util:datablob: data_blob_pad checks its alignment assumption
[samba4-gss.git] / source4 / dsdb / common / util.c
blob757133eb277a211b22dd59701df1554d851d06e4
1 /*
2 Unix SMB/CIFS implementation.
3 Samba utility functions
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
8 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "includes.h"
25 #include "ldb.h"
26 #include "ldb_module.h"
27 #include "ldb_errors.h"
28 #include "../lib/util/util_ldb.h"
29 #include "lib/crypto/gmsa.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "librpc/gen_ndr/ndr_security.h"
32 #include "librpc/gen_ndr/ndr_misc.h"
33 #include "../libds/common/flags.h"
34 #include "dsdb/common/proto.h"
35 #include "libcli/ldap/ldap_ndr.h"
36 #include "param/param.h"
37 #include "librpc/gen_ndr/ndr_drsblobs.h"
38 #include "dsdb/common/util.h"
39 #include "dsdb/gmsa/gkdi.h"
40 #include "dsdb/gmsa/util.h"
41 #include "lib/socket/socket.h"
42 #include "librpc/gen_ndr/irpc.h"
43 #include "libds/common/flag_mapping.h"
44 #include "lib/util/access.h"
45 #include "lib/util/data_blob.h"
46 #include "lib/util/debug.h"
47 #include "lib/util/fault.h"
48 #include "lib/util/sys_rw_data.h"
49 #include "libcli/util/ntstatus.h"
50 #include "lib/util/smb_strtox.h"
51 #include "auth/auth.h"
53 #undef strncasecmp
54 #undef strcasecmp
57 * This is included to allow us to handle DSDB_FLAG_REPLICATED_UPDATE in
58 * dsdb_request_add_controls()
60 #include "dsdb/samdb/ldb_modules/util.h"
62 /* default is 30 minutes: -1e7 * 30 * 60 */
63 #define DEFAULT_OBSERVATION_WINDOW (-18000000000)
66 search the sam for the specified attributes in a specific domain, filter on
67 objectSid being in domain_sid.
69 int samdb_search_domain(struct ldb_context *sam_ldb,
70 TALLOC_CTX *mem_ctx,
71 struct ldb_dn *basedn,
72 struct ldb_message ***res,
73 const char * const *attrs,
74 const struct dom_sid *domain_sid,
75 const char *format, ...) _PRINTF_ATTRIBUTE(7,8)
77 va_list ap;
78 int i, count;
80 va_start(ap, format);
81 count = gendb_search_v(sam_ldb, mem_ctx, basedn,
82 res, attrs, format, ap);
83 va_end(ap);
85 i=0;
87 while (i<count) {
88 struct dom_sid *entry_sid;
90 entry_sid = samdb_result_dom_sid(mem_ctx, (*res)[i], "objectSid");
92 if ((entry_sid == NULL) ||
93 (!dom_sid_in_domain(domain_sid, entry_sid))) {
94 /* Delete that entry from the result set */
95 (*res)[i] = (*res)[count-1];
96 count -= 1;
97 talloc_free(entry_sid);
98 continue;
100 talloc_free(entry_sid);
101 i += 1;
104 return count;
108 search the sam for a single string attribute in exactly 1 record
110 const char *samdb_search_string_v(struct ldb_context *sam_ldb,
111 TALLOC_CTX *mem_ctx,
112 struct ldb_dn *basedn,
113 const char *attr_name,
114 const char *format, va_list ap) _PRINTF_ATTRIBUTE(5,0)
116 int count;
117 const char *attrs[2] = { NULL, NULL };
118 struct ldb_message **res = NULL;
120 attrs[0] = attr_name;
122 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
123 if (count > 1) {
124 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
125 attr_name, format, count));
127 if (count != 1) {
128 talloc_free(res);
129 return NULL;
132 return ldb_msg_find_attr_as_string(res[0], attr_name, NULL);
136 search the sam for a single string attribute in exactly 1 record
138 const char *samdb_search_string(struct ldb_context *sam_ldb,
139 TALLOC_CTX *mem_ctx,
140 struct ldb_dn *basedn,
141 const char *attr_name,
142 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
144 va_list ap;
145 const char *str;
147 va_start(ap, format);
148 str = samdb_search_string_v(sam_ldb, mem_ctx, basedn, attr_name, format, ap);
149 va_end(ap);
151 return str;
154 struct ldb_dn *samdb_search_dn(struct ldb_context *sam_ldb,
155 TALLOC_CTX *mem_ctx,
156 struct ldb_dn *basedn,
157 const char *format, ...) _PRINTF_ATTRIBUTE(4,5)
159 va_list ap;
160 struct ldb_dn *ret;
161 struct ldb_message **res = NULL;
162 int count;
164 va_start(ap, format);
165 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, NULL, format, ap);
166 va_end(ap);
168 if (count != 1) return NULL;
170 ret = talloc_steal(mem_ctx, res[0]->dn);
171 talloc_free(res);
173 return ret;
177 search the sam for a dom_sid attribute in exactly 1 record
179 struct dom_sid *samdb_search_dom_sid(struct ldb_context *sam_ldb,
180 TALLOC_CTX *mem_ctx,
181 struct ldb_dn *basedn,
182 const char *attr_name,
183 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
185 va_list ap;
186 int count;
187 struct ldb_message **res;
188 const char *attrs[2] = { NULL, NULL };
189 struct dom_sid *sid;
191 attrs[0] = attr_name;
193 va_start(ap, format);
194 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
195 va_end(ap);
196 if (count > 1) {
197 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
198 attr_name, format, count));
200 if (count != 1) {
201 talloc_free(res);
202 return NULL;
204 sid = samdb_result_dom_sid(mem_ctx, res[0], attr_name);
205 talloc_free(res);
206 return sid;
210 search the sam for a single integer attribute in exactly 1 record
212 unsigned int samdb_search_uint(struct ldb_context *sam_ldb,
213 TALLOC_CTX *mem_ctx,
214 unsigned int default_value,
215 struct ldb_dn *basedn,
216 const char *attr_name,
217 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
219 va_list ap;
220 int count;
221 struct ldb_message **res;
222 const char *attrs[2] = { NULL, NULL };
224 attrs[0] = attr_name;
226 va_start(ap, format);
227 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
228 va_end(ap);
230 if (count != 1) {
231 return default_value;
234 return ldb_msg_find_attr_as_uint(res[0], attr_name, default_value);
238 search the sam for a single signed 64 bit integer attribute in exactly 1 record
240 int64_t samdb_search_int64(struct ldb_context *sam_ldb,
241 TALLOC_CTX *mem_ctx,
242 int64_t default_value,
243 struct ldb_dn *basedn,
244 const char *attr_name,
245 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
247 va_list ap;
248 int count;
249 struct ldb_message **res;
250 const char *attrs[2] = { NULL, NULL };
252 attrs[0] = attr_name;
254 va_start(ap, format);
255 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
256 va_end(ap);
258 if (count != 1) {
259 return default_value;
262 return ldb_msg_find_attr_as_int64(res[0], attr_name, default_value);
266 search the sam for multiple records each giving a single string attribute
267 return the number of matches, or -1 on error
269 int samdb_search_string_multiple(struct ldb_context *sam_ldb,
270 TALLOC_CTX *mem_ctx,
271 struct ldb_dn *basedn,
272 const char ***strs,
273 const char *attr_name,
274 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
276 va_list ap;
277 int count, i;
278 const char *attrs[2] = { NULL, NULL };
279 struct ldb_message **res = NULL;
281 attrs[0] = attr_name;
283 va_start(ap, format);
284 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
285 va_end(ap);
287 if (count <= 0) {
288 return count;
291 /* make sure its single valued */
292 for (i=0;i<count;i++) {
293 if (res[i]->num_elements != 1) {
294 DEBUG(1,("samdb: search for %s %s not single valued\n",
295 attr_name, format));
296 talloc_free(res);
297 return -1;
301 *strs = talloc_array(mem_ctx, const char *, count+1);
302 if (! *strs) {
303 talloc_free(res);
304 return -1;
307 for (i=0;i<count;i++) {
308 (*strs)[i] = ldb_msg_find_attr_as_string(res[i], attr_name, NULL);
310 (*strs)[count] = NULL;
312 return count;
315 struct ldb_dn *samdb_result_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
316 const char *attr, struct ldb_dn *default_value)
318 struct ldb_dn *ret_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
319 if (!ret_dn) {
320 return default_value;
322 return ret_dn;
326 pull a rid from a objectSid in a result set.
328 uint32_t samdb_result_rid_from_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
329 const char *attr, uint32_t default_value)
331 struct dom_sid *sid;
332 uint32_t rid;
334 sid = samdb_result_dom_sid(mem_ctx, msg, attr);
335 if (sid == NULL) {
336 return default_value;
338 rid = sid->sub_auths[sid->num_auths-1];
339 talloc_free(sid);
340 return rid;
344 pull a dom_sid structure from a objectSid in a result set.
346 struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
347 const char *attr)
349 ssize_t ret;
350 const struct ldb_val *v;
351 struct dom_sid *sid;
352 v = ldb_msg_find_ldb_val(msg, attr);
353 if (v == NULL) {
354 return NULL;
356 sid = talloc(mem_ctx, struct dom_sid);
357 if (sid == NULL) {
358 return NULL;
360 ret = sid_parse(v->data, v->length, sid);
361 if (ret == -1) {
362 talloc_free(sid);
363 return NULL;
365 return sid;
370 * Makes an auth_SidAttr structure from a objectSid in a result set and a
371 * supplied attribute value.
373 * @param [in] mem_ctx Talloc memory context on which to allocate the auth_SidAttr.
374 * @param [in] msg The message from which to take the objectSid.
375 * @param [in] attr The attribute name, usually "objectSid".
376 * @param [in] attrs SE_GROUP_* flags to go with the SID.
377 * @returns A pointer to the auth_SidAttr structure, or NULL on failure.
379 struct auth_SidAttr *samdb_result_dom_sid_attrs(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
380 const char *attr, uint32_t attrs)
382 ssize_t ret;
383 const struct ldb_val *v;
384 struct auth_SidAttr *sid;
385 v = ldb_msg_find_ldb_val(msg, attr);
386 if (v == NULL) {
387 return NULL;
389 sid = talloc(mem_ctx, struct auth_SidAttr);
390 if (sid == NULL) {
391 return NULL;
393 ret = sid_parse(v->data, v->length, &sid->sid);
394 if (ret == -1) {
395 talloc_free(sid);
396 return NULL;
398 sid->attrs = attrs;
399 return sid;
403 pull a dom_sid structure from a objectSid in a result set.
405 int samdb_result_dom_sid_buf(const struct ldb_message *msg,
406 const char *attr,
407 struct dom_sid *sid)
409 ssize_t ret;
410 const struct ldb_val *v = NULL;
411 v = ldb_msg_find_ldb_val(msg, attr);
412 if (v == NULL) {
413 return LDB_ERR_NO_SUCH_ATTRIBUTE;
415 ret = sid_parse(v->data, v->length, sid);
416 if (ret == -1) {
417 return LDB_ERR_OPERATIONS_ERROR;
419 return LDB_SUCCESS;
423 pull a guid structure from a objectGUID in a result set.
425 struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
427 const struct ldb_val *v;
428 struct GUID guid;
429 NTSTATUS status;
431 v = ldb_msg_find_ldb_val(msg, attr);
432 if (!v) return GUID_zero();
434 status = GUID_from_ndr_blob(v, &guid);
435 if (!NT_STATUS_IS_OK(status)) {
436 return GUID_zero();
439 return guid;
443 pull a sid prefix from a objectSid in a result set.
444 this is used to find the domain sid for a user
446 struct dom_sid *samdb_result_sid_prefix(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
447 const char *attr)
449 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg, attr);
450 if (!sid || sid->num_auths < 1) return NULL;
451 sid->num_auths--;
452 return sid;
456 pull a NTTIME in a result set.
458 NTTIME samdb_result_nttime(const struct ldb_message *msg, const char *attr,
459 NTTIME default_value)
461 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
465 * Windows stores 0 for lastLogoff.
466 * But when a MS DC return the lastLogoff (as Logoff Time)
467 * it returns INT64_MAX, not returning this value in this case
468 * cause windows 2008 and newer version to fail for SMB requests
470 NTTIME samdb_result_last_logoff(const struct ldb_message *msg)
472 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "lastLogoff",0);
474 if (ret == 0)
475 ret = INT64_MAX;
477 return ret;
481 * Windows uses both 0 and 9223372036854775807 (INT64_MAX) to
482 * indicate an account doesn't expire.
484 * When Windows initially creates an account, it sets
485 * accountExpires = 9223372036854775807 (INT64_MAX). However,
486 * when changing from an account having a specific expiration date to
487 * that account never expiring, it sets accountExpires = 0.
489 * Consolidate that logic here to allow clearer logic for account expiry in
490 * the rest of the code.
492 NTTIME samdb_result_account_expires(const struct ldb_message *msg)
494 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "accountExpires",
497 if (ret == 0)
498 ret = INT64_MAX;
500 return ret;
504 construct the allow_password_change field from the PwdLastSet attribute and the
505 domain password settings
507 NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
508 TALLOC_CTX *mem_ctx,
509 struct ldb_dn *domain_dn,
510 const struct ldb_message *msg,
511 const char *attr)
513 uint64_t attr_time = ldb_msg_find_attr_as_uint64(msg, attr, 0);
514 int64_t minPwdAge;
516 if (attr_time == 0) {
517 return 0;
520 minPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "minPwdAge", NULL);
522 /* yes, this is a -= not a += as minPwdAge is stored as the negative
523 of the number of 100-nano-seconds */
524 attr_time -= minPwdAge;
526 return attr_time;
530 pull a samr_Password structure from a result set.
532 struct samr_Password *samdb_result_hash(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr)
534 struct samr_Password *hash = NULL;
535 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
536 if (val && (val->length >= sizeof(hash->hash))) {
537 hash = talloc(mem_ctx, struct samr_Password);
538 if (hash == NULL) {
539 return NULL;
541 talloc_keep_secret(hash);
542 memcpy(hash->hash, val->data, sizeof(hash->hash));
544 return hash;
548 pull an array of samr_Password structures from a result set.
550 unsigned int samdb_result_hashes(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
551 const char *attr, struct samr_Password **hashes)
553 unsigned int count, i;
554 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
556 *hashes = NULL;
557 if (!val) {
558 return 0;
560 if (val->length % 16 != 0) {
562 * The length is wrong. Don’t try to read beyond the end of the
563 * buffer.
565 return 0;
567 count = val->length / 16;
568 if (count == 0) {
569 return 0;
572 *hashes = talloc_array(mem_ctx, struct samr_Password, count);
573 if (! *hashes) {
574 return 0;
576 talloc_keep_secret(*hashes);
578 for (i=0;i<count;i++) {
579 memcpy((*hashes)[i].hash, (i*16)+(char *)val->data, 16);
582 return count;
585 NTSTATUS samdb_result_passwords_from_history(TALLOC_CTX *mem_ctx,
586 struct loadparm_context *lp_ctx,
587 const struct ldb_message *msg,
588 unsigned int idx,
589 const struct samr_Password **lm_pwd,
590 const struct samr_Password **nt_pwd)
592 struct samr_Password *lmPwdHash, *ntPwdHash;
594 if (nt_pwd) {
595 unsigned int num_nt;
596 num_nt = samdb_result_hashes(mem_ctx, msg, "ntPwdHistory", &ntPwdHash);
597 if (num_nt <= idx) {
598 *nt_pwd = NULL;
599 } else {
600 *nt_pwd = &ntPwdHash[idx];
603 if (lm_pwd) {
604 /* Ensure that if we have turned off LM
605 * authentication, that we never use the LM hash, even
606 * if we store it */
607 if (lpcfg_lanman_auth(lp_ctx)) {
608 unsigned int num_lm;
609 num_lm = samdb_result_hashes(mem_ctx, msg, "lmPwdHistory", &lmPwdHash);
610 if (num_lm <= idx) {
611 *lm_pwd = NULL;
612 } else {
613 *lm_pwd = &lmPwdHash[idx];
615 } else {
616 *lm_pwd = NULL;
619 return NT_STATUS_OK;
622 NTSTATUS samdb_result_passwords_no_lockout(TALLOC_CTX *mem_ctx,
623 struct loadparm_context *lp_ctx,
624 const struct ldb_message *msg,
625 struct samr_Password **nt_pwd)
627 struct samr_Password *ntPwdHash;
629 if (nt_pwd) {
630 unsigned int num_nt;
631 num_nt = samdb_result_hashes(mem_ctx, msg, "unicodePwd", &ntPwdHash);
632 if (num_nt == 0) {
633 *nt_pwd = NULL;
634 } else if (num_nt > 1) {
635 return NT_STATUS_INTERNAL_DB_CORRUPTION;
636 } else {
637 *nt_pwd = &ntPwdHash[0];
640 return NT_STATUS_OK;
643 NTSTATUS samdb_result_passwords(TALLOC_CTX *mem_ctx,
644 struct loadparm_context *lp_ctx,
645 const struct ldb_message *msg,
646 struct samr_Password **nt_pwd)
648 uint32_t acct_flags;
650 acct_flags = samdb_result_acct_flags(msg,
651 "msDS-User-Account-Control-Computed");
652 /* Quit if the account was locked out. */
653 if (acct_flags & ACB_AUTOLOCK) {
654 DEBUG(3,("samdb_result_passwords: Account for user %s was locked out.\n",
655 ldb_dn_get_linearized(msg->dn)));
656 return NT_STATUS_ACCOUNT_LOCKED_OUT;
659 return samdb_result_passwords_no_lockout(mem_ctx, lp_ctx, msg,
660 nt_pwd);
664 pull a samr_LogonHours structure from a result set.
666 struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr)
668 struct samr_LogonHours hours = {};
669 size_t units_per_week = 168;
670 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
672 if (val) {
673 units_per_week = val->length * 8;
676 hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week/8);
677 if (!hours.bits) {
678 return hours;
680 hours.units_per_week = units_per_week;
681 memset(hours.bits, 0xFF, units_per_week/8);
682 if (val) {
683 memcpy(hours.bits, val->data, val->length);
686 return hours;
690 pull a set of account_flags from a result set.
692 Naturally, this requires that userAccountControl and
693 (if not null) the attributes 'attr' be already
694 included in msg
696 uint32_t samdb_result_acct_flags(const struct ldb_message *msg, const char *attr)
698 uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
699 uint32_t attr_flags = 0;
700 uint32_t acct_flags = ds_uf2acb(userAccountControl);
701 if (attr) {
702 attr_flags = ldb_msg_find_attr_as_uint(msg, attr, UF_ACCOUNTDISABLE);
703 if (attr_flags == UF_ACCOUNTDISABLE) {
704 DEBUG(0, ("Attribute %s not found, disabling account %s!\n", attr,
705 ldb_dn_get_linearized(msg->dn)));
707 acct_flags |= ds_uf2acb(attr_flags);
710 return acct_flags;
713 NTSTATUS samdb_result_parameters(TALLOC_CTX *mem_ctx,
714 struct ldb_message *msg,
715 const char *attr,
716 struct lsa_BinaryString *s)
718 int i;
719 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
721 ZERO_STRUCTP(s);
723 if (!val) {
724 return NT_STATUS_OK;
727 if ((val->length % 2) != 0) {
729 * If the on-disk data is not even in length, we know
730 * it is corrupt, and can not be safely pushed. We
731 * would either truncate, send an uninitialised
732 * byte or send a forced zero byte
734 return NT_STATUS_INTERNAL_DB_CORRUPTION;
737 s->array = talloc_array(mem_ctx, uint16_t, val->length/2);
738 if (!s->array) {
739 return NT_STATUS_NO_MEMORY;
741 s->length = s->size = val->length;
743 /* The on-disk format is the 'network' format, being UTF16LE (sort of) */
744 for (i = 0; i < s->length / 2; i++) {
745 s->array[i] = SVAL(val->data, i * 2);
748 return NT_STATUS_OK;
751 /* Find an attribute, with a particular value */
753 /* The current callers of this function expect a very specific
754 * behaviour: In particular, objectClass subclass equivalence is not
755 * wanted. This means that we should not lookup the schema for the
756 * comparison function */
757 struct ldb_message_element *samdb_find_attribute(struct ldb_context *ldb,
758 const struct ldb_message *msg,
759 const char *name, const char *value)
761 unsigned int i;
762 struct ldb_message_element *el = ldb_msg_find_element(msg, name);
764 if (!el) {
765 return NULL;
768 for (i=0;i<el->num_values;i++) {
769 if (ldb_attr_cmp(value, (char *)el->values[i].data) == 0) {
770 return el;
774 return NULL;
777 static int samdb_find_or_add_attribute_ex(struct ldb_context *ldb,
778 struct ldb_message *msg,
779 const char *name,
780 const char *set_value,
781 unsigned attr_flags,
782 bool *added)
784 int ret;
785 struct ldb_message_element *el;
787 SMB_ASSERT(attr_flags != 0);
789 el = ldb_msg_find_element(msg, name);
790 if (el) {
791 if (added != NULL) {
792 *added = false;
795 return LDB_SUCCESS;
798 ret = ldb_msg_add_empty(msg, name,
799 attr_flags,
800 &el);
801 if (ret != LDB_SUCCESS) {
802 return ret;
805 if (set_value != NULL) {
806 ret = ldb_msg_add_string(msg, name, set_value);
807 if (ret != LDB_SUCCESS) {
808 return ret;
812 if (added != NULL) {
813 *added = true;
815 return LDB_SUCCESS;
818 int samdb_find_or_add_attribute(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
820 return samdb_find_or_add_attribute_ex(ldb, msg, name, set_value, LDB_FLAG_MOD_ADD, NULL);
824 add a dom_sid element to a message
826 int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
827 const char *attr_name, const struct dom_sid *sid)
829 struct ldb_val v;
830 enum ndr_err_code ndr_err;
832 ndr_err = ndr_push_struct_blob(&v, mem_ctx,
833 sid,
834 (ndr_push_flags_fn_t)ndr_push_dom_sid);
835 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
836 return ldb_operr(sam_ldb);
838 return ldb_msg_add_value(msg, attr_name, &v, NULL);
843 add a delete element operation to a message
845 int samdb_msg_add_delete(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
846 const char *attr_name)
848 /* we use an empty replace rather than a delete, as it allows for
849 dsdb_replace() to be used everywhere */
850 return ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_REPLACE, NULL);
854 add an add attribute value to a message or enhance an existing attribute
855 which has the same name and the add flag set.
857 int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
858 struct ldb_message *msg, const char *attr_name,
859 const char *value)
861 struct ldb_message_element *el;
862 struct ldb_val val;
863 char *v;
864 unsigned int i;
865 bool found = false;
866 int ret;
868 v = talloc_strdup(mem_ctx, value);
869 if (v == NULL) {
870 return ldb_oom(sam_ldb);
873 val.data = (uint8_t *) v;
874 val.length = strlen(v);
876 if (val.length == 0) {
877 /* allow empty strings as non-existent attributes */
878 return LDB_SUCCESS;
881 for (i = 0; i < msg->num_elements; i++) {
882 el = &msg->elements[i];
883 if ((ldb_attr_cmp(el->name, attr_name) == 0) &&
884 (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_ADD)) {
885 found = true;
886 break;
889 if (!found) {
890 ret = ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_ADD,
891 &el);
892 if (ret != LDB_SUCCESS) {
893 return ret;
897 ret = ldb_msg_element_add_value(msg->elements, el, &val);
898 if (ret != LDB_SUCCESS) {
899 return ldb_oom(sam_ldb);
902 return LDB_SUCCESS;
906 add a delete attribute value to a message or enhance an existing attribute
907 which has the same name and the delete flag set.
909 int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
910 struct ldb_message *msg, const char *attr_name,
911 const char *value)
913 struct ldb_message_element *el;
914 struct ldb_val val;
915 char *v;
916 unsigned int i;
917 bool found = false;
918 int ret;
920 v = talloc_strdup(mem_ctx, value);
921 if (v == NULL) {
922 return ldb_oom(sam_ldb);
925 val.data = (uint8_t *) v;
926 val.length = strlen(v);
928 if (val.length == 0) {
929 /* allow empty strings as non-existent attributes */
930 return LDB_SUCCESS;
933 for (i = 0; i < msg->num_elements; i++) {
934 el = &msg->elements[i];
935 if ((ldb_attr_cmp(el->name, attr_name) == 0) &&
936 (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE)) {
937 found = true;
938 break;
941 if (!found) {
942 ret = ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_DELETE,
943 &el);
944 if (ret != LDB_SUCCESS) {
945 return ret;
949 ret = ldb_msg_element_add_value(msg->elements, el, &val);
950 if (ret != LDB_SUCCESS) {
951 return ldb_oom(sam_ldb);
954 return LDB_SUCCESS;
958 add a int element to a message
960 int samdb_msg_add_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
961 const char *attr_name, int v)
963 const char *s = talloc_asprintf(mem_ctx, "%d", v);
964 if (s == NULL) {
965 return ldb_oom(sam_ldb);
967 return ldb_msg_add_string(msg, attr_name, s);
970 int samdb_msg_add_int_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
971 const char *attr_name, int v, int flags)
973 const char *s = talloc_asprintf(mem_ctx, "%d", v);
974 if (s == NULL) {
975 return ldb_oom(sam_ldb);
977 return ldb_msg_add_string_flags(msg, attr_name, s, flags);
981 * Add an unsigned int element to a message
983 * The issue here is that we have not yet first cast to int32_t explicitly,
984 * before we cast to an signed int to printf() into the %d or cast to a
985 * int64_t before we then cast to a long long to printf into a %lld.
987 * There are *no* unsigned integers in Active Directory LDAP, even the RID
988 * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
989 * (See the schema, and the syntax definitions in schema_syntax.c).
992 int samdb_msg_add_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
993 const char *attr_name, unsigned int v)
995 return samdb_msg_add_int(sam_ldb, mem_ctx, msg, attr_name, (int)v);
998 int samdb_msg_add_uint_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
999 const char *attr_name, unsigned int v, int flags)
1001 return samdb_msg_add_int_flags(sam_ldb, mem_ctx, msg, attr_name, (int)v, flags);
1005 add a (signed) int64_t element to a message
1007 int samdb_msg_add_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1008 const char *attr_name, int64_t v)
1010 const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
1011 if (s == NULL) {
1012 return ldb_oom(sam_ldb);
1014 return ldb_msg_add_string(msg, attr_name, s);
1018 * Add an unsigned int64_t (uint64_t) element to a message
1020 * The issue here is that we have not yet first cast to int32_t explicitly,
1021 * before we cast to an signed int to printf() into the %d or cast to a
1022 * int64_t before we then cast to a long long to printf into a %lld.
1024 * There are *no* unsigned integers in Active Directory LDAP, even the RID
1025 * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
1026 * (See the schema, and the syntax definitions in schema_syntax.c).
1029 int samdb_msg_add_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1030 const char *attr_name, uint64_t v)
1032 return samdb_msg_add_int64(sam_ldb, mem_ctx, msg, attr_name, (int64_t)v);
1036 append a int element to a message
1038 int samdb_msg_append_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1039 const char *attr_name, int v, int flags)
1041 const char *s = talloc_asprintf(mem_ctx, "%d", v);
1042 if (s == NULL) {
1043 return ldb_oom(sam_ldb);
1045 return ldb_msg_append_string(msg, attr_name, s, flags);
1049 * Append an unsigned int element to a message
1051 * The issue here is that we have not yet first cast to int32_t explicitly,
1052 * before we cast to an signed int to printf() into the %d or cast to a
1053 * int64_t before we then cast to a long long to printf into a %lld.
1055 * There are *no* unsigned integers in Active Directory LDAP, even the RID
1056 * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
1057 * (See the schema, and the syntax definitions in schema_syntax.c).
