source4/dsdb/samdb/ldb_modules/samldb.c

   1 /*
   2    SAM ldb module
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2014
   5    Copyright (C) Simo Sorce  2004-2008
   6    Copyright (C) Matthias Dieter Wallnöfer 2009-2011
   7    Copyright (C) Matthieu Patou 2012
   8    Copyright (C) Catalyst.Net Ltd 2017
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 /*
  25  *  Name: ldb
  26  *
  27  *  Component: ldb samldb module
  28  *
  29  *  Description: various internal DSDB triggers - most for SAM specific objects
  30  *
  31  *  Author: Simo Sorce
  32  */
  33
  34 #include "includes.h"
  35 #include "libcli/ldap/ldap_ndr.h"
  36 #include "ldb_module.h"
  37 #include "auth/auth.h"
  38 #include "dsdb/samdb/samdb.h"
  39 #include "dsdb/samdb/ldb_modules/util.h"
  40 #include "dsdb/samdb/ldb_modules/ridalloc.h"
  41 #include "libcli/security/security.h"
  42 #include "librpc/gen_ndr/ndr_security.h"
  43 #include "ldb_wrap.h"
  44 #include "param/param.h"
  45 #include "libds/common/flag_mapping.h"
  46 #include "system/network.h"
  47 #include "librpc/gen_ndr/irpc.h"
  48
  49 struct samldb_ctx;
  50 enum samldb_add_type {
  51         SAMLDB_TYPE_USER,
  52         SAMLDB_TYPE_GROUP,
  53         SAMLDB_TYPE_CLASS,
  54         SAMLDB_TYPE_ATTRIBUTE
  55 };
  56
  57 typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
  58
  59 struct samldb_step {
  60         struct samldb_step *next;
  61         samldb_step_fn_t fn;
  62 };
  63
  64 struct samldb_ctx {
  65         struct ldb_module *module;
  66         struct ldb_request *req;
  67
  68         /* used for add operations */
  69         enum samldb_add_type type;
  70
  71         /* the resulting message */
  72         struct ldb_message *msg;
  73
  74         /* used in "samldb_find_for_defaultObjectCategory" */
  75         struct ldb_dn *dn, *res_dn;
  76
  77         /* all the async steps necessary to complete the operation */
  78         struct samldb_step *steps;
  79         struct samldb_step *curstep;
  80
  81         /* If someone set an ares to forward controls and response back to the caller */
  82         struct ldb_reply *ares;
  83 };
  84
  85 static struct samldb_ctx *samldb_ctx_init(struct ldb_module *module,
  86                                           struct ldb_request *req)
  87 {
  88         struct ldb_context *ldb;
  89         struct samldb_ctx *ac;
  90
  91         ldb = ldb_module_get_ctx(module);
  92
  93         ac = talloc_zero(req, struct samldb_ctx);
  94         if (ac == NULL) {
  95                 ldb_oom(ldb);
  96                 return NULL;
  97         }
  98
  99         ac->module = module;
 100         ac->req = req;
 101
 102         return ac;
 103 }
 104
 105 static int samldb_add_step(struct samldb_ctx *ac, samldb_step_fn_t fn)
 106 {
 107         struct samldb_step *step, *stepper;
 108
 109         step = talloc_zero(ac, struct samldb_step);
 110         if (step == NULL) {
 111                 return ldb_oom(ldb_module_get_ctx(ac->module));
 112         }
 113
 114         step->fn = fn;
 115
 116         if (ac->steps == NULL) {
 117                 ac->steps = step;
 118                 ac->curstep = step;
 119         } else {
 120                 if (ac->curstep == NULL)
 121                         return ldb_operr(ldb_module_get_ctx(ac->module));
 122                 for (stepper = ac->curstep; stepper->next != NULL;
 123                         stepper = stepper->next);
 124                 stepper->next = step;
 125         }
 126
 127         return LDB_SUCCESS;
 128 }
 129
 130 static int samldb_first_step(struct samldb_ctx *ac)
 131 {
 132         if (ac->steps == NULL) {
 133                 return ldb_operr(ldb_module_get_ctx(ac->module));
 134         }
 135
 136         ac->curstep = ac->steps;
 137         return ac->curstep->fn(ac);
 138 }
 139
 140 static int samldb_next_step(struct samldb_ctx *ac)
 141 {
 142         if (ac->curstep->next) {
 143                 ac->curstep = ac->curstep->next;
 144                 return ac->curstep->fn(ac);
 145         }
 146
 147         /* We exit the samldb module here. If someone set an "ares" to forward
 148          * controls and response back to the caller, use them. */
 149         if (ac->ares) {
 150                 return ldb_module_done(ac->req, ac->ares->controls,
 151                                        ac->ares->response, LDB_SUCCESS);
 152         } else {
 153                 return ldb_module_done(ac->req, NULL, NULL, LDB_SUCCESS);
 154         }
 155 }
 156
 157 static int samldb_unique_attr_check(struct samldb_ctx *ac, const char *attr,
 158                                     const char *attr_conflict,
 159                                     struct ldb_dn *base_dn)
 160 {
 161         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 162         const char * const no_attrs[] = { NULL };
 163         struct ldb_result *res;
 164         const char *enc_str;
 165         struct ldb_message_element *el;
 166         int ret;
 167
 168         el = dsdb_get_single_valued_attr(ac->msg, attr,
 169                                          ac->req->operation);
 170         if (el == NULL) {
 171                 /* we are not affected */
 172                 return LDB_SUCCESS;
 173         }
 174
 175         if (el->num_values > 1) {
 176                 ldb_asprintf_errstring(ldb,
 177                                        "samldb: %s has %u values, should be single-valued!",
 178                                        attr, el->num_values);
 179                 return LDB_ERR_CONSTRAINT_VIOLATION;
 180         } else if (el->num_values == 0) {
 181                 ldb_asprintf_errstring(ldb,
 182                                        "samldb: new value for %s not provided for mandatory, single-valued attribute!",
 183                                        attr);
 184                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 185         }
 186         if (el->values[0].length == 0) {
 187                 ldb_asprintf_errstring(ldb,
 188                                        "samldb: %s is of zero length, should have a value!",
 189                                        attr);
 190                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
 191         }
 192         enc_str = ldb_binary_encode(ac, el->values[0]);
 193
 194         if (enc_str == NULL) {
 195                 return ldb_module_oom(ac->module);
 196         }
 197
 198         /* Make sure that attr (eg) "sAMAccountName" is only used once */
 199
 200         if (attr_conflict != NULL) {
 201                 ret = dsdb_module_search(ac->module, ac, &res,
 202                                          base_dn,
 203                                          LDB_SCOPE_SUBTREE, no_attrs,
 204                                          DSDB_FLAG_NEXT_MODULE, ac->req,
 205                                          "(|(%s=%s)(%s=%s))",
 206                                          attr, enc_str,
 207                                          attr_conflict, enc_str);
 208         } else {
 209                 ret = dsdb_module_search(ac->module, ac, &res,
 210                                          base_dn,
 211                                          LDB_SCOPE_SUBTREE, no_attrs,
 212                                          DSDB_FLAG_NEXT_MODULE, ac->req,
 213                                          "(%s=%s)", attr, enc_str);
 214         }
 215         if (ret != LDB_SUCCESS) {
 216                 return ret;
 217         }
 218         if (res->count > 1) {
 219                 return ldb_operr(ldb);
 220         } else if (res->count == 1) {
 221                 if (ldb_dn_compare(res->msgs[0]->dn, ac->msg->dn) != 0) {
 222                         ldb_asprintf_errstring(ldb,
 223                                                "samldb: %s '%s' already in use!",
 224                                                attr, enc_str);
 225                         return LDB_ERR_ENTRY_ALREADY_EXISTS;
 226                 }
 227         }
 228         talloc_free(res);
 229
 230         return LDB_SUCCESS;
 231 }
 232
 233 static int samldb_sam_accountname_valid_check(struct samldb_ctx *ac)
 234 {
 235         int ret = samldb_unique_attr_check(ac, "samAccountName", NULL,
 236                                            ldb_get_default_basedn(
 237                                                    ldb_module_get_ctx(ac->module)));
 238         if (ret == LDB_ERR_OBJECT_CLASS_VIOLATION) {
 239                 ret = LDB_ERR_CONSTRAINT_VIOLATION;
 240         }
 241         return ret;
 242 }
 243
 244 static int samldb_schema_attributeid_valid_check(struct samldb_ctx *ac)
 245 {
 246         int ret = samldb_unique_attr_check(ac, "attributeID", "governsID",
 247                                            ldb_get_schema_basedn(
 248                                                    ldb_module_get_ctx(ac->module)));
 249         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
 250                 ret = LDB_ERR_UNWILLING_TO_PERFORM;
 251         }
 252         return ret;
 253 }
 254
 255 static int samldb_schema_governsid_valid_check(struct samldb_ctx *ac)
 256 {
 257         int ret = samldb_unique_attr_check(ac, "governsID", "attributeID",
 258                                            ldb_get_schema_basedn(
 259                                                    ldb_module_get_ctx(ac->module)));
 260         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
 261                 ret = LDB_ERR_UNWILLING_TO_PERFORM;
 262         }
 263         return ret;
 264 }
 265
 266 static int samldb_schema_ldapdisplayname_valid_check(struct samldb_ctx *ac)
 267 {
 268         int ret = samldb_unique_attr_check(ac, "lDAPDisplayName", NULL,
 269                                            ldb_get_schema_basedn(
 270                                                    ldb_module_get_ctx(ac->module)));
 271         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
 272                 ret = LDB_ERR_UNWILLING_TO_PERFORM;
 273         }
 274         return ret;
 275 }
 276
 277 static int samldb_check_linkid_used(struct samldb_ctx *ac,
 278                                     struct dsdb_schema *schema,
 279                                     struct ldb_dn *schema_dn,
 280                                     struct ldb_context *ldb,
 281                                     int32_t linkID,
 282                                     bool *found)
 283 {
 284         int ret;
 285         struct ldb_result *ldb_res;
 286
 287         if (dsdb_attribute_by_linkID(schema, linkID)) {
 288                 *found = true;
 289                 return LDB_SUCCESS;
 290         }
 291
 292         ret = dsdb_module_search(ac->module, ac,
 293                                  &ldb_res,
 294                                  schema_dn, LDB_SCOPE_ONELEVEL, NULL,
 295                                  DSDB_FLAG_NEXT_MODULE,
 296                                  ac->req,
 297                                  "(linkID=%d)", linkID);
 298         if (ret != LDB_SUCCESS) {
 299                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 300                               __location__": Searching for linkID=%d failed - %s\n",
 301                               linkID,
 302                               ldb_errstring(ldb));
 303                 return ldb_operr(ldb);
 304         }
 305
 306         *found = (ldb_res->count != 0);
 307         talloc_free(ldb_res);
 308
 309         return LDB_SUCCESS;
 310 }
 311
 312 /* Find the next open forward linkID in the schema. */
 313 static int samldb_generate_next_linkid(struct samldb_ctx *ac,
 314                                        struct dsdb_schema *schema,
 315                                        int32_t *next_linkID)
 316 {
 317         int ret;
 318         struct ldb_context *ldb;
 319         struct ldb_dn *schema_dn;
 320         bool linkID_used = true;
 321
 322         /*
 323          * Windows starts at about 0xB0000000 in order to stop potential
 324          * collisions with future additions to the schema. We pass this
 325          * around as a signed int sometimes, but this should be sufficient.
 326          */
 327         *next_linkID = 0x40000000;
 328
 329         ldb = ldb_module_get_ctx(ac->module);
 330         schema_dn = ldb_get_schema_basedn(ldb);
 331
 332         while (linkID_used) {
 333                 *next_linkID += 2;
 334                 ret = samldb_check_linkid_used(ac, schema,
 335                                                schema_dn, ldb,
 336                                                *next_linkID, &linkID_used);
 337                 if (ret != LDB_SUCCESS) {
 338                         return ret;
 339                 }
 340         }
 341
 342         return LDB_SUCCESS;
 343 }
 344
 345 static int samldb_schema_add_handle_linkid(struct samldb_ctx *ac)
 346 {
 347         int ret;
 348         bool ok, found = false;
 349         struct ldb_message_element *el;
 350         const char *enc_str;
 351         const struct dsdb_attribute *attr;
 352         struct ldb_context *ldb;
 353         struct ldb_dn *schema_dn;
 354         struct dsdb_schema *schema;
 355         int32_t new_linkID = 0;
 356
 357         ldb = ldb_module_get_ctx(ac->module);
 358         schema = dsdb_get_schema(ldb, ac);
 359         schema_dn = ldb_get_schema_basedn(ldb);
 360
 361         el = dsdb_get_single_valued_attr(ac->msg, "linkID",
 362                                          ac->req->operation);
 363         if (el == NULL) {
 364                 return LDB_SUCCESS;
 365         }
 366
 367         enc_str = ldb_binary_encode(ac, el->values[0]);
 368         if (enc_str == NULL) {
 369                 return ldb_module_oom(ac->module);
 370         }
 371
 372         ok = (strcmp(enc_str, "0") == 0);
 373         if (ok) {
 374                 return LDB_SUCCESS;
 375         }
 376
 377         /*
 378          * This OID indicates that the caller wants the linkID
 379          * to be automatically generated. We therefore assign
 380          * it the next open linkID.
 381          */
 382         ok = (strcmp(enc_str, "1.2.840.113556.1.2.50") == 0);
 383         if (ok) {
 384                 ret = samldb_generate_next_linkid(ac, schema, &new_linkID);
 385                 if (ret != LDB_SUCCESS) {
 386                         return ret;
 387                 }
 388
 389                 ldb_msg_remove_element(ac->msg, el);
 390                 ret = samdb_msg_add_int(ldb, ac->msg, ac->msg, "linkID",
 391                                         new_linkID);
 392                 return ret;
 393         }
 394
 395         /*
 396          * Using either the attributeID or lDAPDisplayName of
 397          * another attribute in the linkID field indicates that
 398          * we should make this the backlink of that attribute.
 399          */
 400         attr = dsdb_attribute_by_attributeID_oid(schema, enc_str);
 401         if (attr == NULL) {
 402                 attr = dsdb_attribute_by_lDAPDisplayName(schema, enc_str);
 403         }
 404
 405         if (attr != NULL) {
 406                 /*
 407                  * The attribute we're adding this as a backlink of must
 408                  * be a forward link.
 409                  */
 410                 if (attr->linkID % 2 != 0) {
 411                         return LDB_ERR_UNWILLING_TO_PERFORM;
 412                 }
 413
 414                 new_linkID = attr->linkID + 1;
 415
 416                 /* Make sure that this backlink doesn't already exist. */
 417                 ret = samldb_check_linkid_used(ac, schema,
 418                                                schema_dn, ldb,
 419                                                new_linkID, &found);
 420                 if (ret != LDB_SUCCESS) {
 421                         return ret;
 422                 }
 423
 424                 if (found) {
 425                         return LDB_ERR_UNWILLING_TO_PERFORM;
 426                 }
 427
 428                 ldb_msg_remove_element(ac->msg, el);
 429                 ret = samdb_msg_add_int(ldb, ac->msg, ac->msg, "linkID",
 430                                         new_linkID);
 431                 return ret;
 432         }
 433
 434         schema_dn = ldb_get_schema_basedn(ldb_module_get_ctx(ac->module));
 435         ret = samldb_unique_attr_check(ac, "linkID", NULL, schema_dn);
 436         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
 437                 return LDB_ERR_UNWILLING_TO_PERFORM;
 438         } else {
 439                 return ret;
 440         }
 441 }
 442
 443 static int samldb_check_mapiid_used(struct samldb_ctx *ac,
 444                                     struct dsdb_schema *schema,
 445                                     struct ldb_dn *schema_dn,
 446                                     struct ldb_context *ldb,
 447                                     int32_t mapiid,
 448                                     bool *found)
 449 {
 450         int ret;
 451         struct ldb_result *ldb_res;
 452
 453         ret = dsdb_module_search(ac->module, ac,
 454                                  &ldb_res,
 455                                  schema_dn, LDB_SCOPE_ONELEVEL, NULL,
 456                                  DSDB_FLAG_NEXT_MODULE,
 457                                  ac->req,
 458                                  "(mAPIID=%d)", mapiid);
 459         if (ret != LDB_SUCCESS) {
 460                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 461                               __location__": Searching for mAPIID=%d failed - %s\n",
 462                               mapiid,
 463                               ldb_errstring(ldb));
 464                 return ldb_operr(ldb);
 465         }
 466
 467         *found = (ldb_res->count != 0);
 468         talloc_free(ldb_res);
 469
 470         return LDB_SUCCESS;
 471 }
 472
 473 static int samldb_generate_next_mapiid(struct samldb_ctx *ac,
 474                                        struct dsdb_schema *schema,
 475                                        int32_t *next_mapiid)
 476 {
 477         int ret;
 478         struct ldb_context *ldb;
 479         struct ldb_dn *schema_dn;
 480         bool mapiid_used = true;
 481
 482         /* Windows' generation seems to start about here */
 483         *next_mapiid = 60000;
 484
 485         ldb = ldb_module_get_ctx(ac->module);
 486         schema_dn = ldb_get_schema_basedn(ldb);
 487
 488         while (mapiid_used) {
 489                 *next_mapiid += 1;
 490                 ret = samldb_check_mapiid_used(ac, schema,
 491                                                schema_dn, ldb,
 492                                                *next_mapiid, &mapiid_used);
 493                 if (ret != LDB_SUCCESS) {
 494                         return ret;
 495                 }
 496         }
 497
 498         return LDB_SUCCESS;
 499 }
 500
 501 static int samldb_schema_add_handle_mapiid(struct samldb_ctx *ac)
 502 {
 503         int ret;
 504         bool ok;
 505         struct ldb_message_element *el;
 506         const char *enc_str;
 507         struct ldb_context *ldb;
 508         struct ldb_dn *schema_dn;
 509         struct dsdb_schema *schema;
 510         int32_t new_mapiid = 0;
 511
 512         /*
 513          * The mAPIID of a new attribute should be automatically generated
 514          * if a specific OID is put as the mAPIID, as according to
 515          * [MS-ADTS] 3.1.1.2.3.2.
