Changeset 988 for vendor/current/source4/dsdb/samdb

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/dsdb/samdb

Files:

• cracknames.c (modified) (43 diffs)
• ldb_modules/acl.c (modified) (58 diffs)
• ldb_modules/acl_read.c (modified) (8 diffs)
• ldb_modules/acl_util.c (modified) (8 diffs)
• ldb_modules/descriptor.c (modified) (30 diffs)
• ldb_modules/dirsync.c (added)
• ldb_modules/dns_notify.c (added)
• ldb_modules/extended_dn_in.c (modified) (15 diffs)
• ldb_modules/extended_dn_out.c (modified) (13 diffs)
• ldb_modules/extended_dn_store.c (modified) (3 diffs)
• ldb_modules/instancetype.c (modified) (2 diffs)
• ldb_modules/linked_attributes.c (modified) (34 diffs)
• ldb_modules/local_password.c (modified) (2 diffs)
• ldb_modules/naming_fsmo.c (deleted)
• ldb_modules/netlogon.c (added)
• ldb_modules/new_partition.c (modified) (4 diffs)
• ldb_modules/objectclass.c (modified) (33 diffs)
• ldb_modules/objectclass_attrs.c (modified) (12 diffs)
• ldb_modules/operational.c (modified) (24 diffs)
• ldb_modules/partition.c (modified) (23 diffs)
• ldb_modules/partition.h (modified) (3 diffs)
• ldb_modules/partition_init.c (modified) (10 diffs)
• ldb_modules/partition_metadata.c (added)
• ldb_modules/password_hash.c (modified) (44 diffs)
• ldb_modules/pdc_fsmo.c (deleted)
• ldb_modules/proxy.c (modified) (2 diffs)
• ldb_modules/ranged_results.c (modified) (2 diffs)
• ldb_modules/repl_meta_data.c (modified) (113 diffs)
• ldb_modules/resolve_oids.c (modified) (1 diff)
• ldb_modules/ridalloc.c (modified) (11 diffs)
• ldb_modules/rootdse.c (modified) (38 diffs)
• ldb_modules/samba_dsdb.c (modified) (17 diffs)
• ldb_modules/samba_secrets.c (modified) (1 diff)
• ldb_modules/samldb.c (modified) (75 diffs)
• ldb_modules/schema.c (deleted)
• ldb_modules/schema_data.c (modified) (9 diffs)
• ldb_modules/schema_load.c (modified) (12 diffs)
• ldb_modules/schema_util.c (modified) (2 diffs)
• ldb_modules/secrets_tdb_sync.c (added)
• ldb_modules/show_deleted.c (modified) (6 diffs)
• ldb_modules/simple_dn.c (modified) (1 diff)
• ldb_modules/simple_ldap_map.c (modified) (7 diffs)
• ldb_modules/subtree_delete.c (modified) (2 diffs)
• ldb_modules/subtree_rename.c (modified) (11 diffs)
• ldb_modules/tombstone_reanimate.c (added)
• ldb_modules/update_keytab.c (modified) (7 diffs)
• ldb_modules/util.c (modified) (15 diffs)
• ldb_modules/util.h (modified) (1 diff)
• ldb_modules/wscript_build (modified) (2 diffs)
• ldb_modules/wscript_build_server (added)
• samdb.c (modified) (4 diffs)
• samdb.h (modified) (11 diffs)

vendor/current/source4/dsdb/samdb/cracknames.c

@@ -2 +2 @@
    Unix SMB/CIFS implementation.
 
