
2243 {
2244         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2245                                           struct libnet_BecomeDC_state);
2246         struct composite_context *c = s->creq;
2247         struct drsuapi_DsAddEntry *r = talloc_get_type(req->ndr.struct_ptr,
2248                                        struct drsuapi_DsAddEntry);
2249         char *binding_str;
2250         bool print = false;
2251
2252         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2253                 print = true;
2254         }
2255
2256         c->status = dcerpc_ndr_request_recv(req);
2257         if (!composite_is_ok(c)) return;
2258
2259         if (print) {
2260                 NDR_PRINT_OUT_DEBUG(drsuapi_DsAddEntry, r);
2261         }
2262
2263         if (!W_ERROR_IS_OK(r->out.result)) {
2264                 composite_error(c, werror_to_ntstatus(r->out.result));
2265                 return;
2266         }
2267
2268         if (*r->out.level_out == 3) {
2269                 if (r->out.ctr->ctr3.count != 1) {
2270                         WERROR status;
2271
2272                         if (r->out.ctr->ctr3.level != 1) {
2273                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2274                                 return;
2275                         }
2276
2277                         if (!r->out.ctr->ctr3.error) {
2278                                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2279                                 return;
2280                         }
2281
2282                         status = r->out.ctr->ctr3.error->info1.status;
2283
2284                         if (!r->out.ctr->ctr3.error->info1.info) {
2285                                 composite_error(c, werror_to_ntstatus(status));
2286                                 return;
2287                         }
2288
2289                         /* see if we can get a more detailed error */
2290                         switch (r->out.ctr->ctr3.error->info1.level) {
2291                         case 1:
2292                                 status = r->out.ctr->ctr3.error->info1.info->error1.status;
2293                                 break;
2294                         case 4:
2295                         case 5:
2296                         case 6:
2297                         case 7:
2298                                 status = r->out.ctr->ctr3.error->info1.info->errorX.status;
2299                                 break;
2300                         }
2301
2302                         composite_error(c, werror_to_ntstatus(status));
2303                         return;
2304                 }
2305
2306                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr3.objects[0].guid;
2307         } else if (*r->out.level_out == 2) {
2308                 if (r->out.ctr->ctr2.count != 1) {
2309                         composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.error.status));
2310                         return;
2311                 }
2312
2313                 s->dest_dsa.ntds_guid   = r->out.ctr->ctr2.objects[0].guid;
2314         } else {
2315                 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
2316                 return;
2317         }
2318
2319         talloc_free(r);
2320
2321         s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s",
2322                                                   s->dest_dsa.server_dn_str);
2323         if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return;
2324
2325         c->status = becomeDC_prepare_db(s);
2326         if (!composite_is_ok(c)) return;
2327
2328         /* this avoids the epmapper lookup on the 2nd connection */
2329         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2330         if (composite_nomem(binding_str, c)) return;
2331
2332         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding);
2333         talloc_free(binding_str);
2334         if (!composite_is_ok(c)) return;
2335
2336         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2337         s->drsuapi2.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2338
2339         becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv);
2340 }
2341
2342 static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s)
2343 {
2344         if (!s->callbacks.prepare_db) return NT_STATUS_OK;
2345
2346         s->_pp.domain           = &s->domain;
2347         s->_pp.forest           = &s->forest;
2348         s->_pp.source_dsa       = &s->source_dsa;
2349         s->_pp.dest_dsa         = &s->dest_dsa;
2350
2351         return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp);
2352 }
2353
2354 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req);
2355
2356 static void becomeDC_drsuapi2_connect_recv(struct composite_context *req)
2357 {
2358         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2359                                           struct libnet_BecomeDC_state);
2360         struct composite_context *c = s->creq;
2361
2362         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe);
2363         if (!composite_is_ok(c)) return;
2364
2365         c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state,
2366                                        &s->drsuapi2.gensec_skey);
2367         if (!composite_is_ok(c)) return;
2368
2369         becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv);
2370 }
2371
2372 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req);
2373
2374 static void becomeDC_drsuapi2_bind_recv(struct rpc_request *req)
2375 {
2376         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2377                                           struct libnet_BecomeDC_state);
2378         struct composite_context *c = s->creq;