 516          */
 517
 518         ldb = ldb_module_get_ctx(ac->module);
 519         schema = dsdb_get_schema(ldb, ac);
 520         schema_dn = ldb_get_schema_basedn(ldb);
 521
 522         el = dsdb_get_single_valued_attr(ac->msg, "mAPIID",
 523                                          ac->req->operation);
 524         if (el == NULL) {
 525                 return LDB_SUCCESS;
 526         }
 527
 528         enc_str = ldb_binary_encode(ac, el->values[0]);
 529         if (enc_str == NULL) {
 530                 return ldb_module_oom(ac->module);
 531         }
 532
 533         ok = (strcmp(enc_str, "1.2.840.113556.1.2.49") == 0);
 534         if (ok) {
 535                 ret = samldb_generate_next_mapiid(ac, schema,
 536                                                   &new_mapiid);
 537                 if (ret != LDB_SUCCESS) {
 538                         return ret;
 539                 }
 540
 541                 ldb_msg_remove_element(ac->msg, el);
 542                 ret = samdb_msg_add_int(ldb, ac->msg, ac->msg,
 543                                         "mAPIID", new_mapiid);
 544                 return ret;
 545         }
 546
 547         schema_dn = ldb_get_schema_basedn(ldb_module_get_ctx(ac->module));
 548         ret = samldb_unique_attr_check(ac, "mAPIID", NULL, schema_dn);
 549         if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
 550                 return LDB_ERR_UNWILLING_TO_PERFORM;
 551         } else {
 552                 return ret;
 553         }
 554 }
 555
 556 /* sAMAccountName handling */
 557 static int samldb_generate_sAMAccountName(struct ldb_context *ldb,
 558                                           struct ldb_message *msg)
 559 {
 560         char *name;
 561
 562         /* Format: $000000-000000000000 */
 563
 564         name = talloc_asprintf(msg, "$%.6X-%.6X%.6X",
 565                                 (unsigned int)generate_random(),
 566                                 (unsigned int)generate_random(),
 567                                 (unsigned int)generate_random());
 568         if (name == NULL) {
 569                 return ldb_oom(ldb);
 570         }
 571         return ldb_msg_add_steal_string(msg, "sAMAccountName", name);
 572 }
 573
 574 static int samldb_check_sAMAccountName(struct samldb_ctx *ac)
 575 {
 576         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 577         int ret;
 578
 579         if (ldb_msg_find_element(ac->msg, "sAMAccountName") == NULL) {
 580                 ret = samldb_generate_sAMAccountName(ldb, ac->msg);
 581                 if (ret != LDB_SUCCESS) {
 582                         return ret;
 583                 }
 584         }
 585
 586         ret = samldb_sam_accountname_valid_check(ac);
 587         if (ret != LDB_SUCCESS) {
 588                 return ret;
 589         }
 590
 591         return samldb_next_step(ac);
 592 }
 593
 594
 595 static bool samldb_msg_add_sid(struct ldb_message *msg,
 596                                 const char *name,
 597                                 const struct dom_sid *sid)
 598 {
 599         struct ldb_val v;
 600         enum ndr_err_code ndr_err;
 601
 602         ndr_err = ndr_push_struct_blob(&v, msg, sid,
 603                                        (ndr_push_flags_fn_t)ndr_push_dom_sid);
 604         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 605                 return false;
 606         }
 607         return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
 608 }
 609
 610
 611 /* allocate a SID using our RID Set */
 612 static int samldb_allocate_sid(struct samldb_ctx *ac)
 613 {
 614         uint32_t rid;
 615         struct dom_sid *sid;
 616         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 617         int ret;
 618
 619         ret = ridalloc_allocate_rid(ac->module, &rid, ac->req);
 620         if (ret != LDB_SUCCESS) {
 621                 return ret;
 622         }
 623
 624         sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
 625         if (sid == NULL) {
 626                 return ldb_module_oom(ac->module);
 627         }
 628
 629         if ( ! samldb_msg_add_sid(ac->msg, "objectSid", sid)) {
 630                 return ldb_operr(ldb);
 631         }
 632
 633         return samldb_next_step(ac);
 634 }
 635
 636 /*
 637   see if a krbtgt_number is available
 638  */
 639 static bool samldb_krbtgtnumber_available(struct samldb_ctx *ac,
 640                                           uint32_t krbtgt_number)
 641 {
 642         TALLOC_CTX *tmp_ctx = talloc_new(ac);
 643         struct ldb_result *res;
 644         const char * const no_attrs[] = { NULL };
 645         int ret;
 646
 647         ret = dsdb_module_search(ac->module, tmp_ctx, &res,
 648                                  ldb_get_default_basedn(ldb_module_get_ctx(ac->module)),
 649                                  LDB_SCOPE_SUBTREE, no_attrs,
 650                                  DSDB_FLAG_NEXT_MODULE,
 651                                  ac->req,
 652                                  "(msDC-SecondaryKrbTgtNumber=%u)",
 653                                  krbtgt_number);
 654         if (ret == LDB_SUCCESS && res->count == 0) {
 655                 talloc_free(tmp_ctx);
 656                 return true;
 657         }
 658         talloc_free(tmp_ctx);
 659         return false;
 660 }
 661
 662 /* special handling for add in RODC join */
 663 static int samldb_rodc_add(struct samldb_ctx *ac)
 664 {
 665         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 666         uint32_t krbtgt_number, i_start, i;
 667         int ret;
 668         struct ldb_val newpass_utf16;
 669
 670         /* find a unused msDC-SecondaryKrbTgtNumber */
 671         i_start = generate_random() & 0xFFFF;
 672         if (i_start == 0) {
 673                 i_start = 1;
 674         }
 675
 676         for (i=i_start; i<=0xFFFF; i++) {
 677                 if (samldb_krbtgtnumber_available(ac, i)) {
 678                         krbtgt_number = i;
 679                         goto found;
 680                 }
 681         }
 682         for (i=1; i<i_start; i++) {
 683                 if (samldb_krbtgtnumber_available(ac, i)) {
 684                         krbtgt_number = i;
 685                         goto found;
 686                 }
 687         }
 688
 689         ldb_asprintf_errstring(ldb,
 690                                "%08X: Unable to find available msDS-SecondaryKrbTgtNumber",
 691                                W_ERROR_V(WERR_NO_SYSTEM_RESOURCES));
 692         return LDB_ERR_OTHER;
 693
 694 found:
 695         ret = ldb_msg_add_empty(ac->msg, "msDS-SecondaryKrbTgtNumber",
 696                                 LDB_FLAG_INTERNAL_DISABLE_VALIDATION, NULL);
 697         if (ret != LDB_SUCCESS) {
 698                 return ldb_operr(ldb);
 699         }
 700
 701         ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
 702                                  "msDS-SecondaryKrbTgtNumber", krbtgt_number);
 703         if (ret != LDB_SUCCESS) {
 704                 return ldb_operr(ldb);
 705         }
 706
 707         ret = ldb_msg_add_fmt(ac->msg, "sAMAccountName", "krbtgt_%u",
 708                               krbtgt_number);
 709         if (ret != LDB_SUCCESS) {
 710                 return ldb_operr(ldb);
 711         }
 712
 713         newpass_utf16 = data_blob_talloc_zero(ac->module, 256);
 714         if (newpass_utf16.data == NULL) {
 715                 return ldb_oom(ldb);
 716         }
 717         /*
 718          * Note that the password_hash module will ignore
 719          * this value and use it's own generate_secret_buffer()
 720          * that's why we can just use generate_random_buffer()
 721          * here.
 722          */
 723         generate_random_buffer(newpass_utf16.data, newpass_utf16.length);
 724         ret = ldb_msg_add_steal_value(ac->msg, "clearTextPassword", &newpass_utf16);
 725         if (ret != LDB_SUCCESS) {
 726                 return ldb_operr(ldb);
 727         }
 728
 729         return samldb_next_step(ac);
 730 }
 731
 732 static int samldb_find_for_defaultObjectCategory(struct samldb_ctx *ac)
 733 {
 734         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 735         struct ldb_result *res;
 736         const char * const no_attrs[] = { NULL };
 737         int ret;
 738
 739         ac->res_dn = NULL;
 740
 741         ret = dsdb_module_search(ac->module, ac, &res,
 742                                  ac->dn, LDB_SCOPE_BASE, no_attrs,
 743                                  DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT
 744                                  | DSDB_FLAG_NEXT_MODULE,
 745                                  ac->req,
 746                                  "(objectClass=classSchema)");
 747         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 748                 /* Don't be pricky when the DN doesn't exist if we have the */
 749                 /* RELAX control specified */
 750                 if (ldb_request_get_control(ac->req,
 751                                             LDB_CONTROL_RELAX_OID) == NULL) {
 752                         ldb_set_errstring(ldb,
 753                                           "samldb_find_defaultObjectCategory: "
 754                                           "Invalid DN for 'defaultObjectCategory'!");
 755                         return LDB_ERR_CONSTRAINT_VIOLATION;
 756                 }
 757         }
 758         if ((ret != LDB_ERR_NO_SUCH_OBJECT) && (ret != LDB_SUCCESS)) {
 759                 return ret;
 760         }
 761
 762         if (ret == LDB_SUCCESS) {
 763                 /* ensure the defaultObjectCategory has a full GUID */
 764                 struct ldb_message *m;
 765                 m = ldb_msg_new(ac->msg);
 766                 if (m == NULL) {
 767                         return ldb_oom(ldb);
 768                 }
 769                 m->dn = ac->msg->dn;
 770                 if (ldb_msg_add_string(m, "defaultObjectCategory",
 771                                        ldb_dn_get_extended_linearized(m, res->msgs[0]->dn, 1)) !=
 772                     LDB_SUCCESS) {
 773                         return ldb_oom(ldb);
 774                 }
 775                 m->elements[0].flags = LDB_FLAG_MOD_REPLACE;
 776
 777                 ret = dsdb_module_modify(ac->module, m,
 778                                          DSDB_FLAG_NEXT_MODULE,
 779                                          ac->req);
 780                 if (ret != LDB_SUCCESS) {
 781                         return ret;
 782                 }
 783         }
 784
 785
 786         ac->res_dn = ac->dn;
 787
 788         return samldb_next_step(ac);
 789 }
 790
 791 /**
 792  * msDS-IntId attributeSchema attribute handling
 793  * during LDB_ADD request processing
 794  */
 795 static int samldb_add_handle_msDS_IntId(struct samldb_ctx *ac)
 796 {
 797         int ret;
 798         bool id_exists;
 799         uint32_t msds_intid;
 800         int32_t system_flags;
 801         struct ldb_context *ldb;
 802         struct ldb_result *ldb_res;
 803         struct ldb_dn *schema_dn;
 804         struct samldb_msds_intid_persistant *msds_intid_struct;
 805         struct dsdb_schema *schema;
 806
 807         ldb = ldb_module_get_ctx(ac->module);
 808         schema_dn = ldb_get_schema_basedn(ldb);
 809
 810         /* replicated update should always go through */
 811         if (ldb_request_get_control(ac->req,
 812                                     DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
 813                 return LDB_SUCCESS;
 814         }
 815
 816         /* msDS-IntId is handled by system and should never be
 817          * passed by clients */
 818         if (ldb_msg_find_element(ac->msg, "msDS-IntId")) {
 819                 return LDB_ERR_UNWILLING_TO_PERFORM;
 820         }
 821
 822         /* do not generate msDS-IntId if Relax control is passed */
 823         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
 824                 return LDB_SUCCESS;
 825         }
 826
 827         /* check Functional Level */
 828         if (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003) {
 829                 return LDB_SUCCESS;
 830         }
 831
 832         /* check systemFlags for SCHEMA_BASE_OBJECT flag */
 833         system_flags = ldb_msg_find_attr_as_int(ac->msg, "systemFlags", 0);
 834         if (system_flags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) {
 835                 return LDB_SUCCESS;
 836         }
 837         schema = dsdb_get_schema(ldb, NULL);
 838         if (!schema) {
 839                 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
 840                               "samldb_schema_info_update: no dsdb_schema loaded");
 841                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
 842                 return ldb_operr(ldb);
 843         }
 844
 845         msds_intid_struct = (struct samldb_msds_intid_persistant*) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
 846         if (!msds_intid_struct) {
 847                 msds_intid_struct = talloc(ldb, struct samldb_msds_intid_persistant);
 848                 /* Generate new value for msDs-IntId
 849                 * Value should be in 0x80000000..0xBFFFFFFF range */
 850                 msds_intid = generate_random() % 0X3FFFFFFF;
 851                 msds_intid += 0x80000000;
 852                 msds_intid_struct->msds_intid = msds_intid;
 853                 DEBUG(2, ("No samldb_msds_intid_persistant struct, allocating a new one\n"));
 854         } else {
 855                 msds_intid = msds_intid_struct->msds_intid;
 856         }
 857
 858         /* probe id values until unique one is found */
 859         do {
 860                 msds_intid++;
 861                 if (msds_intid > 0xBFFFFFFF) {
 862                         msds_intid = 0x80000001;
 863                 }
 864                 /*
 865                  * We search in the schema if we have already this
 866                  * intid (using dsdb_attribute_by_attributeID_id
 867                  * because in the range 0x80000000 0xBFFFFFFFF,
 868                  * attributeID is a DSDB_ATTID_TYPE_INTID).
 869                  *
 870                  * If so generate another random value.
 871                  *
 872                  * We have to check the DB in case someone else has
 873                  * modified the database while we are doing our
 874                  * changes too (this case should be very bery rare) in
 875                  * order to be sure.
 876                  */
 877                 if (dsdb_attribute_by_attributeID_id(schema, msds_intid)) {
 878                         id_exists = true;
 879                         msds_intid = generate_random() % 0X3FFFFFFF;
 880                         msds_intid += 0x80000000;
 881                         continue;
 882                 }
 883
 884
 885                 ret = dsdb_module_search(ac->module, ac,
 886                                          &ldb_res,
 887                                          schema_dn, LDB_SCOPE_ONELEVEL, NULL,
 888                                          DSDB_FLAG_NEXT_MODULE,
 889                                          ac->req,
 890                                          "(msDS-IntId=%d)", msds_intid);
 891                 if (ret != LDB_SUCCESS) {
 892                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 893                                       __location__": Searching for msDS-IntId=%d failed - %s\n",
 894                                       msds_intid,
 895                                       ldb_errstring(ldb));
 896                         return ldb_operr(ldb);
 897                 }
 898                 id_exists = (ldb_res->count > 0);
 899                 talloc_free(ldb_res);
 900
 901         } while(id_exists);
 902         msds_intid_struct->msds_intid = msds_intid;
 903         ldb_set_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE, msds_intid_struct);
 904
 905         return samdb_msg_add_int(ldb, ac->msg, ac->msg, "msDS-IntId",
 906                                  msds_intid);
 907 }
 908
 909
 910 /*
 911  * samldb_add_entry (async)
 912  */
 913
 914 static int samldb_add_entry_callback(struct ldb_request *req,
 915                                         struct ldb_reply *ares)
 916 {
 917         struct ldb_context *ldb;
 918         struct samldb_ctx *ac;
 919         int ret;
 920
 921         ac = talloc_get_type(req->context, struct samldb_ctx);
 922         ldb = ldb_module_get_ctx(ac->module);
 923
 924         if (!ares) {
 925                 return ldb_module_done(ac->req, NULL, NULL,
 926                                         LDB_ERR_OPERATIONS_ERROR);
 927         }
 928
 929         if (ares->type == LDB_REPLY_REFERRAL) {
 930                 return ldb_module_send_referral(ac->req, ares->referral);
 931         }
 932
 933         if (ares->error != LDB_SUCCESS) {
 934                 return ldb_module_done(ac->req, ares->controls,
 935                                         ares->response, ares->error);
 936         }
 937         if (ares->type != LDB_REPLY_DONE) {
 938                 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
 939                 return ldb_module_done(ac->req, NULL, NULL,
 940                                         LDB_ERR_OPERATIONS_ERROR);
 941         }
 942
 943         /* The caller may wish to get controls back from the add */
 944         ac->ares = talloc_steal(ac, ares);
 945
 946         ret = samldb_next_step(ac);
 947         if (ret != LDB_SUCCESS) {
 948                 return ldb_module_done(ac->req, NULL, NULL, ret);
 949         }
 950         return ret;
 951 }
 952
 953 static int samldb_add_entry(struct samldb_ctx *ac)
 954 {
 955         struct ldb_context *ldb;
 956         struct ldb_request *req;
 957         int ret;
 958
 959         ldb = ldb_module_get_ctx(ac->module);
 960
 961         ret = ldb_build_add_req(&req, ldb, ac,
 962                                 ac->msg,
 963                                 ac->req->controls,
 964                                 ac, samldb_add_entry_callback,
 965                                 ac->req);
 966         LDB_REQ_SET_LOCATION(req);
 967         if (ret != LDB_SUCCESS) {
 968                 return ret;
 969         }
 970
 971         return ldb_next_request(ac->module, req);
 972 }
 973
 974 /*
 975  * return true if msg carries an attributeSchema that is intended to be RODC
 976  * filtered but is also a system-critical attribute.
 977  */
 978 static bool check_rodc_critical_attribute(struct ldb_message *msg)
 979 {
 980         uint32_t schemaFlagsEx, searchFlags, rodc_filtered_flags;
 981
 982         schemaFlagsEx = ldb_msg_find_attr_as_uint(msg, "schemaFlagsEx", 0);
 983         searchFlags = ldb_msg_find_attr_as_uint(msg, "searchFlags", 0);
 984         rodc_filtered_flags = (SEARCH_FLAG_RODC_ATTRIBUTE
 985                               | SEARCH_FLAG_CONFIDENTIAL);
 986
 987         if ((schemaFlagsEx & SCHEMA_FLAG_ATTR_IS_CRITICAL) &&
 988                 ((searchFlags & rodc_filtered_flags) == rodc_filtered_flags)) {
 989                 return true;
 990         } else {
 991                 return false;
 992         }
 993 }
 994
 995
 996 static int samldb_fill_object(struct samldb_ctx *ac)
 997 {
 998         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
 999         int ret;
1000
1001         /* Add information for the different account types */
1002         switch(ac->type) {
1003         case SAMLDB_TYPE_USER: {
1004                 struct ldb_control *rodc_control = ldb_request_get_control(ac->req,
1005                                                                            LDB_CONTROL_RODC_DCPROMO_OID);
1006                 if (rodc_control != NULL) {
1007                         /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */
1008                         rodc_control->critical = false;
1009                         ret = samldb_add_step(ac, samldb_rodc_add);
1010                         if (ret != LDB_SUCCESS) return ret;
1011                 }
1012
1013                 /* check if we have a valid sAMAccountName */
1014                 ret = samldb_add_step(ac, samldb_check_sAMAccountName);
1015                 if (ret != LDB_SUCCESS) return ret;
1016
1017                 ret = samldb_add_step(ac, samldb_add_entry);
1018                 if (ret != LDB_SUCCESS) return ret;
1019                 break;
1020         }
1021
1022         case SAMLDB_TYPE_GROUP: {
1023                 /* check if we have a valid sAMAccountName */
1024                 ret = samldb_add_step(ac, samldb_check_sAMAccountName);
1025                 if (ret != LDB_SUCCESS) return ret;
1026
1027                 ret = samldb_add_step(ac, samldb_add_entry);
1028                 if (ret != LDB_SUCCESS) return ret;
1029                 break;
1030         }
1031
1032         case SAMLDB_TYPE_CLASS: {
1033                 const char *lDAPDisplayName = NULL;
1034                 const struct ldb_val *rdn_value, *def_obj_cat_val;
1035                 unsigned int v = ldb_msg_find_attr_as_uint(ac->msg, "objectClassCategory", -2);
1036
1037                 /* As discussed with Microsoft through dochelp in April 2012 this is the behavior of windows*/
1038                 if (!ldb_msg_find_element(ac->msg, "subClassOf")) {
1039                         ret = ldb_msg_add_string(ac->msg, "subClassOf", "top");
1040                         if (ret != LDB_SUCCESS) return ret;
1041                 }
1042
1043                 ret = samdb_find_or_add_attribute(ldb, ac->msg,
1044                                                   "rdnAttId", "cn");
1045                 if (ret != LDB_SUCCESS) return ret;
1046
1047                 /* do not allow one to mark an attributeSchema as RODC filtered if it
1048                  * is system-critical */
1049                 if (check_rodc_critical_attribute(ac->msg)) {
1050                         ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
1051                                                ldb_dn_get_linearized(ac->msg->dn));
1052                         return LDB_ERR_UNWILLING_TO_PERFORM;
1053                 }
1054
1055                 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
1056                 if (rdn_value == NULL) {
1057                         return ldb_operr(ldb);
1058                 }
1059                 if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
1060                         /* the RDN has prefix "CN" */
1061                         ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
1062                                 samdb_cn_to_lDAPDisplayName(ac->msg,
1063                                                             (const char *) rdn_value->data));
1064                         if (ret != LDB_SUCCESS) {
1065                                 ldb_oom(ldb);
1066                                 return ret;
1067                         }
1068                 }
1069
1070                 lDAPDisplayName = ldb_msg_find_attr_as_string(ac->msg,
1071                                                               "lDAPDisplayName",
1072                                                               NULL);
1073                 ret = ldb_valid_attr_name(lDAPDisplayName);
1074                 if (ret != 1 ||
1075                     lDAPDisplayName[0] == '*' ||
1076                     lDAPDisplayName[0] == '@')
1077                 {
1078                         return dsdb_module_werror(ac->module,
1079                                                   LDB_ERR_UNWILLING_TO_PERFORM,
1080                                                   WERR_DS_INVALID_LDAP_DISPLAY_NAME,
1081                                                   "lDAPDisplayName is invalid");
1082                 }
1083
1084                 if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
1085                         struct GUID guid;
1086                         /* a new GUID */
1087                         guid = GUID_random();
1088                         ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
1089                         if (ret != LDB_SUCCESS) {
1090                                 ldb_oom(ldb);
1091                                 return ret;
1092                         }
1093                 }
1094
1095                 def_obj_cat_val = ldb_msg_find_ldb_val(ac->msg,
1096                                                        "defaultObjectCategory");
1097                 if (def_obj_cat_val != NULL) {
1098                         /* "defaultObjectCategory" has been set by the caller.
1099                          * Do some checks for consistency.
1100                          * NOTE: The real constraint check (that
1101                          * 'defaultObjectCategory' is the DN of the new
1102                          * objectclass or any parent of it) is still incomplete.
1103                          * For now we say that 'defaultObjectCategory' is valid
1104                          * if it exists and it is of objectclass "classSchema".