-   endpoint server for the drsuapi pipe
+   crachnames implementation for the drsuapi pipe
    DsCrackNames()
 
    Copyright (C) Stefan Metzmacher 2004
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
+   Copyright (C) Matthieu Patou <mat@matws.net> 2012
 
    This program is free software; you can redistribute it and/or modify
@@ -25 +26 @@
 #include "librpc/gen_ndr/drsuapi.h"
 #include "lib/events/events.h"
-#include "rpc_server/common/common.h"
 #include <ldb.h>
 #include <ldb_errors.h>
-#include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
 #include "libcli/ldap/ldap_ndr.h"
@@ -44 +43 @@
                                    struct ldb_dn *name_dn, const char *name, 
                                    const char *domain_filter, const char *result_filter, 
-                                   struct drsuapi_DsNameInfo1 *info1);
+                                   struct drsuapi_DsNameInfo1 *info1, int scope, struct ldb_dn *search_dn);
 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
                                         enum drsuapi_DsNameFormat format_offered,
@@ -58 +57 @@
         krb5_principal principal;
         /* perhaps it's a principal with a realm, so return the right 'domain only' response */
-        const char *realm;
+        char *realm;
         ret = krb5_parse_name_flags(smb_krb5_context->krb5_context, name, 
                                     KRB5_PRINCIPAL_PARSE_REQUIRE_REALM, &principal);
@@ -66 +65 @@
         }
 
-        /* This isn't an allocation assignemnt, so it is free'ed with the krb5_free_principal */
-        realm = krb5_principal_get_realm(smb_krb5_context->krb5_context, principal);
+        realm = smb_krb5_principal_get_realm(smb_krb5_context->krb5_context, principal);
 
         info1->dns_domain_name  = talloc_strdup(mem_ctx, realm);
         krb5_free_principal(smb_krb5_context->krb5_context, principal);
+        free(realm);
 
         W_ERROR_HAVE_NO_MEMORY(info1->dns_domain_name);
@@ -114 +113 @@
 
         if (ret != LDB_SUCCESS && ret != LDB_ERR_NO_SUCH_OBJECT) {
-                DEBUG(1, ("ldb_search: dn: %s not found: %s", service_dn_str, ldb_errstring(ldb_ctx)));
+                DEBUG(1, ("ldb_search: dn: %s not found: %s\n", service_dn_str, ldb_errstring(ldb_ctx)));
                 return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
         } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
-                DEBUG(1, ("ldb_search: dn: %s not found", service_dn_str));
+                DEBUG(1, ("ldb_search: dn: %s not found\n", service_dn_str));
                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
         } else if (res->count != 1) {
                 talloc_free(res);
-                DEBUG(1, ("ldb_search: dn: %s not found", service_dn_str));
+                DEBUG(1, ("ldb_search: dn: %s not found\n", service_dn_str));
                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
         }
@@ -127 +126 @@
         spnmappings = ldb_msg_find_element(res->msgs[0], "sPNMappings");
         if (!spnmappings || spnmappings->num_values == 0) {
-                DEBUG(1, ("ldb_search: dn: %s no sPNMappings attribute", service_dn_str));
+                DEBUG(1, ("ldb_search: dn: %s no sPNMappings attribute\n", service_dn_str));
                 talloc_free(tmp_ctx);
                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
@@ -187 +186 @@
         krb5_error_code ret;
         krb5_principal principal;
+        const krb5_data *component;
         const char *service, *dns_name;
         char *new_service;
@@ -196 +196 @@
                                     name, KRB5_PRINCIPAL_PARSE_NO_REALM, &principal);
         if (ret) {
-                DEBUG(2, ("Could not parse principal: %s: %s",
+                DEBUG(2, ("Could not parse principal: %s: %s\n",
                           name, smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
                                                            ret, mem_ctx)));
@@ -205 +205 @@
 
         /* This is checked for in callers, but be safe */
-        if (principal->name.name_string.len < 2) {
+        if (krb5_princ_size(smb_krb5_context->krb5_context, principal) < 2) {
                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
                 return WERR_OK;
         }
-        service = principal->name.name_string.val[0];
-        dns_name = principal->name.name_string.val[1];
+        component = krb5_princ_component(smb_krb5_context->krb5_context,
+                                         principal, 0);
+        service = (const char *)component->data;
+        component = krb5_princ_component(smb_krb5_context->krb5_context,
+                                         principal, 1);
+        dns_name = (const char *)component->data;
 