1060 int samdb_msg_append_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1061 const char *attr_name, unsigned int v, int flags)
1063 return samdb_msg_append_int(sam_ldb, mem_ctx, msg, attr_name, (int)v, flags);
1067 append a (signed) int64_t element to a message
1069 int samdb_msg_append_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1070 const char *attr_name, int64_t v, int flags)
1072 const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
1073 if (s == NULL) {
1074 return ldb_oom(sam_ldb);
1076 return ldb_msg_append_string(msg, attr_name, s, flags);
1080 * Append an unsigned int64_t (uint64_t) element to a message
1082 * The issue here is that we have not yet first cast to int32_t explicitly,
1083 * before we cast to an signed int to printf() into the %d or cast to a
1084 * int64_t before we then cast to a long long to printf into a %lld.
1086 * There are *no* unsigned integers in Active Directory LDAP, even the RID
1087 * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
1088 * (See the schema, and the syntax definitions in schema_syntax.c).
1091 int samdb_msg_append_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1092 const char *attr_name, uint64_t v, int flags)
1094 return samdb_msg_append_int64(sam_ldb, mem_ctx, msg, attr_name, (int64_t)v, flags);
1098 add a samr_Password element to a message
1100 int samdb_msg_add_hash(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1101 const char *attr_name, const struct samr_Password *hash)
1103 struct ldb_val val;
1104 val.data = talloc_memdup(mem_ctx, hash->hash, 16);
1105 if (!val.data) {
1106 return ldb_oom(sam_ldb);
1108 val.length = 16;
1109 return ldb_msg_add_value(msg, attr_name, &val, NULL);
1113 add a samr_Password array to a message
1115 int samdb_msg_add_hashes(struct ldb_context *ldb,
1116 TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1117 const char *attr_name, struct samr_Password *hashes,
1118 unsigned int count)
1120 struct ldb_val val;
1121 unsigned int i;
1122 val.data = talloc_array_size(mem_ctx, 16, count);
1123 val.length = count*16;
1124 if (!val.data) {
1125 return ldb_oom(ldb);
1127 for (i=0;i<count;i++) {
1128 memcpy(i*16 + (char *)val.data, hashes[i].hash, 16);
1130 return ldb_msg_add_value(msg, attr_name, &val, NULL);
1134 add a acct_flags element to a message
1136 int samdb_msg_add_acct_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1137 const char *attr_name, uint32_t v)
1139 return samdb_msg_add_uint(sam_ldb, mem_ctx, msg, attr_name, ds_acb2uf(v));
1143 add a logon_hours element to a message
1145 int samdb_msg_add_logon_hours(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1146 const char *attr_name, struct samr_LogonHours *hours)
1148 struct ldb_val val;
1149 val.length = hours->units_per_week / 8;
1150 val.data = hours->bits;
1151 return ldb_msg_add_value(msg, attr_name, &val, NULL);
1155 add a parameters element to a message
1157 int samdb_msg_add_parameters(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
1158 const char *attr_name, struct lsa_BinaryString *parameters)
1160 int i;
1161 struct ldb_val val;
1162 if ((parameters->length % 2) != 0) {
1163 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
1166 val.data = talloc_array(mem_ctx, uint8_t, parameters->length);
1167 if (val.data == NULL) {
1168 return LDB_ERR_OPERATIONS_ERROR;
1170 val.length = parameters->length;
1171 for (i = 0; i < parameters->length / 2; i++) {
1173 * The on-disk format needs to be in the 'network'
1174 * format, parameters->array is a uint16_t array of
1175 * length parameters->length / 2
1177 SSVAL(val.data, i * 2, parameters->array[i]);
1179 return ldb_msg_add_steal_value(msg, attr_name, &val);
1183 * Sets an unsigned int element in a message
1185 * The issue here is that we have not yet first cast to int32_t explicitly,
1186 * before we cast to an signed int to printf() into the %d or cast to a
1187 * int64_t before we then cast to a long long to printf into a %lld.
1189 * There are *no* unsigned integers in Active Directory LDAP, even the RID
1190 * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
1191 * (See the schema, and the syntax definitions in schema_syntax.c).
1194 int samdb_msg_set_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
1195 struct ldb_message *msg, const char *attr_name,
1196 unsigned int v)
1198 struct ldb_message_element *el;
1200 el = ldb_msg_find_element(msg, attr_name);
1201 if (el) {
1202 el->num_values = 0;
1204 return samdb_msg_add_uint(sam_ldb, mem_ctx, msg, attr_name, v);
1208 * Handle ldb_request in transaction
1210 int dsdb_autotransaction_request(struct ldb_context *sam_ldb,
1211 struct ldb_request *req)
1213 int ret;
1215 ret = ldb_transaction_start(sam_ldb);
1216 if (ret != LDB_SUCCESS) {
1217 return ret;
1220 ret = ldb_request(sam_ldb, req);
1221 if (ret == LDB_SUCCESS) {
1222 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
1225 if (ret == LDB_SUCCESS) {
1226 return ldb_transaction_commit(sam_ldb);
1228 ldb_transaction_cancel(sam_ldb);
1230 return ret;
1234 return a default security descriptor
1236 struct security_descriptor *samdb_default_security_descriptor(TALLOC_CTX *mem_ctx)
1238 struct security_descriptor *sd;
1240 sd = security_descriptor_initialise(mem_ctx);
1242 return sd;
1245 struct ldb_dn *samdb_aggregate_schema_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1247 struct ldb_dn *schema_dn = ldb_get_schema_basedn(sam_ctx);
1248 struct ldb_dn *aggregate_dn;
1249 if (!schema_dn) {
1250 return NULL;
1253 aggregate_dn = ldb_dn_copy(mem_ctx, schema_dn);
1254 if (!aggregate_dn) {
1255 return NULL;
1257 if (!ldb_dn_add_child_fmt(aggregate_dn, "CN=Aggregate")) {
1258 return NULL;
1260 return aggregate_dn;
1263 struct ldb_dn *samdb_partitions_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1265 struct ldb_dn *new_dn;
1267 new_dn = ldb_dn_copy(mem_ctx, ldb_get_config_basedn(sam_ctx));
1268 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Partitions")) {
1269 talloc_free(new_dn);
1270 return NULL;
1272 return new_dn;
1275 struct ldb_dn *samdb_infrastructure_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1277 struct ldb_dn *new_dn;
1279 new_dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(sam_ctx));
1280 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Infrastructure")) {
1281 talloc_free(new_dn);
1282 return NULL;
1284 return new_dn;
1287 struct ldb_dn *samdb_system_container_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1289 struct ldb_dn *new_dn = NULL;
1290 bool ok;
1292 new_dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(sam_ctx));
1293 if (new_dn == NULL) {
1294 return NULL;
1297 ok = ldb_dn_add_child_fmt(new_dn, "CN=System");
1298 if (!ok) {
1299 TALLOC_FREE(new_dn);
1300 return NULL;
1303 return new_dn;
1306 struct ldb_dn *samdb_sites_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1308 struct ldb_dn *new_dn;
1310 new_dn = ldb_dn_copy(mem_ctx, ldb_get_config_basedn(sam_ctx));
1311 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Sites")) {
1312 talloc_free(new_dn);
1313 return NULL;
1315 return new_dn;
1318 struct ldb_dn *samdb_extended_rights_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1320 struct ldb_dn *new_dn;
1322 new_dn = ldb_dn_copy(mem_ctx, ldb_get_config_basedn(sam_ctx));
1323 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Extended-Rights")) {
1324 talloc_free(new_dn);
1325 return NULL;
1327 return new_dn;
1330 struct ldb_dn *samdb_configuration_dn(struct ldb_context *sam_ctx,
1331 TALLOC_CTX *mem_ctx,
1332 const char *dn_str)
1334 struct ldb_dn *config_dn = NULL;
1335 struct ldb_dn *child_dn = NULL;
1336 bool ok;
1338 config_dn = ldb_dn_copy(mem_ctx, ldb_get_config_basedn(sam_ctx));
1339 if (config_dn == NULL) {
1340 return NULL;
1343 child_dn = ldb_dn_new(mem_ctx, sam_ctx, dn_str);
1344 if (child_dn == NULL) {
1345 talloc_free(config_dn);
1346 return NULL;
1349 ok = ldb_dn_add_child(config_dn, child_dn);
1350 talloc_free(child_dn);
1351 if (!ok) {
1352 talloc_free(config_dn);
1353 return NULL;
1356 return config_dn;
1359 struct ldb_dn *samdb_gkdi_root_key_container_dn(struct ldb_context *sam_ctx,
1360 TALLOC_CTX *mem_ctx)
1363 * [MS-GKDI] says the root key container is to be found in “CN=Sid Key
1364 * Service,CN=Services”, but that is not correct.
1366 return samdb_configuration_dn(sam_ctx,
1367 mem_ctx,
1368 "CN=Master Root Keys,"
1369 "CN=Group Key Distribution Service,"
1370 "CN=Services");
1373 struct ldb_dn *samdb_gkdi_root_key_dn(struct ldb_context *sam_ctx,
1374 TALLOC_CTX *mem_ctx,
1375 const struct GUID *root_key_id)
1377 struct ldb_dn *root_key_dn = NULL;
1378 struct ldb_dn *child_dn = NULL;
1379 struct GUID_txt_buf guid_buf;
1380 char *root_key_id_string = NULL;
1381 bool ok;
1383 root_key_id_string = GUID_buf_string(root_key_id, &guid_buf);
1384 if (root_key_id_string == NULL) {
1385 return NULL;
1388 root_key_dn = samdb_gkdi_root_key_container_dn(sam_ctx, mem_ctx);
1389 if (root_key_dn == NULL) {
1390 return NULL;
1393 child_dn = ldb_dn_new_fmt(mem_ctx,
1394 sam_ctx,
1395 "CN=%s",
1396 root_key_id_string);
1397 if (child_dn == NULL) {
1398 talloc_free(root_key_dn);
1399 return NULL;
1402 ok = ldb_dn_add_child(root_key_dn, child_dn);
1403 talloc_free(child_dn);
1404 if (!ok) {
1405 talloc_free(root_key_dn);
1406 return NULL;
1409 return root_key_dn;
1413 work out the domain sid for the current open ldb
1415 const struct dom_sid *samdb_domain_sid(struct ldb_context *ldb)
1417 TALLOC_CTX *tmp_ctx;
1418 const struct dom_sid *domain_sid;
1419 const char *attrs[] = {
1420 "objectSid",
1421 NULL
1423 struct ldb_result *res;
1424 int ret;
1426 /* see if we have a cached copy */
1427 domain_sid = (struct dom_sid *)ldb_get_opaque(ldb, "cache.domain_sid");
1428 if (domain_sid) {
1429 return domain_sid;
1432 tmp_ctx = talloc_new(ldb);
1433 if (tmp_ctx == NULL) {
1434 goto failed;
1437 ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
1439 if (ret != LDB_SUCCESS) {
1440 goto failed;
1443 if (res->count != 1) {
1444 goto failed;
1447 domain_sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
1448 if (domain_sid == NULL) {
1449 goto failed;
1452 /* cache the domain_sid in the ldb */
1453 if (ldb_set_opaque(ldb, "cache.domain_sid", discard_const_p(struct dom_sid, domain_sid)) != LDB_SUCCESS) {
1454 goto failed;
1457 talloc_steal(ldb, domain_sid);
1458 talloc_free(tmp_ctx);
1460 return domain_sid;
1462 failed:
1463 talloc_free(tmp_ctx);
1464 return NULL;
1468 get domain sid from cache
1470 const struct dom_sid *samdb_domain_sid_cache_only(struct ldb_context *ldb)
1472 return (struct dom_sid *)ldb_get_opaque(ldb, "cache.domain_sid");
1475 bool samdb_set_domain_sid(struct ldb_context *ldb, const struct dom_sid *dom_sid_in)
1477 TALLOC_CTX *tmp_ctx;
1478 struct dom_sid *dom_sid_new;
1479 struct dom_sid *dom_sid_old;
1481 /* see if we have a cached copy */
1482 dom_sid_old = talloc_get_type(ldb_get_opaque(ldb,
1483 "cache.domain_sid"), struct dom_sid);
1485 tmp_ctx = talloc_new(ldb);
1486 if (tmp_ctx == NULL) {
1487 goto failed;
1490 dom_sid_new = dom_sid_dup(tmp_ctx, dom_sid_in);
1491 if (!dom_sid_new) {
1492 goto failed;
1495 /* cache the domain_sid in the ldb */
1496 if (ldb_set_opaque(ldb, "cache.domain_sid", dom_sid_new) != LDB_SUCCESS) {
1497 goto failed;
1500 talloc_steal(ldb, dom_sid_new);
1501 talloc_free(tmp_ctx);
1502 talloc_free(dom_sid_old);
1504 return true;
1506 failed:
1507 DEBUG(1,("Failed to set our own cached domain SID in the ldb!\n"));
1508 talloc_free(tmp_ctx);
1509 return false;
1513 work out the domain guid for the current open ldb
1515 const struct GUID *samdb_domain_guid(struct ldb_context *ldb)
1517 TALLOC_CTX *tmp_ctx = NULL;
1518 struct GUID *domain_guid = NULL;
1519 const char *attrs[] = {
1520 "objectGUID",
1521 NULL
1523 struct ldb_result *res = NULL;
1524 int ret;
1526 /* see if we have a cached copy */
1527 domain_guid = (struct GUID *)ldb_get_opaque(ldb, "cache.domain_guid");
1528 if (domain_guid) {
1529 return domain_guid;
1532 tmp_ctx = talloc_new(ldb);
1533 if (tmp_ctx == NULL) {
1534 goto failed;
1537 ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectGUID=*");
1538 if (ret != LDB_SUCCESS) {
1539 goto failed;
1542 if (res->count != 1) {
1543 goto failed;
1546 domain_guid = talloc(tmp_ctx, struct GUID);
1547 if (domain_guid == NULL) {
1548 goto failed;
1550 *domain_guid = samdb_result_guid(res->msgs[0], "objectGUID");
1552 /* cache the domain_sid in the ldb */
1553 if (ldb_set_opaque(ldb, "cache.domain_guid", domain_guid) != LDB_SUCCESS) {
1554 goto failed;
1557 talloc_steal(ldb, domain_guid);
1558 talloc_free(tmp_ctx);
1560 return domain_guid;
1562 failed:
1563 talloc_free(tmp_ctx);
1564 return NULL;
1567 bool samdb_set_ntds_settings_dn(struct ldb_context *ldb, struct ldb_dn *ntds_settings_dn_in)
1569 TALLOC_CTX *tmp_ctx;
1570 struct ldb_dn *ntds_settings_dn_new;
1571 struct ldb_dn *ntds_settings_dn_old;
1573 /* see if we have a forced copy from provision */
1574 ntds_settings_dn_old = talloc_get_type(ldb_get_opaque(ldb,
1575 "forced.ntds_settings_dn"), struct ldb_dn);
1577 tmp_ctx = talloc_new(ldb);
1578 if (tmp_ctx == NULL) {
1579 goto failed;
1582 ntds_settings_dn_new = ldb_dn_copy(tmp_ctx, ntds_settings_dn_in);
1583 if (!ntds_settings_dn_new) {
1584 goto failed;
1587 /* set the DN in the ldb to avoid lookups during provision */
1588 if (ldb_set_opaque(ldb, "forced.ntds_settings_dn", ntds_settings_dn_new) != LDB_SUCCESS) {
1589 goto failed;
1592 talloc_steal(ldb, ntds_settings_dn_new);
1593 talloc_free(tmp_ctx);
1594 talloc_free(ntds_settings_dn_old);
1596 return true;
1598 failed:
1599 DEBUG(1,("Failed to set our NTDS Settings DN in the ldb!\n"));
1600 talloc_free(tmp_ctx);
1601 return false;
1605 work out the ntds settings dn for the current open ldb
1607 struct ldb_dn *samdb_ntds_settings_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1609 TALLOC_CTX *tmp_ctx;
1610 const char *root_attrs[] = { "dsServiceName", NULL };
1611 int ret;
1612 struct ldb_result *root_res;
1613 struct ldb_dn *settings_dn;
1615 /* see if we have a cached copy */
1616 settings_dn = (struct ldb_dn *)ldb_get_opaque(ldb, "forced.ntds_settings_dn");
1617 if (settings_dn) {
1618 return ldb_dn_copy(mem_ctx, settings_dn);
1621 tmp_ctx = talloc_new(mem_ctx);
1622 if (tmp_ctx == NULL) {
1623 goto failed;
1626 ret = ldb_search(ldb, tmp_ctx, &root_res, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
1627 if (ret != LDB_SUCCESS) {
1628 DEBUG(1,("Searching for dsServiceName in rootDSE failed: %s\n",
1629 ldb_errstring(ldb)));
1630 goto failed;
1633 if (root_res->count != 1) {
1634 goto failed;
1637 settings_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, root_res->msgs[0], "dsServiceName");
1639 /* note that we do not cache the DN here, as that would mean
1640 * we could not handle server renames at runtime. Only
1641 * provision sets up forced.ntds_settings_dn */
1643 talloc_steal(mem_ctx, settings_dn);
1644 talloc_free(tmp_ctx);
1646 return settings_dn;
1648 failed:
1649 DEBUG(1,("Failed to find our own NTDS Settings DN in the ldb!\n"));
1650 talloc_free(tmp_ctx);
1651 return NULL;
1655 work out the ntds settings invocationID/objectGUID for the current open ldb
1657 static const struct GUID *samdb_ntds_GUID(struct ldb_context *ldb,
1658 const char *attribute,
1659 const char *cache_name)
1661 TALLOC_CTX *tmp_ctx;
1662 const char *attrs[] = { attribute, NULL };
1663 int ret;
1664 struct ldb_result *res;
1665 struct GUID *ntds_guid;
1666 struct ldb_dn *ntds_settings_dn = NULL;
1667 const char *errstr = NULL;
1669 /* see if we have a cached copy */
1670 ntds_guid = (struct GUID *)ldb_get_opaque(ldb, cache_name);
1671 if (ntds_guid != NULL) {
1672 return ntds_guid;
1675 tmp_ctx = talloc_new(ldb);
1676 if (tmp_ctx == NULL) {
1677 goto failed;
1680 ntds_settings_dn = samdb_ntds_settings_dn(ldb, tmp_ctx);
1681 if (ntds_settings_dn == NULL) {
1682 errstr = "samdb_ntds_settings_dn() returned NULL";
1683 goto failed;
1686 ret = ldb_search(ldb, tmp_ctx, &res, ntds_settings_dn,
1687 LDB_SCOPE_BASE, attrs, NULL);
1688 if (ret) {
1689 errstr = ldb_errstring(ldb);
1690 goto failed;
1693 if (res->count != 1) {
1694 errstr = "incorrect number of results from base search";
1695 goto failed;
1698 ntds_guid = talloc(tmp_ctx, struct GUID);
1699 if (ntds_guid == NULL) {
1700 goto failed;
1703 *ntds_guid = samdb_result_guid(res->msgs[0], attribute);
1705 if (GUID_all_zero(ntds_guid)) {
1706 if (ldb_msg_find_ldb_val(res->msgs[0], attribute)) {
1707 errstr = "failed to find the GUID attribute";
1708 } else {
1709 errstr = "failed to parse the GUID";
1711 goto failed;
1714 /* cache the domain_sid in the ldb */
1715 if (ldb_set_opaque(ldb, cache_name, ntds_guid) != LDB_SUCCESS) {
1716 errstr = "ldb_set_opaque() failed";
1717 goto failed;
1720 talloc_steal(ldb, ntds_guid);
1721 talloc_free(tmp_ctx);
1723 return ntds_guid;
1725 failed:
1726 DBG_WARNING("Failed to find our own NTDS Settings %s in the ldb: %s!\n",
1727 attribute, errstr);
1728 talloc_free(tmp_ctx);
1729 return NULL;
1733 work out the ntds settings objectGUID for the current open ldb
1735 const struct GUID *samdb_ntds_objectGUID(struct ldb_context *ldb)
1737 return samdb_ntds_GUID(ldb, "objectGUID", "cache.ntds_guid");
1741 work out the ntds settings invocationId for the current open ldb
1743 const struct GUID *samdb_ntds_invocation_id(struct ldb_context *ldb)
1745 return samdb_ntds_GUID(ldb, "invocationId", "cache.invocation_id");
1748 static bool samdb_set_ntds_GUID(struct ldb_context *ldb,
1749 const struct GUID *ntds_guid_in,
1750 const char *attribute,
1751 const char *cache_name)
1753 TALLOC_CTX *tmp_ctx;
1754 struct GUID *ntds_guid_new;
1755 struct GUID *ntds_guid_old;
1757 /* see if we have a cached copy */
1758 ntds_guid_old = (struct GUID *)ldb_get_opaque(ldb, cache_name);
1760 tmp_ctx = talloc_new(ldb);
1761 if (tmp_ctx == NULL) {
1762 goto failed;
1765 ntds_guid_new = talloc(tmp_ctx, struct GUID);
1766 if (!ntds_guid_new) {
1767 goto failed;
1770 *ntds_guid_new = *ntds_guid_in;
1772 /* cache the domain_sid in the ldb */
1773 if (ldb_set_opaque(ldb, cache_name, ntds_guid_new) != LDB_SUCCESS) {
1774 goto failed;
1777 talloc_steal(ldb, ntds_guid_new);
1778 talloc_free(tmp_ctx);
1779 talloc_free(ntds_guid_old);
1781 return true;
1783 failed:
1784 DBG_WARNING("Failed to set our own cached %s in the ldb!\n",
1785 attribute);
1786 talloc_free(tmp_ctx);
1787 return false;
1790 bool samdb_set_ntds_objectGUID(struct ldb_context *ldb, const struct GUID *ntds_guid_in)
1792 return samdb_set_ntds_GUID(ldb,
1793 ntds_guid_in,
1794 "objectGUID",
1795 "cache.ntds_guid");
1798 bool samdb_set_ntds_invocation_id(struct ldb_context *ldb, const struct GUID *invocation_id_in)
1800 return samdb_set_ntds_GUID(ldb,
1801 invocation_id_in,
1802 "invocationId",
1803 "cache.invocation_id");
1807 work out the server dn for the current open ldb
1809 struct ldb_dn *samdb_server_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1811 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1812 struct ldb_dn *dn;
1813 if (!tmp_ctx) {
1814 return NULL;
1816 dn = ldb_dn_get_parent(mem_ctx, samdb_ntds_settings_dn(ldb, tmp_ctx));
1817 talloc_free(tmp_ctx);
1818 return dn;
1823 work out the server dn for the current open ldb
1825 struct ldb_dn *samdb_server_site_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1827 struct ldb_dn *server_dn;
1828 struct ldb_dn *servers_dn;
1829 struct ldb_dn *server_site_dn;
1831 /* TODO: there must be a saner way to do this!! */
1832 server_dn = samdb_server_dn(ldb, mem_ctx);
1833 if (!server_dn) return NULL;
1835 servers_dn = ldb_dn_get_parent(mem_ctx, server_dn);
1836 talloc_free(server_dn);
1837 if (!servers_dn) return NULL;
1839 server_site_dn = ldb_dn_get_parent(mem_ctx, servers_dn);
1840 talloc_free(servers_dn);
1842 return server_site_dn;
1846 find the site name from a computers DN record
1848 int samdb_find_site_for_computer(struct ldb_context *ldb,
1849 TALLOC_CTX *mem_ctx, struct ldb_dn *computer_dn,
1850 const char **site_name)
1852 int ret;
1853 struct ldb_dn *dn;
1854 const struct ldb_val *rdn_val;
1856 *site_name = NULL;
1858 ret = samdb_reference_dn(ldb, mem_ctx, computer_dn, "serverReferenceBL", &dn);
1859 if (ret != LDB_SUCCESS) {
1860 return ret;
1863 if (!ldb_dn_remove_child_components(dn, 2)) {
1864 talloc_free(dn);
1865 return LDB_ERR_INVALID_DN_SYNTAX;
1868 rdn_val = ldb_dn_get_rdn_val(dn);
1869 if (rdn_val == NULL) {
1870 return LDB_ERR_OPERATIONS_ERROR;
1873 (*site_name) = talloc_strndup(mem_ctx, (const char *)rdn_val->data, rdn_val->length);
1874 talloc_free(dn);
1875 if (!*site_name) {
1876 return LDB_ERR_OPERATIONS_ERROR;
1878 return LDB_SUCCESS;
1882 find the NTDS GUID from a computers DN record
1884 int samdb_find_ntdsguid_for_computer(struct ldb_context *ldb, struct ldb_dn *computer_dn,
1885 struct GUID *ntds_guid)
1887 int ret;
1888 struct ldb_dn *dn;
1890 *ntds_guid = GUID_zero();
1892 ret = samdb_reference_dn(ldb, ldb, computer_dn, "serverReferenceBL", &dn);
1893 if (ret != LDB_SUCCESS) {
1894 return ret;
1897 if (!ldb_dn_add_child_fmt(dn, "CN=NTDS Settings")) {
1898 talloc_free(dn);
1899 return LDB_ERR_OPERATIONS_ERROR;
1902 ret = dsdb_find_guid_by_dn(ldb, dn, ntds_guid);
1903 talloc_free(dn);
1904 return ret;
1908 find a 'reference' DN that points at another object
1909 (eg. serverReference, rIDManagerReference etc)
1911 int samdb_reference_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *base,
1912 const char *attribute, struct ldb_dn **dn)
1914 const char *attrs[2];
1915 struct ldb_result *res;
1916 int ret;
1918 attrs[0] = attribute;
1919 attrs[1] = NULL;
1921 ret = dsdb_search(ldb, mem_ctx, &res, base, LDB_SCOPE_BASE, attrs, DSDB_SEARCH_ONE_ONLY|DSDB_SEARCH_SHOW_EXTENDED_DN, NULL);
1922 if (ret != LDB_SUCCESS) {
1923 ldb_asprintf_errstring(ldb, "Cannot find DN %s to get attribute %s for reference dn: %s",
1924 ldb_dn_get_linearized(base), attribute, ldb_errstring(ldb));
1925 return ret;
1928 *dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, res->msgs[0], attribute);
1929 if (!*dn) {
1930 if (!ldb_msg_find_element(res->msgs[0], attribute)) {
1931 ldb_asprintf_errstring(ldb, "Cannot find attribute %s of %s to calculate reference dn", attribute,
1932 ldb_dn_get_linearized(base));
1933 } else {
1934 ldb_asprintf_errstring(ldb, "Cannot interpret attribute %s of %s as a dn", attribute,
1935 ldb_dn_get_linearized(base));
1937 talloc_free(res);
1938 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1941 talloc_free(res);
1942 return LDB_SUCCESS;
1946 find if a DN (must have GUID component!) is our ntdsDsa
1948 int samdb_dn_is_our_ntdsa(struct ldb_context *ldb, struct ldb_dn *dn, bool *is_ntdsa)
1950 NTSTATUS status;
1951 struct GUID dn_guid;
1952 const struct GUID *our_ntds_guid;
1953 status = dsdb_get_extended_dn_guid(dn, &dn_guid, "GUID");
1954 if (!NT_STATUS_IS_OK(status)) {
1955 return LDB_ERR_OPERATIONS_ERROR;
1958 our_ntds_guid = samdb_ntds_objectGUID(ldb);
1959 if (!our_ntds_guid) {
1960 DEBUG(0, ("Failed to find our NTDS Settings GUID for comparison with %s - %s\n", ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
1961 return LDB_ERR_OPERATIONS_ERROR;
1964 *is_ntdsa = GUID_equal(&dn_guid, our_ntds_guid);
1965 return LDB_SUCCESS;
1969 find a 'reference' DN that points at another object and indicate if it is our ntdsDsa
1971 int samdb_reference_dn_is_our_ntdsa(struct ldb_context *ldb, struct ldb_dn *base,
1972 const char *attribute, bool *is_ntdsa)
1974 int ret;
1975 struct ldb_dn *referenced_dn;
1976 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
1977 if (tmp_ctx == NULL) {
1978 return LDB_ERR_OPERATIONS_ERROR;
1980 ret = samdb_reference_dn(ldb, tmp_ctx, base, attribute, &referenced_dn);
1981 if (ret != LDB_SUCCESS) {
1982 DEBUG(0, ("Failed to find object %s for attribute %s - %s\n", ldb_dn_get_linearized(base), attribute, ldb_errstring(ldb)));
1983 return ret;
1986 ret = samdb_dn_is_our_ntdsa(ldb, referenced_dn, is_ntdsa);
1988 talloc_free(tmp_ctx);
1989 return ret;
1993 find our machine account via the serverReference attribute in the
1994 server DN
1996 int samdb_server_reference_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn **dn)
1998 struct ldb_dn *server_dn;
1999 int ret;
2001 server_dn = samdb_server_dn(ldb, mem_ctx);
2002 if (server_dn == NULL) {
2003 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
2006 ret = samdb_reference_dn(ldb, mem_ctx, server_dn, "serverReference", dn);
2007 talloc_free(server_dn);
2009 return ret;
2013 find the RID Manager$ DN via the rIDManagerReference attribute in the
2014 base DN
2016 int samdb_rid_manager_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn **dn)
2018 return samdb_reference_dn(ldb, mem_ctx, ldb_get_default_basedn(ldb),
2019 "rIDManagerReference", dn);
2023 find the RID Set DN via the rIDSetReferences attribute in our
2024 machine account DN
2026 int samdb_rid_set_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn **dn)
2028 struct ldb_dn *server_ref_dn = NULL;
2029 int ret;
2031 ret = samdb_server_reference_dn(ldb, mem_ctx, &server_ref_dn);
2032 if (ret != LDB_SUCCESS) {
2033 return ret;
2035 ret = samdb_reference_dn(ldb, mem_ctx, server_ref_dn, "rIDSetReferences", dn);
2036 talloc_free(server_ref_dn);
2037 return ret;
2040 const char *samdb_server_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
2042 const struct ldb_val *val = ldb_dn_get_rdn_val(samdb_server_site_dn(ldb,
2043 mem_ctx));
2045 if (val == NULL) {
2046 return NULL;
2049 return (const char *) val->data;
2053 * Finds the client site by using the client's IP address.