1105                          */
1106                         ac->dn = ldb_dn_from_ldb_val(ac, ldb, def_obj_cat_val);
1107                         if (ac->dn == NULL) {
1108                                 ldb_set_errstring(ldb,
1109                                                   "Invalid DN for 'defaultObjectCategory'!");
1110                                 return LDB_ERR_CONSTRAINT_VIOLATION;
1111                         }
1112                 } else {
1113                         /* "defaultObjectCategory" has not been set by the
1114                          * caller. Use the entry DN for it. */
1115                         ac->dn = ac->msg->dn;
1116
1117                         ret = ldb_msg_add_string(ac->msg, "defaultObjectCategory",
1118                                                  ldb_dn_alloc_linearized(ac->msg, ac->dn));
1119                         if (ret != LDB_SUCCESS) {
1120                                 ldb_oom(ldb);
1121                                 return ret;
1122                         }
1123                 }
1124
1125                 ret = samldb_add_step(ac, samldb_add_entry);
1126                 if (ret != LDB_SUCCESS) return ret;
1127
1128                 /* Now perform the checks for the 'defaultObjectCategory'. The
1129                  * lookup DN was already saved in "ac->dn" */
1130                 ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory);
1131                 if (ret != LDB_SUCCESS) return ret;
1132
1133                 /* -2 is not a valid objectClassCategory so it means the attribute wasn't present */
1134                 if (v == -2) {
1135                         /* Windows 2003 does this*/
1136                         ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "objectClassCategory", 0);
1137                         if (ret != LDB_SUCCESS) {
1138                                 return ret;
1139                         }
1140                 }
1141                 break;
1142         }
1143
1144         case SAMLDB_TYPE_ATTRIBUTE: {
1145                 const char *lDAPDisplayName = NULL;
1146                 const struct ldb_val *rdn_value;
1147                 struct ldb_message_element *el;
1148                 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
1149                 if (rdn_value == NULL) {
1150                         return ldb_operr(ldb);
1151                 }
1152                 if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
1153                         /* the RDN has prefix "CN" */
1154                         ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
1155                                 samdb_cn_to_lDAPDisplayName(ac->msg,
1156                                                             (const char *) rdn_value->data));
1157                         if (ret != LDB_SUCCESS) {
1158                                 ldb_oom(ldb);
1159                                 return ret;
1160                         }
1161                 }
1162
1163                 lDAPDisplayName = ldb_msg_find_attr_as_string(ac->msg,
1164                                                               "lDAPDisplayName",
1165                                                               NULL);
1166                 ret = ldb_valid_attr_name(lDAPDisplayName);
1167                 if (ret != 1 ||
1168                     lDAPDisplayName[0] == '*' ||
1169                     lDAPDisplayName[0] == '@')
1170                 {
1171                         return dsdb_module_werror(ac->module,
1172                                                   LDB_ERR_UNWILLING_TO_PERFORM,
1173                                                   WERR_DS_INVALID_LDAP_DISPLAY_NAME,
1174                                                   "lDAPDisplayName is invalid");
1175                 }
1176
1177                 /* do not allow one to mark an attributeSchema as RODC filtered if it
1178                  * is system-critical */
1179                 if (check_rodc_critical_attribute(ac->msg)) {
1180                         ldb_asprintf_errstring(ldb,
1181                                                "samldb: refusing schema add of %s - cannot combine critical attribute with RODC filtering",
1182                                                ldb_dn_get_linearized(ac->msg->dn));
1183                         return LDB_ERR_UNWILLING_TO_PERFORM;
1184                 }
1185
1186                 ret = samdb_find_or_add_attribute(ldb, ac->msg,
1187                                                   "isSingleValued", "FALSE");
1188                 if (ret != LDB_SUCCESS) return ret;
1189
1190                 if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
1191                         struct GUID guid;
1192                         /* a new GUID */
1193                         guid = GUID_random();
1194                         ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
1195                         if (ret != LDB_SUCCESS) {
1196                                 ldb_oom(ldb);
1197                                 return ret;
1198                         }
1199                 }
1200
1201                 el = ldb_msg_find_element(ac->msg, "attributeSyntax");
1202                 if (el) {
1203                         /*
1204                          * No need to scream if there isn't as we have code later on
1205                          * that will take care of it.
1206                          */
1207                         const struct dsdb_syntax *syntax = find_syntax_map_by_ad_oid((const char *)el->values[0].data);
1208                         if (!syntax) {
1209                                 DEBUG(9, ("Can't find dsdb_syntax object for attributeSyntax %s\n",
1210                                                 (const char *)el->values[0].data));
1211                         } else {
1212                                 unsigned int v = ldb_msg_find_attr_as_uint(ac->msg, "oMSyntax", 0);
1213                                 const struct ldb_val *val = ldb_msg_find_ldb_val(ac->msg, "oMObjectClass");
1214
1215                                 if (v == 0) {
1216                                         ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "oMSyntax", syntax->oMSyntax);
1217                                         if (ret != LDB_SUCCESS) {
1218                                                 return ret;
1219                                         }
1220                                 }
1221                                 if (!val) {
1222                                         struct ldb_val val2 = ldb_val_dup(ldb, &syntax->oMObjectClass);
1223                                         if (val2.length > 0) {
1224                                                 ret = ldb_msg_add_value(ac->msg, "oMObjectClass", &val2, NULL);
1225                                                 if (ret != LDB_SUCCESS) {
1226                                                         return ret;
1227                                                 }
1228                                         }
1229                                 }
1230                         }
1231                 }
1232
1233                 /* handle msDS-IntID attribute */
1234                 ret = samldb_add_handle_msDS_IntId(ac);
1235                 if (ret != LDB_SUCCESS) return ret;
1236
1237                 ret = samldb_add_step(ac, samldb_add_entry);
1238                 if (ret != LDB_SUCCESS) return ret;
1239                 break;
1240         }
1241
1242         default:
1243                 ldb_asprintf_errstring(ldb, "Invalid entry type!");
1244                 return LDB_ERR_OPERATIONS_ERROR;
1245                 break;
1246         }
1247
1248         return samldb_first_step(ac);
1249 }
1250
1251 static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
1252 {
1253         struct ldb_context *ldb = NULL;
1254         const struct ldb_val *rdn_value = NULL;
1255         struct ldb_message_element *sid_el = NULL;
1256         struct dom_sid *sid = NULL;
1257         struct ldb_control *as_system = NULL;
1258         struct ldb_control *provision = NULL;
1259         bool allowed = false;
1260         int ret;
1261
1262         ldb = ldb_module_get_ctx(ac->module);
1263
1264         as_system = ldb_request_get_control(ac->req, LDB_CONTROL_AS_SYSTEM_OID);
1265         if (as_system != NULL) {
1266                 allowed = true;
1267         }
1268
1269         provision = ldb_request_get_control(ac->req, LDB_CONTROL_PROVISION_OID);
1270         if (provision != NULL) {
1271                 allowed = true;
1272         }
1273
1274         sid_el = ldb_msg_find_element(ac->msg, "objectSid");
1275
1276         if (!allowed && sid_el == NULL) {
1277                 return dsdb_module_werror(ac->module,
1278                                 LDB_ERR_OBJECT_CLASS_VIOLATION,
1279                                 WERR_DS_MISSING_REQUIRED_ATT,
1280                                 "objectSid missing on foreignSecurityPrincipal");
1281         }
1282
1283         if (!allowed) {
1284                 return dsdb_module_werror(ac->module,
1285                                 LDB_ERR_UNWILLING_TO_PERFORM,
1286                                 WERR_DS_ILLEGAL_MOD_OPERATION,
1287                                 "foreignSecurityPrincipal object not allowed");
1288         }
1289
1290         if (sid_el != NULL) {
1291                 sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
1292                 if (sid == NULL) {
1293                         ldb_set_errstring(ldb,
1294                                           "samldb: invalid objectSid!");
1295                         return LDB_ERR_CONSTRAINT_VIOLATION;
1296                 }
1297         }
1298
1299         if (sid == NULL) {
1300                 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
1301                 if (rdn_value == NULL) {
1302                         return ldb_operr(ldb);
1303                 }
1304                 sid = dom_sid_parse_talloc(ac->msg,
1305                                            (const char *)rdn_value->data);
1306                 if (sid == NULL) {
1307                         ldb_set_errstring(ldb,
1308                                           "samldb: No valid SID found in ForeignSecurityPrincipal CN!");
1309                         return LDB_ERR_CONSTRAINT_VIOLATION;
1310                 }
1311                 if (! samldb_msg_add_sid(ac->msg, "objectSid", sid)) {
1312                         return ldb_operr(ldb);
1313                 }
1314         }
1315
1316         /* finally proceed with adding the entry */
1317         ret = samldb_add_step(ac, samldb_add_entry);
1318         if (ret != LDB_SUCCESS) return ret;
1319
1320         return samldb_first_step(ac);
1321 }
1322
1323 static int samldb_schema_info_update(struct samldb_ctx *ac)
1324 {
1325         int ret;
1326         struct ldb_context *ldb;
1327         struct dsdb_schema *schema;
1328
1329         /* replicated update should always go through */
1330         if (ldb_request_get_control(ac->req,
1331                                     DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1332                 return LDB_SUCCESS;
1333         }
1334
1335         /* do not update schemaInfo during provisioning */
1336         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
1337                 return LDB_SUCCESS;
1338         }
1339
1340         ldb = ldb_module_get_ctx(ac->module);
1341         schema = dsdb_get_schema(ldb, NULL);
1342         if (!schema) {
1343                 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
1344                               "samldb_schema_info_update: no dsdb_schema loaded");
1345                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1346                 return ldb_operr(ldb);
1347         }
1348
1349         ret = dsdb_module_schema_info_update(ac->module, schema,
1350                                              DSDB_FLAG_NEXT_MODULE|
1351                                              DSDB_FLAG_AS_SYSTEM,
1352                                              ac->req);
1353         if (ret != LDB_SUCCESS) {
1354                 ldb_asprintf_errstring(ldb,
1355                                        "samldb_schema_info_update: dsdb_module_schema_info_update failed with %s",
1356                                        ldb_errstring(ldb));
1357                 return ret;
1358         }
1359
1360         return LDB_SUCCESS;
1361 }
1362
1363 static int samldb_prim_group_tester(struct samldb_ctx *ac, uint32_t rid);
1364 static int samldb_check_user_account_control_rules(struct samldb_ctx *ac,
1365                                                    struct dom_sid *sid,
1366                                                    uint32_t req_uac,
1367                                                    uint32_t user_account_control,
1368                                                    uint32_t user_account_control_old);
1369
1370 /*
1371  * "Objectclass" trigger (MS-SAMR 3.1.1.8.1)
1372  *
1373  * Has to be invoked on "add" and "modify" operations on "user", "computer" and
1374  * "group" objects.
1375  * ac->msg contains the "add"/"modify" message
1376  * ac->type contains the object type (main objectclass)
1377  */
1378 static int samldb_objectclass_trigger(struct samldb_ctx *ac)
1379 {
1380         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1381         void *skip_allocate_sids = ldb_get_opaque(ldb,
1382                                                   "skip_allocate_sids");
1383         struct ldb_message_element *el, *el2;
1384         struct dom_sid *sid;
1385         int ret;
1386
1387         /* make sure that "sAMAccountType" is not specified */
1388         el = ldb_msg_find_element(ac->msg, "sAMAccountType");
1389         if (el != NULL) {
1390                 ldb_set_errstring(ldb,
1391                                   "samldb: sAMAccountType must not be specified!");
1392                 return LDB_ERR_UNWILLING_TO_PERFORM;
1393         }
1394
1395         /* Step 1: objectSid assignment */
1396
1397         /* Don't allow the objectSid to be changed. But beside the RELAX
1398          * control we have also to guarantee that it can always be set with
1399          * SYSTEM permissions. This is needed for the "samba3sam" backend. */
1400         sid = samdb_result_dom_sid(ac, ac->msg, "objectSid");
1401         if ((sid != NULL) && (!dsdb_module_am_system(ac->module)) &&
1402             (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) == NULL)) {
1403                 ldb_set_errstring(ldb,
1404                                   "samldb: objectSid must not be specified!");
1405                 return LDB_ERR_UNWILLING_TO_PERFORM;
1406         }
1407
1408         /* but generate a new SID when we do have an add operations */
1409         if ((sid == NULL) && (ac->req->operation == LDB_ADD) && !skip_allocate_sids) {
1410                 ret = samldb_add_step(ac, samldb_allocate_sid);
1411                 if (ret != LDB_SUCCESS) return ret;
1412         }
1413
1414         switch(ac->type) {
1415         case SAMLDB_TYPE_USER: {
1416                 bool uac_generated = false, uac_add_flags = false;
1417
1418                 /* Step 1.2: Default values */
1419                 ret = dsdb_user_obj_set_defaults(ldb, ac->msg, ac->req);
1420                 if (ret != LDB_SUCCESS) return ret;
1421
1422                 /* On add operations we might need to generate a
1423                  * "userAccountControl" (if it isn't specified). */
1424                 el = ldb_msg_find_element(ac->msg, "userAccountControl");
1425                 if ((el == NULL) && (ac->req->operation == LDB_ADD)) {
1426                         ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
1427                                                  "userAccountControl",
1428                                                  UF_NORMAL_ACCOUNT);
1429                         if (ret != LDB_SUCCESS) {
1430                                 return ret;
1431                         }
1432                         uac_generated = true;
1433                         uac_add_flags = true;
1434                 }
1435
1436                 el = ldb_msg_find_element(ac->msg, "userAccountControl");
1437                 if (el != NULL) {
1438                         uint32_t raw_uac;
1439                         uint32_t user_account_control;
1440                         /* Step 1.3: "userAccountControl" -> "sAMAccountType" mapping */
1441                         user_account_control = ldb_msg_find_attr_as_uint(ac->msg,
1442                                                                          "userAccountControl",
1443                                                                          0);
1444                         raw_uac = user_account_control;
1445                         /*
1446                          * "userAccountControl" = 0 or missing one of
1447                          * the types means "UF_NORMAL_ACCOUNT".  See
1448                          * MS-SAMR 3.1.1.8.10 point 8
1449                          */
1450                         if ((user_account_control & UF_ACCOUNT_TYPE_MASK) == 0) {
1451                                 user_account_control = UF_NORMAL_ACCOUNT | user_account_control;
1452                                 uac_generated = true;
1453                         }
1454
1455                         /*
1456                          * As per MS-SAMR 3.1.1.8.10 these flags have not to be set
1457                          */
1458                         if ((user_account_control & UF_LOCKOUT) != 0) {
1459                                 user_account_control &= ~UF_LOCKOUT;
1460                                 uac_generated = true;
1461                         }
1462                         if ((user_account_control & UF_PASSWORD_EXPIRED) != 0) {
1463                                 user_account_control &= ~UF_PASSWORD_EXPIRED;
1464                                 uac_generated = true;
1465                         }
1466
1467                         ret = samldb_check_user_account_control_rules(ac, NULL,
1468                                                                       raw_uac,
1469                                                                       user_account_control,
1470                                                                       0);
1471                         if (ret != LDB_SUCCESS) {
1472                                 return ret;
1473                         }
1474
1475                         /* Workstation and (read-only) DC objects do need objectclass "computer" */
1476                         if ((samdb_find_attribute(ldb, ac->msg,
1477                                                   "objectclass", "computer") == NULL) &&
1478                             (user_account_control &
1479                              (UF_SERVER_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT))) {
1480                                 ldb_set_errstring(ldb,
1481                                                   "samldb: Requested account type does need objectclass 'computer'!");
1482                                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1483                         }
1484
1485                         /* add "sAMAccountType" attribute */
1486                         ret = dsdb_user_obj_set_account_type(ldb, ac->msg, user_account_control, NULL);
1487                         if (ret != LDB_SUCCESS) {
1488                                 return ret;
1489                         }
1490
1491                         /* "isCriticalSystemObject" might be set */
1492                         if (user_account_control &
1493                             (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
1494                                 ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
1495                                                          "TRUE");
1496                                 if (ret != LDB_SUCCESS) {
1497                                         return ret;
1498                                 }
1499                                 el2 = ldb_msg_find_element(ac->msg,
1500                                                            "isCriticalSystemObject");
1501                                 el2->flags = LDB_FLAG_MOD_REPLACE;
1502                         } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
1503                                 ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
1504                                                          "FALSE");
1505                                 if (ret != LDB_SUCCESS) {
1506                                         return ret;
1507                                 }
1508                                 el2 = ldb_msg_find_element(ac->msg,
1509                                                            "isCriticalSystemObject");
1510                                 el2->flags = LDB_FLAG_MOD_REPLACE;
1511                         }
1512
1513                         /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
1514                         if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
1515                                 uint32_t rid;
1516
1517                                 ret = dsdb_user_obj_set_primary_group_id(ldb, ac->msg, user_account_control, &rid);
1518                                 if (ret != LDB_SUCCESS) {
1519                                         return ret;
1520                                 }
1521                                 /*
1522                                  * Older AD deployments don't know about the
1523                                  * RODC group
1524                                  */
1525                                 if (rid == DOMAIN_RID_READONLY_DCS) {
1526                                         ret = samldb_prim_group_tester(ac, rid);
1527                                         if (ret != LDB_SUCCESS) {
1528                                                 return ret;
1529                                         }
1530                                 }
1531                         }
1532
1533                         /* Step 1.5: Add additional flags when needed */
1534                         /* Obviously this is done when the "userAccountControl"
1535                          * has been generated here (tested against Windows
1536                          * Server) */
1537                         if (uac_generated) {
1538                                 if (uac_add_flags) {
1539                                         user_account_control |= UF_ACCOUNTDISABLE;
1540                                         user_account_control |= UF_PASSWD_NOTREQD;
1541                                 }
1542
1543                                 ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
1544                                                          "userAccountControl",
1545                                                          user_account_control);
1546                                 if (ret != LDB_SUCCESS) {
1547                                         return ret;
1548                                 }
1549                         }
1550
1551                 }
1552                 break;
1553         }
1554
1555         case SAMLDB_TYPE_GROUP: {
1556                 const char *tempstr;
1557
1558                 /* Step 2.2: Default values */
1559                 tempstr = talloc_asprintf(ac->msg, "%d",
1560                                           GTYPE_SECURITY_GLOBAL_GROUP);
1561                 if (tempstr == NULL) return ldb_operr(ldb);
1562                 ret = samdb_find_or_add_attribute(ldb, ac->msg,
1563                         "groupType", tempstr);
1564                 if (ret != LDB_SUCCESS) return ret;
1565
1566                 /* Step 2.3: "groupType" -> "sAMAccountType" */
1567                 el = ldb_msg_find_element(ac->msg, "groupType");
1568                 if (el != NULL) {
1569                         uint32_t group_type, account_type;
1570
1571                         group_type = ldb_msg_find_attr_as_uint(ac->msg,
1572                                                                "groupType", 0);
1573
1574                         /* The creation of builtin groups requires the
1575                          * RELAX control */
1576                         if (group_type == GTYPE_SECURITY_BUILTIN_LOCAL_GROUP) {
1577                                 if (ldb_request_get_control(ac->req,
1578                                                             LDB_CONTROL_RELAX_OID) == NULL) {
1579                                         return LDB_ERR_UNWILLING_TO_PERFORM;
1580                                 }
1581                         }
1582
1583                         account_type = ds_gtype2atype(group_type);
1584                         if (account_type == 0) {
1585                                 ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
1586                                 return LDB_ERR_UNWILLING_TO_PERFORM;
1587                         }
1588                         ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
1589                                                  "sAMAccountType",
1590                                                  account_type);
1591                         if (ret != LDB_SUCCESS) {
1592                                 return ret;
1593                         }
1594                         el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
1595                         el2->flags = LDB_FLAG_MOD_REPLACE;
1596                 }
1597                 break;
1598         }
1599
1600         default:
1601                 ldb_asprintf_errstring(ldb,
1602                                 "Invalid entry type!");
1603                 return LDB_ERR_OPERATIONS_ERROR;
1604                 break;
1605         }
1606
1607         return LDB_SUCCESS;
1608 }
1609
1610 /*
1611  * "Primary group ID" trigger (MS-SAMR 3.1.1.8.2)
1612  *
1613  * Has to be invoked on "add" and "modify" operations on "user" and "computer"
1614  * objects.