         /* MAP it */
@@ -233 +237 @@
         }
 
-        /* ooh, very nasty playing around in the Principal... */
-        free(principal->name.name_string.val[0]);
-        principal->name.name_string.val[0] = strdup(new_service);
-        if (!principal->name.name_string.val[0]) {
+        /* reform principal */
+        new_princ = talloc_asprintf(mem_ctx, "%s/%s", new_service, dns_name);
+        if (!new_princ) {
                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
                 return WERR_NOMEM;
         }
 
-        /* reform principal */
-        ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context, principal, 
-                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM, &new_princ);
-
-        if (ret) {
-                krb5_free_principal(smb_krb5_context->krb5_context, principal);
-                return WERR_NOMEM;
-        }
-
         wret = DsCrackNameOneName(sam_ctx, mem_ctx, format_flags, format_offered, format_desired,
                                   new_princ, info1);
-        free(new_princ);
+        talloc_free(new_princ);
         if (W_ERROR_IS_OK(wret) && (info1->status == DRSUAPI_DS_NAME_STATUS_NOT_FOUND)) {
                 info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
@@ -278 +272 @@
         krb5_error_code ret;
         krb5_principal principal;
-        const char *realm;
+        char *realm;
         char *unparsed_name_short;
         const char *domain_attrs[] = { NULL };
@@ -296 +290 @@
         }
 
-        realm = krb5_principal_get_realm(smb_krb5_context->krb5_context,
-                                         principal);
+        realm = smb_krb5_principal_get_realm(smb_krb5_context->krb5_context,
+                                             principal);
 
         ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
-                                     samdb_partitions_dn(sam_ctx, mem_ctx), 
-                                     LDB_SCOPE_ONELEVEL,
-                                     domain_attrs,
-                                     "(&(&(|(&(dnsRoot=%s)(nETBIOSName=*))(nETBIOSName=%s))(objectclass=crossRef))(ncName=*))",
-                                     ldb_binary_encode_string(mem_ctx, realm), 
-                                     ldb_binary_encode_string(mem_ctx, realm));
+                             samdb_partitions_dn(sam_ctx, mem_ctx),
+                             LDB_SCOPE_ONELEVEL,
+                             domain_attrs,
+                             "(&(objectClass=crossRef)(|(dnsRoot=%s)(netbiosName=%s))(systemFlags:%s:=%u))",
+                             ldb_binary_encode_string(mem_ctx, realm),
+                             ldb_binary_encode_string(mem_ctx, realm),
+                             LDB_OID_COMPARATOR_AND,
+                             SYSTEM_FLAG_CR_NTDS_DOMAIN);
+        free(realm);
 
         if (ldb_ret != LDB_SUCCESS) {
-                DEBUG(2, ("DsCrackNameUPN domain ref search failed: %s", ldb_errstring(sam_ctx)));
+                DEBUG(2, ("DsCrackNameUPN domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
@@ -327 +324 @@
         }
 
+        /*
+         * The important thing here is that a samAccountName may have
+         * a space in it, and this must not be kerberos escaped to
+         * match this filter, so we specify
+         * KRB5_PRINCIPAL_UNPARSE_DISPLAY
+         */
         ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context, principal, 
-                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM, &unparsed_name_short);
+                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM |
+                                      KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+                                      &unparsed_name_short);
         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 
@@ -350 +355 @@
                                       format_flags, format_offered, format_desired, 
                                       NULL, unparsed_name_short, domain_filter, result_filter, 
-                                      info1);
+                                      info1, LDB_SCOPE_SUBTREE, NULL);
         free(unparsed_name_short);
 