2379         char *binding_str;
2380         WERROR status;
2381
2382         bool print = false;
2383
2384         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2385                 print = true;
2386         }
2387
2388         c->status = dcerpc_ndr_request_recv(req);
2389         if (!composite_is_ok(c)) return;
2390
2391         if (print) {
2392                 NDR_PRINT_OUT_DEBUG(drsuapi_DsBind, &s->drsuapi2.bind_r);
2393         }
2394
2395         status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2);
2396         if (!W_ERROR_IS_OK(status)) {
2397                 composite_error(c, werror_to_ntstatus(status));
2398                 return;
2399         }
2400
2401         /* this avoids the epmapper lookup on the 3rd connection */
2402         binding_str = dcerpc_binding_string(s, s->drsuapi1.binding);
2403         if (composite_nomem(binding_str, c)) return;
2404
2405         c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding);
2406         talloc_free(binding_str);
2407         if (!composite_is_ok(c)) return;
2408
2409         /* w2k3 uses the same assoc_group_id as on the first connection, so we do */
2410         s->drsuapi3.binding->assoc_group_id     = s->drsuapi1.pipe->assoc_group_id;
2411         /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */
2412         s->drsuapi3.binding->flags              |= DCERPC_CONCURRENT_MULTIPLEX;
2413
2414         becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv);
2415 }
2416
2417 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s);
2418
2419 static void becomeDC_drsuapi3_connect_recv(struct composite_context *req)
2420 {
2421         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2422                                           struct libnet_BecomeDC_state);
2423         struct composite_context *c = s->creq;
2424
2425         c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe);
2426         if (!composite_is_ok(c)) return;
2427
2428         c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state,
2429                                        &s->drsuapi3.gensec_skey);
2430         if (!composite_is_ok(c)) return;
2431
2432         becomeDC_drsuapi3_pull_schema_send(s);
2433 }
2434
2435 static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s,
2436                                                  struct becomeDC_drsuapi *drsuapi_h,
2437                                                  struct becomeDC_drsuapi *drsuapi_p,
2438                                                  struct libnet_BecomeDC_Partition *partition,
2439                                                  void (*recv_fn)(struct rpc_request *req))
2440 {
2441         struct composite_context *c = s->creq;
2442         struct rpc_request *req;
2443         struct drsuapi_DsGetNCChanges *r;
2444
2445         r = talloc(s, struct drsuapi_DsGetNCChanges);
2446         if (composite_nomem(r, c)) return;
2447
2448         r->out.level_out = talloc(r, int32_t);
2449         if (composite_nomem(r->out.level_out, c)) return;
2450         r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest);
2451         if (composite_nomem(r->in.req, c)) return;
2452         r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr);
2453         if (composite_nomem(r->out.ctr, c)) return;
2454
2455         r->in.bind_handle       = &drsuapi_h->bind_handle;
2456         if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) {
2457                 r->in.level                             = 8;
2458                 r->in.req->req8.destination_dsa_guid    = partition->destination_dsa_guid;
2459                 r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2460                 r->in.req->req8.naming_context          = &partition->nc;
2461                 r->in.req->req8.highwatermark           = partition->highwatermark;
2462                 r->in.req->req8.uptodateness_vector     = NULL;
2463                 r->in.req->req8.replica_flags           = partition->replica_flags;
2464                 r->in.req->req8.max_object_count        = 133;
2465                 r->in.req->req8.max_ndr_size            = 1336811;
2466                 r->in.req->req8.extended_op             = DRSUAPI_EXOP_NONE;
2467                 r->in.req->req8.fsmo_info               = 0;
2468                 r->in.req->req8.partial_attribute_set   = NULL;
2469                 r->in.req->req8.partial_attribute_set_ex= NULL;
2470                 r->in.req->req8.mapping_ctr.num_mappings= 0;
2471                 r->in.req->req8.mapping_ctr.mappings    = NULL;
2472         } else {
2473                 r->in.level                             = 5;
2474                 r->in.req->req5.destination_dsa_guid    = partition->destination_dsa_guid;
2475                 r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id;
2476                 r->in.req->req5.naming_context          = &partition->nc;
2477                 r->in.req->req5.highwatermark           = partition->highwatermark;
2478                 r->in.req->req5.uptodateness_vector     = NULL;
2479                 r->in.req->req5.replica_flags           = partition->replica_flags;
2480                 r->in.req->req5.max_object_count        = 133;
2481                 r->in.req->req5.max_ndr_size            = 1336770;
2482                 r->in.req->req5.extended_op             = DRSUAPI_EXOP_NONE;
2483                 r->in.req->req5.fsmo_info               = 0;
2484         }
2485
2486         /*
2487          * we should try to use the drsuapi_p->pipe here, as w2k3 does
2488          * but it seems that some extra flags in the DCERPC Bind call
2489          * are needed for it. Or the same KRB5 TGS is needed on both
2490          * connections.