1615  * ac->msg contains the "add"/"modify" message
1616  */
1617
1618 static int samldb_prim_group_tester(struct samldb_ctx *ac, uint32_t rid)
1619 {
1620         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1621         struct dom_sid *sid;
1622         struct ldb_result *res;
1623         int ret;
1624         const char * const noattrs[] = { NULL };
1625
1626         sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
1627         if (sid == NULL) {
1628                 return ldb_operr(ldb);
1629         }
1630
1631         ret = dsdb_module_search(ac->module, ac, &res,
1632                                  ldb_get_default_basedn(ldb),
1633                                  LDB_SCOPE_SUBTREE,
1634                                  noattrs, DSDB_FLAG_NEXT_MODULE,
1635                                  ac->req,
1636                                  "(objectSid=%s)",
1637                                  ldap_encode_ndr_dom_sid(ac, sid));
1638         if (ret != LDB_SUCCESS) {
1639                 return ret;
1640         }
1641         if (res->count != 1) {
1642                 talloc_free(res);
1643                 ldb_asprintf_errstring(ldb,
1644                                        "Failed to find primary group with RID %u!",
1645                                        rid);
1646                 return LDB_ERR_UNWILLING_TO_PERFORM;
1647         }
1648         talloc_free(res);
1649
1650         return LDB_SUCCESS;
1651 }
1652
1653 static int samldb_prim_group_set(struct samldb_ctx *ac)
1654 {
1655         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1656         uint32_t rid;
1657
1658         rid = ldb_msg_find_attr_as_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
1659         if (rid == (uint32_t) -1) {
1660                 /* we aren't affected of any primary group set */
1661                 return LDB_SUCCESS;
1662
1663         } else if (!ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
1664                 ldb_set_errstring(ldb,
1665                                   "The primary group isn't settable on add operations!");
1666                 return LDB_ERR_UNWILLING_TO_PERFORM;
1667         }
1668
1669         return samldb_prim_group_tester(ac, rid);
1670 }
1671
1672 static int samldb_prim_group_change(struct samldb_ctx *ac)
1673 {
1674         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1675         const char * const attrs[] = {
1676                 "primaryGroupID",
1677                 "memberOf",
1678                 "userAccountControl",
1679                 NULL };
1680         struct ldb_result *res, *group_res;
1681         struct ldb_message_element *el;
1682         struct ldb_message *msg;
1683         uint32_t prev_rid, new_rid, uac;
1684         struct dom_sid *prev_sid, *new_sid;
1685         struct ldb_dn *prev_prim_group_dn, *new_prim_group_dn;
1686         int ret;
1687         const char * const noattrs[] = { NULL };
1688
1689         el = dsdb_get_single_valued_attr(ac->msg, "primaryGroupID",
1690                                          ac->req->operation);
1691         if (el == NULL) {
1692                 /* we are not affected */
1693                 return LDB_SUCCESS;
1694         }
1695
1696         /* Fetch information from the existing object */
1697
1698         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
1699                                     DSDB_FLAG_NEXT_MODULE, ac->req);
1700         if (ret != LDB_SUCCESS) {
1701                 return ret;
1702         }
1703
1704         uac = ldb_msg_find_attr_as_uint(res->msgs[0], "userAccountControl", 0);
1705
1706         /* Finds out the DN of the old primary group */
1707
1708         prev_rid = ldb_msg_find_attr_as_uint(res->msgs[0], "primaryGroupID",
1709                                              (uint32_t) -1);
1710         if (prev_rid == (uint32_t) -1) {
1711                 /* User objects do always have a mandatory "primaryGroupID"
1712                  * attribute. If this doesn't exist then the object is of the
1713                  * wrong type. This is the exact Windows error code */
1714                 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1715         }
1716
1717         prev_sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), prev_rid);
1718         if (prev_sid == NULL) {
1719                 return ldb_operr(ldb);
1720         }
1721
1722         /* Finds out the DN of the new primary group
1723          * Notice: in order to parse the primary group ID correctly we create
1724          * a temporary message here. */
1725
1726         msg = ldb_msg_new(ac->msg);
1727         if (msg == NULL) {
1728                 return ldb_module_oom(ac->module);
1729         }
1730         ret = ldb_msg_add(msg, el, 0);
1731         if (ret != LDB_SUCCESS) {
1732                 return ret;
1733         }
1734         new_rid = ldb_msg_find_attr_as_uint(msg, "primaryGroupID", (uint32_t) -1);
1735         talloc_free(msg);
1736         if (new_rid == (uint32_t) -1) {
1737                 /* we aren't affected of any primary group change */
1738                 return LDB_SUCCESS;
1739         }
1740
1741         if (prev_rid == new_rid) {
1742                 return LDB_SUCCESS;
1743         }
1744
1745         if ((uac & UF_SERVER_TRUST_ACCOUNT) && new_rid != DOMAIN_RID_DCS) {
1746                 ldb_asprintf_errstring(ldb,
1747                         "%08X: samldb: UF_SERVER_TRUST_ACCOUNT requires "
1748                         "primaryGroupID=%u!",
1749                         W_ERROR_V(WERR_DS_CANT_MOD_PRIMARYGROUPID),
1750                         DOMAIN_RID_DCS);
1751                 return LDB_ERR_UNWILLING_TO_PERFORM;
1752         }
1753
1754         if ((uac & UF_PARTIAL_SECRETS_ACCOUNT) && new_rid != DOMAIN_RID_READONLY_DCS) {
1755                 ldb_asprintf_errstring(ldb,
1756                         "%08X: samldb: UF_PARTIAL_SECRETS_ACCOUNT requires "
1757                         "primaryGroupID=%u!",
1758                         W_ERROR_V(WERR_DS_CANT_MOD_PRIMARYGROUPID),
1759                         DOMAIN_RID_READONLY_DCS);
1760                 return LDB_ERR_UNWILLING_TO_PERFORM;
1761         }
1762
1763         ret = dsdb_module_search(ac->module, ac, &group_res,
1764                                  ldb_get_default_basedn(ldb),
1765                                  LDB_SCOPE_SUBTREE,
1766                                  noattrs, DSDB_FLAG_NEXT_MODULE,
1767                                  ac->req,
1768                                  "(objectSid=%s)",
1769                                  ldap_encode_ndr_dom_sid(ac, prev_sid));
1770         if (ret != LDB_SUCCESS) {
1771                 return ret;
1772         }
1773         if (group_res->count != 1) {
1774                 return ldb_operr(ldb);
1775         }
1776         prev_prim_group_dn = group_res->msgs[0]->dn;
1777
1778         new_sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), new_rid);
1779         if (new_sid == NULL) {
1780                 return ldb_operr(ldb);
1781         }
1782
1783         ret = dsdb_module_search(ac->module, ac, &group_res,
1784                                  ldb_get_default_basedn(ldb),
1785                                  LDB_SCOPE_SUBTREE,
1786                                  noattrs, DSDB_FLAG_NEXT_MODULE,
1787                                  ac->req,
1788                                  "(objectSid=%s)",
1789                                  ldap_encode_ndr_dom_sid(ac, new_sid));
1790         if (ret != LDB_SUCCESS) {
1791                 return ret;
1792         }
1793         if (group_res->count != 1) {
1794                 /* Here we know if the specified new primary group candidate is
1795                  * valid or not. */
1796                 return LDB_ERR_UNWILLING_TO_PERFORM;
1797         }
1798         new_prim_group_dn = group_res->msgs[0]->dn;
1799
1800         /* We need to be already a normal member of the new primary
1801          * group in order to be successful. */
1802         el = samdb_find_attribute(ldb, res->msgs[0], "memberOf",
1803                                   ldb_dn_get_linearized(new_prim_group_dn));
1804         if (el == NULL) {
1805                 return LDB_ERR_UNWILLING_TO_PERFORM;
1806         }
1807
1808         /* Remove the "member" attribute on the new primary group */
1809         msg = ldb_msg_new(ac->msg);
1810         if (msg == NULL) {
1811                 return ldb_module_oom(ac->module);
1812         }
1813         msg->dn = new_prim_group_dn;
1814
1815         ret = samdb_msg_add_delval(ldb, msg, msg, "member",
1816                                    ldb_dn_get_linearized(ac->msg->dn));
1817         if (ret != LDB_SUCCESS) {
1818                 return ret;
1819         }
1820
1821         ret = dsdb_module_modify(ac->module, msg, DSDB_FLAG_NEXT_MODULE, ac->req);
1822         if (ret != LDB_SUCCESS) {
1823                 return ret;
1824         }
1825         talloc_free(msg);
1826
1827         /* Add a "member" attribute for the previous primary group */
1828         msg = ldb_msg_new(ac->msg);
1829         if (msg == NULL) {
1830                 return ldb_module_oom(ac->module);
1831         }
1832         msg->dn = prev_prim_group_dn;
1833
1834         ret = samdb_msg_add_addval(ldb, msg, msg, "member",
1835                                    ldb_dn_get_linearized(ac->msg->dn));
1836         if (ret != LDB_SUCCESS) {
1837                 return ret;
1838         }
1839
1840         ret = dsdb_module_modify(ac->module, msg, DSDB_FLAG_NEXT_MODULE, ac->req);
1841         if (ret != LDB_SUCCESS) {
1842                 return ret;
1843         }
1844         talloc_free(msg);
1845
1846         return LDB_SUCCESS;
1847 }
1848
1849 static int samldb_prim_group_trigger(struct samldb_ctx *ac)
1850 {
1851         int ret;
1852
1853         if (ac->req->operation == LDB_ADD) {
1854                 ret = samldb_prim_group_set(ac);
1855         } else {
1856                 ret = samldb_prim_group_change(ac);
1857         }
1858
1859         return ret;
1860 }
1861
1862 static int samldb_check_user_account_control_invariants(struct samldb_ctx *ac,
1863                                                     uint32_t user_account_control)
1864 {
1865         int i, ret = 0;
1866         bool need_check = false;
1867         const struct uac_to_guid {
1868                 uint32_t uac;
1869                 bool never;
1870                 uint32_t needs;
1871                 uint32_t not_with;
1872                 const char *error_string;
1873         } map[] = {
1874                 {
1875                         .uac = UF_TEMP_DUPLICATE_ACCOUNT,
1876                         .never = true,
1877                         .error_string = "Updating the UF_TEMP_DUPLICATE_ACCOUNT flag is never allowed"
1878                 },
1879                 {
1880                         .uac = UF_PARTIAL_SECRETS_ACCOUNT,
1881                         .needs = UF_WORKSTATION_TRUST_ACCOUNT,
1882                         .error_string = "Setting UF_PARTIAL_SECRETS_ACCOUNT only permitted with UF_WORKSTATION_TRUST_ACCOUNT"
1883                 },
1884                 {
1885                         .uac = UF_TRUSTED_FOR_DELEGATION,
1886                         .not_with = UF_PARTIAL_SECRETS_ACCOUNT,
1887                         .error_string = "Setting UF_TRUSTED_FOR_DELEGATION not allowed with UF_PARTIAL_SECRETS_ACCOUNT"
1888                 },
1889                 {
1890                         .uac = UF_NORMAL_ACCOUNT,
1891                         .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_NORMAL_ACCOUNT,
1892                         .error_string = "Setting more than one account type not permitted"
1893                 },
1894                 {
1895                         .uac = UF_WORKSTATION_TRUST_ACCOUNT,
1896                         .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_WORKSTATION_TRUST_ACCOUNT,
1897                         .error_string = "Setting more than one account type not permitted"
1898                 },
1899                 {
1900                         .uac = UF_INTERDOMAIN_TRUST_ACCOUNT,
1901                         .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_INTERDOMAIN_TRUST_ACCOUNT,
1902                         .error_string = "Setting more than one account type not permitted"
1903                 },
1904                 {
1905                         .uac = UF_SERVER_TRUST_ACCOUNT,
1906                         .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_SERVER_TRUST_ACCOUNT,
1907                         .error_string = "Setting more than one account type not permitted"
1908                 },
1909                 {
1910                         .uac = UF_TRUSTED_FOR_DELEGATION,
1911                         .not_with = UF_PARTIAL_SECRETS_ACCOUNT,
1912                         .error_string = "Setting UF_TRUSTED_FOR_DELEGATION not allowed with UF_PARTIAL_SECRETS_ACCOUNT"
1913                 }
1914         };
1915
1916         for (i = 0; i < ARRAY_SIZE(map); i++) {
1917                 if (user_account_control & map[i].uac) {
1918                         need_check = true;
1919                         break;
1920                 }
1921         }
1922         if (need_check == false) {
1923                 return LDB_SUCCESS;
1924         }
1925
1926         for (i = 0; i < ARRAY_SIZE(map); i++) {
1927                 uint32_t this_uac = user_account_control & map[i].uac;
1928                 if (this_uac != 0) {
1929                         if (map[i].never) {
1930                                 ret = LDB_ERR_OTHER;
1931                                 break;
1932                         } else if (map[i].needs != 0) {
1933                                 if ((map[i].needs & user_account_control) == 0) {
1934                                         ret = LDB_ERR_OTHER;
1935                                         break;
1936                                 }
1937                         } else if (map[i].not_with != 0) {
1938                                 if ((map[i].not_with & user_account_control) != 0) {
1939                                         ret = LDB_ERR_OTHER;
1940                                         break;
1941                                 }
1942                         }
1943                 }
1944         }
1945         if (ret != LDB_SUCCESS) {
1946                 switch (ac->req->operation) {
1947                 case LDB_ADD:
1948                         ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
1949                                                "Failed to add %s: %s",
1950                                                ldb_dn_get_linearized(ac->msg->dn),
1951                                                map[i].error_string);
1952                         break;
1953                 case LDB_MODIFY:
1954                         ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
1955                                                "Failed to modify %s: %s",
1956                                                ldb_dn_get_linearized(ac->msg->dn),
1957                                                map[i].error_string);
1958                         break;
1959                 default:
1960                         return ldb_module_operr(ac->module);
1961                 }
1962         }
1963         return ret;
1964 }
1965
1966 /**
1967  * Validate that the restriction in point 5 of MS-SAMR 3.1.1.8.10 userAccountControl is honoured
1968  *
1969  */
1970 static int samldb_check_user_account_control_acl(struct samldb_ctx *ac,
1971                                                  struct dom_sid *sid,
1972                                                  uint32_t user_account_control,
1973                                                  uint32_t user_account_control_old)
1974 {
1975         int i, ret = 0;
1976         bool need_acl_check = false;
1977         struct ldb_result *res;
1978         const char * const sd_attrs[] = {"ntSecurityDescriptor", NULL};
1979         struct security_token *user_token;
1980         struct security_descriptor *domain_sd;
1981         struct ldb_dn *domain_dn = ldb_get_default_basedn(ldb_module_get_ctx(ac->module));
1982         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1983         const struct uac_to_guid {
1984                 uint32_t uac;
1985                 uint32_t priv_to_change_from;
1986                 const char *oid;
1987                 const char *guid;
1988                 enum sec_privilege privilege;
1989                 bool delete_is_privileged;
1990                 bool admin_required;
1991                 const char *error_string;
1992         } map[] = {
1993                 {
1994                         .uac = UF_PASSWD_NOTREQD,
1995                         .guid = GUID_DRS_UPDATE_PASSWORD_NOT_REQUIRED_BIT,
1996                         .error_string = "Adding the UF_PASSWD_NOTREQD bit in userAccountControl requires the Update-Password-Not-Required-Bit right that was not given on the Domain object"
1997                 },
1998                 {
1999                         .uac = UF_DONT_EXPIRE_PASSWD,
2000                         .guid = GUID_DRS_UNEXPIRE_PASSWORD,
2001                         .error_string = "Adding the UF_DONT_EXPIRE_PASSWD bit in userAccountControl requires the Unexpire-Password right that was not given on the Domain object"
2002                 },
2003                 {
2004                         .uac = UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED,
2005                         .guid = GUID_DRS_ENABLE_PER_USER_REVERSIBLY_ENCRYPTED_PASSWORD,
2006                         .error_string = "Adding the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED bit in userAccountControl requires the Enable-Per-User-Reversibly-Encrypted-Password right that was not given on the Domain object"
2007                 },
2008                 {
2009                         .uac = UF_SERVER_TRUST_ACCOUNT,
2010                         .guid = GUID_DRS_DS_INSTALL_REPLICA,
2011                         .error_string = "Adding the UF_SERVER_TRUST_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
2012                 },
2013                 {
2014                         .uac = UF_PARTIAL_SECRETS_ACCOUNT,
2015                         .guid = GUID_DRS_DS_INSTALL_REPLICA,
2016                         .error_string = "Adding the UF_PARTIAL_SECRETS_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
2017                 },
2018                 {
2019                         .uac = UF_WORKSTATION_TRUST_ACCOUNT,
2020                         .priv_to_change_from = UF_NORMAL_ACCOUNT,
2021                         .error_string = "Swapping UF_NORMAL_ACCOUNT to UF_WORKSTATION_TRUST_ACCOUNT requires the user to be a member of the domain admins group"
2022                 },
2023                 {
2024                         .uac = UF_NORMAL_ACCOUNT,
2025                         .priv_to_change_from = UF_WORKSTATION_TRUST_ACCOUNT,
2026                         .error_string = "Swapping UF_WORKSTATION_TRUST_ACCOUNT to UF_NORMAL_ACCOUNT requires the user to be a member of the domain admins group"
2027                 },
2028                 {
2029                         .uac = UF_INTERDOMAIN_TRUST_ACCOUNT,
2030                         .oid = DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID,
2031                         .error_string = "Updating the UF_INTERDOMAIN_TRUST_ACCOUNT bit in userAccountControl is not permitted over LDAP.  This bit is restricted to the LSA CreateTrustedDomain interface",
2032                         .delete_is_privileged = true
2033                 },
2034                 {
2035                         .uac = UF_TRUSTED_FOR_DELEGATION,
2036                         .privilege = SEC_PRIV_ENABLE_DELEGATION,
2037                         .delete_is_privileged = true,
2038                         .error_string = "Updating the UF_TRUSTED_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
2039                 },
2040                 {
2041                         .uac = UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION,
2042                         .privilege = SEC_PRIV_ENABLE_DELEGATION,
2043                         .delete_is_privileged = true,
2044                         .error_string = "Updating the UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
2045                 }
2046
2047         };
2048
2049         if (dsdb_module_am_system(ac->module)) {
2050                 return LDB_SUCCESS;
2051         }
2052
2053         for (i = 0; i < ARRAY_SIZE(map); i++) {
2054                 if (user_account_control & map[i].uac) {
2055                         need_acl_check = true;
2056                         break;
2057                 }
2058         }
2059         if (need_acl_check == false) {
2060                 return LDB_SUCCESS;
2061         }
2062
2063         user_token = acl_user_token(ac->module);
2064         if (user_token == NULL) {
2065                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
2066         }
2067
2068         ret = dsdb_module_search_dn(ac->module, ac, &res,
2069                                     domain_dn,
2070                                     sd_attrs,
2071                                     DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
2072                                     ac->req);
2073         if (ret != LDB_SUCCESS) {
2074                 return ret;
2075         }
2076         if (res->count != 1) {
2077                 return ldb_module_operr(ac->module);
2078         }
2079
2080         ret = dsdb_get_sd_from_ldb_message(ldb,
2081                                            ac, res->msgs[0], &domain_sd);
2082
2083         if (ret != LDB_SUCCESS) {
2084                 return ret;
2085         }
2086
2087         for (i = 0; i < ARRAY_SIZE(map); i++) {
2088                 uint32_t this_uac_new = user_account_control & map[i].uac;
2089                 uint32_t this_uac_old = user_account_control_old & map[i].uac;
2090                 if (this_uac_new != this_uac_old) {
2091                         if (this_uac_old != 0) {
2092                                 if (map[i].delete_is_privileged == false) {
2093                                         continue;
2094                                 }
2095                         }
2096                         if (map[i].oid) {
2097                                 struct ldb_control *control = ldb_request_get_control(ac->req, map[i].oid);
2098                                 if (control == NULL) {
2099                                         ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
2100                                 }
2101                         } else if (map[i].privilege != SEC_PRIV_INVALID) {
2102                                 bool have_priv = security_token_has_privilege(user_token,
2103                                                                               map[i].privilege);
2104                                 if (have_priv == false) {
2105                                         ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
2106                                 }
2107                         } else if (map[i].priv_to_change_from & user_account_control_old) {
2108                                 bool is_admin = security_token_has_builtin_administrators(user_token);
2109                                 if (is_admin == false) {
2110                                         ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
2111                                 }
2112                         } else if (map[i].guid) {
2113                                 ret = acl_check_extended_right(ac, domain_sd,
2114                                                                user_token,
2115                                                                map[i].guid,
2116                                                                SEC_ADS_CONTROL_ACCESS,
2117                                                                sid);
2118                         } else {
2119                                 ret = LDB_SUCCESS;
2120                         }
2121                         if (ret != LDB_SUCCESS) {
2122                                 break;
2123                         }
2124                 }
2125         }
2126         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
2127                 switch (ac->req->operation) {
2128                 case LDB_ADD:
2129                         ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
2130                                                "Failed to add %s: %s",
2131                                                ldb_dn_get_linearized(ac->msg->dn),
2132                                                map[i].error_string);
2133                         break;
2134                 case LDB_MODIFY:
2135                         ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
2136                                                "Failed to modify %s: %s",
2137                                                ldb_dn_get_linearized(ac->msg->dn),
2138                                                map[i].error_string);
2139                         break;
2140                 default:
2141                         return ldb_module_operr(ac->module);
2142                 }
2143                 if (map[i].guid) {
2144                         dsdb_acl_debug(domain_sd, acl_user_token(ac->module),
2145                                        domain_dn,
2146                                        true,
2147                                        10);
2148                 }
2149         }
2150         return ret;
2151 }
2152
2153 static int samldb_check_user_account_control_rules(struct samldb_ctx *ac,
2154                                                    struct dom_sid *sid,
2155                                                    uint32_t req_uac,
2156                                                    uint32_t user_account_control,
2157                                                    uint32_t user_account_control_old)
2158 {
2159         int ret;
2160         struct dsdb_control_password_user_account_control *uac = NULL;
2161
2162         ret = samldb_check_user_account_control_invariants(ac, user_account_control);
2163         if (ret != LDB_SUCCESS) {
2164                 return ret;
2165         }
2166         ret = samldb_check_user_account_control_acl(ac, sid, user_account_control, user_account_control_old);
2167         if (ret != LDB_SUCCESS) {
2168                 return ret;
2169         }
2170
2171         uac = talloc_zero(ac->req,
2172                           struct dsdb_control_password_user_account_control);
2173         if (uac == NULL) {
2174                 return ldb_module_oom(ac->module);
2175         }
2176
2177         uac->req_flags = req_uac;
2178         uac->old_flags = user_account_control_old;
2179         uac->new_flags = user_account_control;
2180
2181         ret = ldb_request_add_control(ac->req,
2182                                 DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID,
2183                                 false, uac);
2184         if (ret != LDB_SUCCESS) {
2185                 return ret;
2186         }
2187
2188         return ret;
2189 }
2190
2191
2192 /**
2193  * This function is called on LDB modify operations. It performs some additions/
2194  * replaces on the current LDB message when "userAccountControl" changes.