         return status;
+}
+
+/*
+ * This function will workout the filtering parameter in order to be able to do
+ * the adapted search when the incomming format is format_functional.
+ * This boils down to defining the search_dn (passed as pointer to ldb_dn *) and the
+ * ldap filter request.
+ * Main input parameters are:
+ * * name, which is the portion of the functional name after the
+ * first '/'.
+ * * domain_filter, which is a ldap search filter used to find the NC DN given the
+ * function name to crack.
+ */
+static WERROR get_format_functional_filtering_param(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
+                        char *name, struct drsuapi_DsNameInfo1 *info1,
+                        struct ldb_dn **psearch_dn, const char *domain_filter, const char **presult_filter)
+{
+        struct ldb_result *domain_res = NULL;
+        const char * const domain_attrs[] = {"ncName", NULL};
+        struct ldb_dn *partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
+        int ldb_ret;
+        char *account,  *s, *result_filter = NULL;
+        struct ldb_dn *search_dn = NULL;
+
+        *psearch_dn = NULL;
+        *presult_filter = NULL;
+
+        ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
+                                partitions_basedn,
+                                LDB_SCOPE_ONELEVEL,
+                                domain_attrs,
+                                "%s", domain_filter);
+
+        if (ldb_ret != LDB_SUCCESS) {
+                DEBUG(2, ("DsCrackNameOne domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
+                info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
+                return WERR_FOOBAR;
+        }
+
+        if (domain_res->count == 1) {
+                struct ldb_dn *tmp_dn = samdb_result_dn(sam_ctx, mem_ctx, domain_res->msgs[0], "ncName", NULL);
+                const char * const name_attrs[] = {"name", NULL};
+
+                account = name;
+                s = strchr(account, '/');
+                talloc_free(domain_res);
+                while(s) {
+                        s[0] = '\0';
+                        s++;
+
+                        ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
+                                                tmp_dn,
+                                                LDB_SCOPE_ONELEVEL,
+                                                name_attrs,
+                                                "name=%s", account);
+
+                        if (ldb_ret != LDB_SUCCESS) {
+                                DEBUG(2, ("DsCrackNameOne domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
+                                info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
+                                return WERR_OK;
+                        }
+                        talloc_free(tmp_dn);
+                        switch (domain_res->count) {
+                        case 1:
+                                break;
+                        case 0:
+                                talloc_free(domain_res);
+                                info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
+                                return WERR_OK;
+                        default:
+                                talloc_free(domain_res);
+                                info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
+                                return WERR_OK;
+                        }
+
+                        tmp_dn = talloc_steal(mem_ctx, domain_res->msgs[0]->dn);
+                        talloc_free(domain_res);
+                        search_dn = tmp_dn;
+                        account = s;
+                        s = strchr(account, '/');
+                }
+                account = ldb_binary_encode_string(mem_ctx, account);
+                W_ERROR_HAVE_NO_MEMORY(account);
+                result_filter = talloc_asprintf(mem_ctx, "(name=%s)",
+                                                account);
+                W_ERROR_HAVE_NO_MEMORY(result_filter);
+        }
+        *psearch_dn = search_dn;
+        *presult_filter = result_filter;
+        return WERR_OK;
 }
 
@@ -367 +462 @@
         const char *result_filter = NULL;
         struct ldb_dn *name_dn = NULL;
+        struct ldb_dn *search_dn = NULL;
 
         struct smb_krb5_context *smb_krb5_context = NULL;
+        int scope = LDB_SCOPE_SUBTREE;
 
         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
@@ -381 +478 @@
          *       - handle format_flags
          */
-
+        if (format_desired == DRSUAPI_DS_NAME_FORMAT_UNKNOWN) {
+                return WERR_OK;
+        }
         /* here we need to set the domain_filter and/or the result_filter */
         switch (format_offered) {
@@ -401 +500 @@
                                 return werr;
                         }
-                        if (info1->status != DRSUAPI_DS_NAME_STATUS_NOT_FOUND) {
+                        if (info1->status != DRSUAPI_DS_NAME_STATUS_NOT_FOUND &&
+                            (formats[i] != DRSUAPI_DS_NAME_FORMAT_CANONICAL ||
+                             info1->status != DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR))
+                        {
                                 return werr;
                         }
@@ -412 +514 @@
         {
                 char *str, *s, *account;
+                scope = LDB_SCOPE_ONELEVEL;
 
                 if (strlen(name) == 0) {
@@ -441 +544 @@
                 s++;
 