2054 * The "subnet_name" returns the name of the subnet if parameter != NULL
2056 * Has a Windows-based fallback to provide the only site available, or an empty
2057 * string if there are multiple sites.
2059 const char *samdb_client_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2060 const char *ip_address, char **subnet_name,
2061 bool fallback)
2063 const char *attrs[] = { "cn", "siteObject", NULL };
2064 struct ldb_dn *sites_container_dn = NULL;
2065 struct ldb_dn *subnets_dn = NULL;
2066 struct ldb_dn *sites_dn = NULL;
2067 struct ldb_result *res = NULL;
2068 const struct ldb_val *val = NULL;
2069 const char *site_name = NULL;
2070 const char *l_subnet_name = NULL;
2071 const char *allow_list[2] = { NULL, NULL };
2072 unsigned int i, count;
2073 int ret;
2076 * if we don't have a client ip e.g. ncalrpc
2077 * the server site is the client site
2079 if (ip_address == NULL) {
2080 return samdb_server_site_name(ldb, mem_ctx);
2083 sites_container_dn = samdb_sites_dn(ldb, mem_ctx);
2084 if (sites_container_dn == NULL) {
2085 goto exit;
2088 subnets_dn = ldb_dn_copy(mem_ctx, sites_container_dn);
2089 if ( ! ldb_dn_add_child_fmt(subnets_dn, "CN=Subnets")) {
2090 goto exit;
2093 ret = ldb_search(ldb, mem_ctx, &res, subnets_dn, LDB_SCOPE_ONELEVEL,
2094 attrs, NULL);
2095 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2096 count = 0;
2097 } else if (ret != LDB_SUCCESS) {
2098 goto exit;
2099 } else {
2100 count = res->count;
2103 for (i = 0; i < count; i++) {
2104 l_subnet_name = ldb_msg_find_attr_as_string(res->msgs[i], "cn",
2105 NULL);
2107 allow_list[0] = l_subnet_name;
2109 if (allow_access_nolog(NULL, allow_list, "", ip_address)) {
2110 sites_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx,
2111 res->msgs[i],
2112 "siteObject");
2113 if (sites_dn == NULL) {
2114 /* No reference, maybe another subnet matches */
2115 continue;
2118 /* "val" cannot be NULL here since "sites_dn" != NULL */
2119 val = ldb_dn_get_rdn_val(sites_dn);
2120 site_name = talloc_strdup(mem_ctx,
2121 (const char *) val->data);
2123 TALLOC_FREE(sites_dn);
2125 break;
2129 if (site_name == NULL && fallback) {
2130 /* This is the Windows Server fallback rule: when no subnet
2131 * exists and we have only one site available then use it (it
2132 * is for sure the same as our server site). If more sites do
2133 * exist then we don't know which one to use and set the site
2134 * name to "". */
2135 size_t cnt = 0;
2136 ret = dsdb_domain_count(
2137 ldb,
2138 &cnt,
2139 sites_container_dn,
2140 NULL,
2141 LDB_SCOPE_SUBTREE,
2142 "(objectClass=site)");
2143 if (ret != LDB_SUCCESS) {
2144 goto exit;
2146 if (cnt == 1) {
2147 site_name = samdb_server_site_name(ldb, mem_ctx);
2148 } else {
2149 site_name = talloc_strdup(mem_ctx, "");
2151 l_subnet_name = NULL;
2154 if (subnet_name != NULL) {
2155 *subnet_name = talloc_strdup(mem_ctx, l_subnet_name);
2158 exit:
2159 TALLOC_FREE(sites_container_dn);
2160 TALLOC_FREE(subnets_dn);
2161 TALLOC_FREE(res);
2163 return site_name;
2167 work out if we are the PDC for the domain of the current open ldb
2169 bool samdb_is_pdc(struct ldb_context *ldb)
2171 int ret;
2172 bool is_pdc;
2174 ret = samdb_reference_dn_is_our_ntdsa(ldb, ldb_get_default_basedn(ldb), "fsmoRoleOwner",
2175 &is_pdc);
2176 if (ret != LDB_SUCCESS) {
2177 DEBUG(1,("Failed to find if we are the PDC for this ldb: Searching for fSMORoleOwner in %s failed: %s\n",
2178 ldb_dn_get_linearized(ldb_get_default_basedn(ldb)),
2179 ldb_errstring(ldb)));
2180 return false;
2183 return is_pdc;
2187 work out if we are a Global Catalog server for the domain of the current open ldb
2189 bool samdb_is_gc(struct ldb_context *ldb)
2191 uint32_t options = 0;
2192 if (samdb_ntds_options(ldb, &options) != LDB_SUCCESS) {
2193 return false;
2195 return (options & DS_NTDSDSA_OPT_IS_GC) != 0;
2198 /* Find a domain object in the parents of a particular DN. */
2199 int samdb_search_for_parent_domain(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2200 struct ldb_dn **parent_dn, const char **errstring)
2202 TALLOC_CTX *local_ctx;
2203 struct ldb_dn *sdn = dn;
2204 struct ldb_result *res = NULL;
2205 int ret = LDB_SUCCESS;
2206 const char *attrs[] = { NULL };
2208 local_ctx = talloc_new(mem_ctx);
2209 if (local_ctx == NULL) return ldb_oom(ldb);
2211 while ((sdn = ldb_dn_get_parent(local_ctx, sdn))) {
2212 ret = ldb_search(ldb, local_ctx, &res, sdn, LDB_SCOPE_BASE, attrs,
2213 "(|(objectClass=domain)(objectClass=builtinDomain))");
2214 if (ret == LDB_SUCCESS) {
2215 if (res->count == 1) {
2216 break;
2218 } else {
2219 break;
2223 if (ret != LDB_SUCCESS) {
2224 *errstring = talloc_asprintf(mem_ctx, "Error searching for parent domain of %s, failed searching for %s: %s",
2225 ldb_dn_get_linearized(dn),
2226 ldb_dn_get_linearized(sdn),
2227 ldb_errstring(ldb));
2228 talloc_free(local_ctx);
2229 return ret;
2231 /* should never be true with 'ret=LDB_SUCCESS', here to satisfy clang */
2232 if (res == NULL) {
2233 talloc_free(local_ctx);
2234 return LDB_ERR_OTHER;
2236 if (res->count != 1) {
2237 *errstring = talloc_asprintf(mem_ctx, "Invalid dn (%s), not child of a domain object",
2238 ldb_dn_get_linearized(dn));
2239 DEBUG(0,(__location__ ": %s\n", *errstring));
2240 talloc_free(local_ctx);
2241 return LDB_ERR_CONSTRAINT_VIOLATION;
2244 *parent_dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
2245 talloc_free(local_ctx);
2246 return ret;
2249 static void pwd_timeout_debug(struct tevent_context *unused1,
2250 struct tevent_timer *unused2,
2251 struct timeval unused3,
2252 void *unused4)
2254 DEBUG(0, ("WARNING: check_password_complexity: password script "
2255 "took more than 1 second to run\n"));
2260 * Performs checks on a user password (plaintext UNIX format - attribute
2261 * "password"). The remaining parameters have to be extracted from the domain
2262 * object in the AD.
2264 * Result codes from "enum samr_ValidationStatus" (consider "samr.idl")
2266 enum samr_ValidationStatus samdb_check_password(TALLOC_CTX *mem_ctx,
2267 struct loadparm_context *lp_ctx,
2268 const char *account_name,
2269 const char *user_principal_name,
2270 const char *full_name,
2271 const DATA_BLOB *utf8_blob,
2272 const uint32_t pwdProperties,
2273 const uint32_t minPwdLength)
2275 const struct loadparm_substitution *lp_sub =
2276 lpcfg_noop_substitution();
2277 char *password_script = NULL;
2278 const char *utf8_pw = (const char *)utf8_blob->data;
2281 * This looks strange because it is.
2283 * The check for the number of characters in the password
2284 * should clearly not be against the byte length, or else a
2285 * single UTF8 character would count for more than one.
2287 * We have chosen to use the number of 16-bit units that the
2288 * password encodes to as the measure of length. This is not
2289 * the same as the number of codepoints, if a password
2290 * contains a character beyond the Basic Multilingual Plane
2291 * (above 65535) it will count for more than one "character".
2294 size_t password_characters_roughly = strlen_m(utf8_pw);
2296 /* checks if the "minPwdLength" property is satisfied */
2297 if (minPwdLength > password_characters_roughly) {
2298 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
2301 /* We might not be asked to check the password complexity */
2302 if (!(pwdProperties & DOMAIN_PASSWORD_COMPLEX)) {
2303 return SAMR_VALIDATION_STATUS_SUCCESS;
2306 if (password_characters_roughly == 0) {
2307 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
2310 password_script = lpcfg_check_password_script(lp_ctx, lp_sub, mem_ctx);
2311 if (password_script != NULL && *password_script != '\0') {
2312 int check_ret = 0;
2313 int error = 0;
2314 ssize_t nwritten = 0;
2315 struct tevent_context *event_ctx = NULL;
2316 struct tevent_req *req = NULL;
2317 int cps_stdin = -1;
2318 const char * const cmd[4] = {
2319 "/bin/sh", "-c",
2320 password_script,
2321 NULL
2324 event_ctx = tevent_context_init(mem_ctx);
2325 if (event_ctx == NULL) {
2326 TALLOC_FREE(password_script);
2327 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2330 /* Gives a warning after 1 second, terminates after 10 */
2331 tevent_add_timer(event_ctx, event_ctx,
2332 tevent_timeval_current_ofs(1, 0),
2333 pwd_timeout_debug, NULL);
2335 check_ret = setenv("SAMBA_CPS_ACCOUNT_NAME", account_name, 1);
2336 if (check_ret != 0) {
2337 TALLOC_FREE(password_script);
2338 TALLOC_FREE(event_ctx);
2339 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2341 if (user_principal_name != NULL) {
2342 check_ret = setenv("SAMBA_CPS_USER_PRINCIPAL_NAME",
2343 user_principal_name, 1);
2344 } else {
2345 unsetenv("SAMBA_CPS_USER_PRINCIPAL_NAME");
2347 if (check_ret != 0) {
2348 TALLOC_FREE(password_script);
2349 TALLOC_FREE(event_ctx);
2350 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2352 if (full_name != NULL) {
2353 check_ret = setenv("SAMBA_CPS_FULL_NAME", full_name, 1);
2354 } else {
2355 unsetenv("SAMBA_CPS_FULL_NAME");
2357 if (check_ret != 0) {
2358 TALLOC_FREE(password_script);
2359 TALLOC_FREE(event_ctx);
2360 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2363 req = samba_runcmd_send(event_ctx, event_ctx,
2364 tevent_timeval_current_ofs(10, 0),
2365 100, 100, cmd, NULL);
2366 unsetenv("SAMBA_CPS_ACCOUNT_NAME");
2367 unsetenv("SAMBA_CPS_USER_PRINCIPAL_NAME");
2368 unsetenv("SAMBA_CPS_FULL_NAME");
2369 if (req == NULL) {
2370 TALLOC_FREE(password_script);
2371 TALLOC_FREE(event_ctx);
2372 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2375 cps_stdin = samba_runcmd_export_stdin(req);
2377 nwritten = write_data(
2378 cps_stdin, utf8_blob->data, utf8_blob->length);
2379 if (nwritten == -1) {
2380 close(cps_stdin);
2381 TALLOC_FREE(password_script);
2382 TALLOC_FREE(event_ctx);
2383 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2386 close(cps_stdin);
2388 if (!tevent_req_poll(req, event_ctx)) {
2389 TALLOC_FREE(password_script);
2390 TALLOC_FREE(event_ctx);
2391 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2394 check_ret = samba_runcmd_recv(req, &error);
2395 TALLOC_FREE(event_ctx);
2397 if (error == ETIMEDOUT) {
2398 DEBUG(0, ("check_password_complexity: check password script took too long!\n"));
2399 TALLOC_FREE(password_script);
2400 return SAMR_VALIDATION_STATUS_PASSWORD_FILTER_ERROR;
2402 DEBUG(5,("check_password_complexity: check password script (%s) "
2403 "returned [%d]\n", password_script, check_ret));
2405 if (check_ret != 0) {
2406 DEBUG(1,("check_password_complexity: "
2407 "check password script said new password is not good "
2408 "enough!\n"));
2409 TALLOC_FREE(password_script);
2410 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
2413 TALLOC_FREE(password_script);
2414 return SAMR_VALIDATION_STATUS_SUCCESS;
2417 TALLOC_FREE(password_script);
2420 * Here are the standard AD password quality rules, which we
2421 * run after the script.
2424 if (!check_password_quality(utf8_pw)) {
2425 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
2428 return SAMR_VALIDATION_STATUS_SUCCESS;
2432 * Callback for "samdb_set_password" password change
2434 int samdb_set_password_callback(struct ldb_request *req, struct ldb_reply *ares)
2436 int ret;
2438 if (!ares) {
2439 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
2442 if (ares->error != LDB_SUCCESS) {
2443 ret = ares->error;
2444 req->context = talloc_steal(req,
2445 ldb_reply_get_control(ares, DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID));
2446 talloc_free(ares);
2447 return ldb_request_done(req, ret);
2450 if (ares->type != LDB_REPLY_DONE) {
2451 talloc_free(ares);
2452 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
2455 req->context = talloc_steal(req,
2456 ldb_reply_get_control(ares, DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID));
2457 talloc_free(ares);
2458 return ldb_request_done(req, LDB_SUCCESS);
2461 static NTSTATUS samdb_set_password_request(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2462 struct ldb_dn *user_dn,
2463 const DATA_BLOB *new_password,
2464 const struct samr_Password *ntNewHash,
2465 enum dsdb_password_checked old_password_checked,
2466 bool permit_interdomain_trust,
2467 struct ldb_request **req_out)
2469 struct ldb_message *msg;
2470 struct ldb_message_element *el;
2471 struct ldb_request *req;
2472 int ret;
2473 bool hash_values = false;
2475 *req_out = NULL;
2477 #define CHECK_RET(x) \
2478 if (x != LDB_SUCCESS) { \
2479 talloc_free(msg); \
2480 return NT_STATUS_NO_MEMORY; \
2483 msg = ldb_msg_new(mem_ctx);
2484 if (msg == NULL) {
2485 return NT_STATUS_NO_MEMORY;
2487 msg->dn = user_dn;
2488 if ((new_password != NULL)
2489 && ((ntNewHash == NULL))) {
2490 /* we have the password as plaintext UTF16 */
2491 CHECK_RET(ldb_msg_add_value(msg, "clearTextPassword",
2492 new_password, NULL));
2493 el = ldb_msg_find_element(msg, "clearTextPassword");
2494 el->flags = LDB_FLAG_MOD_REPLACE;
2495 } else if ((new_password == NULL)
2496 && ((ntNewHash != NULL))) {
2497 /* we have a password as NT hash */
2498 if (ntNewHash != NULL) {
2499 CHECK_RET(samdb_msg_add_hash(ldb, msg, msg,
2500 "unicodePwd", ntNewHash));
2501 el = ldb_msg_find_element(msg, "unicodePwd");
2502 el->flags = LDB_FLAG_MOD_REPLACE;
2504 hash_values = true;
2505 } else {
2506 /* the password wasn't specified correctly */
2507 talloc_free(msg);
2508 return NT_STATUS_INVALID_PARAMETER;
2511 #undef CHECK_RET
2513 /* build modify request */
2514 ret = ldb_build_mod_req(&req, ldb, mem_ctx, msg, NULL, NULL,
2515 samdb_set_password_callback, NULL);
2516 if (ret != LDB_SUCCESS) {
2517 talloc_free(msg);
2518 return NT_STATUS_NO_MEMORY;
2521 /* Tie the lifetime of the message to that of the request. */
2522 talloc_steal(req, msg);
2524 /* A password change operation */
2525 if (old_password_checked == DSDB_PASSWORD_CHECKED_AND_CORRECT) {
2526 struct dsdb_control_password_change *change;
2528 change = talloc(req, struct dsdb_control_password_change);
2529 if (change == NULL) {
2530 talloc_free(req);
2531 return NT_STATUS_NO_MEMORY;
2534 change->old_password_checked = old_password_checked;
2536 ret = ldb_request_add_control(req,
2537 DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID,
2538 true, change);
2539 if (ret != LDB_SUCCESS) {
2540 talloc_free(req);
2541 return NT_STATUS_NO_MEMORY;
2544 /* a KDC-triggered smart card password rollover (ResetSmartCardAccountPassword) */
2545 } else if (old_password_checked == DSDB_PASSWORD_KDC_RESET_SMARTCARD_ACCOUNT_PASSWORD) {
2546 ret = ldb_request_add_control(req,
2547 DSDB_CONTROL_PASSWORD_KDC_RESET_SMARTCARD_ACCOUNT_PASSWORD,
2548 true, NULL);
2549 if (ret != LDB_SUCCESS) {
2550 talloc_free(req);
2551 return NT_STATUS_NO_MEMORY;
2554 if (hash_values) {
2555 ret = ldb_request_add_control(req,
2556 DSDB_CONTROL_PASSWORD_HASH_VALUES_OID,
2557 true, NULL);
2558 if (ret != LDB_SUCCESS) {
2559 talloc_free(req);
2560 return NT_STATUS_NO_MEMORY;
2563 if (permit_interdomain_trust) {
2564 ret = ldb_request_add_control(req,
2565 DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID,
2566 false, NULL);
2567 if (ret != LDB_SUCCESS) {
2568 talloc_free(req);
2569 return NT_STATUS_NO_MEMORY;
2572 ret = ldb_request_add_control(req,
2573 DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
2574 true, NULL);
2575 if (ret != LDB_SUCCESS) {
2576 talloc_free(req);
2577 return NT_STATUS_NO_MEMORY;
2580 *req_out = req;
2582 return NT_STATUS_OK;
2586 * Sets the user password using plaintext UTF16 (attribute "new_password") or NT
2587 * (attribute "ntNewHash") hash. Also pass the old LM and/or NT hash (attributes
2588 * "lmOldHash"/"ntOldHash") if it is a user change or not. The "rejectReason"
2589 * gives some more information if the change failed.
2591 * Results: NT_STATUS_OK, NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
2592 * NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION,
2593 * NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY
2595 static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2596 struct ldb_dn *user_dn,
2597 const DATA_BLOB *new_password,
2598 const struct samr_Password *ntNewHash,
2599 enum dsdb_password_checked old_password_checked,
2600 enum samPwdChangeReason *reject_reason,
2601 struct samr_DomInfo1 **_dominfo,
2602 bool permit_interdomain_trust)
2604 struct ldb_request *req;
2605 struct dsdb_control_password_change_status *pwd_stat = NULL;
2606 int ret;
2607 NTSTATUS status = NT_STATUS_OK;
2609 status = samdb_set_password_request(ldb,
2610 mem_ctx,
2611 user_dn,
2612 new_password,
2613 ntNewHash,
2614 old_password_checked,
2615 permit_interdomain_trust,
2616 &req);
2617 if (!NT_STATUS_IS_OK(status)) {
2618 return status;
2621 ret = ldb_request(ldb, req);
2622 if (ret == LDB_SUCCESS) {
2623 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2626 if (req->context != NULL) {
2627 struct ldb_control *control = talloc_get_type_abort(req->context,
2628 struct ldb_control);
2629 pwd_stat = talloc_get_type_abort(control->data,
2630 struct dsdb_control_password_change_status);
2631 talloc_steal(mem_ctx, pwd_stat);
2634 talloc_free(req);
2636 /* Sets the domain info (if requested) */
2637 if (_dominfo != NULL) {
2638 struct samr_DomInfo1 *dominfo;
2640 dominfo = talloc_zero(mem_ctx, struct samr_DomInfo1);
2641 if (dominfo == NULL) {
2642 return NT_STATUS_NO_MEMORY;
2645 if (pwd_stat != NULL) {
2646 dominfo->min_password_length = pwd_stat->domain_data.minPwdLength;
2647 dominfo->password_properties = pwd_stat->domain_data.pwdProperties;
2648 dominfo->password_history_length = pwd_stat->domain_data.pwdHistoryLength;
2649 dominfo->max_password_age = pwd_stat->domain_data.maxPwdAge;
2650 dominfo->min_password_age = pwd_stat->domain_data.minPwdAge;
2653 *_dominfo = dominfo;
2656 if (reject_reason != NULL) {
2657 if (pwd_stat != NULL) {
2658 *reject_reason = pwd_stat->reject_reason;
2659 } else {
2660 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
2664 if (pwd_stat != NULL) {
2665 talloc_free(pwd_stat);
2668 if (ret == LDB_ERR_CONSTRAINT_VIOLATION) {
2669 const char *errmsg = ldb_errstring(ldb);
2670 char *endptr = NULL;
2671 WERROR werr = WERR_GEN_FAILURE;
2672 status = NT_STATUS_UNSUCCESSFUL;
2673 if (errmsg != NULL) {
2674 werr = W_ERROR(strtol(errmsg, &endptr, 16));
2675 DBG_WARNING("%s\n", errmsg);
2677 if (endptr != errmsg) {
2678 if (W_ERROR_EQUAL(werr, WERR_INVALID_PASSWORD)) {
2679 status = NT_STATUS_WRONG_PASSWORD;
2681 if (W_ERROR_EQUAL(werr, WERR_PASSWORD_RESTRICTION)) {
2682 status = NT_STATUS_PASSWORD_RESTRICTION;
2684 if (W_ERROR_EQUAL(werr, WERR_ACCOUNT_LOCKED_OUT)) {
2685 status = NT_STATUS_ACCOUNT_LOCKED_OUT;
2688 } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2689 /* don't let the caller know if an account doesn't exist */
2690 status = NT_STATUS_WRONG_PASSWORD;
2691 } else if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
2692 status = NT_STATUS_ACCESS_DENIED;
2693 } else if (ret != LDB_SUCCESS) {
2694 DEBUG(1, ("Failed to set password on %s: %s\n",
2695 ldb_dn_get_linearized(user_dn),
2696 ldb_errstring(ldb)));
2697 status = NT_STATUS_UNSUCCESSFUL;
2700 return status;
2703 NTSTATUS samdb_set_password(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2704 struct ldb_dn *user_dn,
2705 const DATA_BLOB *new_password,
2706 const struct samr_Password *ntNewHash,
2707 enum dsdb_password_checked old_password_checked,
2708 enum samPwdChangeReason *reject_reason,
2709 struct samr_DomInfo1 **_dominfo)
2711 return samdb_set_password_internal(ldb, mem_ctx,
2712 user_dn,
2713 new_password,
2714 ntNewHash,
2715 old_password_checked,
2716 reject_reason, _dominfo,
2717 false); /* reject trusts */
2721 * Sets the user password using plaintext UTF16 (attribute "new_password") or NT
2722 * (attribute "ntNewHash") hash. Also pass the old LM and/or NT hash (attributes
2723 * "lmOldHash"/"ntOldHash") if it is a user change or not. The "rejectReason"
2724 * gives some more information if the change failed.
2726 * This wrapper function for "samdb_set_password" takes a SID as input rather
2727 * than a user DN.
2729 * This call encapsulates a new LDB transaction for changing the password;
2730 * therefore the user hasn't to start a new one.