2195  */
2196 static int samldb_user_account_control_change(struct samldb_ctx *ac)
2197 {
2198         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2199         uint32_t old_uac;
2200         uint32_t new_uac;
2201         uint32_t raw_uac;
2202         uint32_t old_ufa;
2203         uint32_t new_ufa;
2204         uint32_t old_uac_computed;
2205         uint32_t clear_uac;
2206         uint32_t old_atype;
2207         uint32_t new_atype;
2208         uint32_t old_pgrid;
2209         uint32_t new_pgrid;
2210         NTTIME old_lockoutTime;
2211         struct ldb_message_element *el;
2212         struct ldb_val *val;
2213         struct ldb_val computer_val;
2214         struct ldb_message *tmp_msg;
2215         struct dom_sid *sid;
2216         int ret;
2217         struct ldb_result *res;
2218         const char * const attrs[] = {
2219                 "objectClass",
2220                 "isCriticalSystemObject",
2221                 "userAccountControl",
2222                 "msDS-User-Account-Control-Computed",
2223                 "lockoutTime",
2224                 "objectSid",
2225                 NULL
2226         };
2227         bool is_computer = false;
2228         bool old_is_critical = false;
2229         bool new_is_critical = false;
2230
2231         el = dsdb_get_single_valued_attr(ac->msg, "userAccountControl",
2232                                          ac->req->operation);
2233         if (el == NULL || el->num_values == 0) {
2234                 ldb_asprintf_errstring(ldb,
2235                         "%08X: samldb: 'userAccountControl' can't be deleted!",
2236                         W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
2237                 return LDB_ERR_UNWILLING_TO_PERFORM;
2238         }
2239
2240         /* Create a temporary message for fetching the "userAccountControl" */
2241         tmp_msg = ldb_msg_new(ac->msg);
2242         if (tmp_msg == NULL) {
2243                 return ldb_module_oom(ac->module);
2244         }
2245         ret = ldb_msg_add(tmp_msg, el, 0);
2246         if (ret != LDB_SUCCESS) {
2247                 return ret;
2248         }
2249         raw_uac = ldb_msg_find_attr_as_uint(tmp_msg,
2250                                             "userAccountControl",
2251                                             0);
2252         talloc_free(tmp_msg);
2253         /*
2254          * UF_LOCKOUT, UF_PASSWD_CANT_CHANGE and UF_PASSWORD_EXPIRED
2255          * are only generated and not stored. We ignore them almost
2256          * completely, along with unknown bits and UF_SCRIPT.
2257          *
2258          * The only exception is ACB_AUTOLOCK, which features in
2259          * clear_acb when the bit is cleared in this modify operation.
2260          *
2261          * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are
2262          * ignored by clients and servers
2263          */
2264         new_uac = raw_uac & UF_SETTABLE_BITS;
2265
2266         /* Fetch the old "userAccountControl" and "objectClass" */
2267         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
2268                                     DSDB_FLAG_NEXT_MODULE, ac->req);
2269         if (ret != LDB_SUCCESS) {
2270                 return ret;
2271         }
2272         old_uac = ldb_msg_find_attr_as_uint(res->msgs[0], "userAccountControl", 0);
2273         if (old_uac == 0) {
2274                 return ldb_operr(ldb);
2275         }
2276         old_uac_computed = ldb_msg_find_attr_as_uint(res->msgs[0],
2277                                                      "msDS-User-Account-Control-Computed", 0);
2278         old_lockoutTime = ldb_msg_find_attr_as_int64(res->msgs[0],
2279                                                      "lockoutTime", 0);
2280         old_is_critical = ldb_msg_find_attr_as_bool(res->msgs[0],
2281                                                     "isCriticalSystemObject", 0);
2282         /* When we do not have objectclass "computer" we cannot switch to a (read-only) DC */
2283         el = ldb_msg_find_element(res->msgs[0], "objectClass");
2284         if (el == NULL) {
2285                 return ldb_operr(ldb);
2286         }
2287         computer_val = data_blob_string_const("computer");
2288         val = ldb_msg_find_val(el, &computer_val);
2289         if (val != NULL) {
2290                 is_computer = true;
2291         }
2292
2293         old_ufa = old_uac & UF_ACCOUNT_TYPE_MASK;
2294         old_atype = ds_uf2atype(old_ufa);
2295         old_pgrid = ds_uf2prim_group_rid(old_uac);
2296
2297         new_ufa = new_uac & UF_ACCOUNT_TYPE_MASK;
2298         if (new_ufa == 0) {
2299                 /*
2300                  * "userAccountControl" = 0 or missing one of the
2301                  * types means "UF_NORMAL_ACCOUNT".  See MS-SAMR
2302                  * 3.1.1.8.10 point 8
2303                  */
2304                 new_ufa = UF_NORMAL_ACCOUNT;
2305                 new_uac |= new_ufa;
2306         }
2307         sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
2308         if (sid == NULL) {
2309                 return ldb_module_operr(ac->module);
2310         }
2311
2312         ret = samldb_check_user_account_control_rules(ac, sid,
2313                                                       raw_uac,
2314                                                       new_uac,
2315                                                       old_uac);
2316         if (ret != LDB_SUCCESS) {
2317                 return ret;
2318         }
2319
2320         new_atype = ds_uf2atype(new_ufa);
2321         new_pgrid = ds_uf2prim_group_rid(new_uac);
2322
2323         clear_uac = (old_uac | old_uac_computed) & ~raw_uac;
2324
2325         switch (new_ufa) {
2326         case UF_NORMAL_ACCOUNT:
2327                 new_is_critical = old_is_critical;
2328                 break;
2329
2330         case UF_INTERDOMAIN_TRUST_ACCOUNT:
2331                 new_is_critical = true;
2332                 break;
2333
2334         case UF_WORKSTATION_TRUST_ACCOUNT:
2335                 new_is_critical = false;
2336                 if (new_uac & UF_PARTIAL_SECRETS_ACCOUNT) {
2337                         if (!is_computer) {
2338                                 ldb_asprintf_errstring(ldb,
2339                                                        "%08X: samldb: UF_PARTIAL_SECRETS_ACCOUNT "
2340                                                        "requires objectclass 'computer'!",
2341                                                        W_ERROR_V(WERR_DS_MACHINE_ACCOUNT_CREATED_PRENT4));
2342                                 return LDB_ERR_UNWILLING_TO_PERFORM;
2343                         }
2344                         new_is_critical = true;
2345                 }
2346                 break;
2347
2348         case UF_SERVER_TRUST_ACCOUNT:
2349                 if (!is_computer) {
2350                         ldb_asprintf_errstring(ldb,
2351                                 "%08X: samldb: UF_SERVER_TRUST_ACCOUNT "
2352                                 "requires objectclass 'computer'!",
2353                                 W_ERROR_V(WERR_DS_MACHINE_ACCOUNT_CREATED_PRENT4));
2354                         return LDB_ERR_UNWILLING_TO_PERFORM;
2355                 }
2356                 new_is_critical = true;
2357                 break;
2358
2359         default:
2360                 ldb_asprintf_errstring(ldb,
2361                         "%08X: samldb: invalid userAccountControl[0x%08X]",
2362                         W_ERROR_V(WERR_INVALID_PARAMETER), raw_uac);
2363                 return LDB_ERR_OTHER;
2364         }
2365
2366         if (old_atype != new_atype) {
2367                 ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
2368                                          "sAMAccountType", new_atype);
2369                 if (ret != LDB_SUCCESS) {
2370                         return ret;
2371                 }
2372                 el = ldb_msg_find_element(ac->msg, "sAMAccountType");
2373                 el->flags = LDB_FLAG_MOD_REPLACE;
2374         }
2375
2376         /* As per MS-SAMR 3.1.1.8.10 these flags have not to be set */
2377         if ((clear_uac & UF_LOCKOUT) && (old_lockoutTime != 0)) {
2378                 /* "lockoutTime" reset as per MS-SAMR 3.1.1.8.10 */
2379                 ldb_msg_remove_attr(ac->msg, "lockoutTime");
2380                 ret = samdb_msg_add_uint64(ldb, ac->msg, ac->msg, "lockoutTime",
2381                                            (NTTIME)0);
2382                 if (ret != LDB_SUCCESS) {
2383                         return ret;
2384                 }
2385                 el = ldb_msg_find_element(ac->msg, "lockoutTime");
2386                 el->flags = LDB_FLAG_MOD_REPLACE;
2387         }
2388
2389         /* "isCriticalSystemObject" might be set/changed */
2390         if (old_is_critical != new_is_critical) {
2391                 ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
2392                                          new_is_critical ? "TRUE": "FALSE");
2393                 if (ret != LDB_SUCCESS) {
2394                         return ret;
2395                 }
2396                 el = ldb_msg_find_element(ac->msg,
2397                                            "isCriticalSystemObject");
2398                 el->flags = LDB_FLAG_MOD_REPLACE;
2399         }
2400
2401         if (!ldb_msg_find_element(ac->msg, "primaryGroupID") &&
2402             (old_pgrid != new_pgrid)) {
2403                 /* Older AD deployments don't know about the RODC group */
2404                 if (new_pgrid == DOMAIN_RID_READONLY_DCS) {
2405                         ret = samldb_prim_group_tester(ac, new_pgrid);
2406                         if (ret != LDB_SUCCESS) {
2407                                 return ret;
2408                         }
2409                 }
2410
2411                 ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
2412                                          "primaryGroupID", new_pgrid);
2413                 if (ret != LDB_SUCCESS) {
2414                         return ret;
2415                 }
2416                 el = ldb_msg_find_element(ac->msg,
2417                                            "primaryGroupID");
2418                 el->flags = LDB_FLAG_MOD_REPLACE;
2419         }
2420
2421         /* Propagate eventual "userAccountControl" attribute changes */
2422         if (old_uac != new_uac) {
2423                 char *tempstr = talloc_asprintf(ac->msg, "%d",
2424                                                 new_uac);
2425                 if (tempstr == NULL) {
2426                         return ldb_module_oom(ac->module);
2427                 }
2428
2429                 /* Overwrite "userAccountControl" correctly */
2430                 el = dsdb_get_single_valued_attr(ac->msg, "userAccountControl",
2431                                                  ac->req->operation);
2432                 el->values[0].data = (uint8_t *) tempstr;
2433                 el->values[0].length = strlen(tempstr);
2434         } else {
2435                 ldb_msg_remove_attr(ac->msg, "userAccountControl");
2436         }
2437
2438         return LDB_SUCCESS;
2439 }
2440
2441 static int samldb_check_pwd_last_set_acl(struct samldb_ctx *ac,
2442                                          struct dom_sid *sid)
2443 {
2444         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2445         int ret = 0;
2446         struct ldb_result *res = NULL;
2447         const char * const sd_attrs[] = {"ntSecurityDescriptor", NULL};
2448         struct security_token *user_token = NULL;
2449         struct security_descriptor *domain_sd = NULL;
2450         struct ldb_dn *domain_dn = ldb_get_default_basedn(ldb_module_get_ctx(ac->module));
2451         const char *operation = "";
2452
2453         if (dsdb_module_am_system(ac->module)) {
2454                 return LDB_SUCCESS;
2455         }
2456
2457         switch (ac->req->operation) {
2458         case LDB_ADD:
2459                 operation = "add";
2460                 break;
2461         case LDB_MODIFY:
2462                 operation = "modify";
2463                 break;
2464         default:
2465                 return ldb_module_operr(ac->module);
2466         }
2467
2468         user_token = acl_user_token(ac->module);
2469         if (user_token == NULL) {
2470                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
2471         }
2472
2473         ret = dsdb_module_search_dn(ac->module, ac, &res,
2474                                     domain_dn,
2475                                     sd_attrs,
2476                                     DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
2477                                     ac->req);
2478         if (ret != LDB_SUCCESS) {
2479                 return ret;
2480         }
2481         if (res->count != 1) {
2482                 return ldb_module_operr(ac->module);
2483         }
2484
2485         ret = dsdb_get_sd_from_ldb_message(ldb, ac, res->msgs[0], &domain_sd);
2486         if (ret != LDB_SUCCESS) {
2487                 return ret;
2488         }
2489
2490         ret = acl_check_extended_right(ac, domain_sd,
2491                                        user_token,
2492                                        GUID_DRS_UNEXPIRE_PASSWORD,
2493                                        SEC_ADS_CONTROL_ACCESS,
2494                                        sid);
2495         if (ret != LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
2496                 return ret;
2497         }
2498
2499         ldb_debug_set(ldb, LDB_DEBUG_WARNING,
2500                       "Failed to %s %s: "
2501                       "Setting pwdLastSet to -1 requires the "
2502                       "Unexpire-Password right that was not given "
2503                       "on the Domain object",
2504                       operation,
2505                       ldb_dn_get_linearized(ac->msg->dn));
2506         dsdb_acl_debug(domain_sd, user_token,
2507                        domain_dn, true, 10);
2508
2509         return ret;
2510 }
2511
2512 /**
2513  * This function is called on LDB modify operations. It performs some additions/
2514  * replaces on the current LDB message when "pwdLastSet" changes.