-                domain_filter = talloc_asprintf(mem_ctx, "(&(objectClass=crossRef)(ncName=%s))", 
-                                                ldb_dn_get_linearized(samdb_dns_domain_to_dn(sam_ctx, mem_ctx, str)));
+                domain_filter = talloc_asprintf(mem_ctx, "(&(objectClass=crossRef)(dnsRoot=%s)(systemFlags:%s:=%u))",
+                                                ldb_binary_encode_string(mem_ctx, str),
+                                                LDB_OID_COMPARATOR_AND,
+                                                SYSTEM_FLAG_CR_NTDS_DOMAIN);
                 W_ERROR_HAVE_NO_MEMORY(domain_filter);
 
                 /* There may not be anything after the domain component (search for the domain itself) */
-                if (s[0]) {
-
-                        account = strrchr(s, '/');
-                        if (!account) {
-                                account = s;
-                        } else {
-                                account++;
+                account = s;
+                if (account && *account) {
+                        WERROR werr = get_format_functional_filtering_param(sam_ctx,
+                                                                                mem_ctx,
+                                                                                account,
+                                                                                info1,
+                                                                                &search_dn,
+                                                                                domain_filter,
+                                                                                &result_filter);
+                        if (!W_ERROR_IS_OK(werr)) {
+                                return werr;
                         }
-                        account = ldb_binary_encode_string(mem_ctx, account);
-                        W_ERROR_HAVE_NO_MEMORY(account);
-                        result_filter = talloc_asprintf(mem_ctx, "(name=%s)",
-                                                        account);              
-                        W_ERROR_HAVE_NO_MEMORY(result_filter);
+                        if (info1->status != DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR)
+                                return WERR_OK;
                 }
                 break;
@@ -465 +571 @@
                 char *p;
                 char *domain;
-                struct ldb_dn *dn_domain;
                 const char *account = NULL;
 
@@ -483 +588 @@
                 }
 
-                /* it could be in DNS domain form */
-                dn_domain = samdb_dns_domain_to_dn(sam_ctx, mem_ctx, domain);
-                W_ERROR_HAVE_NO_MEMORY(dn_domain);
-
                 domain_filter = talloc_asprintf(mem_ctx, 
-                                                "(&(&(|(nETBIOSName=%s)(nCName=%s))(objectclass=crossRef))(ncName=*))",
+                                                "(&(objectClass=crossRef)(netbiosName=%s)(systemFlags:%s:=%u))",
                                                 ldb_binary_encode_string(mem_ctx, domain),
-                                                ldb_dn_get_linearized(dn_domain));
+                                                LDB_OID_COMPARATOR_AND,
+                                                SYSTEM_FLAG_CR_NTDS_DOMAIN);
                 W_ERROR_HAVE_NO_MEMORY(domain_filter);
                 if (account) {
@@ -552 +654 @@
                 domain_filter = NULL;
                 if (!sid) {
+                        info1->dns_domain_name = NULL;
                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
                         return WERR_OK;
@@ -570 +673 @@
 
                 ret = smb_krb5_init_context(mem_ctx, 
-                                            ldb_get_event_context(sam_ctx),
                                             (struct loadparm_context *)ldb_get_opaque(sam_ctx, "loadparm"), 
                                             &smb_krb5_context);
@@ -587 +689 @@
                 domain_filter = NULL;
 