2732 * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
2733 * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
2734 * NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION,
2735 * NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY
2736 * NT_STATUS_TRANSACTION_ABORTED, NT_STATUS_NO_SUCH_USER
2738 NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2739 const struct dom_sid *user_sid,
2740 const uint32_t *new_version, /* optional for trusts */
2741 const DATA_BLOB *new_password,
2742 const struct samr_Password *ntNewHash,
2743 enum dsdb_password_checked old_password_checked,
2744 enum samPwdChangeReason *reject_reason,
2745 struct samr_DomInfo1 **_dominfo)
2747 TALLOC_CTX *frame = talloc_stackframe();
2748 NTSTATUS nt_status;
2749 static const char * const attrs[] = {
2750 "userAccountControl",
2751 "sAMAccountName",
2752 NULL
2754 struct ldb_message *user_msg = NULL;
2755 int ret;
2756 uint32_t uac = 0;
2758 ret = ldb_transaction_start(ldb);
2759 if (ret != LDB_SUCCESS) {
2760 DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ldb)));
2761 TALLOC_FREE(frame);
2762 return NT_STATUS_TRANSACTION_ABORTED;
2765 ret = dsdb_search_one(ldb, frame, &user_msg, ldb_get_default_basedn(ldb),
2766 LDB_SCOPE_SUBTREE, attrs, 0,
2767 "(&(objectSid=%s)(objectClass=user))",
2768 ldap_encode_ndr_dom_sid(frame, user_sid));
2769 if (ret != LDB_SUCCESS) {
2770 ldb_transaction_cancel(ldb);
2771 DEBUG(3, ("samdb_set_password_sid: SID[%s] not found in samdb %s - %s, "
2772 "returning NO_SUCH_USER\n",
2773 dom_sid_string(frame, user_sid),
2774 ldb_strerror(ret), ldb_errstring(ldb)));
2775 TALLOC_FREE(frame);
2776 return NT_STATUS_NO_SUCH_USER;
2779 uac = ldb_msg_find_attr_as_uint(user_msg, "userAccountControl", 0);
2780 if (!(uac & UF_ACCOUNT_TYPE_MASK)) {
2781 ldb_transaction_cancel(ldb);
2782 DEBUG(1, ("samdb_set_password_sid: invalid "
2783 "userAccountControl[0x%08X] for SID[%s] DN[%s], "
2784 "returning NO_SUCH_USER\n",
2785 (unsigned)uac, dom_sid_string(frame, user_sid),
2786 ldb_dn_get_linearized(user_msg->dn)));
2787 TALLOC_FREE(frame);
2788 return NT_STATUS_NO_SUCH_USER;
2791 if (uac & UF_INTERDOMAIN_TRUST_ACCOUNT) {
2792 static const char * const tdo_attrs[] = {
2793 "trustAuthIncoming",
2794 "trustDirection",
2795 NULL
2797 struct ldb_message *tdo_msg = NULL;
2798 const char *account_name = NULL;
2799 uint32_t trust_direction;
2800 uint32_t i;
2801 const struct ldb_val *old_val = NULL;
2802 struct trustAuthInOutBlob old_blob = {
2803 .count = 0,
2805 uint32_t old_version = 0;
2806 struct AuthenticationInformation *old_version_a = NULL;
2807 uint32_t _new_version = 0;
2808 struct trustAuthInOutBlob new_blob = {
2809 .count = 0,
2811 struct ldb_val new_val = {
2812 .length = 0,
2814 struct timeval tv = timeval_current();
2815 NTTIME now = timeval_to_nttime(&tv);
2816 enum ndr_err_code ndr_err;
2818 if (new_password == NULL && ntNewHash == NULL) {
2819 ldb_transaction_cancel(ldb);
2820 DEBUG(1, ("samdb_set_password_sid: "
2821 "no new password provided "
2822 "sAMAccountName for SID[%s] DN[%s], "
2823 "returning INVALID_PARAMETER\n",
2824 dom_sid_string(frame, user_sid),
2825 ldb_dn_get_linearized(user_msg->dn)));
2826 TALLOC_FREE(frame);
2827 return NT_STATUS_INVALID_PARAMETER;
2830 if (new_password != NULL && ntNewHash != NULL) {
2831 ldb_transaction_cancel(ldb);
2832 DEBUG(1, ("samdb_set_password_sid: "
2833 "two new passwords provided "
2834 "sAMAccountName for SID[%s] DN[%s], "
2835 "returning INVALID_PARAMETER\n",
2836 dom_sid_string(frame, user_sid),
2837 ldb_dn_get_linearized(user_msg->dn)));
2838 TALLOC_FREE(frame);
2839 return NT_STATUS_INVALID_PARAMETER;
2842 if (new_password != NULL && (new_password->length % 2)) {
2843 ldb_transaction_cancel(ldb);
2844 DEBUG(2, ("samdb_set_password_sid: "
2845 "invalid utf16 length (%zu) "
2846 "sAMAccountName for SID[%s] DN[%s], "
2847 "returning WRONG_PASSWORD\n",
2848 new_password->length,
2849 dom_sid_string(frame, user_sid),
2850 ldb_dn_get_linearized(user_msg->dn)));
2851 TALLOC_FREE(frame);
2852 return NT_STATUS_WRONG_PASSWORD;
2855 if (new_password != NULL && new_password->length >= 500) {
2856 ldb_transaction_cancel(ldb);
2857 DEBUG(2, ("samdb_set_password_sid: "
2858 "utf16 password too long (%zu) "
2859 "sAMAccountName for SID[%s] DN[%s], "
2860 "returning WRONG_PASSWORD\n",
2861 new_password->length,
2862 dom_sid_string(frame, user_sid),
2863 ldb_dn_get_linearized(user_msg->dn)));
2864 TALLOC_FREE(frame);
2865 return NT_STATUS_WRONG_PASSWORD;
2868 account_name = ldb_msg_find_attr_as_string(user_msg,
2869 "sAMAccountName", NULL);
2870 if (account_name == NULL) {
2871 ldb_transaction_cancel(ldb);
2872 DEBUG(1, ("samdb_set_password_sid: missing "
2873 "sAMAccountName for SID[%s] DN[%s], "
2874 "returning NO_SUCH_USER\n",
2875 dom_sid_string(frame, user_sid),
2876 ldb_dn_get_linearized(user_msg->dn)));
2877 TALLOC_FREE(frame);
2878 return NT_STATUS_NO_SUCH_USER;
2881 nt_status = dsdb_trust_search_tdo_by_type(ldb,
2882 SEC_CHAN_DOMAIN,
2883 account_name,
2884 tdo_attrs,
2885 frame, &tdo_msg);
2886 if (!NT_STATUS_IS_OK(nt_status)) {
2887 ldb_transaction_cancel(ldb);
2888 DEBUG(1, ("samdb_set_password_sid: dsdb_trust_search_tdo "
2889 "failed(%s) for sAMAccountName[%s] SID[%s] DN[%s], "
2890 "returning INTERNAL_DB_CORRUPTION\n",
2891 nt_errstr(nt_status), account_name,
2892 dom_sid_string(frame, user_sid),
2893 ldb_dn_get_linearized(user_msg->dn)));
2894 TALLOC_FREE(frame);
2895 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2898 trust_direction = ldb_msg_find_attr_as_int(tdo_msg,
2899 "trustDirection", 0);
2900 if (!(trust_direction & LSA_TRUST_DIRECTION_INBOUND)) {
2901 ldb_transaction_cancel(ldb);
2902 DEBUG(1, ("samdb_set_password_sid: direction[0x%08X] is "
2903 "not inbound for sAMAccountName[%s] "
2904 "DN[%s] TDO[%s], "
2905 "returning INTERNAL_DB_CORRUPTION\n",
2906 (unsigned)trust_direction,
2907 account_name,
2908 ldb_dn_get_linearized(user_msg->dn),
2909 ldb_dn_get_linearized(tdo_msg->dn)));
2910 TALLOC_FREE(frame);
2911 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2914 old_val = ldb_msg_find_ldb_val(tdo_msg, "trustAuthIncoming");
2915 if (old_val != NULL) {
2916 ndr_err = ndr_pull_struct_blob(old_val, frame, &old_blob,
2917 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2918 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2919 ldb_transaction_cancel(ldb);
2920 DEBUG(1, ("samdb_set_password_sid: "
2921 "failed(%s) to parse "
2922 "trustAuthOutgoing sAMAccountName[%s] "
2923 "DN[%s] TDO[%s], "
2924 "returning INTERNAL_DB_CORRUPTION\n",
2925 ndr_map_error2string(ndr_err),
2926 account_name,
2927 ldb_dn_get_linearized(user_msg->dn),
2928 ldb_dn_get_linearized(tdo_msg->dn)));
2930 TALLOC_FREE(frame);
2931 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2935 for (i = old_blob.current.count; i > 0; i--) {
2936 struct AuthenticationInformation *a =
2937 &old_blob.current.array[i - 1];
2939 switch (a->AuthType) {
2940 case TRUST_AUTH_TYPE_NONE:
2941 if (i == old_blob.current.count) {
2943 * remove TRUST_AUTH_TYPE_NONE at the
2944 * end
2946 old_blob.current.count--;
2948 break;
2950 case TRUST_AUTH_TYPE_VERSION:
2951 old_version_a = a;
2952 old_version = a->AuthInfo.version.version;
2953 break;
2955 case TRUST_AUTH_TYPE_CLEAR:
2956 break;
2958 case TRUST_AUTH_TYPE_NT4OWF:
2959 break;
2963 if (new_version == NULL) {
2964 _new_version = 0;
2965 new_version = &_new_version;
2968 if (old_version_a != NULL && *new_version != (old_version + 1)) {
2969 old_version_a->LastUpdateTime = now;
2970 old_version_a->AuthType = TRUST_AUTH_TYPE_NONE;
2973 new_blob.count = MAX(old_blob.current.count, 2);
2974 new_blob.current.array = talloc_zero_array(frame,
2975 struct AuthenticationInformation,
2976 new_blob.count);
2977 if (new_blob.current.array == NULL) {
2978 ldb_transaction_cancel(ldb);
2979 TALLOC_FREE(frame);
2980 return NT_STATUS_NO_MEMORY;
2982 new_blob.previous.array = talloc_zero_array(frame,
2983 struct AuthenticationInformation,
2984 new_blob.count);
2985 if (new_blob.current.array == NULL) {
2986 ldb_transaction_cancel(ldb);
2987 TALLOC_FREE(frame);
2988 return NT_STATUS_NO_MEMORY;
2991 for (i = 0; i < old_blob.current.count; i++) {
2992 struct AuthenticationInformation *o =
2993 &old_blob.current.array[i];
2994 struct AuthenticationInformation *p =
2995 &new_blob.previous.array[i];
2997 *p = *o;
2998 new_blob.previous.count++;
3000 for (; i < new_blob.count; i++) {
3001 struct AuthenticationInformation *pi =
3002 &new_blob.previous.array[i];
3004 if (i == 0) {
3006 * new_blob.previous is still empty so
3007 * we'll do new_blob.previous = new_blob.current
3008 * below.
3010 break;
3013 pi->LastUpdateTime = now;
3014 pi->AuthType = TRUST_AUTH_TYPE_NONE;
3015 new_blob.previous.count++;
3018 for (i = 0; i < new_blob.count; i++) {
3019 struct AuthenticationInformation *ci =
3020 &new_blob.current.array[i];
3022 ci->LastUpdateTime = now;
3023 switch (i) {
3024 case 0:
3025 if (ntNewHash != NULL) {
3026 ci->AuthType = TRUST_AUTH_TYPE_NT4OWF;
3027 ci->AuthInfo.nt4owf.password = *ntNewHash;
3028 break;
3031 ci->AuthType = TRUST_AUTH_TYPE_CLEAR;
3032 ci->AuthInfo.clear.size = new_password->length;
3033 ci->AuthInfo.clear.password = new_password->data;
3034 break;
3035 case 1:
3036 ci->AuthType = TRUST_AUTH_TYPE_VERSION;
3037 ci->AuthInfo.version.version = *new_version;
3038 break;
3039 default:
3040 ci->AuthType = TRUST_AUTH_TYPE_NONE;
3041 break;
3044 new_blob.current.count++;
3047 if (new_blob.previous.count == 0) {
3048 TALLOC_FREE(new_blob.previous.array);
3049 new_blob.previous = new_blob.current;
3052 ndr_err = ndr_push_struct_blob(&new_val, frame, &new_blob,
3053 (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
3054 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3055 ldb_transaction_cancel(ldb);
3056 DEBUG(1, ("samdb_set_password_sid: "
3057 "failed(%s) to generate "
3058 "trustAuthOutgoing sAMAccountName[%s] "
3059 "DN[%s] TDO[%s], "
3060 "returning UNSUCCESSFUL\n",
3061 ndr_map_error2string(ndr_err),
3062 account_name,
3063 ldb_dn_get_linearized(user_msg->dn),
3064 ldb_dn_get_linearized(tdo_msg->dn)));
3065 TALLOC_FREE(frame);
3066 return NT_STATUS_UNSUCCESSFUL;
3069 tdo_msg->num_elements = 0;
3070 TALLOC_FREE(tdo_msg->elements);
3072 ret = ldb_msg_append_value(tdo_msg, "trustAuthIncoming",
3073 &new_val, LDB_FLAG_MOD_REPLACE);
3074 if (ret != LDB_SUCCESS) {
3075 ldb_transaction_cancel(ldb);
3076 TALLOC_FREE(frame);
3077 return NT_STATUS_NO_MEMORY;
3080 ret = ldb_modify(ldb, tdo_msg);
3081 if (ret != LDB_SUCCESS) {
3082 nt_status = dsdb_ldb_err_to_ntstatus(ret);
3083 ldb_transaction_cancel(ldb);
3084 DEBUG(1, ("samdb_set_password_sid: "
3085 "failed to replace "
3086 "trustAuthOutgoing sAMAccountName[%s] "
3087 "DN[%s] TDO[%s], "
3088 "%s - %s\n",
3089 account_name,
3090 ldb_dn_get_linearized(user_msg->dn),
3091 ldb_dn_get_linearized(tdo_msg->dn),
3092 nt_errstr(nt_status), ldb_errstring(ldb)));
3093 TALLOC_FREE(frame);
3094 return nt_status;
3098 nt_status = samdb_set_password_internal(ldb, mem_ctx,
3099 user_msg->dn,
3100 new_password,
3101 ntNewHash,
3102 old_password_checked,
3103 reject_reason, _dominfo,
3104 true); /* permit trusts */
3105 if (!NT_STATUS_IS_OK(nt_status)) {
3106 ldb_transaction_cancel(ldb);
3107 TALLOC_FREE(frame);
3108 return nt_status;
3111 ret = ldb_transaction_commit(ldb);
3112 if (ret != LDB_SUCCESS) {
3113 DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
3114 ldb_dn_get_linearized(user_msg->dn),
3115 ldb_errstring(ldb)));
3116 TALLOC_FREE(frame);
3117 return NT_STATUS_TRANSACTION_ABORTED;
3120 TALLOC_FREE(frame);
3121 return NT_STATUS_OK;
3125 NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
3126 struct dom_sid *sid, struct ldb_dn **ret_dn)
3128 struct ldb_message *msg;
3129 struct ldb_dn *basedn = NULL;
3130 char *sidstr;
3131 int ret;
3133 sidstr = dom_sid_string(mem_ctx, sid);
3134 NT_STATUS_HAVE_NO_MEMORY(sidstr);
3136 /* We might have to create a ForeignSecurityPrincipal, even if this user
3137 * is in our own domain */
3139 msg = ldb_msg_new(sidstr);
3140 if (msg == NULL) {
3141 talloc_free(sidstr);
3142 return NT_STATUS_NO_MEMORY;
3145 ret = dsdb_wellknown_dn(sam_ctx, sidstr,
3146 ldb_get_default_basedn(sam_ctx),
3147 DS_GUID_FOREIGNSECURITYPRINCIPALS_CONTAINER,
3148 &basedn);
3149 if (ret != LDB_SUCCESS) {
3150 DEBUG(0, ("Failed to find DN for "
3151 "ForeignSecurityPrincipal container - %s\n", ldb_errstring(sam_ctx)));
3152 talloc_free(sidstr);
3153 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3156 /* add core elements to the ldb_message for the alias */
3157 msg->dn = basedn;
3158 if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr)) {
3159 talloc_free(sidstr);
3160 return NT_STATUS_NO_MEMORY;
3163 ret = ldb_msg_add_string(msg, "objectClass",
3164 "foreignSecurityPrincipal");
3165 if (ret != LDB_SUCCESS) {
3166 talloc_free(sidstr);
3167 return NT_STATUS_NO_MEMORY;
3170 /* create the alias */
3171 ret = ldb_add(sam_ctx, msg);
3172 if (ret != LDB_SUCCESS) {
3173 DEBUG(0,("Failed to create foreignSecurityPrincipal "
3174 "record %s: %s\n",
3175 ldb_dn_get_linearized(msg->dn),
3176 ldb_errstring(sam_ctx)));
3177 talloc_free(sidstr);
3178 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3181 *ret_dn = talloc_steal(mem_ctx, msg->dn);
3182 talloc_free(sidstr);
3184 return NT_STATUS_OK;
3189 Find the DN of a domain, assuming it to be a dotted.dns name
3192 struct ldb_dn *samdb_dns_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *dns_domain)
3194 unsigned int i;
3195 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
3196 const char *binary_encoded;
3197 const char * const *split_realm;
3198 struct ldb_dn *dn;
3200 if (!tmp_ctx) {
3201 return NULL;
3204 split_realm = (const char * const *)str_list_make(tmp_ctx, dns_domain, ".");
3205 if (!split_realm) {
3206 talloc_free(tmp_ctx);
3207 return NULL;
3209 dn = ldb_dn_new(mem_ctx, ldb, NULL);
3210 for (i=0; split_realm[i]; i++) {
3211 binary_encoded = ldb_binary_encode_string(tmp_ctx, split_realm[i]);
3212 if (binary_encoded == NULL) {
3213 DEBUG(2, ("Failed to add dc= element to DN %s\n",
3214 ldb_dn_get_linearized(dn)));
3215 talloc_free(tmp_ctx);
3216 return NULL;
3218 if (!ldb_dn_add_base_fmt(dn, "dc=%s", binary_encoded)) {
3219 DEBUG(2, ("Failed to add dc=%s element to DN %s\n",
3220 binary_encoded, ldb_dn_get_linearized(dn)));
3221 talloc_free(tmp_ctx);
3222 return NULL;
3225 if (!ldb_dn_validate(dn)) {
3226 DEBUG(2, ("Failed to validated DN %s\n",
3227 ldb_dn_get_linearized(dn)));
3228 talloc_free(tmp_ctx);
3229 return NULL;
3231 talloc_free(tmp_ctx);
3232 return dn;
3237 Find the DNS equivalent of a DN, in dotted DNS form
3239 char *samdb_dn_to_dns_domain(TALLOC_CTX *mem_ctx, struct ldb_dn *dn)
3241 int i, num_components = ldb_dn_get_comp_num(dn);
3242 char *dns_name = talloc_strdup(mem_ctx, "");
3243 if (dns_name == NULL) {
3244 return NULL;
3247 for (i=0; i<num_components; i++) {
3248 const struct ldb_val *v = ldb_dn_get_component_val(dn, i);
3249 char *s;
3250 if (v == NULL) {
3251 talloc_free(dns_name);
3252 return NULL;
3254 s = talloc_asprintf_append_buffer(dns_name, "%*.*s.",
3255 (int)v->length, (int)v->length, (char *)v->data);
3256 if (s == NULL) {
3257 talloc_free(dns_name);
3258 return NULL;
3260 dns_name = s;
3263 /* remove the last '.' */
3264 if (dns_name[0] != 0) {
3265 dns_name[strlen(dns_name)-1] = 0;
3268 return dns_name;
3272 Find the DNS _msdcs name for a given NTDS GUID. The resulting DNS
3273 name is based on the forest DNS name
3275 char *samdb_ntds_msdcs_dns_name(struct ldb_context *samdb,
3276 TALLOC_CTX *mem_ctx,
3277 const struct GUID *ntds_guid)
3279 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
3280 const char *guid_str;
3281 struct ldb_dn *forest_dn;
3282 const char *dnsforest;
3283 char *ret;
3285 guid_str = GUID_string(tmp_ctx, ntds_guid);
3286 if (guid_str == NULL) {
3287 talloc_free(tmp_ctx);
3288 return NULL;
3290 forest_dn = ldb_get_root_basedn(samdb);
3291 if (forest_dn == NULL) {
3292 talloc_free(tmp_ctx);
3293 return NULL;
3295 dnsforest = samdb_dn_to_dns_domain(tmp_ctx, forest_dn);
3296 if (dnsforest == NULL) {
3297 talloc_free(tmp_ctx);
3298 return NULL;
3300 ret = talloc_asprintf(mem_ctx, "%s._msdcs.%s", guid_str, dnsforest);
3301 talloc_free(tmp_ctx);
3302 return ret;
3307 Find the DN of a domain, be it the netbios or DNS name
3309 struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
3310 const char *domain_name)
3312 const char * const domain_ref_attrs[] = {
3313 "ncName", NULL
3315 const char * const domain_ref2_attrs[] = {
3316 NULL
3318 struct ldb_result *res_domain_ref;
3319 char *escaped_domain = ldb_binary_encode_string(mem_ctx, domain_name);
3320 int ret_domain;
3322 if (escaped_domain == NULL) {
3323 return NULL;
3326 /* find the domain's DN */
3327 ret_domain = ldb_search(ldb, mem_ctx,
3328 &res_domain_ref,
3329 samdb_partitions_dn(ldb, mem_ctx),
3330 LDB_SCOPE_ONELEVEL,
3331 domain_ref_attrs,
3332 "(&(nETBIOSName=%s)(objectclass=crossRef))",
3333 escaped_domain);
3334 if (ret_domain != LDB_SUCCESS) {
3335 return NULL;
3338 if (res_domain_ref->count == 0) {
3339 ret_domain = ldb_search(ldb, mem_ctx,
3340 &res_domain_ref,
3341 samdb_dns_domain_to_dn(ldb, mem_ctx, domain_name),
3342 LDB_SCOPE_BASE,
3343 domain_ref2_attrs,
3344 "(objectclass=domain)");
3345 if (ret_domain != LDB_SUCCESS) {
3346 return NULL;
3349 if (res_domain_ref->count == 1) {
3350 return res_domain_ref->msgs[0]->dn;
3352 return NULL;
3355 if (res_domain_ref->count > 1) {
3356 DEBUG(0,("Found %d records matching domain [%s]\n",
3357 ret_domain, domain_name));
3358 return NULL;
3361 return samdb_result_dn(ldb, mem_ctx, res_domain_ref->msgs[0], "nCName", NULL);
3367 use a GUID to find a DN
3369 int dsdb_find_dn_by_guid(struct ldb_context *ldb,
3370 TALLOC_CTX *mem_ctx,
3371 const struct GUID *guid,
3372 uint32_t dsdb_flags,
3373 struct ldb_dn **dn)
3375 int ret;
3376 struct ldb_result *res;
3377 const char *attrs[] = { NULL };
3378 struct GUID_txt_buf buf;
3379 char *guid_str = GUID_buf_string(guid, &buf);
3381 ret = dsdb_search(ldb, mem_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3382 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3383 DSDB_SEARCH_SHOW_EXTENDED_DN |
3384 DSDB_SEARCH_ONE_ONLY | dsdb_flags,
3385 "objectGUID=%s", guid_str);
3386 if (ret != LDB_SUCCESS) {
3387 return ret;
3390 *dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
3391 talloc_free(res);
3393 return LDB_SUCCESS;
3397 use a DN to find a GUID with a given attribute name
3399 int dsdb_find_guid_attr_by_dn(struct ldb_context *ldb,
3400 struct ldb_dn *dn, const char *attribute,
3401 struct GUID *guid)
3403 int ret;
3404 struct ldb_result *res = NULL;
3405 const char *attrs[2];
3406 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
3408 attrs[0] = attribute;
3409 attrs[1] = NULL;
3411 ret = dsdb_search_dn(ldb, tmp_ctx, &res, dn, attrs,
3412 DSDB_SEARCH_SHOW_DELETED |
3413 DSDB_SEARCH_SHOW_RECYCLED);
3414 if (ret != LDB_SUCCESS) {
3415 talloc_free(tmp_ctx);
3416 return ret;
3418 /* satisfy clang */
3419 if (res == NULL) {
3420 talloc_free(tmp_ctx);
3421 return LDB_ERR_OTHER;
3423 if (res->count < 1) {
3424 talloc_free(tmp_ctx);
3425 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
3427 *guid = samdb_result_guid(res->msgs[0], attribute);
3428 talloc_free(tmp_ctx);
3429 return LDB_SUCCESS;
3433 use a DN to find a GUID
3435 int dsdb_find_guid_by_dn(struct ldb_context *ldb,
3436 struct ldb_dn *dn, struct GUID *guid)
3438 return dsdb_find_guid_attr_by_dn(ldb, dn, "objectGUID", guid);
3444 adds the given GUID to the given ldb_message. This value is added
3445 for the given attr_name (may be either "objectGUID" or "parentGUID").