2491          */
2492         req = dcerpc_drsuapi_DsGetNCChanges_send(drsuapi_p->pipe, r, r);
2493         composite_continue_rpc(c, req, recv_fn, s);
2494 }
2495
2496 static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s,
2497                                                    struct becomeDC_drsuapi *drsuapi_h,
2498                                                    struct becomeDC_drsuapi *drsuapi_p,
2499                                                    struct libnet_BecomeDC_Partition *partition,
2500                                                    struct drsuapi_DsGetNCChanges *r)
2501 {
2502         uint32_t ctr_level = 0;
2503         struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL;
2504         struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL;
2505         struct GUID *source_dsa_guid = NULL;
2506         struct GUID *source_dsa_invocation_id = NULL;
2507         struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL;
2508         bool more_data = false;
2509         NTSTATUS nt_status;
2510
2511         if (!W_ERROR_IS_OK(r->out.result)) {
2512                 return r->out.result;
2513         }
2514
2515         if (*r->out.level_out == 1) {
2516                 ctr_level = 1;
2517                 ctr1 = &r->out.ctr->ctr1;
2518         } else if (*r->out.level_out == 2 &&
2519                    r->out.ctr->ctr2.mszip1.ts) {
2520                 ctr_level = 1;
2521                 ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1;
2522         } else if (*r->out.level_out == 6) {
2523                 ctr_level = 6;
2524                 ctr6 = &r->out.ctr->ctr6;
2525         } else if (*r->out.level_out == 7 &&
2526                    r->out.ctr->ctr7.level == 6 &&
2527                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP &&
2528                    r->out.ctr->ctr7.ctr.mszip6.ts) {
2529                 ctr_level = 6;
2530                 ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6;
2531         } else if (*r->out.level_out == 7 &&
2532                    r->out.ctr->ctr7.level == 6 &&
2533                    r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_XPRESS &&
2534                    r->out.ctr->ctr7.ctr.xpress6.ts) {
2535                 ctr_level = 6;
2536                 ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6;
2537         } else {
2538                 return WERR_BAD_NET_RESP;
2539         }
2540
2541         if (!ctr1 && ! ctr6) {
2542                 return WERR_BAD_NET_RESP;
2543         }
2544
2545         if (ctr_level == 6) {
2546                 if (!W_ERROR_IS_OK(ctr6->drs_error)) {
2547                         return ctr6->drs_error;
2548                 }
2549         }
2550
2551         switch (ctr_level) {
2552         case 1:
2553                 source_dsa_guid                 = &ctr1->source_dsa_guid;
2554                 source_dsa_invocation_id        = &ctr1->source_dsa_invocation_id;
2555                 new_highwatermark               = &ctr1->new_highwatermark;
2556                 more_data                       = ctr1->more_data;
2557                 break;
2558         case 6:
2559                 source_dsa_guid                 = &ctr6->source_dsa_guid;
2560                 source_dsa_invocation_id        = &ctr6->source_dsa_invocation_id;
2561                 new_highwatermark               = &ctr6->new_highwatermark;
2562                 more_data                       = ctr6->more_data;
2563                 break;
2564         }
2565
2566         partition->highwatermark                = *new_highwatermark;
2567         partition->source_dsa_guid              = *source_dsa_guid;
2568         partition->source_dsa_invocation_id     = *source_dsa_invocation_id;
2569         partition->more_data                    = more_data;
2570
2571         if (!partition->store_chunk) return WERR_OK;
2572
2573         s->_sc.domain           = &s->domain;
2574         s->_sc.forest           = &s->forest;
2575         s->_sc.source_dsa       = &s->source_dsa;
2576         s->_sc.dest_dsa         = &s->dest_dsa;
2577         s->_sc.partition        = partition;
2578         s->_sc.ctr_level        = ctr_level;
2579         s->_sc.ctr1             = ctr1;
2580         s->_sc.ctr6             = ctr6;
2581         /*
2582          * we need to use the drsuapi_p->gensec_skey here,
2583          * when we use drsuapi_p->pipe in the for this request
2584          */
2585         s->_sc.gensec_skey      = &drsuapi_p->gensec_skey;
2586
2587         nt_status = partition->store_chunk(s->callbacks.private_data, &s->_sc);
2588         if (!NT_STATUS_IS_OK(nt_status)) {
2589                 return ntstatus_to_werror(nt_status);
2590         }
2591
2592         return WERR_OK;
2593 }
2594
2595 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req);
2596
2597 static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s)
2598 {
2599         s->schema_part.nc.guid  = GUID_zero();