-                /* By getting the unparsed name here, we ensure the escaping is correct (and trust the client less) */
-                ret = krb5_unparse_name(smb_krb5_context->krb5_context, principal, &unparsed_name);
+                /*
+                 * By getting the unparsed name here, we ensure the
+                 * escaping is removed correctly (and trust the client
+                 * less).  The important thing here is that a
+                 * userPrincipalName may have a space in it, and this
+                 * must not be kerberos escaped to match this filter,
+                 * so we specify KRB5_PRINCIPAL_UNPARSE_DISPLAY
+                 */
+                ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context,
+                                              principal,
+                                              KRB5_PRINCIPAL_UNPARSE_DISPLAY,
+                                              &unparsed_name);
                 if (ret) {
                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
@@ -607 +719 @@
                 krb5_principal principal;
                 char *unparsed_name_short;
+                const krb5_data *component;
                 char *service;
 
                 ret = smb_krb5_init_context(mem_ctx, 
-                                            ldb_get_event_context(sam_ctx),
                                             (struct loadparm_context *)ldb_get_opaque(sam_ctx, "loadparm"), 
                                             &smb_krb5_context);
@@ -619 +731 @@
 
                 ret = krb5_parse_name(smb_krb5_context->krb5_context, name, &principal);
-                if (ret == 0 && principal->name.name_string.len < 2) {
+                if (ret == 0 &&
+                    krb5_princ_size(smb_krb5_context->krb5_context,
+                                                        principal) < 2) {
                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
@@ -642 +756 @@
                 }
 
-                service = principal->name.name_string.val[0];
-                if ((principal->name.name_string.len == 2) && (strcasecmp(service, "host") == 0)) {
+                component = krb5_princ_component(smb_krb5_context->krb5_context,
+                                                 principal, 0);
+                service = (char *)component->data;
+                if ((krb5_princ_size(smb_krb5_context->krb5_context,
+                                                        principal) == 2) &&
+                        (strcasecmp(service, "host") == 0)) {
                         /* the 'cn' attribute is just the leading part of the name */
                         char *computer_name;
-                        computer_name = talloc_strndup(mem_ctx, principal->name.name_string.val[1], 
-                                                      strcspn(principal->name.name_string.val[1], "."));
+                        component = krb5_princ_component(
+                                                smb_krb5_context->krb5_context,
+                                                principal, 1);
+                        computer_name = talloc_strndup(mem_ctx, (char *)component->data,
+                                                        strcspn((char *)component->data, "."));
                         if (computer_name == NULL) {
                                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
@@ -683 +804 @@
                                     name_dn, name, 
                                     domain_filter, result_filter, 
-                                    info1);
+                                    info1, scope, search_dn);
 }
 
@@ -735 +856 @@
                                    struct ldb_dn *name_dn, const char *name, 
                                    const char *domain_filter, const char *result_filter, 
-                                   struct drsuapi_DsNameInfo1 *info1)
+                                   struct drsuapi_DsNameInfo1 *info1,
+                                   int scope, struct ldb_dn *search_dn)
 {
         int ldb_ret;
@@ -803 +925 @@
 