3446 This function is used in processing 'add' requests.
3448 int dsdb_msg_add_guid(struct ldb_message *msg,
3449 struct GUID *guid,
3450 const char *attr_name)
3452 int ret;
3453 struct ldb_val v;
3454 NTSTATUS status;
3455 TALLOC_CTX *tmp_ctx = talloc_init("dsdb_msg_add_guid");
3457 status = GUID_to_ndr_blob(guid, tmp_ctx, &v);
3458 if (!NT_STATUS_IS_OK(status)) {
3459 ret = LDB_ERR_OPERATIONS_ERROR;
3460 goto done;
3463 ret = ldb_msg_add_steal_value(msg, attr_name, &v);
3464 if (ret != LDB_SUCCESS) {
3465 DEBUG(4,(__location__ ": Failed to add %s to the message\n",
3466 attr_name));
3467 goto done;
3470 ret = LDB_SUCCESS;
3472 done:
3473 talloc_free(tmp_ctx);
3474 return ret;
3480 use a DN to find a SID
3482 int dsdb_find_sid_by_dn(struct ldb_context *ldb,
3483 struct ldb_dn *dn, struct dom_sid *sid)
3485 int ret;
3486 struct ldb_result *res = NULL;
3487 const char *attrs[] = { "objectSid", NULL };
3488 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
3489 struct dom_sid *s;
3491 ZERO_STRUCTP(sid);
3493 ret = dsdb_search_dn(ldb, tmp_ctx, &res, dn, attrs,
3494 DSDB_SEARCH_SHOW_DELETED |
3495 DSDB_SEARCH_SHOW_RECYCLED);
3496 if (ret != LDB_SUCCESS) {
3497 talloc_free(tmp_ctx);
3498 return ret;
3500 if (res == NULL) {
3501 talloc_free(tmp_ctx);
3502 return LDB_ERR_OTHER;
3504 if (res->count < 1) {
3505 talloc_free(tmp_ctx);
3506 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
3508 s = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
3509 if (s == NULL) {
3510 talloc_free(tmp_ctx);
3511 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
3513 *sid = *s;
3514 talloc_free(tmp_ctx);
3515 return LDB_SUCCESS;
3519 use a SID to find a DN
3521 int dsdb_find_dn_by_sid(struct ldb_context *ldb,
3522 TALLOC_CTX *mem_ctx,
3523 struct dom_sid *sid, struct ldb_dn **dn)
3525 int ret;
3526 struct ldb_result *res;
3527 const char *attrs[] = { NULL };
3528 char *sid_str = ldap_encode_ndr_dom_sid(mem_ctx, sid);
3530 if (!sid_str) {
3531 return ldb_operr(ldb);
3534 ret = dsdb_search(ldb, mem_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3535 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3536 DSDB_SEARCH_SHOW_EXTENDED_DN |
3537 DSDB_SEARCH_ONE_ONLY,
3538 "objectSid=%s", sid_str);
3539 talloc_free(sid_str);
3540 if (ret != LDB_SUCCESS) {
3541 return ret;
3544 *dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
3545 talloc_free(res);
3547 return LDB_SUCCESS;
3551 load a repsFromTo blob list for a given partition GUID
3552 attr must be "repsFrom" or "repsTo"
3554 WERROR dsdb_loadreps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
3555 const char *attr, struct repsFromToBlob **r, uint32_t *count)
3557 const char *attrs[] = { attr, NULL };
3558 struct ldb_result *res = NULL;
3559 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
3560 unsigned int i;
3561 struct ldb_message_element *el;
3562 int ret;
3564 *r = NULL;
3565 *count = 0;
3567 if (tmp_ctx == NULL) {
3568 return WERR_NOT_ENOUGH_MEMORY;
3571 ret = dsdb_search_dn(sam_ctx, tmp_ctx, &res, dn, attrs, 0);
3572 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3573 /* partition hasn't been replicated yet */
3574 talloc_free(tmp_ctx);
3575 return WERR_OK;
3577 if (ret != LDB_SUCCESS) {
3578 DEBUG(0,("dsdb_loadreps: failed to read partition object: %s\n", ldb_errstring(sam_ctx)));
3579 talloc_free(tmp_ctx);
3580 return WERR_DS_DRA_INTERNAL_ERROR;
3583 /* satisfy clang */
3584 if (res == NULL) {
3585 talloc_free(tmp_ctx);
3586 return WERR_DS_DRA_INTERNAL_ERROR;
3588 el = ldb_msg_find_element(res->msgs[0], attr);
3589 if (el == NULL) {
3590 /* it's OK to be empty */
3591 talloc_free(tmp_ctx);
3592 return WERR_OK;
3595 *count = el->num_values;
3596 *r = talloc_array(mem_ctx, struct repsFromToBlob, *count);
3597 if (*r == NULL) {
3598 talloc_free(tmp_ctx);
3599 return WERR_DS_DRA_INTERNAL_ERROR;
3602 for (i=0; i<(*count); i++) {
3603 enum ndr_err_code ndr_err;
3604 ndr_err = ndr_pull_struct_blob(&el->values[i],
3605 mem_ctx,
3606 &(*r)[i],
3607 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3608 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3609 talloc_free(tmp_ctx);
3610 return WERR_DS_DRA_INTERNAL_ERROR;
3614 talloc_free(tmp_ctx);
3616 return WERR_OK;
3620 save the repsFromTo blob list for a given partition GUID
3621 attr must be "repsFrom" or "repsTo"
3623 WERROR dsdb_savereps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
3624 const char *attr, struct repsFromToBlob *r, uint32_t count)
3626 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
3627 struct ldb_message *msg;
3628 struct ldb_message_element *el;
3629 unsigned int i;
3631 if (tmp_ctx == NULL) {
3632 goto failed;
3635 msg = ldb_msg_new(tmp_ctx);
3636 if (msg == NULL) {
3637 goto failed;
3639 msg->dn = dn;
3640 if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_REPLACE, &el) != LDB_SUCCESS) {
3641 goto failed;
3644 el->values = talloc_array(msg, struct ldb_val, count);
3645 if (!el->values) {
3646 goto failed;
3649 for (i=0; i<count; i++) {
3650 struct ldb_val v;
3651 enum ndr_err_code ndr_err;
3653 ndr_err = ndr_push_struct_blob(&v, tmp_ctx,
3654 &r[i],
3655 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3656 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3657 goto failed;
3660 el->num_values++;
3661 el->values[i] = v;
3664 if (dsdb_modify(sam_ctx, msg, 0) != LDB_SUCCESS) {
3665 DEBUG(0,("Failed to store %s - %s\n", attr, ldb_errstring(sam_ctx)));
3666 goto failed;
3669 talloc_free(tmp_ctx);
3671 return WERR_OK;
3673 failed:
3674 talloc_free(tmp_ctx);
3675 return WERR_DS_DRA_INTERNAL_ERROR;
3680 load the uSNHighest and the uSNUrgent attributes from the @REPLCHANGED
3681 object for a partition
3683 int dsdb_load_partition_usn(struct ldb_context *ldb, struct ldb_dn *dn,
3684 uint64_t *uSN, uint64_t *urgent_uSN)
3686 struct ldb_request *req;
3687 int ret;
3688 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
3689 struct dsdb_control_current_partition *p_ctrl;
3690 struct ldb_result *res;
3692 if (tmp_ctx == NULL) {
3693 return ldb_oom(ldb);
3696 res = talloc_zero(tmp_ctx, struct ldb_result);
3697 if (!res) {
3698 talloc_free(tmp_ctx);
3699 return ldb_oom(ldb);
3702 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
3703 ldb_dn_new(tmp_ctx, ldb, "@REPLCHANGED"),
3704 LDB_SCOPE_BASE,
3705 NULL, NULL,
3706 NULL,
3707 res, ldb_search_default_callback,
3708 NULL);
3709 if (ret != LDB_SUCCESS) {
3710 talloc_free(tmp_ctx);
3711 return ret;
3714 p_ctrl = talloc(req, struct dsdb_control_current_partition);
3715 if (p_ctrl == NULL) {
3716 talloc_free(tmp_ctx);
3717 return ldb_oom(ldb);
3719 p_ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
3720 p_ctrl->dn = dn;
3722 ret = ldb_request_add_control(req,
3723 DSDB_CONTROL_CURRENT_PARTITION_OID,
3724 false, p_ctrl);
3725 if (ret != LDB_SUCCESS) {
3726 talloc_free(tmp_ctx);
3727 return ret;
3730 /* Run the new request */
3731 ret = ldb_request(ldb, req);
3733 if (ret == LDB_SUCCESS) {
3734 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
3737 if (ret == LDB_ERR_NO_SUCH_OBJECT || ret == LDB_ERR_INVALID_DN_SYNTAX) {
3738 /* it hasn't been created yet, which means
3739 an implicit value of zero */
3740 *uSN = 0;
3741 talloc_free(tmp_ctx);
3742 return LDB_SUCCESS;
3745 if (ret != LDB_SUCCESS) {
3746 talloc_free(tmp_ctx);
3747 return ret;
3750 if (res->count < 1) {
3751 *uSN = 0;
3752 if (urgent_uSN) {
3753 *urgent_uSN = 0;
3755 } else {
3756 *uSN = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNHighest", 0);
3757 if (urgent_uSN) {
3758 *urgent_uSN = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNUrgent", 0);
3762 talloc_free(tmp_ctx);
3764 return LDB_SUCCESS;
3767 int drsuapi_DsReplicaCursor2_compare(const struct drsuapi_DsReplicaCursor2 *c1,
3768 const struct drsuapi_DsReplicaCursor2 *c2)
3770 return GUID_compare(&c1->source_dsa_invocation_id, &c2->source_dsa_invocation_id);
3773 int drsuapi_DsReplicaCursor_compare(const struct drsuapi_DsReplicaCursor *c1,
3774 const struct drsuapi_DsReplicaCursor *c2)
3776 return GUID_compare(&c1->source_dsa_invocation_id, &c2->source_dsa_invocation_id);
3780 * Return the NTDS object for a GUID, confirming it is in the
3781 * configuration partition and a nTDSDSA object
3783 int samdb_get_ntds_obj_by_guid(TALLOC_CTX *mem_ctx,
3784 struct ldb_context *sam_ctx,
3785 const struct GUID *objectGUID,
3786 const char **attrs,
3787 struct ldb_message **msg)
3789 int ret;
3790 struct ldb_result *res;
3791 struct GUID_txt_buf guid_buf;
3792 char *guid_str = GUID_buf_string(objectGUID, &guid_buf);
3793 struct ldb_dn *config_dn = NULL;
3795 config_dn = ldb_get_config_basedn(sam_ctx);
3796 if (config_dn == NULL) {
3797 return ldb_operr(sam_ctx);
3800 ret = dsdb_search(sam_ctx,
3801 mem_ctx,
3802 &res,
3803 config_dn,
3804 LDB_SCOPE_SUBTREE,
3805 attrs,
3806 DSDB_SEARCH_ONE_ONLY,
3807 "(&(objectGUID=%s)(objectClass=nTDSDSA))",
3808 guid_str);
3809 if (ret != LDB_SUCCESS) {
3810 return ret;
3812 if (msg) {
3813 *msg = talloc_steal(mem_ctx, res->msgs[0]);
3815 TALLOC_FREE(res);
3816 return ret;
3821 see if a computer identified by its objectGUID is a RODC
3823 int samdb_is_rodc(struct ldb_context *sam_ctx, const struct GUID *objectGUID, bool *is_rodc)
3825 /* 1) find the DN for this servers NTDSDSA object
3826 2) search for the msDS-isRODC attribute
3827 3) if not present then not a RODC
3828 4) if present and TRUE then is a RODC
3830 const char *attrs[] = { "msDS-isRODC", NULL };
3831 int ret;
3832 struct ldb_message *msg;
3833 TALLOC_CTX *tmp_ctx = talloc_new(sam_ctx);
3835 if (tmp_ctx == NULL) {
3836 return ldb_oom(sam_ctx);
3839 ret = samdb_get_ntds_obj_by_guid(tmp_ctx,
3840 sam_ctx,
3841 objectGUID,
3842 attrs, &msg);
3844 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3845 *is_rodc = false;
3846 talloc_free(tmp_ctx);
3847 return LDB_SUCCESS;
3850 if (ret != LDB_SUCCESS) {
3851 DEBUG(1,("Failed to find our own NTDS Settings object by objectGUID=%s!\n",
3852 GUID_string(tmp_ctx, objectGUID)));
3853 *is_rodc = false;
3854 talloc_free(tmp_ctx);
3855 return ret;
3858 ret = ldb_msg_find_attr_as_bool(msg, "msDS-isRODC", 0);
3859 *is_rodc = (ret == 1);
3861 talloc_free(tmp_ctx);
3862 return LDB_SUCCESS;
3867 see if we are a RODC
3869 int samdb_rodc(struct ldb_context *sam_ctx, bool *am_rodc)
3871 const struct GUID *objectGUID;
3872 int ret;
3873 bool *cached;
3875 /* see if we have a cached copy */
3876 cached = (bool *)ldb_get_opaque(sam_ctx, "cache.am_rodc");
3877 if (cached) {
3878 *am_rodc = *cached;
3879 return LDB_SUCCESS;
3882 objectGUID = samdb_ntds_objectGUID(sam_ctx);
3883 if (!objectGUID) {
3884 return ldb_operr(sam_ctx);
3887 ret = samdb_is_rodc(sam_ctx, objectGUID, am_rodc);
3888 if (ret != LDB_SUCCESS) {
3889 return ret;
3892 cached = talloc(sam_ctx, bool);
3893 if (cached == NULL) {
3894 return ldb_oom(sam_ctx);
3896 *cached = *am_rodc;
3898 ret = ldb_set_opaque(sam_ctx, "cache.am_rodc", cached);
3899 if (ret != LDB_SUCCESS) {
3900 talloc_free(cached);
3901 return ldb_operr(sam_ctx);
3904 return LDB_SUCCESS;
3907 int samdb_dns_host_name(struct ldb_context *sam_ctx, const char **host_name)
3909 const char *_host_name = NULL;
3910 const char *attrs[] = { "dnsHostName", NULL };
3911 TALLOC_CTX *tmp_ctx = NULL;
3912 int ret;
3913 struct ldb_result *res = NULL;
3915 _host_name = (const char *)ldb_get_opaque(sam_ctx, "cache.dns_host_name");
3916 if (_host_name != NULL) {
3917 *host_name = _host_name;
3918 return LDB_SUCCESS;
3921 tmp_ctx = talloc_new(sam_ctx);
3922 if (tmp_ctx == NULL) {
3923 return ldb_oom(sam_ctx);
3926 ret = dsdb_search_dn(sam_ctx, tmp_ctx, &res, NULL, attrs, 0);
3928 if (res == NULL || res->count != 1 || ret != LDB_SUCCESS) {
3929 DEBUG(0, ("Failed to get rootDSE for dnsHostName: %s\n",
3930 ldb_errstring(sam_ctx)));
3931 TALLOC_FREE(tmp_ctx);
3932 return ret;
3935 _host_name = ldb_msg_find_attr_as_string(res->msgs[0],
3936 "dnsHostName",
3937 NULL);
3938 if (_host_name == NULL) {
3939 DEBUG(0, ("Failed to get dnsHostName from rootDSE\n"));
3940 TALLOC_FREE(tmp_ctx);
3941 return LDB_ERR_OPERATIONS_ERROR;
3943 ret = ldb_set_opaque(sam_ctx, "cache.dns_host_name",
3944 discard_const_p(char *, _host_name));
3945 if (ret != LDB_SUCCESS) {
3946 TALLOC_FREE(tmp_ctx);
3947 return ldb_operr(sam_ctx);
3950 *host_name = talloc_steal(sam_ctx, _host_name);
3952 TALLOC_FREE(tmp_ctx);
3953 return LDB_SUCCESS;
3956 bool samdb_set_am_rodc(struct ldb_context *ldb, bool am_rodc)
3958 TALLOC_CTX *tmp_ctx;
3959 bool *cached;
3961 tmp_ctx = talloc_new(ldb);
3962 if (tmp_ctx == NULL) {
3963 goto failed;
3966 cached = talloc(tmp_ctx, bool);
3967 if (!cached) {
3968 goto failed;
3971 *cached = am_rodc;
3972 if (ldb_set_opaque(ldb, "cache.am_rodc", cached) != LDB_SUCCESS) {
3973 goto failed;
3976 talloc_steal(ldb, cached);
3977 talloc_free(tmp_ctx);
3978 return true;
3980 failed:
3981 DEBUG(1,("Failed to set our own cached am_rodc in the ldb!\n"));
3982 talloc_free(tmp_ctx);
3983 return false;
3988 * return NTDSSiteSettings options. See MS-ADTS 7.1.1.2.2.1.1
3989 * flags are DS_NTDSSETTINGS_OPT_*
3991 int samdb_ntds_site_settings_options(struct ldb_context *ldb_ctx,
3992 uint32_t *options)
3994 int rc;
3995 TALLOC_CTX *tmp_ctx;
3996 struct ldb_result *res;
3997 struct ldb_dn *site_dn;
3998 const char *attrs[] = { "options", NULL };
4000 tmp_ctx = talloc_new(ldb_ctx);
4001 if (tmp_ctx == NULL)
4002 goto failed;
4004 /* Retrieve the site dn for the ldb that we
4005 * have open. This is our local site.
4007 site_dn = samdb_server_site_dn(ldb_ctx, tmp_ctx);
4008 if (site_dn == NULL)
4009 goto failed;
4011 /* Perform a one level (child) search from the local
4012 * site distinguished name. We're looking for the
4013 * "options" attribute within the nTDSSiteSettings
4014 * object
4016 rc = ldb_search(ldb_ctx, tmp_ctx, &res, site_dn,
4017 LDB_SCOPE_ONELEVEL, attrs,
4018 "objectClass=nTDSSiteSettings");
4020 if (rc != LDB_SUCCESS || res->count != 1)
4021 goto failed;
4023 *options = ldb_msg_find_attr_as_uint(res->msgs[0], "options", 0);
4025 talloc_free(tmp_ctx);
4027 return LDB_SUCCESS;
4029 failed:
4030 DEBUG(1,("Failed to find our NTDS Site Settings options in ldb!\n"));
4031 talloc_free(tmp_ctx);
4032 return ldb_error(ldb_ctx, LDB_ERR_NO_SUCH_OBJECT, __func__);
4036 return NTDS options flags. See MS-ADTS 7.1.1.2.2.1.2.1.1
4038 flags are DS_NTDS_OPTION_*
4040 int samdb_ntds_options(struct ldb_context *ldb, uint32_t *options)
4042 TALLOC_CTX *tmp_ctx;
4043 const char *attrs[] = { "options", NULL };
4044 int ret;
4045 struct ldb_result *res;
4047 tmp_ctx = talloc_new(ldb);
4048 if (tmp_ctx == NULL) {
4049 goto failed;
4052 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb, tmp_ctx), LDB_SCOPE_BASE, attrs, NULL);
4053 if (ret != LDB_SUCCESS) {
4054 goto failed;
4057 if (res->count != 1) {
4058 goto failed;
4061 *options = ldb_msg_find_attr_as_uint(res->msgs[0], "options", 0);
4063 talloc_free(tmp_ctx);
4065 return LDB_SUCCESS;
4067 failed:
4068 DEBUG(1,("Failed to find our own NTDS Settings options in the ldb!\n"));
4069 talloc_free(tmp_ctx);
4070 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
4073 const char* samdb_ntds_object_category(TALLOC_CTX *tmp_ctx, struct ldb_context *ldb)
4075 const char *attrs[] = { "objectCategory", NULL };
4076 int ret;
4077 struct ldb_result *res;
4079 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb, tmp_ctx), LDB_SCOPE_BASE, attrs, NULL);
4080 if (ret != LDB_SUCCESS) {
4081 goto failed;
4084 if (res->count != 1) {
4085 goto failed;
4088 return ldb_msg_find_attr_as_string(res->msgs[0], "objectCategory", NULL);
4090 failed:
4091 DEBUG(1,("Failed to find our own NTDS Settings objectCategory in the ldb!\n"));
4092 return NULL;
4096 * Function which generates a "lDAPDisplayName" attribute from a "CN" one.
4097 * Algorithm implemented according to MS-ADTS 3.1.1.2.3.4
4099 const char *samdb_cn_to_lDAPDisplayName(TALLOC_CTX *mem_ctx, const char *cn)
4101 char **tokens, *ret;
4102 size_t i;
4104 tokens = str_list_make(mem_ctx, cn, " -_");
4105 if (tokens == NULL || tokens[0] == NULL) {
4106 return NULL;
4109 /* "tolower()" and "toupper()" should also work properly on 0x00 */
4110 tokens[0][0] = tolower(tokens[0][0]);
4111 for (i = 1; tokens[i] != NULL; i++)
4112 tokens[i][0] = toupper(tokens[i][0]);
4114 ret = talloc_strdup(mem_ctx, tokens[0]);
4115 if (ret == NULL) {
4116 talloc_free(tokens);
4117 return NULL;
4119 for (i = 1; tokens[i] != NULL; i++) {
4120 ret = talloc_asprintf_append_buffer(ret, "%s", tokens[i]);
4121 if (ret == NULL) {
4122 talloc_free(tokens);
4123 return NULL;
4127 talloc_free(tokens);
4129 return ret;
4133 * This detects and returns the domain functional level (DS_DOMAIN_FUNCTION_*)
4135 int dsdb_functional_level(struct ldb_context *ldb)
4137 unsigned long long *domainFunctionality =
4138 talloc_get_type(ldb_get_opaque(ldb, "domainFunctionality"), unsigned long long);
4139 if (!domainFunctionality) {
4140 /* this is expected during initial provision */
4141 DEBUG(4,(__location__ ": WARNING: domainFunctionality not setup\n"));
4142 return DS_DOMAIN_FUNCTION_2000;
4144 return *domainFunctionality;
4148 * This detects and returns the forest functional level (DS_DOMAIN_FUNCTION_*)
4150 int dsdb_forest_functional_level(struct ldb_context *ldb)
4152 unsigned long long *forestFunctionality =
4153 talloc_get_type(ldb_get_opaque(ldb, "forestFunctionality"), unsigned long long);
4154 if (!forestFunctionality) {
4155 DEBUG(0,(__location__ ": WARNING: forestFunctionality not setup\n"));
4156 return DS_DOMAIN_FUNCTION_2000;
4158 return *forestFunctionality;
4162 * This detects and returns the DC functional level (DS_DOMAIN_FUNCTION_*)
4164 int dsdb_dc_functional_level(struct ldb_context *ldb)
4166 unsigned long long *dcFunctionality =
4167 talloc_get_type(ldb_get_opaque(ldb, "domainControllerFunctionality"), unsigned long long);
4168 if (!dcFunctionality) {
4169 /* this is expected during initial provision */
4170 DEBUG(4,(__location__ ": WARNING: domainControllerFunctionality not setup\n"));
4171 return DS_DOMAIN_FUNCTION_2008_R2;
4173 return *dcFunctionality;
4176 const char *dsdb_dc_operatingSystemVersion(int dc_functional_level)
4178 const char *operatingSystemVersion = NULL;
4181 * While we are there also update
4182 * operatingSystem and operatingSystemVersion
4183 * as at least operatingSystemVersion is really
4184 * important for some clients/applications (like exchange).
4187 if (dc_functional_level >= DS_DOMAIN_FUNCTION_2016) {
4188 /* Pretend Windows 2016 */
4189 operatingSystemVersion = "10.0 (14393)";
4190 } else if (dc_functional_level >= DS_DOMAIN_FUNCTION_2012_R2) {
4191 /* Pretend Windows 2012 R2 */
4192 operatingSystemVersion = "6.3 (9600)";
4193 } else if (dc_functional_level >= DS_DOMAIN_FUNCTION_2012) {
4194 /* Pretend Windows 2012 */
4195 operatingSystemVersion = "6.2 (9200)";
4196 } else {
4197 /* Pretend Windows 2008 R2 */
4198 operatingSystemVersion = "6.1 (7600)";
4201 return operatingSystemVersion;
4204 int dsdb_check_and_update_fl(struct ldb_context *ldb_ctx, struct loadparm_context *lp_ctx)
4206 TALLOC_CTX *frame = talloc_stackframe();
4207 int ret;
4209 int db_dc_functional_level;
4210 int db_domain_functional_level;
4211 int db_forest_functional_level;
4212 int lp_dc_functional_level = lpcfg_ad_dc_functional_level(lp_ctx);
4213 bool am_rodc;
4214 struct ldb_message *msg = NULL;
4215 struct ldb_dn *dc_ntds_settings_dn = NULL;
4216 struct ldb_dn *dc_computer_dn = NULL;
4217 const char *operatingSystem = NULL;
4218 const char *operatingSystemVersion = NULL;
4220 db_dc_functional_level = dsdb_dc_functional_level(ldb_ctx);
4221 db_domain_functional_level = dsdb_functional_level(ldb_ctx);
4222 db_forest_functional_level = dsdb_forest_functional_level(ldb_ctx);
4224 if (lp_dc_functional_level < db_domain_functional_level) {
4225 DBG_ERR("Refusing to start as smb.conf 'ad dc functional level' maps to %d, "
4226 "which is less than the domain functional level of %d\n",
4227 lp_dc_functional_level, db_domain_functional_level);
4228 TALLOC_FREE(frame);
4229 return LDB_ERR_CONSTRAINT_VIOLATION;
4232 if (lp_dc_functional_level < db_forest_functional_level) {
4233 DBG_ERR("Refusing to start as smb.conf 'ad dc functional level' maps to %d, "
4234 "which is less than the forest functional level of %d\n",
4235 lp_dc_functional_level, db_forest_functional_level);
4236 TALLOC_FREE(frame);
4237 return LDB_ERR_CONSTRAINT_VIOLATION;
4240 /* Check if we need to update the DB */
4241 if (db_dc_functional_level == lp_dc_functional_level) {
4243 * Note that this early return means
4244 * we're not updating operatingSystem and
4245 * operatingSystemVersion.
4247 * But at least for now that's
4248 * exactly what we want.
4250 TALLOC_FREE(frame);
4251 return LDB_SUCCESS;
4254 /* Confirm we are not an RODC before we try a modify */
4255 ret = samdb_rodc(ldb_ctx, &am_rodc);
4256 if (ret != LDB_SUCCESS) {
4257 DBG_ERR("Failed to determine if this server is an RODC\n");
4258 TALLOC_FREE(frame);
4259 return ret;
4262 if (am_rodc) {
4263 DBG_WARNING("Unable to update DC's msDS-Behavior-Version "
4264 "(from %d to %d) and operatingSystem[Version] "
4265 "as we are an RODC\n",
4266 db_dc_functional_level, lp_dc_functional_level);
4267 TALLOC_FREE(frame);
4268 return LDB_SUCCESS;
4271 dc_ntds_settings_dn = samdb_ntds_settings_dn(ldb_ctx, frame);
4273 if (dc_ntds_settings_dn == NULL) {
4274 DBG_ERR("Failed to find own NTDS Settings DN\n");
4275 TALLOC_FREE(frame);
4276 return LDB_ERR_NO_SUCH_OBJECT;
4279 /* Now update our msDS-Behavior-Version */
4281 msg = ldb_msg_new(frame);
4282 if (msg == NULL) {
4283 DBG_ERR("Failed to allocate message to update msDS-Behavior-Version\n");
4284 TALLOC_FREE(frame);
4285 return LDB_ERR_OPERATIONS_ERROR;
4288 msg->dn = dc_ntds_settings_dn;
4290 ret = samdb_msg_add_int(ldb_ctx, frame, msg, "msDS-Behavior-Version", lp_dc_functional_level);
4291 if (ret != LDB_SUCCESS) {
4292 DBG_ERR("Failed to set new msDS-Behavior-Version on message\n");
4293 TALLOC_FREE(frame);
4294 return LDB_ERR_OPERATIONS_ERROR;
4297 ret = dsdb_replace(ldb_ctx, msg, 0);
4298 if (ret != LDB_SUCCESS) {
4299 DBG_ERR("Failed to update DB with new msDS-Behavior-Version on %s: %s\n",
4300 ldb_dn_get_linearized(dc_ntds_settings_dn),
4301 ldb_errstring(ldb_ctx));
4302 TALLOC_FREE(frame);
4303 return ret;
4307 * We have to update the opaque because this particular ldb_context
4308 * will not re-read the DB
4311 unsigned long long *val = talloc(ldb_ctx, unsigned long long);
4312 if (!val) {
4313 TALLOC_FREE(frame);
4314 return LDB_ERR_OPERATIONS_ERROR;
4316 *val = lp_dc_functional_level;
4317 ret = ldb_set_opaque(ldb_ctx,
4318 "domainControllerFunctionality", val);
4319 if (ret != LDB_SUCCESS) {
4320 DBG_ERR("Failed to re-set domainControllerFunctionality opaque\n");
4321 TALLOC_FREE(val);
4322 TALLOC_FREE(frame);
4323 return ret;
4328 * While we are there also update
4329 * operatingSystem and operatingSystemVersion
4330 * as at least operatingSystemVersion is really
4331 * important for some clients/applications (like exchange).