2600         s->schema_part.nc.sid   = s->zero_sid;
2601         s->schema_part.nc.dn    = s->forest.schema_dn_str;
2602
2603         s->schema_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2604
2605         s->schema_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2606                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2607                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2608                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2609                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2610                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2611
2612         s->schema_part.store_chunk      = s->callbacks.schema_chunk;
2613
2614         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2615                                              becomeDC_drsuapi3_pull_schema_recv);
2616 }
2617
2618 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s);
2619
2620 static void becomeDC_drsuapi3_pull_schema_recv(struct rpc_request *req)
2621 {
2622         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2623                                           struct libnet_BecomeDC_state);
2624         struct composite_context *c = s->creq;
2625         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2626                                            struct drsuapi_DsGetNCChanges);
2627         WERROR status;
2628
2629         bool print = false;
2630
2631         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2632                 print = true;
2633         }
2634
2635         c->status = dcerpc_ndr_request_recv(req);
2636         if (!composite_is_ok(c)) return;
2637
2638         if (print) {
2639                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2640         }
2641
2642         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r);
2643         if (!W_ERROR_IS_OK(status)) {
2644                 composite_error(c, werror_to_ntstatus(status));
2645                 return;
2646         }
2647
2648         talloc_free(r);
2649
2650         if (s->schema_part.more_data) {
2651                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part,
2652                                                      becomeDC_drsuapi3_pull_schema_recv);
2653                 return;
2654         }
2655
2656         becomeDC_drsuapi3_pull_config_send(s);
2657 }
2658
2659 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req);
2660
2661 static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s)
2662 {
2663         s->config_part.nc.guid  = GUID_zero();
2664         s->config_part.nc.sid   = s->zero_sid;
2665         s->config_part.nc.dn    = s->forest.config_dn_str;
2666
2667         s->config_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2668
2669         s->config_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2670                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2671                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2672                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2673                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2674                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2675
2676         s->config_part.store_chunk      = s->callbacks.config_chunk;
2677
2678         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2679                                              becomeDC_drsuapi3_pull_config_recv);
2680 }
2681
2682 static void becomeDC_drsuapi3_pull_config_recv(struct rpc_request *req)
2683 {
2684         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2685                                           struct libnet_BecomeDC_state);
2686         struct composite_context *c = s->creq;
2687         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2688                                            struct drsuapi_DsGetNCChanges);
2689         WERROR status;
2690
2691         bool print = false;
2692
2693         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2694                 print = true;
2695         }
2696
2697         c->status = dcerpc_ndr_request_recv(req);
2698         if (!composite_is_ok(c)) return;
2699
2700         if (print) {
2701                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2702         }
2703
2704         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r);
2705         if (!W_ERROR_IS_OK(status)) {
2706                 composite_error(c, werror_to_ntstatus(status));
2707                 return;
2708         }
2709
2710         talloc_free(r);
2711
2712         if (s->config_part.more_data) {
2713                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part,
2714                                                      becomeDC_drsuapi3_pull_config_recv);
2715                 return;
2716         }
2717
2718         becomeDC_connect_ldap2(s);
2719 }
2720
2721 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req);