2515  */
2516 static int samldb_pwd_last_set_change(struct samldb_ctx *ac)
2517 {
2518         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2519         NTTIME last_set = 0;
2520         struct ldb_message_element *el = NULL;
2521         struct ldb_message *tmp_msg = NULL;
2522         struct dom_sid *self_sid = NULL;
2523         int ret;
2524         struct ldb_result *res = NULL;
2525         const char * const attrs[] = {
2526                 "objectSid",
2527                 NULL
2528         };
2529
2530         el = dsdb_get_single_valued_attr(ac->msg, "pwdLastSet",
2531                                          ac->req->operation);
2532         if (el == NULL || el->num_values == 0) {
2533                 ldb_asprintf_errstring(ldb,
2534                         "%08X: samldb: 'pwdLastSet' can't be deleted!",
2535                         W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
2536                 return LDB_ERR_UNWILLING_TO_PERFORM;
2537         }
2538
2539         /* Create a temporary message for fetching the "userAccountControl" */
2540         tmp_msg = ldb_msg_new(ac->msg);
2541         if (tmp_msg == NULL) {
2542                 return ldb_module_oom(ac->module);
2543         }
2544         ret = ldb_msg_add(tmp_msg, el, 0);
2545         if (ret != LDB_SUCCESS) {
2546                 return ret;
2547         }
2548         last_set = samdb_result_nttime(tmp_msg, "pwdLastSet", 0);
2549         talloc_free(tmp_msg);
2550
2551         /*
2552          * Setting -1 (0xFFFFFFFFFFFFFFFF) requires the Unexpire-Password right
2553          */
2554         if (last_set != UINT64_MAX) {
2555                 return LDB_SUCCESS;
2556         }
2557
2558         /* Fetch the "objectSid" */
2559         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
2560                                     DSDB_FLAG_NEXT_MODULE, ac->req);
2561         if (ret != LDB_SUCCESS) {
2562                 return ret;
2563         }
2564         self_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
2565         if (self_sid == NULL) {
2566                 return ldb_module_operr(ac->module);
2567         }
2568
2569         ret = samldb_check_pwd_last_set_acl(ac, self_sid);
2570         if (ret != LDB_SUCCESS) {
2571                 return ret;
2572         }
2573
2574         return LDB_SUCCESS;
2575 }
2576
2577 static int samldb_lockout_time(struct samldb_ctx *ac)
2578 {
2579         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2580         NTTIME lockoutTime;
2581         struct ldb_message_element *el;
2582         struct ldb_message *tmp_msg;
2583         int ret;
2584
2585         el = dsdb_get_single_valued_attr(ac->msg, "lockoutTime",
2586                                          ac->req->operation);
2587         if (el == NULL || el->num_values == 0) {
2588                 ldb_asprintf_errstring(ldb,
2589                         "%08X: samldb: 'lockoutTime' can't be deleted!",
2590                         W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
2591                 return LDB_ERR_UNWILLING_TO_PERFORM;
2592         }
2593
2594         /* Create a temporary message for fetching the "lockoutTime" */
2595         tmp_msg = ldb_msg_new(ac->msg);
2596         if (tmp_msg == NULL) {
2597                 return ldb_module_oom(ac->module);
2598         }
2599         ret = ldb_msg_add(tmp_msg, el, 0);
2600         if (ret != LDB_SUCCESS) {
2601                 return ret;
2602         }
2603         lockoutTime = ldb_msg_find_attr_as_int64(tmp_msg,
2604                                                  "lockoutTime",
2605                                                  0);
2606         talloc_free(tmp_msg);
2607
2608         if (lockoutTime != 0) {
2609                 return LDB_SUCCESS;
2610         }
2611
2612         /* lockoutTime == 0 resets badPwdCount */
2613         ldb_msg_remove_attr(ac->msg, "badPwdCount");
2614         ret = samdb_msg_add_int(ldb, ac->msg, ac->msg,
2615                                 "badPwdCount", 0);
2616         if (ret != LDB_SUCCESS) {
2617                 return ret;
2618         }
2619         el = ldb_msg_find_element(ac->msg, "badPwdCount");
2620         el->flags = LDB_FLAG_MOD_REPLACE;
2621
2622         return LDB_SUCCESS;
2623 }
2624
2625 static int samldb_group_type_change(struct samldb_ctx *ac)
2626 {
2627         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2628         uint32_t group_type, old_group_type, account_type;
2629         struct ldb_message_element *el;
2630         struct ldb_message *tmp_msg;
2631         int ret;
2632         struct ldb_result *res;
2633         const char * const attrs[] = { "groupType", NULL };
2634
2635         el = dsdb_get_single_valued_attr(ac->msg, "groupType",
2636                                          ac->req->operation);
2637         if (el == NULL) {
2638                 /* we are not affected */
2639                 return LDB_SUCCESS;
2640         }
2641
2642         /* Create a temporary message for fetching the "groupType" */
2643         tmp_msg = ldb_msg_new(ac->msg);
2644         if (tmp_msg == NULL) {
2645                 return ldb_module_oom(ac->module);
2646         }
2647         ret = ldb_msg_add(tmp_msg, el, 0);
2648         if (ret != LDB_SUCCESS) {
2649                 return ret;
2650         }
2651         group_type = ldb_msg_find_attr_as_uint(tmp_msg, "groupType", 0);
2652         talloc_free(tmp_msg);
2653
2654         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
2655                                     DSDB_FLAG_NEXT_MODULE |
2656                                     DSDB_SEARCH_SHOW_DELETED, ac->req);
2657         if (ret != LDB_SUCCESS) {
2658                 return ret;
2659         }
2660         old_group_type = ldb_msg_find_attr_as_uint(res->msgs[0], "groupType", 0);
2661         if (old_group_type == 0) {
2662                 return ldb_operr(ldb);
2663         }
2664
2665         /* Group type switching isn't so easy as it seems: We can only
2666          * change in this directions: global <-> universal <-> local
2667          * On each step also the group type itself
2668          * (security/distribution) is variable. */
2669
2670         if (ldb_request_get_control(ac->req, LDB_CONTROL_PROVISION_OID) == NULL) {
2671                 switch (group_type) {
2672                 case GTYPE_SECURITY_GLOBAL_GROUP:
2673                 case GTYPE_DISTRIBUTION_GLOBAL_GROUP:
2674                         /* change to "universal" allowed */
2675                         if ((old_group_type == GTYPE_SECURITY_DOMAIN_LOCAL_GROUP) ||
2676                         (old_group_type == GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)) {
2677                                 ldb_set_errstring(ldb,
2678                                         "samldb: Change from security/distribution local group forbidden!");
2679                                 return LDB_ERR_UNWILLING_TO_PERFORM;
2680                         }
2681                 break;
2682
2683                 case GTYPE_SECURITY_UNIVERSAL_GROUP:
2684                 case GTYPE_DISTRIBUTION_UNIVERSAL_GROUP:
2685                         /* each change allowed */
2686                 break;
2687                 case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP:
2688                 case GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP:
2689                         /* change to "universal" allowed */
2690                         if ((old_group_type == GTYPE_SECURITY_GLOBAL_GROUP) ||
2691                         (old_group_type == GTYPE_DISTRIBUTION_GLOBAL_GROUP)) {
2692                                 ldb_set_errstring(ldb,
2693                                         "samldb: Change from security/distribution global group forbidden!");
2694                                 return LDB_ERR_UNWILLING_TO_PERFORM;
2695                         }
2696                 break;
2697
2698                 case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP:
2699                 default:
2700                         /* we don't allow this "groupType" values */
2701                         return LDB_ERR_UNWILLING_TO_PERFORM;
2702                 break;
2703                 }
2704         }
2705
2706         account_type =  ds_gtype2atype(group_type);
2707         if (account_type == 0) {
2708                 ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
2709                 return LDB_ERR_UNWILLING_TO_PERFORM;
2710         }
2711         ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "sAMAccountType",
2712                                  account_type);
2713         if (ret != LDB_SUCCESS) {
2714                 return ret;
2715         }
2716         el = ldb_msg_find_element(ac->msg, "sAMAccountType");
2717         el->flags = LDB_FLAG_MOD_REPLACE;
2718
2719         return LDB_SUCCESS;
2720 }
2721
2722 static int samldb_member_check(struct samldb_ctx *ac)
2723 {
2724         const char * const attrs[] = { "objectSid", NULL };
2725         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2726         struct ldb_message_element *el;
2727         struct ldb_dn *member_dn;
2728         struct dom_sid *sid;
2729         struct ldb_result *res;
2730         struct dom_sid *group_sid;
2731         unsigned int i, j;
2732         int ret;
2733
2734         /* Fetch information from the existing object */
2735
2736         ret = dsdb_module_search(ac->module, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
2737                                  DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED, ac->req, NULL);
2738         if (ret != LDB_SUCCESS) {
2739                 return ret;
2740         }
2741         if (res->count != 1) {
2742                 return ldb_operr(ldb);
2743         }
2744
2745         group_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
2746         if (group_sid == NULL) {
2747                 return ldb_operr(ldb);
2748         }
2749
2750         /* We've to walk over all modification entries and consider the "member"
2751          * ones. */
2752         for (i = 0; i < ac->msg->num_elements; i++) {
2753                 if (ldb_attr_cmp(ac->msg->elements[i].name, "member") != 0) {
2754                         continue;
2755                 }
2756
2757                 el = &ac->msg->elements[i];
2758                 for (j = 0; j < el->num_values; j++) {
2759                         struct ldb_result *group_res;
2760                         const char *group_attrs[] = { "primaryGroupID" , NULL };
2761                         uint32_t prim_group_rid;
2762
2763                         if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
2764                                 /* Deletes will be handled in
2765                                  * repl_meta_data, and deletes not
2766                                  * matching a member will return
2767                                  * LDB_ERR_UNWILLING_TO_PERFORM
2768                                  * there */
2769                                 continue;
2770                         }
2771
2772                         member_dn = ldb_dn_from_ldb_val(ac, ldb,
2773                                                         &el->values[j]);
2774                         if (!ldb_dn_validate(member_dn)) {
2775                                 return ldb_operr(ldb);
2776                         }
2777
2778                         /* Denies to add "member"s to groups which are primary
2779                          * ones for them - in this case return
2780                          * ERR_ENTRY_ALREADY_EXISTS. */
2781
2782                         ret = dsdb_module_search_dn(ac->module, ac, &group_res,
2783                                                     member_dn, group_attrs,
2784                                                     DSDB_FLAG_NEXT_MODULE, ac->req);
2785                         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2786                                 /* member DN doesn't exist yet */
2787                                 continue;
2788                         }
2789                         if (ret != LDB_SUCCESS) {
2790                                 return ret;
2791                         }
2792                         prim_group_rid = ldb_msg_find_attr_as_uint(group_res->msgs[0], "primaryGroupID", (uint32_t)-1);
2793                         if (prim_group_rid == (uint32_t) -1) {
2794                                 /* the member hasn't to be a user account ->
2795                                  * therefore no check needed in this case. */
2796                                 continue;
2797                         }
2798
2799                         sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
2800                                               prim_group_rid);
2801                         if (sid == NULL) {
2802                                 return ldb_operr(ldb);
2803                         }
2804
2805                         if (dom_sid_equal(group_sid, sid)) {
2806                                 ldb_asprintf_errstring(ldb,
2807                                                        "samldb: member %s already set via primaryGroupID %u",
2808                                                        ldb_dn_get_linearized(member_dn), prim_group_rid);
2809                                 return LDB_ERR_ENTRY_ALREADY_EXISTS;
2810                         }
2811                 }
2812         }
2813
2814         talloc_free(res);
2815
2816         return LDB_SUCCESS;
2817 }
2818
2819 /* SAM objects have special rules regarding the "description" attribute on
2820  * modify operations. */
2821 static int samldb_description_check(struct samldb_ctx *ac, bool *modified)
2822 {
2823         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2824         const char * const attrs[] = { "objectClass", "description", NULL };
2825         struct ldb_result *res;
2826         unsigned int i;
2827         int ret;
2828
2829         /* Fetch information from the existing object */
2830         ret = dsdb_module_search(ac->module, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
2831                                  DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED, ac->req,
2832                                  "(|(objectclass=user)(objectclass=group)(objectclass=samDomain)(objectclass=samServer))");
2833         if (ret != LDB_SUCCESS) {
2834                 /* don't treat it specially ... let normal error codes
2835                    happen from other places */
2836                 ldb_reset_err_string(ldb);
2837                 return LDB_SUCCESS;
2838         }
2839         if (res->count == 0) {
2840                 /* we didn't match the filter */
2841                 talloc_free(res);
2842                 return LDB_SUCCESS;
2843         }
2844
2845         /* We've to walk over all modification entries and consider the
2846          * "description" ones. */
2847         for (i = 0; i < ac->msg->num_elements; i++) {
2848                 if (ldb_attr_cmp(ac->msg->elements[i].name, "description") == 0) {
2849                         ac->msg->elements[i].flags |= LDB_FLAG_INTERNAL_FORCE_SINGLE_VALUE_CHECK;
2850                         *modified = true;
2851                 }
2852         }
2853
2854         talloc_free(res);
2855
2856         return LDB_SUCCESS;
2857 }
2858
2859 /* This trigger adapts the "servicePrincipalName" attributes if the
2860  * "dNSHostName" and/or "sAMAccountName" attribute change(s) */
2861 static int samldb_service_principal_names_change(struct samldb_ctx *ac)
2862 {
2863         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
2864         struct ldb_message_element *el = NULL, *el2 = NULL;
2865         struct ldb_message *msg;
2866         const char * const attrs[] = { "servicePrincipalName", NULL };
2867         struct ldb_result *res;
2868         const char *dns_hostname = NULL, *old_dns_hostname = NULL,
2869                    *sam_accountname = NULL, *old_sam_accountname = NULL;
2870         unsigned int i, j;
2871         int ret;
2872
2873         el = dsdb_get_single_valued_attr(ac->msg, "dNSHostName",
2874                                          ac->req->operation);
2875         el2 = dsdb_get_single_valued_attr(ac->msg, "sAMAccountName",
2876                                           ac->req->operation);
2877         if ((el == NULL) && (el2 == NULL)) {
2878                 /* we are not affected */
2879                 return LDB_SUCCESS;
2880         }
2881
2882         /* Create a temporary message for fetching the "dNSHostName" */
2883         if (el != NULL) {
2884                 const char *dns_attrs[] = { "dNSHostName", NULL };
2885                 msg = ldb_msg_new(ac->msg);
2886                 if (msg == NULL) {
2887                         return ldb_module_oom(ac->module);
2888                 }
2889                 ret = ldb_msg_add(msg, el, 0);
2890                 if (ret != LDB_SUCCESS) {
2891                         return ret;
2892                 }
2893                 dns_hostname = talloc_strdup(ac,
2894                                              ldb_msg_find_attr_as_string(msg, "dNSHostName", NULL));
2895                 if (dns_hostname == NULL) {
2896                         return ldb_module_oom(ac->module);
2897                 }
2898
2899                 talloc_free(msg);
2900
2901                 ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn,
2902                                             dns_attrs, DSDB_FLAG_NEXT_MODULE, ac->req);
2903                 if (ret == LDB_SUCCESS) {
2904                         old_dns_hostname = ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName", NULL);
2905                 }
2906         }
2907
2908         /* Create a temporary message for fetching the "sAMAccountName" */
2909         if (el2 != NULL) {
2910                 char *tempstr, *tempstr2 = NULL;
2911                 const char *acct_attrs[] = { "sAMAccountName", NULL };
2912
2913                 msg = ldb_msg_new(ac->msg);
2914                 if (msg == NULL) {
2915                         return ldb_module_oom(ac->module);
2916                 }
2917                 ret = ldb_msg_add(msg, el2, 0);
2918                 if (ret != LDB_SUCCESS) {
2919                         return ret;
2920                 }
2921                 tempstr = talloc_strdup(ac,
2922                                         ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
2923                 talloc_free(msg);
2924
2925                 ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, acct_attrs,
2926                                             DSDB_FLAG_NEXT_MODULE, ac->req);
2927                 if (ret == LDB_SUCCESS) {
2928                         tempstr2 = talloc_strdup(ac,
2929                                                  ldb_msg_find_attr_as_string(res->msgs[0],
2930                                                                              "sAMAccountName", NULL));
2931                 }
2932
2933
2934                 /* The "sAMAccountName" needs some additional trimming: we need
2935                  * to remove the trailing "$"s if they exist. */
2936                 if ((tempstr != NULL) && (tempstr[0] != '\0') &&
2937                     (tempstr[strlen(tempstr) - 1] == '$')) {
2938                         tempstr[strlen(tempstr) - 1] = '\0';
2939                 }
2940                 if ((tempstr2 != NULL) && (tempstr2[0] != '\0') &&
2941                     (tempstr2[strlen(tempstr2) - 1] == '$')) {
2942                         tempstr2[strlen(tempstr2) - 1] = '\0';
2943                 }
2944                 sam_accountname = tempstr;
2945                 old_sam_accountname = tempstr2;
2946         }
2947
2948         if (old_dns_hostname == NULL) {
2949                 /* we cannot change when the old name is unknown */
2950                 dns_hostname = NULL;
2951         }
2952         if ((old_dns_hostname != NULL) && (dns_hostname != NULL) &&
2953             (strcasecmp_m(old_dns_hostname, dns_hostname) == 0)) {
2954                 /* The "dNSHostName" didn't change */
2955                 dns_hostname = NULL;
2956         }
2957
2958         if (old_sam_accountname == NULL) {
2959                 /* we cannot change when the old name is unknown */
2960                 sam_accountname = NULL;
2961         }
2962         if ((old_sam_accountname != NULL) && (sam_accountname != NULL) &&
2963             (strcasecmp_m(old_sam_accountname, sam_accountname) == 0)) {
2964                 /* The "sAMAccountName" didn't change */
2965                 sam_accountname = NULL;
2966         }
2967
2968         if ((dns_hostname == NULL) && (sam_accountname == NULL)) {
2969                 /* Well, there are information missing (old name(s)) or the
2970                  * names didn't change. We've nothing to do and can exit here */
2971                 return LDB_SUCCESS;
2972         }
2973
2974         /* Potential "servicePrincipalName" changes in the same request have to
2975          * be handled before the update (Windows behaviour). */
2976         el = ldb_msg_find_element(ac->msg, "servicePrincipalName");
2977         if (el != NULL) {
2978                 msg = ldb_msg_new(ac->msg);
2979                 if (msg == NULL) {
2980                         return ldb_module_oom(ac->module);
2981                 }
2982                 msg->dn = ac->msg->dn;
2983
2984                 do {
2985                         ret = ldb_msg_add(msg, el, el->flags);
2986                         if (ret != LDB_SUCCESS) {
2987                                 return ret;
2988                         }
2989
2990                         ldb_msg_remove_element(ac->msg, el);
2991
2992                         el = ldb_msg_find_element(ac->msg,
2993                                                   "servicePrincipalName");
2994                 } while (el != NULL);
2995
2996                 ret = dsdb_module_modify(ac->module, msg,
2997                                          DSDB_FLAG_NEXT_MODULE, ac->req);
2998                 if (ret != LDB_SUCCESS) {
2999                         return ret;
3000                 }
3001                 talloc_free(msg);
3002         }
3003
3004         /* Fetch the "servicePrincipalName"s if any */
3005         ret = dsdb_module_search(ac->module, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
3006                                  DSDB_FLAG_NEXT_MODULE, ac->req, NULL);
3007         if (ret != LDB_SUCCESS) {
3008                 return ret;
3009         }
3010         if ((res->count != 1) || (res->msgs[0]->num_elements > 1)) {
3011                 return ldb_operr(ldb);
3012         }
3013
3014         if (res->msgs[0]->num_elements == 1) {
3015                 /*
3016                  * Yes, we do have "servicePrincipalName"s. First we update them
3017                  * locally, that means we do always substitute the current
3018                  * "dNSHostName" with the new one and/or "sAMAccountName"
3019                  * without "$" with the new one and then we append the
3020                  * modified "servicePrincipalName"s as a message element
3021                  * replace to the modification request (Windows behaviour). We
3022                  * need also to make sure that the values remain case-
3023                  * insensitively unique.
3024                  */
3025
3026                 ret = ldb_msg_add_empty(ac->msg, "servicePrincipalName",
3027                                         LDB_FLAG_MOD_REPLACE, &el);
3028                 if (ret != LDB_SUCCESS) {
3029                         return ret;
3030                 }
3031
3032                 for (i = 0; i < res->msgs[0]->elements[0].num_values; i++) {
3033                         char *old_str, *new_str;
3034                         char *pos = NULL;
3035                         const char *tok;
3036                         struct ldb_val *vals;
3037                         bool found = false;
3038
3039                         old_str = (char *)
3040                                 res->msgs[0]->elements[0].values[i].data;
3041
3042                         new_str = talloc_strdup(ac->msg,
3043                                                 strtok_r(old_str, "/", &pos));
3044                         if (new_str == NULL) {
3045                                 return ldb_module_oom(ac->module);
3046                         }
3047
3048                         while ((tok = strtok_r(NULL, "/", &pos)) != NULL) {
3049                                 if ((dns_hostname != NULL) &&
3050                                     (strcasecmp_m(tok, old_dns_hostname) == 0)) {
3051                                         tok = dns_hostname;
3052                                 }
3053                                 if ((sam_accountname != NULL) &&
3054                                     (strcasecmp_m(tok, old_sam_accountname) == 0)) {
3055                                         tok = sam_accountname;
3056                                 }
3057
3058                                 new_str = talloc_asprintf(ac->msg, "%s/%s",
3059                                                           new_str, tok);
3060                                 if (new_str == NULL) {
3061                                         return ldb_module_oom(ac->module);
3062                                 }
3063                         }
3064
3065                         /* Uniqueness check */
3066                         for (j = 0; (!found) && (j < el->num_values); j++) {
3067                                 if (strcasecmp_m((char *)el->values[j].data,
3068                                                new_str) == 0) {
3069                                         found = true;
3070                                 }
3071                         }
3072                         if (found) {
3073                                 continue;
3074                         }
3075
3076                         /*
3077                          * append the new "servicePrincipalName" -
3078                          * code derived from ldb_msg_add_value().
3079                          *
3080                          * Open coded to make it clear that we must
3081                          * append to the MOD_REPLACE el created above.
3082                          */
3083                         vals = talloc_realloc(ac->msg, el->values,
3084                                               struct ldb_val,
3085                                               el->num_values + 1);
3086                         if (vals == NULL) {
3087                                 return ldb_module_oom(ac->module);
3088                         }
3089                         el->values = vals;
3090                         el->values[el->num_values] = data_blob_string_const(new_str);
3091                         ++(el->num_values);
3092                 }
3093         }
3094
3095         talloc_free(res);
3096
3097         return LDB_SUCCESS;
3098 }
3099
3100 /* This checks the "fSMORoleOwner" attributes */
3101 static int samldb_fsmo_role_owner_check(struct samldb_ctx *ac)
3102 {
3103         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
3104         const char * const no_attrs[] = { NULL };
3105         struct ldb_message_element *el;
3106         struct ldb_message *tmp_msg;
3107         struct ldb_dn *res_dn;
3108         struct ldb_result *res;
3109         int ret;
3110
3111         el = dsdb_get_single_valued_attr(ac->msg, "fSMORoleOwner",
3112                                          ac->req->operation);
3113         if (el == NULL) {
3114                 /* we are not affected */
3115                 return LDB_SUCCESS;
3116         }
3117
3118         /* Create a temporary message for fetching the "fSMORoleOwner" */
3119         tmp_msg = ldb_msg_new(ac->msg);
3120         if (tmp_msg == NULL) {
3121                 return ldb_module_oom(ac->module);
3122         }
3123         ret = ldb_msg_add(tmp_msg, el, 0);
3124         if (ret != LDB_SUCCESS) {
3125                 return ret;
3126         }
3127         res_dn = ldb_msg_find_attr_as_dn(ldb, ac, tmp_msg, "fSMORoleOwner");
3128         talloc_free(tmp_msg);
3129
3130         if (res_dn == NULL) {
3131                 ldb_set_errstring(ldb,
3132                                   "samldb: 'fSMORoleOwner' attributes have to reference 'nTDSDSA' entries!");
3133                 if (ac->req->operation == LDB_ADD) {
3134                         return LDB_ERR_CONSTRAINT_VIOLATION;
3135                 } else {
3136                         return LDB_ERR_UNWILLING_TO_PERFORM;
3137                 }
3138         }
3139
3140         /* Fetched DN has to reference a "nTDSDSA" entry */
3141         ret = dsdb_module_search(ac->module, ac, &res, res_dn, LDB_SCOPE_BASE,
3142                                  no_attrs,
3143                                  DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
3144                                  ac->req, "(objectClass=nTDSDSA)");
3145         if (ret != LDB_SUCCESS) {
3146                 return ret;
3147         }
3148         if (res->count != 1) {
3149                 ldb_set_errstring(ldb,
3150                                   "samldb: 'fSMORoleOwner' attributes have to reference 'nTDSDSA' entries!");
3151                 return LDB_ERR_UNWILLING_TO_PERFORM;
3152         }
3153
3154         talloc_free(res);
3155
3156         return LDB_SUCCESS;
3157 }
3158
3159 /*
3160  * Return zero if the number of zero bits in the address (looking from low to
3161  * high) is equal to or greater than the length minus the mask. Otherwise it
3162  * returns -1.
3163  */
3164 static int check_cidr_zero_bits(uint8_t *address, unsigned int len,
3165                                 unsigned int mask)
3166 {
3167         /* <address> is an integer in big-endian form, <len> bits long. All
3168            bits between <mask> and <len> must be zero. */
3169         int i;
3170         unsigned int byte_len;
3171         unsigned int byte_mask;
3172         unsigned int bit_mask;
3173         if (len == 32) {
3174                 DBG_INFO("Looking at address %02x%02x%02x%02x, mask %u\n",
3175                          address[0], address[1], address[2], address[3],
3176                           mask);
3177         } else if (len == 128){
3178                 DBG_INFO("Looking at address "
3179                          "%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
3180                          "%02x%02x-%02x%02x-%02x%02x-%02x%02x, mask %u\n",
3181                          address[0], address[1], address[2], address[3],
3182                          address[4], address[5], address[6], address[7],
3183                          address[8], address[9], address[10], address[11],
3184                          address[12], address[13], address[14], address[15],
3185                          mask);
3186         }
3187
3188         if (mask > len){
3189                 DBG_INFO("mask %u is too big (> %u)\n", mask, len);
3190                 return -1;
3191         }
3192         if (mask == len){
3193                 /* single address subnet.