4334 operatingSystem = talloc_asprintf(frame, "Samba-%s",
4335 samba_version_string());
4336 if (operatingSystem == NULL) {
4337 TALLOC_FREE(frame);
4338 return ldb_oom(ldb_ctx);
4341 operatingSystemVersion = dsdb_dc_operatingSystemVersion(db_dc_functional_level);
4343 ret = samdb_server_reference_dn(ldb_ctx, frame, &dc_computer_dn);
4344 if (ret != LDB_SUCCESS) {
4345 DBG_ERR("Failed to get the dc_computer_dn: %s\n",
4346 ldb_errstring(ldb_ctx));
4347 TALLOC_FREE(frame);
4348 return ret;
4351 msg = ldb_msg_new(frame);
4352 if (msg == NULL) {
4353 DBG_ERR("Failed to allocate message to update msDS-Behavior-Version\n");
4354 TALLOC_FREE(frame);
4355 return LDB_ERR_OPERATIONS_ERROR;
4358 msg->dn = dc_computer_dn;
4360 ret = samdb_msg_add_addval(ldb_ctx, frame, msg,
4361 "operatingSystem",
4362 operatingSystem);
4363 if (ret != LDB_SUCCESS) {
4364 DBG_ERR("Failed to set new operatingSystem on message\n");
4365 TALLOC_FREE(frame);
4366 return ldb_operr(ldb_ctx);
4369 ret = samdb_msg_add_addval(ldb_ctx, frame, msg,
4370 "operatingSystemVersion",
4371 operatingSystemVersion);
4372 if (ret != LDB_SUCCESS) {
4373 DBG_ERR("Failed to set new operatingSystemVersion on message\n");
4374 TALLOC_FREE(frame);
4375 return ldb_operr(ldb_ctx);
4378 ret = dsdb_replace(ldb_ctx, msg, 0);
4379 if (ret != LDB_SUCCESS) {
4380 DBG_ERR("Failed to update DB with new operatingSystem[Version] on %s: %s\n",
4381 ldb_dn_get_linearized(dc_computer_dn),
4382 ldb_errstring(ldb_ctx));
4383 TALLOC_FREE(frame);
4384 return ret;
4387 TALLOC_FREE(frame);
4388 return LDB_SUCCESS;
4393 set a GUID in an extended DN structure
4395 int dsdb_set_extended_dn_guid(struct ldb_dn *dn, const struct GUID *guid, const char *component_name)
4397 struct ldb_val v;
4398 NTSTATUS status;
4399 int ret;
4401 status = GUID_to_ndr_blob(guid, dn, &v);
4402 if (!NT_STATUS_IS_OK(status)) {
4403 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
4406 ret = ldb_dn_set_extended_component(dn, component_name, &v);
4407 data_blob_free(&v);
4408 return ret;
4412 return a GUID from a extended DN structure
4414 NTSTATUS dsdb_get_extended_dn_guid(struct ldb_dn *dn, struct GUID *guid, const char *component_name)
4416 const struct ldb_val *v;
4418 v = ldb_dn_get_extended_component(dn, component_name);
4419 if (v == NULL) {
4420 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4423 return GUID_from_ndr_blob(v, guid);
4427 return a uint64_t from a extended DN structure
4429 NTSTATUS dsdb_get_extended_dn_uint64(struct ldb_dn *dn, uint64_t *val, const char *component_name)
4431 const struct ldb_val *v;
4432 int error = 0;
4434 v = ldb_dn_get_extended_component(dn, component_name);
4435 if (v == NULL) {
4436 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4439 /* Just check we don't allow the caller to fill our stack */
4440 if (v->length >= 64) {
4441 return NT_STATUS_INVALID_PARAMETER;
4442 } else {
4443 char s[v->length+1];
4444 memcpy(s, v->data, v->length);
4445 s[v->length] = 0;
4447 *val = smb_strtoull(s, NULL, 0, &error, SMB_STR_STANDARD);
4448 if (error != 0) {
4449 return NT_STATUS_INVALID_PARAMETER;
4452 return NT_STATUS_OK;
4456 return a NTTIME from a extended DN structure
4458 NTSTATUS dsdb_get_extended_dn_nttime(struct ldb_dn *dn, NTTIME *nttime, const char *component_name)
4460 return dsdb_get_extended_dn_uint64(dn, nttime, component_name);
4464 return a uint32_t from a extended DN structure
4466 NTSTATUS dsdb_get_extended_dn_uint32(struct ldb_dn *dn, uint32_t *val, const char *component_name)
4468 const struct ldb_val *v;
4469 int error = 0;
4471 v = ldb_dn_get_extended_component(dn, component_name);
4472 if (v == NULL) {
4473 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4476 /* Just check we don't allow the caller to fill our stack */
4477 if (v->length >= 32) {
4478 return NT_STATUS_INVALID_PARAMETER;
4479 } else {
4480 char s[v->length + 1];
4481 memcpy(s, v->data, v->length);
4482 s[v->length] = 0;
4483 *val = smb_strtoul(s, NULL, 0, &error, SMB_STR_STANDARD);
4484 if (error != 0) {
4485 return NT_STATUS_INVALID_PARAMETER;
4489 return NT_STATUS_OK;
4493 return a dom_sid from a extended DN structure
4495 NTSTATUS dsdb_get_extended_dn_sid(struct ldb_dn *dn, struct dom_sid *sid, const char *component_name)
4497 const struct ldb_val *sid_blob;
4498 enum ndr_err_code ndr_err;
4500 sid_blob = ldb_dn_get_extended_component(dn, component_name);
4501 if (!sid_blob) {
4502 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4505 ndr_err = ndr_pull_struct_blob_all_noalloc(sid_blob, sid,
4506 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
4507 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4508 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
4509 return status;
4512 return NT_STATUS_OK;
4517 return RMD_FLAGS directly from a ldb_dn
4518 returns 0 if not found
4520 uint32_t dsdb_dn_rmd_flags(struct ldb_dn *dn)
4522 uint32_t rmd_flags = 0;
4523 NTSTATUS status = dsdb_get_extended_dn_uint32(dn, &rmd_flags,
4524 "RMD_FLAGS");
4525 if (NT_STATUS_IS_OK(status)) {
4526 return rmd_flags;
4528 return 0;
4532 return RMD_FLAGS directly from a ldb_val for a DN
4533 returns 0 if RMD_FLAGS is not found
4535 uint32_t dsdb_dn_val_rmd_flags(const struct ldb_val *val)
4537 const char *p;
4538 uint32_t flags;
4539 char *end;
4540 int error = 0;
4542 if (val->length < 13) {
4543 return 0;
4545 p = memmem(val->data, val->length, "<RMD_FLAGS=", 11);
4546 if (!p) {
4547 return 0;
4549 flags = smb_strtoul(p+11, &end, 10, &error, SMB_STR_STANDARD);
4550 if (!end || *end != '>' || error != 0) {
4551 /* it must end in a > */
4552 return 0;
4554 return flags;
4558 return true if a ldb_val containing a DN in storage form is deleted
4560 bool dsdb_dn_is_deleted_val(const struct ldb_val *val)
4562 return (dsdb_dn_val_rmd_flags(val) & DSDB_RMD_FLAG_DELETED) != 0;
4566 return true if a ldb_val containing a DN in storage form is
4567 in the upgraded w2k3 linked attribute format
4569 bool dsdb_dn_is_upgraded_link_val(const struct ldb_val *val)
4571 return memmem(val->data, val->length, "<RMD_VERSION=", 13) != NULL;
4575 return a DN for a wellknown GUID
4577 int dsdb_wellknown_dn(struct ldb_context *samdb, TALLOC_CTX *mem_ctx,
4578 struct ldb_dn *nc_root, const char *wk_guid,
4579 struct ldb_dn **wkguid_dn)
4581 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
4582 const char *attrs[] = { NULL };
4583 int ret;
4584 struct ldb_dn *dn;
4585 struct ldb_result *res = NULL;
4587 if (tmp_ctx == NULL) {
4588 return ldb_oom(samdb);
4591 /* construct the magic WKGUID DN */
4592 dn = ldb_dn_new_fmt(tmp_ctx, samdb, "<WKGUID=%s,%s>",
4593 wk_guid, ldb_dn_get_linearized(nc_root));
4594 if (!wkguid_dn) {
4595 talloc_free(tmp_ctx);
4596 return ldb_operr(samdb);
4599 ret = dsdb_search_dn(samdb, tmp_ctx, &res, dn, attrs,
4600 DSDB_SEARCH_SHOW_DELETED |
4601 DSDB_SEARCH_SHOW_RECYCLED);
4602 if (ret != LDB_SUCCESS) {
4603 talloc_free(tmp_ctx);
4604 return ret;
4606 /* fix clang warning */
4607 if (res == NULL){
4608 talloc_free(tmp_ctx);
4609 return LDB_ERR_OTHER;
4612 (*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn);
4613 talloc_free(tmp_ctx);
4614 return LDB_SUCCESS;
4618 static int dsdb_dn_compare_ptrs(struct ldb_dn **dn1, struct ldb_dn **dn2)
4620 return ldb_dn_compare(*dn1, *dn2);
4624 find a NC root given a DN within the NC by reading the rootDSE namingContexts
4626 static int dsdb_find_nc_root_string_based(struct ldb_context *samdb,
4627 TALLOC_CTX *mem_ctx,
4628 struct ldb_dn *dn,
4629 struct ldb_dn **nc_root)
4631 const char *root_attrs[] = { "namingContexts", NULL };
4632 TALLOC_CTX *tmp_ctx;
4633 int ret;
4634 struct ldb_message_element *el;
4635 struct ldb_result *root_res;
4636 unsigned int i;
4637 struct ldb_dn **nc_dns;
4639 tmp_ctx = talloc_new(samdb);
4640 if (tmp_ctx == NULL) {
4641 return ldb_oom(samdb);
4644 ret = ldb_search(samdb, tmp_ctx, &root_res,
4645 ldb_dn_new(tmp_ctx, samdb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
4646 if (ret != LDB_SUCCESS || root_res->count == 0) {
4647 DEBUG(1,("Searching for namingContexts in rootDSE failed: %s\n", ldb_errstring(samdb)));
4648 talloc_free(tmp_ctx);
4649 return ret;
4652 el = ldb_msg_find_element(root_res->msgs[0], "namingContexts");
4653 if ((el == NULL) || (el->num_values < 3)) {
4654 struct ldb_message *tmp_msg;
4656 DEBUG(5,("dsdb_find_nc_root: Finding a valid 'namingContexts' element in the RootDSE failed. Using a temporary list.\n"));
4658 /* This generates a temporary list of NCs in order to let the
4659 * provisioning work. */
4660 tmp_msg = ldb_msg_new(tmp_ctx);
4661 if (tmp_msg == NULL) {
4662 talloc_free(tmp_ctx);
4663 return ldb_oom(samdb);
4665 ret = ldb_msg_add_steal_string(tmp_msg, "namingContexts",
4666 ldb_dn_alloc_linearized(tmp_msg, ldb_get_schema_basedn(samdb)));
4667 if (ret != LDB_SUCCESS) {
4668 talloc_free(tmp_ctx);
4669 return ret;
4671 ret = ldb_msg_add_steal_string(tmp_msg, "namingContexts",
4672 ldb_dn_alloc_linearized(tmp_msg, ldb_get_config_basedn(samdb)));
4673 if (ret != LDB_SUCCESS) {
4674 talloc_free(tmp_ctx);
4675 return ret;
4677 ret = ldb_msg_add_steal_string(tmp_msg, "namingContexts",
4678 ldb_dn_alloc_linearized(tmp_msg, ldb_get_default_basedn(samdb)));
4679 if (ret != LDB_SUCCESS) {
4680 talloc_free(tmp_ctx);
4681 return ret;
4683 el = &tmp_msg->elements[0];
4686 nc_dns = talloc_array(tmp_ctx, struct ldb_dn *, el->num_values);
4687 if (!nc_dns) {
4688 talloc_free(tmp_ctx);
4689 return ldb_oom(samdb);
4692 for (i=0; i<el->num_values; i++) {
4693 nc_dns[i] = ldb_dn_from_ldb_val(nc_dns, samdb, &el->values[i]);
4694 if (nc_dns[i] == NULL) {
4695 talloc_free(tmp_ctx);
4696 return ldb_operr(samdb);
4700 TYPESAFE_QSORT(nc_dns, el->num_values, dsdb_dn_compare_ptrs);
4702 for (i=0; i<el->num_values; i++) {
4703 if (ldb_dn_compare_base(nc_dns[i], dn) == 0) {
4704 (*nc_root) = talloc_steal(mem_ctx, nc_dns[i]);
4705 talloc_free(tmp_ctx);
4706 return LDB_SUCCESS;
4710 talloc_free(tmp_ctx);
4711 return ldb_error(samdb, LDB_ERR_NO_SUCH_OBJECT, __func__);
4714 struct dsdb_get_partition_and_dn {
4715 TALLOC_CTX *mem_ctx;
4716 unsigned int count;
4717 struct ldb_dn *dn;
4718 struct ldb_dn *partition_dn;
4719 bool want_partition_dn;
4722 static int dsdb_get_partition_and_dn(struct ldb_request *req,
4723 struct ldb_reply *ares)
4725 int ret;
4726 struct dsdb_get_partition_and_dn *context = req->context;
4727 struct ldb_control *partition_ctrl = NULL;
4728 struct dsdb_control_current_partition *partition = NULL;
4730 if (!ares) {
4731 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
4733 if (ares->error != LDB_SUCCESS
4734 && ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4735 return ldb_request_done(req, ares->error);
4738 switch (ares->type) {
4739 case LDB_REPLY_ENTRY:
4740 if (context->count != 0) {
4741 return ldb_request_done(req,
4742 LDB_ERR_CONSTRAINT_VIOLATION);
4744 context->count++;
4746 context->dn = talloc_steal(context->mem_ctx,
4747 ares->message->dn);
4748 break;
4750 case LDB_REPLY_REFERRAL:
4751 talloc_free(ares);
4752 return ldb_request_done(req, LDB_SUCCESS);
4754 case LDB_REPLY_DONE:
4755 partition_ctrl
4756 = ldb_reply_get_control(ares,
4757 DSDB_CONTROL_CURRENT_PARTITION_OID);
4758 if (!context->want_partition_dn ||
4759 partition_ctrl == NULL) {
4760 ret = ares->error;
4761 talloc_free(ares);
4763 return ldb_request_done(req, ret);
4766 partition
4767 = talloc_get_type_abort(partition_ctrl->data,
4768 struct dsdb_control_current_partition);
4769 context->partition_dn
4770 = ldb_dn_copy(context->mem_ctx, partition->dn);
4771 if (context->partition_dn == NULL) {
4772 return ldb_request_done(req,
4773 LDB_ERR_OPERATIONS_ERROR);
4776 ret = ares->error;
4777 talloc_free(ares);
4779 return ldb_request_done(req, ret);
4782 talloc_free(ares);
4783 return LDB_SUCCESS;
4787 find a NC root given a DN within the NC
4789 int dsdb_normalise_dn_and_find_nc_root(struct ldb_context *samdb,
4790 TALLOC_CTX *mem_ctx,
4791 struct ldb_dn *dn,
4792 struct ldb_dn **normalised_dn,
4793 struct ldb_dn **nc_root)
4795 TALLOC_CTX *tmp_ctx;
4796 int ret;
4797 struct ldb_request *req;
4798 struct ldb_result *res;
4799 struct ldb_dn *search_dn = dn;
4800 static const char * attrs[] = { NULL };
4801 bool has_extended = ldb_dn_has_extended(dn);
4802 bool has_normal_components = ldb_dn_get_comp_num(dn) >= 1;
4803 struct dsdb_get_partition_and_dn context = {
4804 .mem_ctx = mem_ctx,
4805 .want_partition_dn = nc_root != NULL
4808 if (!has_extended && !has_normal_components) {
4809 return ldb_error(samdb, LDB_ERR_NO_SUCH_OBJECT,
4810 "Request for NC root for rootDSE (\"\") denied.");
4813 tmp_ctx = talloc_new(samdb);
4814 if (tmp_ctx == NULL) {
4815 return ldb_oom(samdb);
4818 res = talloc_zero(tmp_ctx, struct ldb_result);
4819 if (res == NULL) {
4820 talloc_free(tmp_ctx);
4821 return ldb_oom(samdb);
4824 if (has_extended && has_normal_components) {
4825 bool minimise_ok;
4826 search_dn = ldb_dn_copy(tmp_ctx, dn);
4827 if (search_dn == NULL) {
4828 talloc_free(tmp_ctx);
4829 return ldb_oom(samdb);
4831 minimise_ok = ldb_dn_minimise(search_dn);
4832 if (!minimise_ok) {
4833 talloc_free(tmp_ctx);
4834 return ldb_operr(samdb);
4838 ret = ldb_build_search_req(&req, samdb, tmp_ctx,
4839 search_dn,
4840 LDB_SCOPE_BASE,
4841 NULL,
4842 attrs,
4843 NULL,
4844 &context,
4845 dsdb_get_partition_and_dn,
4846 NULL);
4847 if (ret != LDB_SUCCESS) {
4848 talloc_free(tmp_ctx);
4849 return ret;
4852 ret = ldb_request_add_control(req,
4853 DSDB_CONTROL_CURRENT_PARTITION_OID,
4854 false, NULL);
4855 if (ret != LDB_SUCCESS) {
4856 talloc_free(tmp_ctx);
4857 return ret;
4860 ret = dsdb_request_add_controls(req,
4861 DSDB_SEARCH_SHOW_RECYCLED|
4862 DSDB_SEARCH_SHOW_DELETED|
4863 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
4864 if (ret != LDB_SUCCESS) {
4865 talloc_free(tmp_ctx);
4866 return ret;
4869 ret = ldb_request(samdb, req);
4870 if (ret == LDB_SUCCESS) {
4871 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
4875 * This could be a new DN, not in the DB, which is OK. If we
4876 * don't need the normalised DN, we can continue.
4878 * We may be told the partition it would be in in the search
4879 * reply control, or if not we can do a string-based match.
4882 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
4883 if (normalised_dn != NULL) {
4884 talloc_free(tmp_ctx);
4885 return ret;
4887 ret = LDB_SUCCESS;
4888 ldb_reset_err_string(samdb);
4889 } else if (ret != LDB_SUCCESS) {
4890 talloc_free(tmp_ctx);
4891 return ret;
4894 if (normalised_dn != NULL) {
4895 if (context.count != 1) {
4896 /* No results */
4897 ldb_asprintf_errstring(samdb,
4898 "Request for NC root for %s failed to return any results.",
4899 ldb_dn_get_linearized(dn));
4900 talloc_free(tmp_ctx);
4901 return LDB_ERR_NO_SUCH_OBJECT;
4903 *normalised_dn = context.dn;
4907 * If the user did not need to find the nc_root,
4908 * we are done
4910 if (nc_root == NULL) {
4911 talloc_free(tmp_ctx);
4912 return ret;
4916 * When we are working locally, both for the case were
4917 * we find the DN, and the case where we fail, we get
4918 * back via controls the partition it was in or should
4919 * have been in, to return to the client
4921 if (context.partition_dn != NULL) {
4922 (*nc_root) = context.partition_dn;
4924 talloc_free(tmp_ctx);
4925 return ret;
4929 * This is a remote operation, which is a little harder as we
4930 * have a work out the nc_root from the list of NCs. If we did
4931 * at least resolve the DN to a string, get that now, it makes
4932 * the string-based match below possible for a GUID-based
4933 * input over remote LDAP.
4935 if (context.dn) {
4936 dn = context.dn;
4937 } else if (has_extended && !has_normal_components) {
4938 ldb_asprintf_errstring(samdb,
4939 "Cannot determine NC root "
4940 "for a not-found bare extended DN %s.",
4941 ldb_dn_get_extended_linearized(tmp_ctx, dn, 1));
4942 talloc_free(tmp_ctx);
4943 return LDB_ERR_NO_SUCH_OBJECT;
4947 * Either we are working against a remote LDAP
4948 * server or the object doesn't exist locally.
4950 * This means any GUID that was present in the DN
4951 * therefore could not be evaluated, so do a
4952 * string-based match instead.
4954 talloc_free(tmp_ctx);
4955 return dsdb_find_nc_root_string_based(samdb,
4956 mem_ctx,
4958 nc_root);
4962 find a NC root given a DN within the NC
4964 int dsdb_find_nc_root(struct ldb_context *samdb,
4965 TALLOC_CTX *mem_ctx,
4966 struct ldb_dn *dn,
4967 struct ldb_dn **nc_root)
4969 return dsdb_normalise_dn_and_find_nc_root(samdb,
4970 mem_ctx,
4972 NULL,
4973 nc_root);
4977 find the deleted objects DN for any object, by looking for the NC
4978 root, then looking up the wellknown GUID
4980 int dsdb_get_deleted_objects_dn(struct ldb_context *ldb,
4981 TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
4982 struct ldb_dn **do_dn)
4984 struct ldb_dn *nc_root;
4985 int ret;
4987 ret = dsdb_find_nc_root(ldb, mem_ctx, obj_dn, &nc_root);
4988 if (ret != LDB_SUCCESS) {
4989 return ret;
4992 ret = dsdb_wellknown_dn(ldb, mem_ctx, nc_root, DS_GUID_DELETED_OBJECTS_CONTAINER, do_dn);
4993 talloc_free(nc_root);
4994 return ret;
4998 return the tombstoneLifetime, in days
5000 int dsdb_tombstone_lifetime(struct ldb_context *ldb, uint32_t *lifetime)
5002 struct ldb_dn *dn;
5003 dn = ldb_get_config_basedn(ldb);
5004 if (!dn) {
5005 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
5007 dn = ldb_dn_copy(ldb, dn);
5008 if (!dn) {
5009 return ldb_operr(ldb);
5011 /* see MS-ADTS section 7.1.1.2.4.1.1. There doesn't appear to
5012 be a wellknown GUID for this */
5013 if (!ldb_dn_add_child_fmt(dn, "CN=Directory Service,CN=Windows NT,CN=Services")) {
5014 talloc_free(dn);
5015 return ldb_operr(ldb);
5018 *lifetime = samdb_search_uint(ldb, dn, 180, dn, "tombstoneLifetime", "objectClass=nTDSService");
5019 talloc_free(dn);
5020 return LDB_SUCCESS;
5024 compare a ldb_val to a string case insensitively
5026 int samdb_ldb_val_case_cmp(const char *s, struct ldb_val *v)
5028 size_t len = strlen(s);
5029 int ret;
5030 if (len > v->length) return 1;
5031 ret = strncasecmp(s, (const char *)v->data, v->length);
5032 if (ret != 0) return ret;
5033 if (v->length > len && v->data[len] != 0) {
5034 return -1;
5036 return 0;
5041 load the UDV for a partition in v2 format
5042 The list is returned sorted, and with our local cursor added
5044 int dsdb_load_udv_v2(struct ldb_context *samdb, struct ldb_dn *dn, TALLOC_CTX *mem_ctx,
5045 struct drsuapi_DsReplicaCursor2 **cursors, uint32_t *count)
5047 static const char *attrs[] = { "replUpToDateVector", NULL };
5048 struct ldb_result *r = NULL;
5049 const struct ldb_val *ouv_value;
5050 unsigned int i;
5051 int ret;
5052 uint64_t highest_usn = 0;
5053 const struct GUID *our_invocation_id;
5054 static const struct timeval tv1970;
5055 NTTIME nt1970 = timeval_to_nttime(&tv1970);
5057 ret = dsdb_search_dn(samdb, mem_ctx, &r, dn, attrs, DSDB_SEARCH_SHOW_RECYCLED|DSDB_SEARCH_SHOW_DELETED);
5058 if (ret != LDB_SUCCESS) {
5059 return ret;
5061 /* fix clang warning */
5062 if (r == NULL) {
5063 return LDB_ERR_OTHER;
5065 ouv_value = ldb_msg_find_ldb_val(r->msgs[0], "replUpToDateVector");
5066 if (ouv_value) {
5067 enum ndr_err_code ndr_err;
5068 struct replUpToDateVectorBlob ouv;
5070 ndr_err = ndr_pull_struct_blob(ouv_value, r, &ouv,
5071 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
5072 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5073 talloc_free(r);
5074 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
5076 if (ouv.version != 2) {
5077 /* we always store as version 2, and
5078 * replUpToDateVector is not replicated
5080 talloc_free(r);
5081 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
5084 *count = ouv.ctr.ctr2.count;
5085 *cursors = talloc_steal(mem_ctx, ouv.ctr.ctr2.cursors);
5086 } else {
5087 *count = 0;
5088 *cursors = NULL;
5091 talloc_free(r);
5093 our_invocation_id = samdb_ntds_invocation_id(samdb);
5094 if (!our_invocation_id) {
5095 DEBUG(0,(__location__ ": No invocationID on samdb - %s\n", ldb_errstring(samdb)));
5096 talloc_free(*cursors);
5097 return ldb_operr(samdb);
5100 ret = ldb_sequence_number(samdb, LDB_SEQ_HIGHEST_SEQ, &highest_usn);
5101 if (ret != LDB_SUCCESS) {
5102 /* nothing to add - this can happen after a vampire */
5103 TYPESAFE_QSORT(*cursors, *count, drsuapi_DsReplicaCursor2_compare);
5104 return LDB_SUCCESS;
5107 for (i=0; i<*count; i++) {
5108 if (GUID_equal(our_invocation_id, &(*cursors)[i].source_dsa_invocation_id)) {
5109 (*cursors)[i].highest_usn = highest_usn;
5110 (*cursors)[i].last_sync_success = nt1970;
5111 TYPESAFE_QSORT(*cursors, *count, drsuapi_DsReplicaCursor2_compare);
5112 return LDB_SUCCESS;
5116 (*cursors) = talloc_realloc(mem_ctx, *cursors, struct drsuapi_DsReplicaCursor2, (*count)+1);
5117 if (! *cursors) {
5118 return ldb_oom(samdb);
5121 (*cursors)[*count].source_dsa_invocation_id = *our_invocation_id;
5122 (*cursors)[*count].highest_usn = highest_usn;
5123 (*cursors)[*count].last_sync_success = nt1970;
5124 (*count)++;
5126 TYPESAFE_QSORT(*cursors, *count, drsuapi_DsReplicaCursor2_compare);
5128 return LDB_SUCCESS;
5132 load the UDV for a partition in version 1 format
5133 The list is returned sorted, and with our local cursor added
5135 int dsdb_load_udv_v1(struct ldb_context *samdb, struct ldb_dn *dn, TALLOC_CTX *mem_ctx,
5136 struct drsuapi_DsReplicaCursor **cursors, uint32_t *count)
5138 struct drsuapi_DsReplicaCursor2 *v2 = NULL;
5139 uint32_t i;
5140 int ret;
5142 ret = dsdb_load_udv_v2(samdb, dn, mem_ctx, &v2, count);
5143 if (ret != LDB_SUCCESS) {
5144 return ret;
5147 if (*count == 0) {
5148 talloc_free(v2);
5149 *cursors = NULL;
5150 return LDB_SUCCESS;
5153 *cursors = talloc_array(mem_ctx, struct drsuapi_DsReplicaCursor, *count);
5154 if (*cursors == NULL) {
5155 talloc_free(v2);
5156 return ldb_oom(samdb);
5159 for (i=0; i<*count; i++) {
5160 (*cursors)[i].source_dsa_invocation_id = v2[i].source_dsa_invocation_id;
5161 (*cursors)[i].highest_usn = v2[i].highest_usn;
5163 talloc_free(v2);
5164 return LDB_SUCCESS;
5168 add a set of controls to a ldb_request structure based on a set of
5169 flags. See util.h for a list of available flags
5171 int dsdb_request_add_controls(struct ldb_request *req, uint32_t dsdb_flags)
5173 int ret;
5174 if (dsdb_flags & DSDB_SEARCH_SEARCH_ALL_PARTITIONS) {
5175 struct ldb_search_options_control *options;
5176 /* Using the phantom root control allows us to search all partitions */
5177 options = talloc(req, struct ldb_search_options_control);
5178 if (options == NULL) {
5179 return LDB_ERR_OPERATIONS_ERROR;
5181 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
5183 ret = ldb_request_add_control(req,
5184 LDB_CONTROL_SEARCH_OPTIONS_OID,
5185 true, options);
5186 if (ret != LDB_SUCCESS) {
5187 return ret;
5191 if (dsdb_flags & DSDB_SEARCH_NO_GLOBAL_CATALOG) {
5192 ret = ldb_request_add_control(req,
5193 DSDB_CONTROL_NO_GLOBAL_CATALOG,
5194 false, NULL);
5195 if (ret != LDB_SUCCESS) {
5196 return ret;
5200 if (dsdb_flags & DSDB_SEARCH_SHOW_DELETED) {
5201 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
5202 if (ret != LDB_SUCCESS) {
5203 return ret;
5207 if (dsdb_flags & DSDB_SEARCH_SHOW_RECYCLED) {
5208 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_RECYCLED_OID, false, NULL);
5209 if (ret != LDB_SUCCESS) {
5210 return ret;
5214 if (dsdb_flags & DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT) {
5215 ret = ldb_request_add_control(req, DSDB_CONTROL_DN_STORAGE_FORMAT_OID, false, NULL);
5216 if (ret != LDB_SUCCESS) {
5217 return ret;
5221 if (dsdb_flags & DSDB_SEARCH_SHOW_EXTENDED_DN) {