2722
2723 static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s)
2724 {
2725         s->domain_part.nc.guid  = GUID_zero();
2726         s->domain_part.nc.sid   = s->zero_sid;
2727         s->domain_part.nc.dn    = s->domain.dn_str;
2728
2729         s->domain_part.destination_dsa_guid     = s->drsuapi2.bind_guid;
2730
2731         s->domain_part.replica_flags    = DRSUAPI_DS_REPLICA_NEIGHBOUR_WRITEABLE
2732                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_SYNC_ON_STARTUP
2733                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_DO_SCHEDULED_SYNCS
2734                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_IN_PROGRESS
2735                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_NEVER_SYNCED
2736                                         | DRSUAPI_DS_REPLICA_NEIGHBOUR_COMPRESS_CHANGES;
2737
2738         s->domain_part.store_chunk      = s->callbacks.domain_chunk;
2739
2740         becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2741                                              becomeDC_drsuapi3_pull_domain_recv);
2742 }
2743
2744 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2745                                               struct becomeDC_drsuapi *drsuapi,
2746                                               struct libnet_BecomeDC_Partition *partition,
2747                                               void (*recv_fn)(struct rpc_request *req));
2748 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req);
2749
2750 static void becomeDC_drsuapi3_pull_domain_recv(struct rpc_request *req)
2751 {
2752         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2753                                           struct libnet_BecomeDC_state);
2754         struct composite_context *c = s->creq;
2755         struct drsuapi_DsGetNCChanges *r = talloc_get_type(req->ndr.struct_ptr,
2756                                            struct drsuapi_DsGetNCChanges);
2757         WERROR status;
2758         bool print = false;
2759
2760         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2761                 print = true;
2762         }
2763
2764         c->status = dcerpc_ndr_request_recv(req);
2765         if (!composite_is_ok(c)) return;
2766
2767         if (print) {
2768                 NDR_PRINT_OUT_DEBUG(drsuapi_DsGetNCChanges, r);
2769         }
2770
2771         status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r);
2772         if (!W_ERROR_IS_OK(status)) {
2773                 composite_error(c, werror_to_ntstatus(status));
2774                 return;
2775         }
2776
2777         talloc_free(r);
2778
2779         if (s->domain_part.more_data) {
2780                 becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part,
2781                                                      becomeDC_drsuapi3_pull_domain_recv);
2782                 return;
2783         }
2784
2785         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part,
2786                                           becomeDC_drsuapi2_update_refs_schema_recv);
2787 }
2788
2789 static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s,
2790                                               struct becomeDC_drsuapi *drsuapi,
2791                                               struct libnet_BecomeDC_Partition *partition,
2792                                               void (*recv_fn)(struct rpc_request *req))
2793 {
2794         struct composite_context *c = s->creq;
2795         struct rpc_request *req;
2796         struct drsuapi_DsReplicaUpdateRefs *r;
2797         const char *ntds_guid_str;
2798         const char *ntds_dns_name;
2799
2800         r = talloc(s, struct drsuapi_DsReplicaUpdateRefs);
2801         if (composite_nomem(r, c)) return;
2802
2803         ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid);
2804         if (composite_nomem(ntds_guid_str, c)) return;
2805
2806         ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s",
2807                                         ntds_guid_str,
2808                                         s->domain.dns_name);
2809         if (composite_nomem(ntds_dns_name, c)) return;
2810
2811         r->in.bind_handle               = &drsuapi->bind_handle;
2812         r->in.level                     = 1;
2813         r->in.req.req1.naming_context   = &partition->nc;
2814         r->in.req.req1.dest_dsa_dns_name= ntds_dns_name;
2815         r->in.req.req1.dest_dsa_guid    = s->dest_dsa.ntds_guid;
2816         r->in.req.req1.options          = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
2817                                         | DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE;
2818
2819         /* I think this is how we mark ourselves as a RODC */
2820         if (!lp_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) {
2821                 r->in.req.req1.options |= DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE;