                 if (ldb_ret != LDB_SUCCESS) {
-                        DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s", ldb_errstring(sam_ctx)));
+                        DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                         return WERR_OK;
@@ -831 +953 @@
                 struct ldb_result *res;
                 uint32_t dsdb_flags = 0;
-                struct ldb_dn *search_dn;
-
-                if (domain_res) {
-                        dsdb_flags = 0;
-                        search_dn = samdb_result_dn(sam_ctx, mem_ctx, domain_res->msgs[0], "ncName", NULL);
+                struct ldb_dn *real_search_dn = NULL;
+                info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
+
+                /*
+                 * From 4.1.4.2.11 of MS-DRSR
+                 * if DS_NAME_FLAG_GCVERIFY in flags then
+                 * rt := select all O from all
+                 * where attrValue in GetAttrVals(O, att, false)
+                 * else
+                 * rt := select all O from subtree DefaultNC()
+                 * where attrValue in GetAttrVals(O, att, false)
+                 * endif
+                 * return rt
+                 */
+                if (format_flags & DRSUAPI_DS_NAME_FLAG_GCVERIFY ||
+                    format_offered == DRSUAPI_DS_NAME_FORMAT_GUID)
+                {
+                        dsdb_flags = DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
+                } else if (domain_res) {
+                        if (!search_dn) {
+                                struct ldb_dn *tmp_dn = samdb_result_dn(sam_ctx, mem_ctx, domain_res->msgs[0], "ncName", NULL);
+                                real_search_dn = tmp_dn;
+                        } else {
+                                real_search_dn = search_dn;
+                        }
                 } else {
-                        dsdb_flags = DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
-                        search_dn = ldb_get_root_basedn(sam_ctx);
-                }
-
+                        real_search_dn = ldb_get_default_basedn(sam_ctx);
+                }
+                if (format_desired == DRSUAPI_DS_NAME_FORMAT_GUID){
+                         dsdb_flags |= DSDB_SEARCH_SHOW_RECYCLED;
+                }
                 /* search with the 'phantom root' flag */
                 ret = dsdb_search(sam_ctx, mem_ctx, &res,
-                                  search_dn,
-                                  LDB_SCOPE_SUBTREE,
+                                  real_search_dn,
+                                  scope,
                                   result_attrs,
-                                  DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
+                                  dsdb_flags,
                                   "%s", result_filter);
                 if (ret != LDB_SUCCESS) {
-                        DEBUG(2, ("DsCrackNameOneFilter phantom root search failed: %s",
+                        DEBUG(2, ("DsCrackNameOneFilter search from '%s' with flags 0x%08x failed: %s\n",
+                                  ldb_dn_get_linearized(real_search_dn),
+                                  dsdb_flags,
                                   ldb_errstring(sam_ctx)));
                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
@@ -866 +1011 @@
         } else {
                 /* Can't happen */
-                DEBUG(0, ("LOGIC ERROR: DsCrackNameOneFilter domain ref search not available: This can't happen..."));
+                DEBUG(0, ("LOGIC ERROR: DsCrackNameOneFilter domain ref search not available: This can't happen...\n"));
                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                 return WERR_OK;
@@ -893 +1038 @@
                 return WERR_OK;
         case -1:
-                DEBUG(2, ("DsCrackNameOneFilter result search failed: %s", ldb_errstring(sam_ctx)));
+                DEBUG(2, ("DsCrackNameOneFilter result search failed: %s\n", ldb_errstring(sam_ctx)));
                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                 return WERR_OK;
@@ -924 +1069 @@
                         }
                 }
+                /* FALL TROUGH */
                 default:
                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
@@ -962 +1108 @@
                 const struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, result, "objectSid");
                 const char *_acc = "", *_dom = "";
-
-                if (samdb_find_attribute(sam_ctx, result, "objectClass", "domain")) {
-
+                if (sid == NULL) {
+                        info1->status = DRSUAPI_DS_NAME_STATUS_NO_MAPPING;
+                        return WERR_OK;
+                }
+
+                if (samdb_find_attribute(sam_ctx, result, "objectClass",
+                                         "domain")) {
+                        /* This can also find a DomainDNSZones entry,
+                         * but it won't have the SID we just
+                         * checked.  */
                         ldb_ret = ldb_search(sam_ctx, mem_ctx, &domain_res,
                                                      partitions_basedn,
@@ -972 +1125 @@
 
                         if (ldb_ret != LDB_SUCCESS) {
-                                DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s", ldb_errstring(sam_ctx)));
+                                DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
                                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                                 return WERR_OK;
@@ -1013 +1166 @@
 
                                 if (ldb_ret != LDB_SUCCESS) {
-                                        DEBUG(2, ("DsCrackNameOneFilter domain search failed: %s", ldb_errstring(sam_ctx)));
+                                        DEBUG(2, ("DsCrackNameOneFilter domain search failed: %s\n", ldb_errstring(sam_ctx)));
                                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                                         return WERR_OK;
@@ -1036 +1189 @@
 