5222 struct ldb_extended_dn_control *extended_ctrl = talloc(req, struct ldb_extended_dn_control);
5223 if (!extended_ctrl) {
5224 return LDB_ERR_OPERATIONS_ERROR;
5226 extended_ctrl->type = 1;
5228 ret = ldb_request_add_control(req, LDB_CONTROL_EXTENDED_DN_OID, true, extended_ctrl);
5229 if (ret != LDB_SUCCESS) {
5230 return ret;
5234 if (dsdb_flags & DSDB_SEARCH_REVEAL_INTERNALS) {
5235 ret = ldb_request_add_control(req, LDB_CONTROL_REVEAL_INTERNALS, false, NULL);
5236 if (ret != LDB_SUCCESS) {
5237 return ret;
5241 if (dsdb_flags & DSDB_MODIFY_RELAX) {
5242 ret = ldb_request_add_control(req, LDB_CONTROL_RELAX_OID, false, NULL);
5243 if (ret != LDB_SUCCESS) {
5244 return ret;
5248 if (dsdb_flags & DSDB_MODIFY_PERMISSIVE) {
5249 ret = ldb_request_add_control(req, LDB_CONTROL_PERMISSIVE_MODIFY_OID, false, NULL);
5250 if (ret != LDB_SUCCESS) {
5251 return ret;
5255 if (dsdb_flags & DSDB_FLAG_AS_SYSTEM) {
5256 ret = ldb_request_add_control(req, LDB_CONTROL_AS_SYSTEM_OID, false, NULL);
5257 if (ret != LDB_SUCCESS) {
5258 return ret;
5262 if (dsdb_flags & DSDB_TREE_DELETE) {
5263 ret = ldb_request_add_control(req, LDB_CONTROL_TREE_DELETE_OID, false, NULL);
5264 if (ret != LDB_SUCCESS) {
5265 return ret;
5269 if (dsdb_flags & DSDB_PROVISION) {
5270 ret = ldb_request_add_control(req, LDB_CONTROL_PROVISION_OID, false, NULL);
5271 if (ret != LDB_SUCCESS) {
5272 return ret;
5276 /* This is a special control to bypass the password_hash module for use in pdb_samba4 for Samba3 upgrades */
5277 if (dsdb_flags & DSDB_BYPASS_PASSWORD_HASH) {
5278 ret = ldb_request_add_control(req, DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID, true, NULL);
5279 if (ret != LDB_SUCCESS) {
5280 return ret;
5284 if (dsdb_flags & DSDB_PASSWORD_BYPASS_LAST_SET) {
5286 * This must not be critical, as it will only be
5287 * handled (and need to be handled) if the other
5288 * attributes in the request bring password_hash into
5289 * action
5291 ret = ldb_request_add_control(req, DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID, false, NULL);
5292 if (ret != LDB_SUCCESS) {
5293 return ret;
5297 if (dsdb_flags & DSDB_REPLMD_VANISH_LINKS) {
5298 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLMD_VANISH_LINKS, true, NULL);
5299 if (ret != LDB_SUCCESS) {
5300 return ret;
5304 if (dsdb_flags & DSDB_MODIFY_PARTIAL_REPLICA) {
5305 ret = ldb_request_add_control(req, DSDB_CONTROL_PARTIAL_REPLICA, false, NULL);
5306 if (ret != LDB_SUCCESS) {
5307 return ret;
5311 if (dsdb_flags & DSDB_FLAG_REPLICATED_UPDATE) {
5312 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
5313 if (ret != LDB_SUCCESS) {
5314 return ret;
5318 if (dsdb_flags & DSDB_FLAG_FORCE_ALLOW_VALIDATED_DNS_HOSTNAME_SPN_WRITE) {
5319 ret = ldb_request_add_control(req, DSDB_CONTROL_FORCE_ALLOW_VALIDATED_DNS_HOSTNAME_SPN_WRITE_OID, true, NULL);
5320 if (ret != LDB_SUCCESS) {
5321 return ret;
5325 if (dsdb_flags & DSDB_MARK_REQ_UNTRUSTED) {
5326 ldb_req_mark_untrusted(req);
5329 return LDB_SUCCESS;
5333 returns true if a control with the specified "oid" exists
5335 bool dsdb_request_has_control(struct ldb_request *req, const char *oid)
5337 return (ldb_request_get_control(req, oid) != NULL);
5341 an add with a set of controls
5343 int dsdb_add(struct ldb_context *ldb, const struct ldb_message *message,
5344 uint32_t dsdb_flags)
5346 struct ldb_request *req;
5347 int ret;
5349 ret = ldb_build_add_req(&req, ldb, ldb,
5350 message,
5351 NULL,
5352 NULL,
5353 ldb_op_default_callback,
5354 NULL);
5356 if (ret != LDB_SUCCESS) return ret;
5358 ret = dsdb_request_add_controls(req, dsdb_flags);
5359 if (ret != LDB_SUCCESS) {
5360 talloc_free(req);
5361 return ret;
5364 ret = dsdb_autotransaction_request(ldb, req);
5366 talloc_free(req);
5367 return ret;
5371 a modify with a set of controls
5373 int dsdb_modify(struct ldb_context *ldb, const struct ldb_message *message,
5374 uint32_t dsdb_flags)
5376 struct ldb_request *req;
5377 int ret;
5379 ret = ldb_build_mod_req(&req, ldb, ldb,
5380 message,
5381 NULL,
5382 NULL,
5383 ldb_op_default_callback,
5384 NULL);
5386 if (ret != LDB_SUCCESS) return ret;
5388 ret = dsdb_request_add_controls(req, dsdb_flags);
5389 if (ret != LDB_SUCCESS) {
5390 talloc_free(req);
5391 return ret;
5394 ret = dsdb_autotransaction_request(ldb, req);
5396 talloc_free(req);
5397 return ret;
5401 a delete with a set of flags
5403 int dsdb_delete(struct ldb_context *ldb, struct ldb_dn *dn,
5404 uint32_t dsdb_flags)
5406 struct ldb_request *req;
5407 int ret;
5409 ret = ldb_build_del_req(&req, ldb, ldb,
5411 NULL,
5412 NULL,
5413 ldb_op_default_callback,
5414 NULL);
5416 if (ret != LDB_SUCCESS) return ret;
5418 ret = dsdb_request_add_controls(req, dsdb_flags);
5419 if (ret != LDB_SUCCESS) {
5420 talloc_free(req);
5421 return ret;
5424 ret = dsdb_autotransaction_request(ldb, req);
5426 talloc_free(req);
5427 return ret;
5431 like dsdb_modify() but set all the element flags to
5432 LDB_FLAG_MOD_REPLACE
5434 int dsdb_replace(struct ldb_context *ldb, struct ldb_message *msg, uint32_t dsdb_flags)
5436 unsigned int i;
5438 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
5439 for (i=0;i<msg->num_elements;i++) {
5440 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
5443 return dsdb_modify(ldb, msg, dsdb_flags);
5446 const char *dsdb_search_scope_as_string(enum ldb_scope scope)
5448 const char *scope_str;
5450 switch (scope) {
5451 case LDB_SCOPE_BASE:
5452 scope_str = "BASE";
5453 break;
5454 case LDB_SCOPE_ONELEVEL:
5455 scope_str = "ONE";
5456 break;
5457 case LDB_SCOPE_SUBTREE:
5458 scope_str = "SUB";
5459 break;
5460 default:
5461 scope_str = "<Invalid scope>";
5462 break;
5464 return scope_str;
5469 search for attrs on one DN, allowing for dsdb_flags controls
5471 int dsdb_search_dn(struct ldb_context *ldb,
5472 TALLOC_CTX *mem_ctx,
5473 struct ldb_result **_result,
5474 struct ldb_dn *basedn,
5475 const char * const *attrs,
5476 uint32_t dsdb_flags)
5478 int ret;
5479 struct ldb_request *req;
5480 struct ldb_result *res;
5481 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
5483 if (tmp_ctx == NULL) {
5484 return ldb_oom(ldb);
5487 res = talloc_zero(tmp_ctx, struct ldb_result);
5488 if (!res) {
5489 talloc_free(tmp_ctx);
5490 return ldb_oom(ldb);
5493 ret = ldb_build_search_req(&req, ldb, res,
5494 basedn,
5495 LDB_SCOPE_BASE,
5496 NULL,
5497 attrs,
5498 NULL,
5499 res,
5500 ldb_search_default_callback,
5501 NULL);
5502 if (ret != LDB_SUCCESS) {
5503 talloc_free(tmp_ctx);
5504 return ret;
5507 ret = dsdb_request_add_controls(req, dsdb_flags);
5508 if (ret != LDB_SUCCESS) {
5509 talloc_free(tmp_ctx);
5510 return ret;
5513 ret = ldb_request(ldb, req);
5514 if (ret == LDB_SUCCESS) {
5515 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
5518 talloc_free(req);
5519 if (ret != LDB_SUCCESS) {
5520 DBG_INFO("flags=0x%08x %s -> %s (%s)\n",
5521 dsdb_flags,
5522 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5523 basedn,
5524 1):"NULL",
5525 ldb_errstring(ldb), ldb_strerror(ret));
5526 talloc_free(tmp_ctx);
5527 return ret;
5530 DBG_DEBUG("flags=0x%08x %s -> %d\n",
5531 dsdb_flags,
5532 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5533 basedn,
5534 1):"NULL",
5535 res->count);
5537 *_result = talloc_steal(mem_ctx, res);
5539 talloc_free(tmp_ctx);
5540 return LDB_SUCCESS;
5544 search for attrs on one DN, by the GUID of the DN, allowing for
5545 dsdb_flags controls
5547 int dsdb_search_by_dn_guid(struct ldb_context *ldb,
5548 TALLOC_CTX *mem_ctx,
5549 struct ldb_result **_result,
5550 const struct GUID *guid,
5551 const char * const *attrs,
5552 uint32_t dsdb_flags)
5554 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
5555 struct ldb_dn *dn;
5556 int ret;
5558 if (tmp_ctx == NULL) {
5559 return ldb_oom(ldb);
5562 dn = ldb_dn_new_fmt(tmp_ctx, ldb, "<GUID=%s>", GUID_string(tmp_ctx, guid));
5563 if (dn == NULL) {
5564 talloc_free(tmp_ctx);
5565 return ldb_oom(ldb);
5568 ret = dsdb_search_dn(ldb, mem_ctx, _result, dn, attrs, dsdb_flags);
5569 talloc_free(tmp_ctx);
5570 return ret;
5573 NTSTATUS gmsa_system_password_update_request(
5574 struct ldb_context *ldb,
5575 TALLOC_CTX *mem_ctx,
5576 struct ldb_dn *dn,
5577 const uint8_t
5578 password_buf[static const GMSA_PASSWORD_NULL_TERMINATED_LEN],
5579 struct ldb_request **request_out)
5581 DATA_BLOB password_blob = {};
5582 struct ldb_request *request = NULL;
5583 NTSTATUS status;
5584 int ret;
5586 dn = ldb_dn_copy(mem_ctx, dn);
5587 if (dn == NULL) {
5588 return NT_STATUS_INTERNAL_ERROR;
5591 /* Make a copy of the password. */
5592 password_blob = data_blob_talloc(mem_ctx,
5593 password_buf,
5594 GMSA_PASSWORD_LEN);
5595 if (password_blob.data == NULL) {
5596 talloc_free(dn);
5597 return NT_STATUS_NO_MEMORY;
5600 status = samdb_set_password_request(ldb,
5601 mem_ctx,
5603 &password_blob,
5604 NULL,
5605 DSDB_PASSWORD_RESET,
5606 false /* reject trusts */,
5607 &request);
5608 if (!NT_STATUS_IS_OK(status)) {
5609 data_blob_free(&password_blob);
5610 talloc_free(dn);
5611 return status;
5614 /* Tie the lifetime of the password to that of the request. */
5615 talloc_steal(request, password_blob.data);
5617 /* Tie the lifetime of the DN to that of the request. */
5618 talloc_steal(request, dn);
5620 /* Make sure the password update happens as System. */
5621 ret = dsdb_request_add_controls(request, DSDB_FLAG_AS_SYSTEM);
5622 if (ret) {
5623 talloc_free(request);
5624 return NT_STATUS_NO_MEMORY;
5627 *request_out = request;
5628 return NT_STATUS_OK;
5632 general search with dsdb_flags for controls
5634 int dsdb_search(struct ldb_context *ldb,
5635 TALLOC_CTX *mem_ctx,
5636 struct ldb_result **_result,
5637 struct ldb_dn *basedn,
5638 enum ldb_scope scope,
5639 const char * const *attrs,
5640 uint32_t dsdb_flags,
5641 const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(8, 9)
5643 int ret;
5644 struct ldb_request *req;
5645 struct ldb_result *res;
5646 va_list ap;
5647 char *expression = NULL;
5648 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
5649 int tries;
5650 const int max_tries = 5;
5652 /* cross-partitions searches with a basedn break multi-domain support */
5653 SMB_ASSERT(basedn == NULL || (dsdb_flags & DSDB_SEARCH_SEARCH_ALL_PARTITIONS) == 0);
5655 if (tmp_ctx == NULL) {
5656 return ldb_oom(ldb);
5659 res = talloc(tmp_ctx, struct ldb_result);
5660 if (!res) {
5661 talloc_free(tmp_ctx);
5662 return ldb_oom(ldb);
5665 if (exp_fmt) {
5666 va_start(ap, exp_fmt);
5667 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
5668 va_end(ap);
5670 if (!expression) {
5671 talloc_free(tmp_ctx);
5672 return ldb_oom(ldb);
5676 for (tries = 0; tries < max_tries; ++tries) {
5677 bool retry = true;
5679 *res = (struct ldb_result){};
5681 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
5682 basedn,
5683 scope,
5684 expression,
5685 attrs,
5686 NULL,
5687 res,
5688 ldb_search_default_callback,
5689 NULL);
5690 if (ret != LDB_SUCCESS) {
5691 talloc_free(tmp_ctx);
5692 return ret;
5695 ret = dsdb_request_add_controls(req, dsdb_flags);
5696 if (ret != LDB_SUCCESS) {
5697 talloc_free(tmp_ctx);
5698 ldb_reset_err_string(ldb);
5699 return ret;
5702 ret = ldb_request(ldb, req);
5703 if (ret == LDB_SUCCESS) {
5704 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
5707 if (ret != LDB_SUCCESS) {
5708 DBG_INFO("%s flags=0x%08x %s %s -> %s (%s)\n",
5709 dsdb_search_scope_as_string(scope),
5710 dsdb_flags,
5711 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5712 basedn,
5713 1):"NULL",
5714 expression?expression:"NULL",
5715 ldb_errstring(ldb), ldb_strerror(ret));
5716 talloc_free(tmp_ctx);
5717 return ret;
5720 if (dsdb_flags & DSDB_SEARCH_ONE_ONLY) {
5721 if (res->count == 0) {
5722 DBG_INFO("%s SEARCH_ONE_ONLY flags=0x%08x %s %s -> %u results\n",
5723 dsdb_search_scope_as_string(scope),
5724 dsdb_flags,
5725 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5726 basedn,
5727 1):"NULL",
5728 expression?expression:"NULL", res->count);
5729 talloc_free(tmp_ctx);
5730 ldb_reset_err_string(ldb);
5731 return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, __func__);
5733 if (res->count != 1) {
5734 DBG_INFO("%s SEARCH_ONE_ONLY flags=0x%08x %s %s -> %u (expected 1) results\n",
5735 dsdb_search_scope_as_string(scope),
5736 dsdb_flags,
5737 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5738 basedn,
5739 1):"NULL",
5740 expression?expression:"NULL", res->count);
5741 talloc_free(tmp_ctx);
5742 ldb_reset_err_string(ldb);
5743 return LDB_ERR_CONSTRAINT_VIOLATION;
5747 if (!(dsdb_flags & DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS)) {
5748 break;
5752 * If we’re searching for passwords, we must account for the
5753 * possibility that one or more of the accounts are Group
5754 * Managed Service Accounts with out‐of‐date keys. In such a
5755 * case, we must derive the new password(s), update the keys,
5756 * and perform the search again to get the updated results.
5758 * The following attributes are necessary in order for this to
5759 * work properly:
5761 * • msDS-ManagedPasswordId
5762 * • msDS-ManagedPasswordInterval
5763 * • objectClass
5764 * • objectSid
5765 * • whenCreated
5768 ret = dsdb_update_gmsa_keys(tmp_ctx, ldb, res, &retry);
5769 if (ret) {
5770 talloc_free(tmp_ctx);
5771 return ret;
5773 if (!retry) {
5774 break;
5777 if (tries == max_tries) {
5778 talloc_free(tmp_ctx);
5779 ldb_reset_err_string(ldb);
5780 return ldb_operr(ldb);
5783 *_result = talloc_steal(mem_ctx, res);
5785 DBG_DEBUG("%s flags=0x%08x %s %s -> %d\n",
5786 dsdb_search_scope_as_string(scope),
5787 dsdb_flags,
5788 basedn?ldb_dn_get_extended_linearized(tmp_ctx,
5789 basedn,
5790 1):"NULL",
5791 expression?expression:"NULL",
5792 res->count);
5793 talloc_free(tmp_ctx);
5794 return LDB_SUCCESS;
5799 general search with dsdb_flags for controls
5800 returns exactly 1 record or an error
5802 int dsdb_search_one(struct ldb_context *ldb,
5803 TALLOC_CTX *mem_ctx,
5804 struct ldb_message **msg,
5805 struct ldb_dn *basedn,
5806 enum ldb_scope scope,
5807 const char * const *attrs,
5808 uint32_t dsdb_flags,
5809 const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(8, 9)
5811 int ret;
5812 struct ldb_result *res;
5813 va_list ap;
5814 char *expression = NULL;
5815 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
5817 if (tmp_ctx == NULL) {
5818 return ldb_oom(ldb);
5821 dsdb_flags |= DSDB_SEARCH_ONE_ONLY;
5823 res = talloc_zero(tmp_ctx, struct ldb_result);
5824 if (!res) {
5825 talloc_free(tmp_ctx);
5826 return ldb_oom(ldb);
5829 if (exp_fmt) {
5830 va_start(ap, exp_fmt);
5831 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
5832 va_end(ap);
5834 if (!expression) {
5835 talloc_free(tmp_ctx);
5836 return ldb_oom(ldb);
5838 ret = dsdb_search(ldb, tmp_ctx, &res, basedn, scope, attrs,
5839 dsdb_flags, "%s", expression);
5840 } else {
5841 ret = dsdb_search(ldb, tmp_ctx, &res, basedn, scope, attrs,
5842 dsdb_flags, NULL);
5845 if (ret != LDB_SUCCESS) {
5846 talloc_free(tmp_ctx);
5847 return ret;
5850 *msg = talloc_steal(mem_ctx, res->msgs[0]);
5851 talloc_free(tmp_ctx);
5853 return LDB_SUCCESS;
5856 /* returns back the forest DNS name */
5857 const char *samdb_forest_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
5859 const char *forest_name = ldb_dn_canonical_string(mem_ctx,
5860 ldb_get_root_basedn(ldb));
5861 char *p;
5863 if (forest_name == NULL) {
5864 return NULL;
5867 p = strchr(forest_name, '/');
5868 if (p) {
5869 *p = '\0';
5872 return forest_name;
5875 /* returns back the default domain DNS name */
5876 const char *samdb_default_domain_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
5878 const char *domain_name = ldb_dn_canonical_string(mem_ctx,
5879 ldb_get_default_basedn(ldb));
5880 char *p;
5882 if (domain_name == NULL) {
5883 return NULL;
5886 p = strchr(domain_name, '/');
5887 if (p) {
5888 *p = '\0';
5891 return domain_name;
5895 validate that an DSA GUID belongs to the specified user sid.
5896 The user SID must be a domain controller account (either RODC or
5897 RWDC)
5899 int dsdb_validate_dsa_guid(struct ldb_context *ldb,
5900 const struct GUID *dsa_guid,
5901 const struct dom_sid *sid)
5903 /* strategy:
5904 - find DN of record with the DSA GUID in the
5905 configuration partition (objectGUID)
5906 - remove "NTDS Settings" component from DN
5907 - do a base search on that DN for serverReference with
5908 extended-dn enabled
5909 - extract objectSid from resulting serverReference
5910 attribute
5911 - check this sid matches the sid argument
5913 struct ldb_dn *config_dn;
5914 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
5915 struct ldb_message *msg;
5916 const char *attrs1[] = { NULL };
5917 const char *attrs2[] = { "serverReference", NULL };
5918 int ret;
5919 struct ldb_dn *dn, *account_dn;
5920 struct dom_sid sid2;
5921 NTSTATUS status;
5923 if (tmp_ctx == NULL) {
5924 return ldb_oom(ldb);
5927 config_dn = ldb_get_config_basedn(ldb);
5929 ret = dsdb_search_one(ldb, tmp_ctx, &msg, config_dn, LDB_SCOPE_SUBTREE,
5930 attrs1, 0, "(&(objectGUID=%s)(objectClass=nTDSDSA))", GUID_string(tmp_ctx, dsa_guid));
5931 if (ret != LDB_SUCCESS) {
5932 DEBUG(1,(__location__ ": Failed to find DSA objectGUID %s for sid %s\n",
5933 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
5934 talloc_free(tmp_ctx);
5935 return ldb_operr(ldb);
5937 dn = msg->dn;
5939 if (!ldb_dn_remove_child_components(dn, 1)) {
5940 talloc_free(tmp_ctx);
5941 return ldb_operr(ldb);
5944 ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE,
5945 attrs2, DSDB_SEARCH_SHOW_EXTENDED_DN,
5946 "(objectClass=server)");
5947 if (ret != LDB_SUCCESS) {
5948 DEBUG(1,(__location__ ": Failed to find server record for DSA with objectGUID %s, sid %s\n",
5949 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
5950 talloc_free(tmp_ctx);
5951 return ldb_operr(ldb);
5954 account_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, msg, "serverReference");
5955 if (account_dn == NULL) {
5956 DEBUG(1,(__location__ ": Failed to find account dn "
5957 "(serverReference) for %s, parent of DSA with "
5958 "objectGUID %s, sid %s\n",
5959 ldb_dn_get_linearized(msg->dn),
5960 GUID_string(tmp_ctx, dsa_guid),
5961 dom_sid_string(tmp_ctx, sid)));
5962 talloc_free(tmp_ctx);
5963 return ldb_operr(ldb);
5966 status = dsdb_get_extended_dn_sid(account_dn, &sid2, "SID");
5967 if (!NT_STATUS_IS_OK(status)) {
5968 DEBUG(1,(__location__ ": Failed to find SID for DSA with objectGUID %s, sid %s\n",
5969 GUID_string(tmp_ctx, dsa_guid), dom_sid_string(tmp_ctx, sid)));
5970 talloc_free(tmp_ctx);
5971 return ldb_operr(ldb);
5974 if (!dom_sid_equal(sid, &sid2)) {
5975 /* someone is trying to spoof another account */
5976 DEBUG(0,(__location__ ": Bad DSA objectGUID %s for sid %s - expected sid %s\n",
5977 GUID_string(tmp_ctx, dsa_guid),
5978 dom_sid_string(tmp_ctx, sid),
5979 dom_sid_string(tmp_ctx, &sid2)));
5980 talloc_free(tmp_ctx);
5981 return ldb_operr(ldb);
5984 talloc_free(tmp_ctx);
5985 return LDB_SUCCESS;
5988 static const char * const secret_attributes[] = {
5989 DSDB_SECRET_ATTRIBUTES,
5990 NULL
5994 check if the attribute belongs to the RODC filtered attribute set
5995 Note that attributes that are in the filtered attribute set are the
5996 ones that _are_ always sent to a RODC
5998 bool dsdb_attr_in_rodc_fas(const struct dsdb_attribute *sa)
6000 /* they never get secret attributes */
6001 if (ldb_attr_in_list(secret_attributes, sa->lDAPDisplayName)) {
6002 return false;
6005 /* they do get non-secret critical attributes */
6006 if (sa->schemaFlagsEx & SCHEMA_FLAG_ATTR_IS_CRITICAL) {
6007 return true;
6010 /* they do get non-secret attributes marked as being in the FAS */
6011 if (sa->searchFlags & SEARCH_FLAG_RODC_ATTRIBUTE) {
6012 return true;
6015 /* other attributes are denied */
6016 return false;
6019 /* return fsmo role dn and role owner dn for a particular role*/
6020 WERROR dsdb_get_fsmo_role_info(TALLOC_CTX *tmp_ctx,
6021 struct ldb_context *ldb,
6022 uint32_t role,
6023 struct ldb_dn **fsmo_role_dn,
6024 struct ldb_dn **role_owner_dn)
6026 int ret;
6027 switch (role) {
6028 case DREPL_NAMING_MASTER:
6029 *fsmo_role_dn = samdb_partitions_dn(ldb, tmp_ctx);
6030 ret = samdb_reference_dn(ldb, tmp_ctx, *fsmo_role_dn, "fSMORoleOwner", role_owner_dn);
6031 if (ret != LDB_SUCCESS) {
6032 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in Naming Master object - %s\n",
6033 ldb_errstring(ldb)));
6034 talloc_free(tmp_ctx);
6035 return WERR_DS_DRA_INTERNAL_ERROR;
6037 break;
6038 case DREPL_INFRASTRUCTURE_MASTER:
6039 *fsmo_role_dn = samdb_infrastructure_dn(ldb, tmp_ctx);
6040 ret = samdb_reference_dn(ldb, tmp_ctx, *fsmo_role_dn, "fSMORoleOwner", role_owner_dn);
6041 if (ret != LDB_SUCCESS) {
6042 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in Schema Master object - %s\n",
6043 ldb_errstring(ldb)));
6044 talloc_free(tmp_ctx);
6045 return WERR_DS_DRA_INTERNAL_ERROR;
6047 break;
6048 case DREPL_RID_MASTER:
6049 ret = samdb_rid_manager_dn(ldb, tmp_ctx, fsmo_role_dn);
6050 if (ret != LDB_SUCCESS) {
6051 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
6052 talloc_free(tmp_ctx);
6053 return WERR_DS_DRA_INTERNAL_ERROR;
6056 ret = samdb_reference_dn(ldb, tmp_ctx, *fsmo_role_dn, "fSMORoleOwner", role_owner_dn);
6057 if (ret != LDB_SUCCESS) {
6058 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in RID Manager object - %s\n",
6059 ldb_errstring(ldb)));
6060 talloc_free(tmp_ctx);
6061 return WERR_DS_DRA_INTERNAL_ERROR;
6063 break;
6064 case DREPL_SCHEMA_MASTER:
6065 *fsmo_role_dn = ldb_get_schema_basedn(ldb);
6066 ret = samdb_reference_dn(ldb, tmp_ctx, *fsmo_role_dn, "fSMORoleOwner", role_owner_dn);
6067 if (ret != LDB_SUCCESS) {
6068 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in Schema Master object - %s\n",
6069 ldb_errstring(ldb)));
6070 talloc_free(tmp_ctx);
6071 return WERR_DS_DRA_INTERNAL_ERROR;
6073 break;
6074 case DREPL_PDC_MASTER:
6075 *fsmo_role_dn = ldb_get_default_basedn(ldb);
6076 ret = samdb_reference_dn(ldb, tmp_ctx, *fsmo_role_dn, "fSMORoleOwner", role_owner_dn);
6077 if (ret != LDB_SUCCESS) {
6078 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in Pd Master object - %s\n",
6079 ldb_errstring(ldb)));
6080 talloc_free(tmp_ctx);
6081 return WERR_DS_DRA_INTERNAL_ERROR;
6083 break;
6084 default:
6085 return WERR_DS_DRA_INTERNAL_ERROR;
6087 return WERR_OK;
6090 const char *samdb_dn_to_dnshostname(struct ldb_context *ldb,
6091 TALLOC_CTX *mem_ctx,
6092 struct ldb_dn *server_dn)
6094 int ldb_ret;
6095 struct ldb_result *res = NULL;
6096 const char * const attrs[] = { "dNSHostName", NULL};
6098 ldb_ret = ldb_search(ldb, mem_ctx, &res,
6099 server_dn,
6100 LDB_SCOPE_BASE,
6101 attrs, NULL);
6102 if (ldb_ret != LDB_SUCCESS) {
6103 DEBUG(4, ("Failed to find dNSHostName for dn %s, ldb error: %s\n",
6104 ldb_dn_get_linearized(server_dn), ldb_errstring(ldb)));
6105 return NULL;
6108 return ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName", NULL);
6112 returns true if an attribute is in the filter,
6113 false otherwise, provided that attribute value is provided with the expression
6115 bool dsdb_attr_in_parse_tree(struct ldb_parse_tree *tree,
6116 const char *attr)
6118 unsigned int i;
6119 switch (tree->operation) {
6120 case LDB_OP_AND:
6121 case LDB_OP_OR:
6122 for (i=0;i<tree->u.list.num_elements;i++) {
6123 if (dsdb_attr_in_parse_tree(tree->u.list.elements[i],
6124 attr))
6125 return true;
6127 return false;
6128 case LDB_OP_NOT:
6129 return dsdb_attr_in_parse_tree(tree->u.isnot.child, attr);
6130 case LDB_OP_EQUALITY:
6131 if (ldb_attr_cmp(tree->u.equality.attr, attr) == 0) {