2822         }
2823
2824         req = dcerpc_drsuapi_DsReplicaUpdateRefs_send(drsuapi->pipe, r, r);
2825         composite_continue_rpc(c, req, recv_fn, s);
2826 }
2827
2828 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req);
2829
2830 static void becomeDC_drsuapi2_update_refs_schema_recv(struct rpc_request *req)
2831 {
2832         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2833                                           struct libnet_BecomeDC_state);
2834         struct composite_context *c = s->creq;
2835         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2836                                            struct drsuapi_DsReplicaUpdateRefs);
2837         bool print = false;
2838
2839         if (req->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
2840                 print = true;
2841         }
2842
2843         c->status = dcerpc_ndr_request_recv(req);
2844         if (!composite_is_ok(c)) return;
2845
2846         if (print) {
2847                 NDR_PRINT_OUT_DEBUG(drsuapi_DsReplicaUpdateRefs, r);
2848         }
2849
2850         if (!W_ERROR_IS_OK(r->out.result)) {
2851                 composite_error(c, werror_to_ntstatus(r->out.result));
2852                 return;
2853         }
2854
2855         talloc_free(r);
2856
2857         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part,
2858                                           becomeDC_drsuapi2_update_refs_config_recv);
2859 }
2860
2861 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req);
2862
2863 static void becomeDC_drsuapi2_update_refs_config_recv(struct rpc_request *req)
2864 {
2865         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2866                                           struct libnet_BecomeDC_state);
2867         struct composite_context *c = s->creq;
2868         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2869                                            struct drsuapi_DsReplicaUpdateRefs);
2870
2871         c->status = dcerpc_ndr_request_recv(req);
2872         if (!composite_is_ok(c)) return;
2873
2874         if (!W_ERROR_IS_OK(r->out.result)) {
2875                 composite_error(c, werror_to_ntstatus(r->out.result));
2876                 return;
2877         }
2878
2879         talloc_free(r);
2880
2881         becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part,
2882                                           becomeDC_drsuapi2_update_refs_domain_recv);
2883 }
2884
2885 static void becomeDC_drsuapi2_update_refs_domain_recv(struct rpc_request *req)
2886 {
2887         struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data,
2888                                           struct libnet_BecomeDC_state);
2889         struct composite_context *c = s->creq;
2890         struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(req->ndr.struct_ptr,
2891                                            struct drsuapi_DsReplicaUpdateRefs);
2892
2893         c->status = dcerpc_ndr_request_recv(req);
2894         if (!composite_is_ok(c)) return;
2895
2896         if (!W_ERROR_IS_OK(r->out.result)) {
2897                 composite_error(c, werror_to_ntstatus(r->out.result));
2898                 return;
2899         }
2900
2901         talloc_free(r);
2902
2903         /* TODO: use DDNS updates and register dns names */
2904         composite_done(c);
2905 }
2906
2907 static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s)
2908 {
2909         int ret;
2910         struct ldb_message *msg;
2911         uint32_t i;
2912         uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT |
2913                                         UF_TRUSTED_FOR_DELEGATION;
2914
2915         /* as the value is already as we want it to be, we're done */
2916         if (s->dest_dsa.user_account_control == user_account_control) {
2917                 return NT_STATUS_OK;
2918         }
2919
2920         /* make a 'modify' msg, and only for serverReference */
2921         msg = ldb_msg_new(s);
2922         NT_STATUS_HAVE_NO_MEMORY(msg);
2923         msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2924         NT_STATUS_HAVE_NO_MEMORY(msg->dn);
2925
2926         ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
2927         if (ret != 0) {
2928                 talloc_free(msg);
2929                 return NT_STATUS_NO_MEMORY;
2930         }
2931
2932         /* mark all the message elements (should be just one)
2933            as LDB_FLAG_MOD_REPLACE */
2934         for (i=0;i<msg->num_elements;i++) {
2935                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
2936         }
2937
2938         ret = ldb_modify(s->ldap2.ldb, msg);
2939         talloc_free(msg);
2940         if (ret != LDB_SUCCESS) {
2941                 return NT_STATUS_LDAP(ret);
2942         }
2943
2944         s->dest_dsa.user_account_control = user_account_control;
2945
2946         return NT_STATUS_OK;
2947 }
2948
2949 static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s)