3194                  * In IPv4 all 255s is invalid by the bitmask != address rule
3195                  * in MS-ADTS. IPv6 does not suffer.
3196                  */
3197                 if (len == 32){
3198                         if (address[0] == 255 &&
3199                             address[1] == 255 &&
3200                             address[2] == 255 &&
3201                             address[3] == 255){
3202                                 return -1;
3203                         }
3204                 }
3205                 return 0;
3206         }
3207
3208         byte_len = len / 8;
3209         byte_mask = mask / 8;
3210
3211         for (i = byte_len - 1; i > byte_mask; i--){
3212                 DBG_DEBUG("checking byte %d %02x\n", i, address[i]);
3213                 if (address[i] != 0){
3214                         return -1;
3215                 }
3216         }
3217         bit_mask = (1 << (8 - (mask & 7))) - 1;
3218         DBG_DEBUG("checking bitmask %02x & %02x overlap %02x\n", bit_mask, address[byte_mask],
3219                   bit_mask & address[byte_mask]);
3220         if (address[byte_mask] & bit_mask){
3221                 return -1;
3222         }
3223
3224         /* According to MS-ADTS, the mask can't exactly equal the bitmask for
3225          * IPv4 (but this is fine for v6). That is 255.255.80.0/17 is bad,
3226          * because the bitmask implied by "/17" is 255.255.80.0.
3227          *
3228          * The bit_mask used in the previous check is the complement of what
3229          * we want here.
3230          */
3231         if (len == 32 && address[byte_mask] == (uint8_t)~bit_mask){
3232                 bool ok = false;
3233                 for (i = 0; i < byte_mask; i++){
3234                         if (address[i] != 255){
3235                                 ok = true;
3236                                 break;
3237                         }
3238                 }
3239                 if (ok == false){
3240                         return -1;
3241                 }
3242         }
3243         return 0;
3244 }
3245
3246
3247
3248 static int check_address_roundtrip(const char *address, int family,
3249                                    const uint8_t *address_bytes,
3250                                    char *buffer, int buffer_len)
3251 {
3252         /*
3253          * Check that the address is in the canonical RFC5952 format for IPv6,
3254          * and lacks extra leading zeros for each dotted decimal for IPv4.
3255          * Handily this is what inet_ntop() gives you.
3256          */
3257         const char *address_redux = inet_ntop(family, address_bytes,
3258                                               buffer, buffer_len);
3259         if (address_redux == NULL){
3260                 DBG_INFO("Address round trip %s failed unexpectedly"
3261                          " with errno %d\n", address, errno);
3262                 return -1;
3263         }
3264         if (strcasecmp(address, address_redux) != 0){
3265                 DBG_INFO("Address %s round trips to %s; fail!\n",
3266                          address, address_redux);
3267                 /* If the address family is IPv6, and the address is in a
3268                    certain range
3269
3270                  */
3271                 if (strchr(address_redux, '.') != NULL){
3272                         DEBUG(0, ("The IPv6 address '%s' has the misfortune of "
3273                                   "lying in a range that was once used for "
3274                                   "IPv4 embedding (that is, it might also be "
3275                                   "represented as '%s').\n", address,
3276                                   address_redux));
3277                 }
3278                 return -1;
3279         }
3280         return 0;
3281 }
3282
3283
3284
3285 /*
3286  * MS-ADTS v20150630 6.1.1.2.2.2.1 Subnet Object, refers to RFC1166 and
3287  * RFC2373. It specifies something seemingly indistinguishable from an RFC4632
3288  * CIDR address range without saying so explicitly. Here we follow the CIDR
3289  * spec.
3290  *
3291  * Return 0 on success, -1 on error.
3292  */
3293 static int verify_cidr(const char *cidr)
3294 {
3295         char *address = NULL, *slash = NULL, *endptr = NULL;
3296         bool has_colon, has_dot;
3297         int res, ret;
3298         unsigned long mask;
3299         uint8_t *address_bytes = NULL;
3300         char *address_redux = NULL;
3301         unsigned int address_len;
3302         TALLOC_CTX *frame = NULL;
3303
3304         DBG_DEBUG("CIDR is %s\n", cidr);
3305         frame = talloc_stackframe();
3306         address = talloc_strdup(frame, cidr);
3307         if (address == NULL){
3308                 goto error;
3309         }
3310
3311         /* there must be a '/' */
3312         slash = strchr(address, '/');
3313         if (slash == NULL){
3314                 goto error;
3315         }
3316         /* terminate the address for strchr, inet_pton */
3317         *slash = '\0';
3318
3319         mask = strtoul(slash + 1, &endptr, 10);
3320         if (mask == 0){
3321                 DBG_INFO("Windows does not like the zero mask, "
3322                          "so nor do we: %s\n", cidr);
3323                 goto error;
3324         }
3325
3326         if (*endptr != '\0' || endptr == slash + 1){
3327                 DBG_INFO("CIDR mask is not a proper integer: %s\n", cidr);
3328                 goto error;
3329         }
3330
3331         address_bytes = talloc_size(frame, sizeof(struct in6_addr));
3332         if (address_bytes == NULL){
3333                 goto error;
3334         }
3335
3336         address_redux = talloc_size(frame, INET6_ADDRSTRLEN);
3337         if (address_redux == NULL){
3338                 goto error;
3339         }
3340
3341         DBG_INFO("found address %s, mask %lu\n", address, mask);
3342         has_colon = (strchr(address, ':') == NULL) ? false : true;
3343         has_dot = (strchr(address, '.') == NULL) ? false : true;
3344         if (has_dot && has_colon){
3345                 /* This seems to be an IPv4 address embedded in IPv6, which is
3346                    icky. We don't support it. */
3347                 DBG_INFO("Refusing to consider cidr '%s' with dots and colons\n",
3348                           cidr);
3349                 goto error;
3350         } else if (has_colon){  /* looks like IPv6 */
3351                 res = inet_pton(AF_INET6, address, address_bytes);
3352                 if (res != 1) {
3353                         DBG_INFO("Address in %s fails to parse as IPv6\n", cidr);
3354                         goto error;
3355                 }
3356                 address_len = 128;
3357                 if (check_address_roundtrip(address, AF_INET6, address_bytes,
3358                                             address_redux, INET6_ADDRSTRLEN)){
3359                         goto error;
3360                 }
3361         } else if (has_dot) {
3362                 /* looks like IPv4 */
3363                 if (strcmp(address, "0.0.0.0") == 0){
3364                         DBG_INFO("Windows does not like the zero IPv4 address, "
3365                                  "so nor do we.\n");
3366                         goto error;
3367                 }
3368                 res = inet_pton(AF_INET, address, address_bytes);
3369                 if (res != 1) {
3370                         DBG_INFO("Address in %s fails to parse as IPv4\n", cidr);
3371                         goto error;
3372                 }
3373                 address_len = 32;
3374
3375                 if (check_address_roundtrip(address, AF_INET, address_bytes,
3376                                             address_redux, INET_ADDRSTRLEN)){
3377                         goto error;
3378                 }
3379         } else {
3380                 /* This doesn't look like an IP address at all. */
3381                 goto error;
3382         }
3383
3384         ret = check_cidr_zero_bits(address_bytes, address_len, mask);
3385         talloc_free(frame);
3386         return ret;
3387   error:
3388         talloc_free(frame);
3389         return -1;
3390 }
3391
3392
3393 static int samldb_verify_subnet(struct samldb_ctx *ac, struct ldb_dn *dn)
3394 {
3395         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
3396         const char *cidr = NULL;
3397         const struct ldb_val *rdn_value = NULL;
3398
3399         rdn_value = ldb_dn_get_rdn_val(dn);
3400         if (rdn_value == NULL) {
3401                 ldb_set_errstring(ldb, "samldb: ldb_dn_get_rdn_val "
3402                                   "failed");
3403                 return LDB_ERR_UNWILLING_TO_PERFORM;
3404         }
3405
3406         cidr = ldb_dn_escape_value(ac, *rdn_value);
3407         DBG_INFO("looking at cidr '%s'\n", cidr);
3408         if (cidr == NULL) {
3409                 ldb_set_errstring(ldb,
3410                                   "samldb: adding an empty subnet cidr seems wrong");
3411                 return LDB_ERR_UNWILLING_TO_PERFORM;
3412         }
3413
3414         if (verify_cidr(cidr)){
3415                 ldb_set_errstring(ldb,
3416                                   "samldb: subnet value is invalid");
3417                 return LDB_ERR_INVALID_DN_SYNTAX;
3418         }
3419
3420         return LDB_SUCCESS;
3421 }
3422
3423 static char *refer_if_rodc(struct ldb_context *ldb, struct ldb_request *req,
3424                            struct ldb_dn *dn)
3425 {
3426         bool rodc = false;
3427         struct loadparm_context *lp_ctx;
3428         char *referral;
3429         int ret;
3430         WERROR err;
3431
3432         if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID) ||
3433             ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
3434                 return NULL;
3435         }
3436
3437         ret = samdb_rodc(ldb, &rodc);
3438         if (ret != LDB_SUCCESS) {
3439                 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
3440                 return NULL;
3441         }
3442
3443         if (rodc) {
3444                 const char *domain = NULL;
3445                 struct ldb_dn *fsmo_role_dn;
3446                 struct ldb_dn *role_owner_dn;
3447                 ldb_set_errstring(ldb, "RODC modify is forbidden!");
3448                 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
3449                                          struct loadparm_context);
3450
3451                 err = dsdb_get_fsmo_role_info(req, ldb, DREPL_PDC_MASTER,
3452                                               &fsmo_role_dn, &role_owner_dn);
3453                 if (W_ERROR_IS_OK(err)) {
3454                         struct ldb_dn *server_dn = ldb_dn_copy(req, role_owner_dn);
3455                         if (server_dn != NULL) {
3456                                 ldb_dn_remove_child_components(server_dn, 1);
3457
3458                                 domain = samdb_dn_to_dnshostname(ldb, req,
3459                                                                  server_dn);
3460                         }
3461                 }
3462                 if (domain == NULL) {
3463                         domain = lpcfg_dnsdomain(lp_ctx);
3464                 }
3465                 referral = talloc_asprintf(req,
3466                                            "ldap://%s/%s",
3467                                            domain,
3468                                            ldb_dn_get_linearized(dn));
3469                 return referral;
3470         }
3471
3472         return NULL;
3473 }
3474
3475
3476 /* add */
3477 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
3478 {
3479         struct ldb_context *ldb;
3480         struct samldb_ctx *ac;
3481         struct ldb_message_element *el;
3482         int ret;
3483         char *referral = NULL;
3484
3485         ldb = ldb_module_get_ctx(module);
3486         ldb_debug(ldb, LDB_DEBUG_TRACE, "samldb_add\n");
3487
3488         /* do not manipulate our control entries */
3489         if (ldb_dn_is_special(req->op.add.message->dn)) {
3490                 return ldb_next_request(module, req);
3491         }
3492
3493         referral = refer_if_rodc(ldb, req, req->op.add.message->dn);
3494         if (referral != NULL) {
3495                 ret = ldb_module_send_referral(req, referral);
3496                 return ret;
3497         }
3498
3499         el = ldb_msg_find_element(req->op.add.message, "userParameters");
3500         if (el != NULL && ldb_req_is_untrusted(req)) {
3501                 const char *reason = "samldb_add: "
3502                         "setting userParameters is not supported over LDAP, "
3503                         "see https://bugzilla.samba.org/show_bug.cgi?id=8077";
3504                 ldb_debug(ldb, LDB_DEBUG_WARNING, "%s", reason);
3505                 return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, reason);
3506         }
3507
3508         ac = samldb_ctx_init(module, req);
3509         if (ac == NULL) {
3510                 return ldb_operr(ldb);
3511         }
3512
3513         /* build the new msg */
3514         ac->msg = ldb_msg_copy_shallow(ac, req->op.add.message);
3515         if (ac->msg == NULL) {
3516                 talloc_free(ac);
3517                 ldb_debug(ldb, LDB_DEBUG_FATAL,
3518                           "samldb_add: ldb_msg_copy_shallow failed!\n");
3519                 return ldb_operr(ldb);
3520         }
3521
3522         el = ldb_msg_find_element(ac->msg, "fSMORoleOwner");
3523         if (el != NULL) {
3524                 ret = samldb_fsmo_role_owner_check(ac);
3525                 if (ret != LDB_SUCCESS) {
3526                         return ret;
3527                 }
3528         }
3529
3530         if (samdb_find_attribute(ldb, ac->msg,
3531                                  "objectclass", "user") != NULL) {
3532                 ac->type = SAMLDB_TYPE_USER;
3533
3534                 ret = samldb_prim_group_trigger(ac);
3535                 if (ret != LDB_SUCCESS) {
3536                         return ret;
3537                 }
3538
3539                 ret = samldb_objectclass_trigger(ac);
3540                 if (ret != LDB_SUCCESS) {
3541                         return ret;
3542                 }
3543
3544                 return samldb_fill_object(ac);
3545         }
3546
3547         if (samdb_find_attribute(ldb, ac->msg,
3548                                  "objectclass", "group") != NULL) {
3549                 ac->type = SAMLDB_TYPE_GROUP;
3550
3551                 ret = samldb_objectclass_trigger(ac);
3552                 if (ret != LDB_SUCCESS) {
3553                         return ret;
3554                 }
3555
3556                 return samldb_fill_object(ac);
3557         }
3558
3559         /* perhaps a foreignSecurityPrincipal? */
3560         if (samdb_find_attribute(ldb, ac->msg,
3561                                  "objectclass",
3562                                  "foreignSecurityPrincipal") != NULL) {
3563                 return samldb_fill_foreignSecurityPrincipal_object(ac);
3564         }
3565
3566         if (samdb_find_attribute(ldb, ac->msg,
3567                                  "objectclass", "classSchema") != NULL) {
3568                 ac->type = SAMLDB_TYPE_CLASS;
3569
3570                 /* If in provision, these checks are too slow to do */
3571                 if (!ldb_request_get_control(req, DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID)) {
3572                         ret = samldb_schema_governsid_valid_check(ac);
3573                         if (ret != LDB_SUCCESS) {
3574                                 return ret;
3575                         }
3576                 }
3577
3578                 ret = samldb_schema_ldapdisplayname_valid_check(ac);
3579                 if (ret != LDB_SUCCESS) {
3580                         return ret;
3581                 }
3582
3583                 ret = samldb_schema_info_update(ac);
3584                 if (ret != LDB_SUCCESS) {
3585                         talloc_free(ac);
3586                         return ret;
3587                 }
3588
3589                 return samldb_fill_object(ac);
3590         }
3591
3592         if (samdb_find_attribute(ldb, ac->msg,
3593                                  "objectclass", "attributeSchema") != NULL) {
3594                 ac->type = SAMLDB_TYPE_ATTRIBUTE;
3595
3596                 /* If in provision, these checks are too slow to do */
3597                 if (!ldb_request_get_control(req, DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID)) {
3598                         ret = samldb_schema_attributeid_valid_check(ac);
3599                         if (ret != LDB_SUCCESS) {
3600                                 return ret;
3601                         }
3602
3603                         ret = samldb_schema_add_handle_linkid(ac);
3604                         if (ret != LDB_SUCCESS) {
3605                                 return ret;
3606                         }
3607
3608                         ret = samldb_schema_add_handle_mapiid(ac);
3609                         if (ret != LDB_SUCCESS) {
3610                                 return ret;
3611                         }
3612                 }
3613
3614                 ret = samldb_schema_ldapdisplayname_valid_check(ac);
3615                 if (ret != LDB_SUCCESS) {
3616                         return ret;
3617                 }
3618
3619                 ret = samldb_schema_info_update(ac);
3620                 if (ret != LDB_SUCCESS) {
3621                         talloc_free(ac);
3622                         return ret;
3623                 }
3624
3625                 return samldb_fill_object(ac);
3626         }
3627
3628         if (samdb_find_attribute(ldb, ac->msg,
3629                                  "objectclass", "subnet") != NULL) {
3630                 ret = samldb_verify_subnet(ac, ac->msg->dn);
3631                 if (ret != LDB_SUCCESS) {
3632                         talloc_free(ac);
3633                         return ret;
3634                 }
3635                 /* We are just checking the value is valid, and there are no
3636                    values to fill in. */
3637         }
3638
3639         talloc_free(ac);
3640
3641         /* nothing matched, go on */
3642         return ldb_next_request(module, req);
3643 }
3644
3645 /* modify */
3646 static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
3647 {
3648         struct ldb_context *ldb;
3649         struct samldb_ctx *ac;
3650         struct ldb_message_element *el, *el2;
3651         struct ldb_control *is_undelete;
3652         bool modified = false;
3653         int ret;
3654
3655         if (ldb_dn_is_special(req->op.mod.message->dn)) {
3656                 /* do not manipulate our control entries */
3657                 return ldb_next_request(module, req);
3658         }
3659
3660         ldb = ldb_module_get_ctx(module);
3661
3662         /*
3663          * we are going to need some special handling if in Undelete call.