6132 return true;
6134 return false;
6135 case LDB_OP_GREATER:
6136 case LDB_OP_LESS:
6137 case LDB_OP_APPROX:
6138 if (ldb_attr_cmp(tree->u.comparison.attr, attr) == 0) {
6139 return true;
6141 return false;
6142 case LDB_OP_SUBSTRING:
6143 if (ldb_attr_cmp(tree->u.substring.attr, attr) == 0) {
6144 return true;
6146 return false;
6147 case LDB_OP_PRESENT:
6148 /* (attrname=*) is not filtered out */
6149 return false;
6150 case LDB_OP_EXTENDED:
6151 if (tree->u.extended.attr &&
6152 ldb_attr_cmp(tree->u.extended.attr, attr) == 0) {
6153 return true;
6155 return false;
6157 return false;
6160 int dsdb_werror_at(struct ldb_context *ldb, int ldb_ecode, WERROR werr,
6161 const char *location, const char *func,
6162 const char *reason)
6164 if (reason == NULL) {
6165 reason = win_errstr(werr);
6167 ldb_asprintf_errstring(ldb, "%08X: %s at %s:%s",
6168 W_ERROR_V(werr), reason, location, func);
6169 return ldb_ecode;
6173 map an ldb error code to an approximate NTSTATUS code
6175 NTSTATUS dsdb_ldb_err_to_ntstatus(int err)
6177 switch (err) {
6178 case LDB_SUCCESS:
6179 return NT_STATUS_OK;
6181 case LDB_ERR_PROTOCOL_ERROR:
6182 return NT_STATUS_DEVICE_PROTOCOL_ERROR;
6184 case LDB_ERR_TIME_LIMIT_EXCEEDED:
6185 return NT_STATUS_IO_TIMEOUT;
6187 case LDB_ERR_SIZE_LIMIT_EXCEEDED:
6188 return NT_STATUS_BUFFER_TOO_SMALL;
6190 case LDB_ERR_COMPARE_FALSE:
6191 case LDB_ERR_COMPARE_TRUE:
6192 return NT_STATUS_REVISION_MISMATCH;
6194 case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED:
6195 return NT_STATUS_NOT_SUPPORTED;
6197 case LDB_ERR_STRONG_AUTH_REQUIRED:
6198 case LDB_ERR_CONFIDENTIALITY_REQUIRED:
6199 case LDB_ERR_SASL_BIND_IN_PROGRESS:
6200 case LDB_ERR_INAPPROPRIATE_AUTHENTICATION:
6201 case LDB_ERR_INVALID_CREDENTIALS:
6202 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
6203 case LDB_ERR_UNWILLING_TO_PERFORM:
6204 return NT_STATUS_ACCESS_DENIED;
6206 case LDB_ERR_NO_SUCH_OBJECT:
6207 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6209 case LDB_ERR_REFERRAL:
6210 case LDB_ERR_NO_SUCH_ATTRIBUTE:
6211 return NT_STATUS_NOT_FOUND;
6213 case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION:
6214 return NT_STATUS_NOT_SUPPORTED;
6216 case LDB_ERR_ADMIN_LIMIT_EXCEEDED:
6217 return NT_STATUS_BUFFER_TOO_SMALL;
6219 case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE:
6220 case LDB_ERR_INAPPROPRIATE_MATCHING:
6221 case LDB_ERR_CONSTRAINT_VIOLATION:
6222 case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX:
6223 case LDB_ERR_INVALID_DN_SYNTAX:
6224 case LDB_ERR_NAMING_VIOLATION:
6225 case LDB_ERR_OBJECT_CLASS_VIOLATION:
6226 case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF:
6227 case LDB_ERR_NOT_ALLOWED_ON_RDN:
6228 return NT_STATUS_INVALID_PARAMETER;
6230 case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS:
6231 case LDB_ERR_ENTRY_ALREADY_EXISTS:
6232 return NT_STATUS_ERROR_DS_OBJ_STRING_NAME_EXISTS;
6234 case LDB_ERR_BUSY:
6235 return NT_STATUS_NETWORK_BUSY;
6237 case LDB_ERR_ALIAS_PROBLEM:
6238 case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM:
6239 case LDB_ERR_UNAVAILABLE:
6240 case LDB_ERR_LOOP_DETECT:
6241 case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED:
6242 case LDB_ERR_AFFECTS_MULTIPLE_DSAS:
6243 case LDB_ERR_OTHER:
6244 case LDB_ERR_OPERATIONS_ERROR:
6245 break;
6247 return NT_STATUS_UNSUCCESSFUL;
6252 create a new naming context that will hold a partial replica
6254 int dsdb_create_partial_replica_NC(struct ldb_context *ldb, struct ldb_dn *dn)
6256 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
6257 struct ldb_message *msg;
6258 int ret;
6260 if (tmp_ctx == NULL) {
6261 return ldb_oom(ldb);
6264 msg = ldb_msg_new(tmp_ctx);
6265 if (msg == NULL) {
6266 talloc_free(tmp_ctx);
6267 return ldb_oom(ldb);
6270 msg->dn = dn;
6271 ret = ldb_msg_add_string(msg, "objectClass", "top");
6272 if (ret != LDB_SUCCESS) {
6273 talloc_free(tmp_ctx);
6274 return ldb_oom(ldb);
6277 /* [MS-DRSR] implies that we should only add the 'top'
6278 * objectclass, but that would cause lots of problems with our
6279 * objectclass code as top is not structural, so we add
6280 * 'domainDNS' as well to keep things sane. We're expecting
6281 * this new NC to be of objectclass domainDNS after
6282 * replication anyway
6284 ret = ldb_msg_add_string(msg, "objectClass", "domainDNS");
6285 if (ret != LDB_SUCCESS) {
6286 talloc_free(tmp_ctx);
6287 return ldb_oom(ldb);
6290 ret = ldb_msg_add_fmt(msg, "instanceType", "%u",
6291 INSTANCE_TYPE_IS_NC_HEAD|
6292 INSTANCE_TYPE_NC_ABOVE|
6293 INSTANCE_TYPE_UNINSTANT);
6294 if (ret != LDB_SUCCESS) {
6295 talloc_free(tmp_ctx);
6296 return ldb_oom(ldb);
6299 ret = dsdb_add(ldb, msg, DSDB_MODIFY_PARTIAL_REPLICA);
6300 if (ret != LDB_SUCCESS && ret != LDB_ERR_ENTRY_ALREADY_EXISTS) {
6301 DEBUG(0,("Failed to create new NC for %s - %s (%s)\n",
6302 ldb_dn_get_linearized(dn),
6303 ldb_errstring(ldb), ldb_strerror(ret)));
6304 talloc_free(tmp_ctx);
6305 return ret;
6308 DEBUG(1,("Created new NC for %s\n", ldb_dn_get_linearized(dn)));
6310 talloc_free(tmp_ctx);
6311 return LDB_SUCCESS;
6315 * Return the effective badPwdCount
6317 * This requires that the user_msg have (if present):
6318 * - badPasswordTime
6319 * - badPwdCount
6321 * This also requires that the domain_msg have (if present):
6322 * - lockOutObservationWindow
6324 int dsdb_effective_badPwdCount(const struct ldb_message *user_msg,
6325 int64_t lockOutObservationWindow,
6326 NTTIME now)
6328 int64_t badPasswordTime;
6329 badPasswordTime = ldb_msg_find_attr_as_int64(user_msg, "badPasswordTime", 0);
6331 if (badPasswordTime - lockOutObservationWindow >= now) {
6332 return ldb_msg_find_attr_as_int(user_msg, "badPwdCount", 0);
6333 } else {
6334 return 0;
6339 * Returns a user's PSO, or NULL if none was found
6341 static struct ldb_result *lookup_user_pso(struct ldb_context *sam_ldb,
6342 TALLOC_CTX *mem_ctx,
6343 const struct ldb_message *user_msg,
6344 const char * const *attrs)
6346 struct ldb_result *res = NULL;
6347 struct ldb_dn *pso_dn = NULL;
6348 int ret;
6350 /* if the user has a PSO that applies, then use the PSO's setting */
6351 pso_dn = ldb_msg_find_attr_as_dn(sam_ldb, mem_ctx, user_msg,
6352 "msDS-ResultantPSO");
6354 if (pso_dn != NULL) {
6356 ret = dsdb_search_dn(sam_ldb, mem_ctx, &res, pso_dn, attrs, 0);
6357 if (ret != LDB_SUCCESS) {
6360 * log the error. The caller should fallback to using
6361 * the default domain password settings
6363 DBG_ERR("Error retrieving msDS-ResultantPSO %s for %s\n",
6364 ldb_dn_get_linearized(pso_dn),
6365 ldb_dn_get_linearized(user_msg->dn));
6367 talloc_free(pso_dn);
6369 return res;
6373 * Return the msDS-LockoutObservationWindow for a user message
6375 * This requires that the user_msg have (if present):
6376 * - msDS-ResultantPSO
6378 int64_t samdb_result_msds_LockoutObservationWindow(
6379 struct ldb_context *sam_ldb,
6380 TALLOC_CTX *mem_ctx,
6381 struct ldb_dn *domain_dn,
6382 const struct ldb_message *user_msg)
6384 int64_t lockOutObservationWindow;
6385 struct ldb_result *res = NULL;
6386 const char *attrs[] = { "msDS-LockoutObservationWindow",
6387 NULL };
6388 if (domain_dn == NULL) {
6389 smb_panic("domain dn is NULL");
6391 res = lookup_user_pso(sam_ldb, mem_ctx, user_msg, attrs);
6393 if (res != NULL) {
6394 lockOutObservationWindow =
6395 ldb_msg_find_attr_as_int64(res->msgs[0],
6396 "msDS-LockoutObservationWindow",
6397 DEFAULT_OBSERVATION_WINDOW);
6398 talloc_free(res);
6399 } else {
6401 /* no PSO was found, lookup the default domain setting */
6402 lockOutObservationWindow =
6403 samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn,
6404 "lockOutObservationWindow", NULL);
6406 return lockOutObservationWindow;
6410 * Return the effective badPwdCount
6412 * This requires that the user_msg have (if present):
6413 * - badPasswordTime
6414 * - badPwdCount
6415 * - msDS-ResultantPSO
6417 int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
6418 TALLOC_CTX *mem_ctx,
6419 struct ldb_dn *domain_dn,
6420 const struct ldb_message *user_msg)
6422 struct timeval tv_now = timeval_current();
6423 NTTIME now = timeval_to_nttime(&tv_now);
6424 int64_t lockOutObservationWindow =
6425 samdb_result_msds_LockoutObservationWindow(
6426 sam_ldb, mem_ctx, domain_dn, user_msg);
6427 return dsdb_effective_badPwdCount(user_msg, lockOutObservationWindow, now);
6431 * Returns the lockoutThreshold that applies. If a PSO is specified, then that
6432 * setting is used over the domain defaults
6434 static int64_t get_lockout_threshold(struct ldb_message *domain_msg,
6435 struct ldb_message *pso_msg)
6437 if (pso_msg != NULL) {
6438 return ldb_msg_find_attr_as_int(pso_msg,
6439 "msDS-LockoutThreshold", 0);
6440 } else {
6441 return ldb_msg_find_attr_as_int(domain_msg,
6442 "lockoutThreshold", 0);
6447 * Returns the lockOutObservationWindow that applies. If a PSO is specified,
6448 * then that setting is used over the domain defaults
6450 static int64_t get_lockout_observation_window(struct ldb_message *domain_msg,
6451 struct ldb_message *pso_msg)
6453 if (pso_msg != NULL) {
6454 return ldb_msg_find_attr_as_int64(pso_msg,
6455 "msDS-LockoutObservationWindow",
6456 DEFAULT_OBSERVATION_WINDOW);
6457 } else {
6458 return ldb_msg_find_attr_as_int64(domain_msg,
6459 "lockOutObservationWindow",
6460 DEFAULT_OBSERVATION_WINDOW);
6465 * Prepare an update to the badPwdCount and associated attributes.
6467 * This requires that the user_msg have (if present):
6468 * - objectSid
6469 * - badPasswordTime
6470 * - badPwdCount
6472 * This also requires that the domain_msg have (if present):
6473 * - pwdProperties
6474 * - lockoutThreshold
6475 * - lockOutObservationWindow
6477 * This also requires that the pso_msg have (if present):
6478 * - msDS-LockoutThreshold
6479 * - msDS-LockoutObservationWindow
6481 NTSTATUS dsdb_update_bad_pwd_count(TALLOC_CTX *mem_ctx,
6482 struct ldb_context *sam_ctx,
6483 struct ldb_message *user_msg,
6484 struct ldb_message *domain_msg,
6485 struct ldb_message *pso_msg,
6486 struct ldb_message **_mod_msg)
6488 int ret, badPwdCount;
6489 unsigned int i;
6490 int64_t lockoutThreshold, lockOutObservationWindow;
6491 struct dom_sid *sid;
6492 struct timeval tv_now = timeval_current();
6493 NTTIME now = timeval_to_nttime(&tv_now);
6494 NTSTATUS status;
6495 uint32_t pwdProperties, rid = 0;
6496 struct ldb_message *mod_msg;
6498 sid = samdb_result_dom_sid(mem_ctx, user_msg, "objectSid");
6500 pwdProperties = ldb_msg_find_attr_as_uint(domain_msg,
6501 "pwdProperties", -1);
6502 if (sid && !(pwdProperties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
6503 status = dom_sid_split_rid(NULL, sid, NULL, &rid);
6504 if (!NT_STATUS_IS_OK(status)) {
6506 * This can't happen anyway, but always try
6507 * and update the badPwdCount on failure
6509 rid = 0;
6512 TALLOC_FREE(sid);
6515 * Work out if we are doing password lockout on the domain.
6516 * Also, the built in administrator account is exempt:
6517 * http://msdn.microsoft.com/en-us/library/windows/desktop/aa375371%28v=vs.85%29.aspx
6519 lockoutThreshold = get_lockout_threshold(domain_msg, pso_msg);
6520 if (lockoutThreshold == 0 || (rid == DOMAIN_RID_ADMINISTRATOR)) {
6521 DEBUG(5, ("Not updating badPwdCount on %s after wrong password\n",
6522 ldb_dn_get_linearized(user_msg->dn)));
6523 return NT_STATUS_OK;
6526 mod_msg = ldb_msg_new(mem_ctx);
6527 if (mod_msg == NULL) {
6528 return NT_STATUS_NO_MEMORY;
6530 mod_msg->dn = ldb_dn_copy(mod_msg, user_msg->dn);
6531 if (mod_msg->dn == NULL) {
6532 TALLOC_FREE(mod_msg);
6533 return NT_STATUS_NO_MEMORY;
6536 lockOutObservationWindow = get_lockout_observation_window(domain_msg,
6537 pso_msg);
6539 badPwdCount = dsdb_effective_badPwdCount(user_msg, lockOutObservationWindow, now);
6541 badPwdCount++;
6543 ret = samdb_msg_add_int(sam_ctx, mod_msg, mod_msg, "badPwdCount", badPwdCount);
6544 if (ret != LDB_SUCCESS) {
6545 TALLOC_FREE(mod_msg);
6546 return NT_STATUS_NO_MEMORY;
6548 ret = samdb_msg_add_int64(sam_ctx, mod_msg, mod_msg, "badPasswordTime", now);
6549 if (ret != LDB_SUCCESS) {
6550 TALLOC_FREE(mod_msg);
6551 return NT_STATUS_NO_MEMORY;
6554 if (dsdb_account_is_trust(user_msg)) {
6555 /* Trust accounts cannot be locked out. */
6556 } else if (badPwdCount >= lockoutThreshold) {
6557 ret = samdb_msg_add_int64(sam_ctx, mod_msg, mod_msg, "lockoutTime", now);
6558 if (ret != LDB_SUCCESS) {
6559 TALLOC_FREE(mod_msg);
6560 return NT_STATUS_NO_MEMORY;
6562 DEBUGC( DBGC_AUTH, 1, ("Locked out user %s after %d wrong passwords\n",
6563 ldb_dn_get_linearized(user_msg->dn), badPwdCount));
6564 } else {
6565 DEBUGC( DBGC_AUTH, 5, ("Updated badPwdCount on %s after %d wrong passwords\n",
6566 ldb_dn_get_linearized(user_msg->dn), badPwdCount));
6569 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
6570 for (i=0; i< mod_msg->num_elements; i++) {
6571 mod_msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
6574 *_mod_msg = mod_msg;
6575 return NT_STATUS_OK;
6579 * Sets defaults for a User object
6580 * List of default attributes set:
6581 * accountExpires, badPasswordTime, badPwdCount,
6582 * codePage, countryCode, lastLogoff, lastLogon
6583 * logonCount, pwdLastSet
6585 int dsdb_user_obj_set_defaults(struct ldb_context *ldb,
6586 struct ldb_message *usr_obj,
6587 struct ldb_request *req)
6589 size_t i;
6590 int ret;
6591 static const struct attribute_values {
6592 const char *name;
6593 const char *value;
6594 const char *add_value;
6595 const char *mod_value;
6596 const char *control;
6597 unsigned add_flags;
6598 unsigned mod_flags;
6599 } map[] = {
6601 .name = "accountExpires",
6602 .add_value = "9223372036854775807",
6603 .mod_value = "0",
6606 .name = "badPasswordTime",
6607 .value = "0"
6610 .name = "badPwdCount",
6611 .value = "0"
6614 .name = "codePage",
6615 .value = "0"
6618 .name = "countryCode",
6619 .value = "0"
6622 .name = "lastLogoff",
6623 .value = "0"
6626 .name = "lastLogon",
6627 .value = "0"
6630 .name = "logonCount",
6631 .value = "0"
6634 .name = "logonHours",
6635 .add_flags = DSDB_FLAG_INTERNAL_FORCE_META_DATA,
6638 .name = "pwdLastSet",
6639 .value = "0",
6640 .control = DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID,
6643 .name = "adminCount",
6644 .mod_value = "0",
6647 .name = "operatorCount",
6648 .mod_value = "0",
6652 for (i = 0; i < ARRAY_SIZE(map); i++) {
6653 bool added = false;
6654 const char *value = NULL;
6655 unsigned flags = 0;
6657 if (req != NULL && req->operation == LDB_ADD) {
6658 value = map[i].add_value;
6659 flags = map[i].add_flags;
6660 } else {
6661 value = map[i].mod_value;
6662 flags = map[i].mod_flags;
6665 if (value == NULL) {
6666 value = map[i].value;
6669 if (value != NULL) {
6670 flags |= LDB_FLAG_MOD_ADD;
6673 if (flags == 0) {
6674 continue;
6677 ret = samdb_find_or_add_attribute_ex(ldb, usr_obj,
6678 map[i].name,
6679 value, flags,
6680 &added);
6681 if (ret != LDB_SUCCESS) {
6682 return ret;
6685 if (req != NULL && added && map[i].control != NULL) {
6686 ret = ldb_request_add_control(req,
6687 map[i].control,
6688 false, NULL);
6689 if (ret != LDB_SUCCESS) {
6690 return ret;
6695 return LDB_SUCCESS;
6699 * Sets 'sAMAccountType on user object based on userAccountControl.
6700 * This function is used in processing both 'add' and 'modify' requests.
6701 * @param ldb Current ldb_context
6702 * @param usr_obj ldb_message representing User object
6703 * @param user_account_control Value for userAccountControl flags
6704 * @param account_type_p Optional pointer to account_type to return
6705 * @return LDB_SUCCESS or LDB_ERR* code on failure
6707 int dsdb_user_obj_set_account_type(struct ldb_context *ldb, struct ldb_message *usr_obj,
6708 uint32_t user_account_control, uint32_t *account_type_p)
6710 int ret;
6711 uint32_t account_type;
6713 account_type = ds_uf2atype(user_account_control);
6714 if (account_type == 0) {
6715 ldb_set_errstring(ldb, "dsdb: Unrecognized account type!");
6716 return LDB_ERR_UNWILLING_TO_PERFORM;
6718 ret = samdb_msg_add_uint_flags(ldb, usr_obj, usr_obj,
6719 "sAMAccountType",
6720 account_type,
6721 LDB_FLAG_MOD_REPLACE);
6722 if (ret != LDB_SUCCESS) {
6723 return ret;
6726 if (account_type_p) {
6727 *account_type_p = account_type;
6730 return LDB_SUCCESS;
6734 * Determine and set primaryGroupID based on userAccountControl value.
6735 * This function is used in processing both 'add' and 'modify' requests.
6736 * @param ldb Current ldb_context
6737 * @param usr_obj ldb_message representing User object
6738 * @param user_account_control Value for userAccountControl flags
6739 * @param group_rid_p Optional pointer to group RID to return
6740 * @return LDB_SUCCESS or LDB_ERR* code on failure
6742 int dsdb_user_obj_set_primary_group_id(struct ldb_context *ldb, struct ldb_message *usr_obj,
6743 uint32_t user_account_control, uint32_t *group_rid_p)
6745 int ret;
6746 uint32_t rid;
6748 rid = ds_uf2prim_group_rid(user_account_control);
6750 ret = samdb_msg_add_uint_flags(ldb, usr_obj, usr_obj,
6751 "primaryGroupID", rid,
6752 LDB_FLAG_MOD_REPLACE);
6753 if (ret != LDB_SUCCESS) {
6754 return ret;
6757 if (group_rid_p) {
6758 *group_rid_p = rid;
6761 return LDB_SUCCESS;
6765 * Returns True if the source and target DNs both have the same naming context,
6766 * i.e. they're both in the same partition.
6768 bool dsdb_objects_have_same_nc(struct ldb_context *ldb,
6769 TALLOC_CTX *mem_ctx,
6770 struct ldb_dn *source_dn,
6771 struct ldb_dn *target_dn)
6773 TALLOC_CTX *tmp_ctx;
6774 struct ldb_dn *source_nc = NULL;
6775 struct ldb_dn *target_nc = NULL;
6776 int ret;
6777 bool same_nc = true;
6779 tmp_ctx = talloc_new(mem_ctx);
6780 if (tmp_ctx == NULL) {
6781 return ldb_oom(ldb);
6784 ret = dsdb_find_nc_root(ldb, tmp_ctx, source_dn, &source_nc);
6785 /* fix clang warning */
6786 if (source_nc == NULL) {
6787 ret = LDB_ERR_OTHER;
6789 if (ret != LDB_SUCCESS) {
6790 DBG_ERR("Failed to find base DN for source %s: %s\n",
6791 ldb_dn_get_linearized(source_dn), ldb_errstring(ldb));
6792 talloc_free(tmp_ctx);
6793 return true;
6796 ret = dsdb_find_nc_root(ldb, tmp_ctx, target_dn, &target_nc);
6797 /* fix clang warning */
6798 if (target_nc == NULL) {
6799 ret = LDB_ERR_OTHER;
6801 if (ret != LDB_SUCCESS) {
6802 DBG_ERR("Failed to find base DN for target %s: %s\n",
6803 ldb_dn_get_linearized(target_dn), ldb_errstring(ldb));
6804 talloc_free(tmp_ctx);
6805 return true;
6808 same_nc = (ldb_dn_compare(source_nc, target_nc) == 0);
6810 talloc_free(tmp_ctx);
6812 return same_nc;
6815 * Context for dsdb_count_domain_callback
6817 struct dsdb_count_domain_context {
6819 * Number of matching records
6821 size_t count;
6823 * sid of the domain that the records must belong to.
6824 * if NULL records can belong to any domain.
6826 struct dom_sid *dom_sid;
6830 * @brief ldb async callback for dsdb_domain_count.
6832 * count the number of records in the database matching an LDAP query,
6833 * optionally filtering for domain membership.
6835 * @param [in,out] req the ldb request being processed
6836 * req->context contains:
6837 * count The number of matching records
6838 * dom_sid The domain sid, if present records must belong
6839 * to the domain to be counted.
6840 *@param [in,out] ares The query result.
6842 * @return an LDB error code
6845 static int dsdb_count_domain_callback(
6846 struct ldb_request *req,
6847 struct ldb_reply *ares)
6850 if (ares == NULL) {
6851 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
6853 if (ares->error != LDB_SUCCESS) {
6854 int error = ares->error;
6855 TALLOC_FREE(ares);
6856 return ldb_request_done(req, error);
6859 switch (ares->type) {
6860 case LDB_REPLY_ENTRY:
6862 struct dsdb_count_domain_context *context = NULL;
6863 ssize_t ret;
6864 bool in_domain;
6865 struct dom_sid sid;
6866 const struct ldb_val *v;
6868 context = req->context;
6869 if (context->dom_sid == NULL) {
6870 context->count++;
6871 break;
6874 v = ldb_msg_find_ldb_val(ares->message, "objectSid");
6875 if (v == NULL) {
6876 break;
6879 ret = sid_parse(v->data, v->length, &sid);
6880 if (ret == -1) {
6881 break;
6884 in_domain = dom_sid_in_domain(context->dom_sid, &sid);
6885 if (!in_domain) {
6886 break;
6889 context->count++;
6890 break;
6892 case LDB_REPLY_REFERRAL:
6893 break;
6895 case LDB_REPLY_DONE:
6896 TALLOC_FREE(ares);
6897 return ldb_request_done(req, LDB_SUCCESS);
6900 TALLOC_FREE(ares);
6902 return LDB_SUCCESS;
6906 * @brief Count the number of records matching a query.
6908 * Count the number of entries in the database matching the supplied query,
6909 * optionally filtering only those entries belonging to the supplied domain.
6911 * @param ldb [in] Current ldb context
6912 * @param count [out] Pointer to the count
6913 * @param base [in] The base dn for the query
6914 * @param dom_sid [in] The domain sid, if non NULL records that are not a member
6915 * of the domain are ignored.
6916 * @param scope [in] Search scope.
6917 * @param exp_fmt [in] format string for the query.
6919 * @return LDB_STATUS code.
6921 int PRINTF_ATTRIBUTE(6, 7) dsdb_domain_count(
6922 struct ldb_context *ldb,
6923 size_t *count,
6924 struct ldb_dn *base,
6925 struct dom_sid *dom_sid,
6926 enum ldb_scope scope,
6927 const char *exp_fmt, ...)
6929 TALLOC_CTX *tmp_ctx = NULL;
6930 struct ldb_request *req = NULL;
6931 struct dsdb_count_domain_context *context = NULL;
6932 char *expression = NULL;
6933 const char *object_sid[] = {"objectSid", NULL};
6934 const char *none[] = {NULL};
6935 va_list ap;
6936 int ret;
6938 *count = 0;
6939 tmp_ctx = talloc_new(ldb);
6940 if (tmp_ctx == NULL) {
6941 return ldb_oom(ldb);
6944 context = talloc_zero(tmp_ctx, struct dsdb_count_domain_context);
6945 if (context == NULL) {
6946 return LDB_ERR_OPERATIONS_ERROR;
6948 context->dom_sid = dom_sid;
6950 if (exp_fmt) {
6951 va_start(ap, exp_fmt);
6952 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
6953 va_end(ap);
6955 if (expression == NULL) {
6956 TALLOC_FREE(context);
6957 TALLOC_FREE(tmp_ctx);
6958 return LDB_ERR_OPERATIONS_ERROR;
6962 ret = ldb_build_search_req(
6963 &req,
6964 ldb,
6965 tmp_ctx,
6966 base,
6967 scope,
6968 expression,
6969 (dom_sid == NULL) ? none : object_sid,
6970 NULL,
6971 context,
6972 dsdb_count_domain_callback,
6973 NULL);
6974 ldb_req_set_location(req, "dsdb_domain_count");
6976 if (ret != LDB_SUCCESS) goto done;
6978 ret = ldb_request(ldb, req);
6980 if (ret == LDB_SUCCESS) {
6981 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
6982 if (ret == LDB_SUCCESS) {
6983 *count = context->count;
6988 done:
6989 TALLOC_FREE(expression);
6990 TALLOC_FREE(req);
6991 TALLOC_FREE(context);
6992 TALLOC_FREE(tmp_ctx);
6994 return ret;
6998 * Returns 1 if 'sids' contains the Protected Users group SID for the domain, 0
6999 * if not. Returns a negative value on error.
7001 int dsdb_is_protected_user(struct ldb_context *ldb,
7002 const struct auth_SidAttr *sids,
7003 uint32_t num_sids)
7005 const struct dom_sid *domain_sid = NULL;
7006 struct dom_sid protected_users_sid;
7007 uint32_t i;
7009 domain_sid = samdb_domain_sid(ldb);
7010 if (domain_sid == NULL) {
7011 return -1;
7014 protected_users_sid = *domain_sid;
7015 if (!sid_append_rid(&protected_users_sid, DOMAIN_RID_PROTECTED_USERS)) {
7016 return -1;
7019 for (i = 0; i < num_sids; ++i) {
7020 if (dom_sid_equal(&protected_users_sid, &sids[i].sid)) {
7021 return 1;
7025 return 0;
7028 bool dsdb_account_is_trust(const struct ldb_message *msg)
7030 uint32_t userAccountControl;
7032 userAccountControl = ldb_msg_find_attr_as_uint(msg,
7033 "userAccountControl",
7035 return userAccountControl & UF_TRUST_ACCOUNT_MASK;