2950 {
2951         int ret;
2952         struct ldb_result *r;
2953         struct ldb_dn *basedn;
2954         struct ldb_dn *old_dn;
2955         struct ldb_dn *new_dn;
2956         static const char *_1_1_attrs[] = {
2957                 "1.1",
2958                 NULL
2959         };
2960
2961         basedn = ldb_dn_new_fmt(s, s->ldap2.ldb, "<WKGUID=a361b2ffffd211d1aa4b00c04fd7d83a,%s>",
2962                                 s->domain.dn_str);
2963         NT_STATUS_HAVE_NO_MEMORY(basedn);
2964
2965         ret = ldb_search(s->ldap2.ldb, s, &r, basedn, LDB_SCOPE_BASE,
2966                          _1_1_attrs, "(objectClass=*)");
2967         talloc_free(basedn);
2968         if (ret != LDB_SUCCESS) {
2969                 return NT_STATUS_LDAP(ret);
2970         } else if (r->count != 1) {
2971                 talloc_free(r);
2972                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2973         }
2974
2975         old_dn = ldb_dn_new(r, s->ldap2.ldb, s->dest_dsa.computer_dn_str);
2976         NT_STATUS_HAVE_NO_MEMORY(old_dn);
2977
2978         new_dn = r->msgs[0]->dn;
2979
2980         if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
2981                 talloc_free(r);
2982                 return NT_STATUS_NO_MEMORY;
2983         }
2984
2985         if (ldb_dn_compare(old_dn, new_dn) == 0) {
2986                 /* we don't need to rename if the old and new dn match */
2987                 talloc_free(r);
2988                 return NT_STATUS_OK;
2989         }
2990
2991         ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn);
2992         if (ret != LDB_SUCCESS) {
2993                 talloc_free(r);
2994                 return NT_STATUS_LDAP(ret);
2995         }
2996
2997         s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
2998         NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
2999
3000         talloc_free(r);
3001
3002         return NT_STATUS_OK;
3003 }
3004
3005 static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s)
3006 {
3007         struct composite_context *c = s->creq;
3008
3009         c->status = becomeDC_ldap_connect(s, &s->ldap2);
3010         if (!composite_is_ok(c)) return;
3011
3012         c->status = becomeDC_ldap2_modify_computer(s);
3013         if (!composite_is_ok(c)) return;
3014
3015         c->status = becomeDC_ldap2_move_computer(s);
3016         if (!composite_is_ok(c)) return;
3017
3018         becomeDC_drsuapi3_pull_domain_send(s);
3019 }
3020
3021 struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3022 {
3023         struct composite_context *c;
3024         struct libnet_BecomeDC_state *s;
3025         char *tmp_name;
3026
3027         c = composite_create(mem_ctx, ctx->event_ctx);
3028         if (c == NULL) return NULL;
3029
3030         s = talloc_zero(c, struct libnet_BecomeDC_state);
3031         if (composite_nomem(s, c)) return c;
3032         c->private_data = s;
3033         s->creq         = c;
3034         s->libnet       = ctx;
3035
3036         /* Domain input */
3037         s->domain.dns_name      = talloc_strdup(s, r->in.domain_dns_name);
3038         if (composite_nomem(s->domain.dns_name, c)) return c;
3039         s->domain.netbios_name  = talloc_strdup(s, r->in.domain_netbios_name);
3040         if (composite_nomem(s->domain.netbios_name, c)) return c;
3041         s->domain.sid           = dom_sid_dup(s, r->in.domain_sid);
3042         if (composite_nomem(s->domain.sid, c)) return c;
3043
3044         /* Source DSA input */
3045         s->source_dsa.address   = talloc_strdup(s, r->in.source_dsa_address);
3046         if (composite_nomem(s->source_dsa.address, c)) return c;
3047
3048         /* Destination DSA input */
3049         s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
3050         if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
3051
3052         /* Destination DSA dns_name construction */
3053         tmp_name        = strlower_talloc(s, s->dest_dsa.netbios_name);
3054         if (composite_nomem(tmp_name, c)) return c;
3055         tmp_name        = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name);
3056         if (composite_nomem(tmp_name, c)) return c;
3057         s->dest_dsa.dns_name    = tmp_name;
3058
3059         /* Callback function pointers */
3060         s->callbacks = r->in.callbacks;
3061
3062         becomeDC_send_cldap(s);
3063         return c;
3064 }
3065
3066 NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3067 {
3068         NTSTATUS status;
3069
3070         status = composite_wait(c);
3071
3072         ZERO_STRUCT(r->out);
3073
3074         talloc_free(c);
3075         return status;
3076 }
3077
3078 NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r)
3079 {
3080         NTSTATUS status;
3081         struct composite_context *c;
3082         c = libnet_BecomeDC_send(ctx, mem_ctx, r);
3083         status = libnet_BecomeDC_recv(c, mem_ctx, r);
3084         return status;
3085 }