3664          * Since tombstone_reanimate module will restore certain attributes,
3665          * we need to relax checks for: sAMAccountType, primaryGroupID
3666          */
3667         is_undelete = ldb_request_get_control(req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID);
3668
3669         /* make sure that "objectSid" is not specified */
3670         el = ldb_msg_find_element(req->op.mod.message, "objectSid");
3671         if (el != NULL) {
3672                 if (ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID) == NULL) {
3673                         ldb_set_errstring(ldb,
3674                                           "samldb: objectSid must not be specified!");
3675                         return LDB_ERR_UNWILLING_TO_PERFORM;
3676                 }
3677         }
3678         if (is_undelete == NULL) {
3679                 /* make sure that "sAMAccountType" is not specified */
3680                 el = ldb_msg_find_element(req->op.mod.message, "sAMAccountType");
3681                 if (el != NULL) {
3682                         ldb_set_errstring(ldb,
3683                                           "samldb: sAMAccountType must not be specified!");
3684                         return LDB_ERR_UNWILLING_TO_PERFORM;
3685                 }
3686         }
3687         /* make sure that "isCriticalSystemObject" is not specified */
3688         el = ldb_msg_find_element(req->op.mod.message, "isCriticalSystemObject");
3689         if (el != NULL) {
3690                 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) == NULL) {
3691                         ldb_set_errstring(ldb,
3692                                           "samldb: isCriticalSystemObject must not be specified!");
3693                         return LDB_ERR_UNWILLING_TO_PERFORM;
3694                 }
3695         }
3696
3697         /* msDS-IntId is not allowed to be modified
3698          * except when modification comes from replication */
3699         if (ldb_msg_find_element(req->op.mod.message, "msDS-IntId")) {
3700                 if (!ldb_request_get_control(req,
3701                                              DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
3702                         return LDB_ERR_CONSTRAINT_VIOLATION;
3703                 }
3704         }
3705
3706         el = ldb_msg_find_element(req->op.mod.message, "userParameters");
3707         if (el != NULL && ldb_req_is_untrusted(req)) {
3708                 const char *reason = "samldb: "
3709                         "setting userParameters is not supported over LDAP, "
3710                         "see https://bugzilla.samba.org/show_bug.cgi?id=8077";
3711                 ldb_debug(ldb, LDB_DEBUG_WARNING, "%s", reason);
3712                 return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, reason);
3713         }
3714
3715         ac = samldb_ctx_init(module, req);
3716         if (ac == NULL) {
3717                 return ldb_operr(ldb);
3718         }
3719
3720         /* build the new msg */
3721         ac->msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
3722         if (ac->msg == NULL) {
3723                 talloc_free(ac);
3724                 ldb_debug(ldb, LDB_DEBUG_FATAL,
3725                           "samldb_modify: ldb_msg_copy_shallow failed!\n");
3726                 return ldb_operr(ldb);
3727         }
3728
3729         if (is_undelete == NULL) {
3730                 el = ldb_msg_find_element(ac->msg, "primaryGroupID");
3731                 if (el != NULL) {
3732                         ret = samldb_prim_group_trigger(ac);
3733                         if (ret != LDB_SUCCESS) {
3734                                 return ret;
3735                         }
3736                 }
3737         }
3738
3739         el = ldb_msg_find_element(ac->msg, "userAccountControl");
3740         if (el != NULL) {
3741                 modified = true;
3742                 ret = samldb_user_account_control_change(ac);
3743                 if (ret != LDB_SUCCESS) {
3744                         return ret;
3745                 }
3746         }
3747
3748         el = ldb_msg_find_element(ac->msg, "pwdLastSet");
3749         if (el != NULL) {
3750                 modified = true;
3751                 ret = samldb_pwd_last_set_change(ac);
3752                 if (ret != LDB_SUCCESS) {
3753                         return ret;
3754                 }
3755         }
3756
3757         el = ldb_msg_find_element(ac->msg, "lockoutTime");
3758         if (el != NULL) {
3759                 modified = true;
3760                 ret = samldb_lockout_time(ac);
3761                 if (ret != LDB_SUCCESS) {
3762                         return ret;
3763                 }
3764         }
3765
3766         el = ldb_msg_find_element(ac->msg, "groupType");
3767         if (el != NULL) {
3768                 modified = true;
3769                 ret = samldb_group_type_change(ac);
3770                 if (ret != LDB_SUCCESS) {
3771                         return ret;
3772                 }
3773         }
3774
3775         el = ldb_msg_find_element(ac->msg, "sAMAccountName");
3776         if (el != NULL) {
3777                 ret = samldb_sam_accountname_valid_check(ac);
3778                 /*
3779                  * Other errors are checked for elsewhere, we just
3780                  * want to prevent duplicates
3781                  */
3782                 if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
3783                         return ret;
3784                 }
3785         }
3786
3787         el = ldb_msg_find_element(ac->msg, "ldapDisplayName");
3788         if (el != NULL) {
3789                 ret = samldb_schema_ldapdisplayname_valid_check(ac);
3790                 if (ret != LDB_SUCCESS) {
3791                         return ret;
3792                 }
3793         }
3794
3795         el = ldb_msg_find_element(ac->msg, "attributeID");
3796         if (el != NULL) {
3797                 ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
3798                                        "Once set, attributeID values may not be modified");
3799                 return LDB_ERR_CONSTRAINT_VIOLATION;
3800         }
3801
3802         el = ldb_msg_find_element(ac->msg, "governsID");
3803         if (el != NULL) {
3804                 ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
3805                                        "Once set, governsID values may not be modified");
3806                 return LDB_ERR_CONSTRAINT_VIOLATION;
3807         }
3808
3809         el = ldb_msg_find_element(ac->msg, "member");
3810         if (el != NULL) {
3811                 ret = samldb_member_check(ac);
3812                 if (ret != LDB_SUCCESS) {
3813                         return ret;
3814                 }
3815         }
3816
3817         el = ldb_msg_find_element(ac->msg, "description");
3818         if (el != NULL) {
3819                 ret = samldb_description_check(ac, &modified);
3820                 if (ret != LDB_SUCCESS) {
3821                         return ret;
3822                 }
3823         }
3824
3825         el = ldb_msg_find_element(ac->msg, "dNSHostName");
3826         el2 = ldb_msg_find_element(ac->msg, "sAMAccountName");
3827         if ((el != NULL) || (el2 != NULL)) {
3828                 modified = true;
3829                 ret = samldb_service_principal_names_change(ac);
3830                 if (ret != LDB_SUCCESS) {
3831                         return ret;
3832                 }
3833         }
3834
3835         el = ldb_msg_find_element(ac->msg, "fSMORoleOwner");
3836         if (el != NULL) {
3837                 ret = samldb_fsmo_role_owner_check(ac);
3838                 if (ret != LDB_SUCCESS) {
3839                         return ret;
3840                 }
3841         }
3842
3843         if (modified) {
3844                 struct ldb_request *child_req;
3845
3846                 /* Now perform the real modifications as a child request */
3847                 ret = ldb_build_mod_req(&child_req, ldb, ac,
3848                                         ac->msg,
3849                                         req->controls,
3850                                         req, dsdb_next_callback,
3851                                         req);
3852                 LDB_REQ_SET_LOCATION(child_req);
3853                 if (ret != LDB_SUCCESS) {
3854                         return ret;
3855                 }
3856
3857                 return ldb_next_request(module, child_req);
3858         }
3859
3860         talloc_free(ac);
3861
3862         /* no change which interests us, go on */
3863         return ldb_next_request(module, req);
3864 }
3865
3866 /* delete */
3867
3868 static int samldb_prim_group_users_check(struct samldb_ctx *ac)
3869 {
3870         struct ldb_context *ldb;
3871         struct dom_sid *sid;
3872         uint32_t rid;
3873         NTSTATUS status;
3874         int ret;
3875         struct ldb_result *res = NULL;
3876         struct ldb_result *res_users = NULL;
3877         const char * const attrs[] = { "objectSid", "isDeleted", NULL };
3878         const char * const noattrs[] = { NULL };
3879
3880         ldb = ldb_module_get_ctx(ac->module);
3881
3882         /* Finds out the SID/RID of the SAM object */
3883         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->req->op.del.dn,
3884                                         attrs,
3885                                         DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
3886                                         ac->req);
3887         if (ret != LDB_SUCCESS) {
3888                 return ret;
3889         }
3890
3891         if (ldb_msg_check_string_attribute(res->msgs[0], "isDeleted", "TRUE")) {
3892                 return LDB_SUCCESS;
3893         }
3894
3895         sid = samdb_result_dom_sid(ac, res->msgs[0], "objectSid");
3896         if (sid == NULL) {
3897                 /* No SID - it might not be a SAM object - therefore ok */
3898                 return LDB_SUCCESS;
3899         }
3900         status = dom_sid_split_rid(ac, sid, NULL, &rid);
3901         if (!NT_STATUS_IS_OK(status)) {
3902                 return ldb_operr(ldb);
3903         }
3904         if (rid == 0) {
3905                 /* Special object (security principal?) */
3906                 return LDB_SUCCESS;
3907         }
3908         /* do not allow deletion of well-known sids */
3909         if (rid < DSDB_SAMDB_MINIMUM_ALLOWED_RID &&
3910             (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) == NULL)) {
3911                 return LDB_ERR_OTHER;
3912         }
3913
3914         /* Deny delete requests from groups which are primary ones */
3915         ret = dsdb_module_search(ac->module, ac, &res_users,
3916                                  ldb_get_default_basedn(ldb),
3917                                  LDB_SCOPE_SUBTREE, noattrs,
3918                                  DSDB_FLAG_NEXT_MODULE,
3919                                  ac->req,
3920                                  "(&(primaryGroupID=%u)(objectClass=user))", rid);
3921         if (ret != LDB_SUCCESS) {
3922                 return ret;
3923         }
3924         if (res_users->count > 0) {
3925                 ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
3926                                        "Refusing to delete %s, as it "
3927                                        "is still the primaryGroupID "
3928                                        "for %u users",
3929                                        ldb_dn_get_linearized(res->msgs[0]->dn),
3930                                        res_users->count);
3931
3932                 /*
3933                  * Yes, this seems very wrong, but we have a test
3934                  * for this exact error code in sam.py
3935                  */
3936                 return LDB_ERR_ENTRY_ALREADY_EXISTS;
3937         }
3938
3939         return LDB_SUCCESS;
3940 }
3941
3942 static int samldb_delete(struct ldb_module *module, struct ldb_request *req)
3943 {
3944         struct samldb_ctx *ac;
3945         char *referral = NULL;
3946         int ret;
3947         struct ldb_context *ldb;
3948
3949         if (ldb_dn_is_special(req->op.del.dn)) {
3950                 /* do not manipulate our control entries */
3951                 return ldb_next_request(module, req);
3952         }
3953
3954         ldb = ldb_module_get_ctx(module);
3955
3956         referral = refer_if_rodc(ldb, req, req->op.del.dn);
3957         if (referral != NULL) {
3958                 ret = ldb_module_send_referral(req, referral);
3959                 return ret;
3960         }
3961
3962         ac = samldb_ctx_init(module, req);
3963         if (ac == NULL) {
3964                 return ldb_operr(ldb_module_get_ctx(module));
3965         }
3966
3967         ret = samldb_prim_group_users_check(ac);
3968         if (ret != LDB_SUCCESS) {
3969                 return ret;
3970         }
3971
3972         talloc_free(ac);
3973
3974         return ldb_next_request(module, req);
3975 }
3976
3977 /* rename */
3978
3979 static int check_rename_constraints(struct ldb_message *msg,
3980                                     struct samldb_ctx *ac,
3981                                     struct ldb_dn *olddn, struct ldb_dn *newdn)
3982 {
3983         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
3984         struct ldb_dn *dn1, *dn2, *nc_root;
3985         int32_t systemFlags;
3986         bool move_op = false;
3987         bool rename_op = false;
3988         int ret;
3989
3990         /* Skip the checks if old and new DN are the same, or if we have the
3991          * relax control specified or if the returned objects is already
3992          * deleted and needs only to be moved for consistency. */
3993
3994         if (ldb_dn_compare(olddn, newdn) == 0) {
3995                 return LDB_SUCCESS;
3996         }
3997         if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
3998                 return LDB_SUCCESS;
3999         }
4000
4001         if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
4002                 /*
4003                  * check originating request if we are supposed
4004                  * to "see" this record in first place.
4005                  */
4006                 if (ldb_request_get_control(ac->req, LDB_CONTROL_SHOW_DELETED_OID) == NULL) {
4007                         return LDB_ERR_NO_SUCH_OBJECT;
4008                 }
4009                 return LDB_ERR_UNWILLING_TO_PERFORM;
4010         }
4011
4012         /* Objects under CN=System */
4013
4014         dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
4015         if (dn1 == NULL) return ldb_oom(ldb);
4016
4017         if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
4018                 talloc_free(dn1);
4019                 return LDB_ERR_OPERATIONS_ERROR;
4020         }
4021
4022         if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
4023             (ldb_dn_compare_base(dn1, newdn) != 0)) {
4024                 talloc_free(dn1);
4025                 ldb_asprintf_errstring(ldb,
4026                                        "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
4027                                        ldb_dn_get_linearized(olddn));
4028                 return LDB_ERR_OTHER;
4029         }
4030
4031         talloc_free(dn1);
4032
4033         /* LSA objects */
4034
4035         if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
4036             (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
4037                 ldb_asprintf_errstring(ldb,
4038                                        "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
4039                                        ldb_dn_get_linearized(olddn));
4040                 return LDB_ERR_UNWILLING_TO_PERFORM;
4041         }
4042
4043         /* subnet objects */
4044         if (samdb_find_attribute(ldb, msg, "objectclass", "subnet") != NULL) {
4045                 ret = samldb_verify_subnet(ac, newdn);
4046                 if (ret != LDB_SUCCESS) {
4047                         talloc_free(ac);
4048                         return ret;
4049                 }
4050         }
4051
4052         /* systemFlags */
4053
4054         dn1 = ldb_dn_get_parent(ac, olddn);
4055         if (dn1 == NULL) return ldb_oom(ldb);
4056         dn2 = ldb_dn_get_parent(ac, newdn);
4057         if (dn2 == NULL) return ldb_oom(ldb);
4058
4059         if (ldb_dn_compare(dn1, dn2) == 0) {
4060                 rename_op = true;
4061         } else {
4062                 move_op = true;
4063         }
4064
4065         talloc_free(dn1);
4066         talloc_free(dn2);
4067
4068         systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
4069
4070         /* Fetch name context */
4071
4072         ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
4073         if (ret != LDB_SUCCESS) {
4074                 return ret;
4075         }
4076
4077         if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
4078                 if (move_op) {
4079                         ldb_asprintf_errstring(ldb,
4080                                                "subtree_rename: Cannot move %s within schema partition",
4081                                                ldb_dn_get_linearized(olddn));
4082                         return LDB_ERR_UNWILLING_TO_PERFORM;
4083                 }
4084                 if (rename_op &&
4085                     (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
4086                         ldb_asprintf_errstring(ldb,
4087                                                "subtree_rename: Cannot rename %s within schema partition",
4088                                                ldb_dn_get_linearized(olddn));
4089                         return LDB_ERR_UNWILLING_TO_PERFORM;
4090                 }
4091         } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
4092                 if (move_op &&
4093                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
4094                         /* Here we have to do more: control the
4095                          * "ALLOW_LIMITED_MOVE" flag. This means that the
4096                          * grand-grand-parents of two objects have to be equal
4097                          * in order to perform the move (this is used for
4098                          * moving "server" objects in the "sites" container). */
4099                         bool limited_move =
4100                                 systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
4101
4102                         if (limited_move) {
4103                                 dn1 = ldb_dn_copy(ac, olddn);
4104                                 if (dn1 == NULL) return ldb_oom(ldb);
4105                                 dn2 = ldb_dn_copy(ac, newdn);
4106                                 if (dn2 == NULL) return ldb_oom(ldb);
4107
4108                                 limited_move &= ldb_dn_remove_child_components(dn1, 3);
4109                                 limited_move &= ldb_dn_remove_child_components(dn2, 3);
4110                                 limited_move &= ldb_dn_compare(dn1, dn2) == 0;
4111
4112                                 talloc_free(dn1);
4113                                 talloc_free(dn2);
4114                         }
4115
4116                         if (!limited_move
4117                             && ldb_request_get_control(ac->req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID) == NULL) {
4118                                 ldb_asprintf_errstring(ldb,
4119                                                        "subtree_rename: Cannot move %s to %s in config partition",
4120                                                        ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
4121                                 return LDB_ERR_UNWILLING_TO_PERFORM;
4122                         }
4123                 }
4124                 if (rename_op &&
4125                     (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
4126                         ldb_asprintf_errstring(ldb,
4127                                                "subtree_rename: Cannot rename %s to %s within config partition",
4128                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
4129                         return LDB_ERR_UNWILLING_TO_PERFORM;
4130                 }
4131         } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
4132                 if (move_op &&
4133                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
4134                         ldb_asprintf_errstring(ldb,
4135                                                "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
4136                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
4137                         return LDB_ERR_UNWILLING_TO_PERFORM;
4138                 }
4139                 if (rename_op &&
4140                     (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
4141                         ldb_asprintf_errstring(ldb,
4142                                                        "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
4143                                                ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
4144                         return LDB_ERR_UNWILLING_TO_PERFORM;
4145                 }
4146         }
4147
4148         talloc_free(nc_root);
4149
4150         return LDB_SUCCESS;
4151 }
4152
4153
4154 static int samldb_rename_search_base_callback(struct ldb_request *req,
4155                                                struct ldb_reply *ares)
4156 {
4157         struct samldb_ctx *ac;
4158         int ret;
4159
4160         ac = talloc_get_type(req->context, struct samldb_ctx);
4161
4162         if (!ares) {
4163                 return ldb_module_done(ac->req, NULL, NULL,
4164                                         LDB_ERR_OPERATIONS_ERROR);
4165         }
4166         if (ares->error != LDB_SUCCESS) {
4167                 return ldb_module_done(ac->req, ares->controls,
4168                                         ares->response, ares->error);
4169         }
4170
4171         switch (ares->type) {
4172         case LDB_REPLY_ENTRY:
4173                 /*
4174                  * This is the root entry of the originating move
4175                  * respectively rename request. It has been already
4176                  * stored in the list using "subtree_rename_search()".
4177                  * Only this one is subject to constraint checking.
4178                  */
4179                 ret = check_rename_constraints(ares->message, ac,
4180                                                ac->req->op.rename.olddn,
4181                                                ac->req->op.rename.newdn);
4182                 if (ret != LDB_SUCCESS) {
4183                         return ldb_module_done(ac->req, NULL, NULL,
4184                                                ret);
4185                 }
4186                 break;
4187
4188         case LDB_REPLY_REFERRAL:
4189                 /* ignore */
4190                 break;
4191
4192         case LDB_REPLY_DONE:
4193
4194                 /*
4195                  * Great, no problem with the rename, so go ahead as
4196                  * if we never were here
4197                  */
4198                 ret = ldb_next_request(ac->module, ac->req);
4199                 talloc_free(ares);
4200                 return ret;
4201         }
4202
4203         talloc_free(ares);
4204         return LDB_SUCCESS;
4205 }
4206
4207
4208 /* rename */
4209 static int samldb_rename(struct ldb_module *module, struct ldb_request *req)
4210 {
4211         struct ldb_context *ldb;
4212         static const char * const attrs[] = { "objectClass", "systemFlags",
4213                                               "isDeleted", NULL };
4214         struct ldb_request *search_req;
4215         struct samldb_ctx *ac;
4216         int ret;
4217
4218         if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
4219                 return ldb_next_request(module, req);
4220         }
4221
4222         ldb = ldb_module_get_ctx(module);
4223
4224         ac = samldb_ctx_init(module, req);
4225         if (!ac) {
4226                 return ldb_oom(ldb);
4227         }
4228
4229         ret = ldb_build_search_req(&search_req, ldb, ac,
4230                                    req->op.rename.olddn,
4231                                    LDB_SCOPE_BASE,
4232                                    "(objectClass=*)",
4233                                    attrs,
4234                                    NULL,
4235                                    ac,
4236                                    samldb_rename_search_base_callback,
4237                                    req);
4238         LDB_REQ_SET_LOCATION(search_req);
4239         if (ret != LDB_SUCCESS) {
4240                 return ret;
4241         }
4242
4243         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
4244                                       true, NULL);
4245         if (ret != LDB_SUCCESS) {
4246                 return ret;
4247         }
4248
4249         return ldb_next_request(ac->module, search_req);
4250 }
4251
4252 /* extended */
4253
4254 static int samldb_extended_allocate_rid_pool(struct ldb_module *module, struct ldb_request *req)
4255 {
4256         struct ldb_context *ldb = ldb_module_get_ctx(module);
4257         struct dsdb_fsmo_extended_op *exop;
4258         int ret;
4259
4260         exop = talloc_get_type(req->op.extended.data,
4261                                struct dsdb_fsmo_extended_op);
4262         if (!exop) {
4263                 ldb_set_errstring(ldb,
4264                                   "samldb_extended_allocate_rid_pool: invalid extended data");
4265                 return LDB_ERR_PROTOCOL_ERROR;
4266         }
4267
4268         ret = ridalloc_allocate_rid_pool_fsmo(module, exop, req);
4269         if (ret != LDB_SUCCESS) {
4270                 return ret;
4271         }
4272
4273         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
4274 }
4275
4276 static int samldb_extended_allocate_rid(struct ldb_module *module, struct ldb_request *req)
4277 {
4278         struct ldb_context *ldb = ldb_module_get_ctx(module);
4279         struct dsdb_extended_allocate_rid *exop;
4280         int ret;
4281
4282         exop = talloc_get_type(req->op.extended.data,
4283                                struct dsdb_extended_allocate_rid);
4284         if (!exop) {
4285                 ldb_set_errstring(ldb,
4286                                   "samldb_extended_allocate_rid: invalid extended data");
4287                 return LDB_ERR_PROTOCOL_ERROR;
4288         }
4289
4290         ret = ridalloc_allocate_rid(module, &exop->rid, req);
4291         if (ret != LDB_SUCCESS) {
4292                 return ret;
4293         }
4294
4295         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
4296 }
4297
4298 static int samldb_extended_create_own_rid_set(struct ldb_module *module, struct ldb_request *req)
4299 {
4300         struct ldb_context *ldb = ldb_module_get_ctx(module);
4301         int ret;
4302         struct ldb_dn *dn;
4303
4304         if (req->op.extended.data != NULL) {
4305                 ldb_set_errstring(ldb,
4306                                   "samldb_extended_allocate_rid_pool_for_us: invalid extended data (should be NULL)");
4307                 return LDB_ERR_PROTOCOL_ERROR;
4308         }
4309
4310         ret = ridalloc_create_own_rid_set(module, req,
4311                                           &dn, req);
4312         if (ret != LDB_SUCCESS) {
4313                 return ret;
4314         }
4315
4316         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
4317 }
4318
4319 static int samldb_extended(struct ldb_module *module, struct ldb_request *req)
4320 {
4321         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_ALLOCATE_RID_POOL) == 0) {
4322                 return samldb_extended_allocate_rid_pool(module, req);
4323         }
4324
4325         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_ALLOCATE_RID) == 0) {
4326                 return samldb_extended_allocate_rid(module, req);
4327         }
4328
4329         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_CREATE_OWN_RID_SET) == 0) {
4330                 return samldb_extended_create_own_rid_set(module, req);
4331         }
4332
4333         return ldb_next_request(module, req);
4334 }
4335
4336
4337 static const struct ldb_module_ops ldb_samldb_module_ops = {
4338         .name          = "samldb",
4339         .add           = samldb_add,
4340         .modify        = samldb_modify,
4341         .del           = samldb_delete,
4342         .rename        = samldb_rename,
4343         .extended      = samldb_extended
4344 };
4345
4346
4347 int ldb_samldb_module_init(const char *version)
4348 {
4349         LDB_MODULE_CHECK_VERSION(version);
4350         return ldb_register_module(&ldb_samldb_module_ops);
4351 }