                                 if (ldb_ret != LDB_SUCCESS) {
-                                        DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s", ldb_errstring(sam_ctx)));
+                                        DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s\n", ldb_errstring(sam_ctx)));
                                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                                         return WERR_OK;
@@ -1091 +1244 @@
         case DRSUAPI_DS_NAME_FORMAT_DNS_DOMAIN: 
         case DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY: {
+                info1->dns_domain_name = NULL;
                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
                 return WERR_OK;
@@ -1346 +1500 @@
                                                                    server_dn);
                 if(!names[i].dns_domain_name) {
-                        DEBUG(4, ("list_roles: Failed to find dNSHostName for server %s",
+                        DEBUG(4, ("list_roles: Failed to find dNSHostName for server %s\n",
                                   ldb_dn_get_linearized(server_dn)));
                 }
@@ -1366 +1520 @@
         WERROR status;
 
-        *ctr1 = talloc(mem_ctx, struct drsuapi_DsNameCtr1);
+        *ctr1 = talloc_zero(mem_ctx, struct drsuapi_DsNameCtr1);
         W_ERROR_HAVE_NO_MEMORY(*ctr1);
 
@@ -1390 +1544 @@
         return WERR_OK;
 }
+
+WERROR dcesrv_drsuapi_ListInfoServer(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
+                                     const struct drsuapi_DsNameRequest1 *req1,
+                                     struct drsuapi_DsNameCtr1 **_ctr1)
+{
+        struct drsuapi_DsNameInfo1 *names;
+        struct ldb_result *res;
+        struct ldb_dn *server_dn, *dn;
+        struct drsuapi_DsNameCtr1 *ctr1;
+        int ret, i;
+        const char *str;
+        const char *attrs[] = {
+                "dn",
+                "dNSHostName",
+                "serverReference",
+                NULL
+        };
+
+        *_ctr1 = NULL;
+
+        ctr1 = talloc_zero(mem_ctx, struct drsuapi_DsNameCtr1);
+        W_ERROR_HAVE_NO_MEMORY(ctr1);
+
+        /*
+         * No magic value here, we have to return 3 entries according to the
+         * MS-DRSR.pdf
+         */
+        ctr1->count = 3;
+        names = talloc_zero_array(ctr1, struct drsuapi_DsNameInfo1,
+                                  ctr1->count);
+        W_ERROR_HAVE_NO_MEMORY(names);
+        ctr1->array = names;
+
+        for (i=0; i < ctr1->count; i++) {
+                names[i].status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
+        }
+        *_ctr1 = ctr1;
+
+        if (req1->count != 1) {
+                DEBUG(1, ("Expected a count of 1 for the ListInfoServer crackname \n"));
+                return WERR_OK;
+        }
+
+        if (req1->names[0].str == NULL) {
+                return WERR_OK;
+        }
+
+        server_dn = ldb_dn_new(mem_ctx, sam_ctx, req1->names[0].str);
+        W_ERROR_HAVE_NO_MEMORY(server_dn);
+
+        ret = ldb_search(sam_ctx, mem_ctx, &res, server_dn, LDB_SCOPE_ONELEVEL,
+                         NULL, "(objectClass=nTDSDSA)");
+
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Search for objectClass=nTDSDSA "
+                          "returned less than 1 objects\n"));
+                return WERR_OK;
+        }
+
+        if (res->count != 1) {
+                DEBUG(1, ("Search for objectClass=nTDSDSA "
+                          "returned less than 1 objects\n"));
+                return WERR_OK;
+        }
+
+        if (res->msgs[0]->dn) {
+                names[0].result_name = ldb_dn_alloc_linearized(names, res->msgs[0]->dn);
+                W_ERROR_HAVE_NO_MEMORY(names[0].result_name);
+                names[0].status = DRSUAPI_DS_NAME_STATUS_OK;
+        }
+
+        talloc_free(res);
+
+        ret = ldb_search(sam_ctx, mem_ctx, &res, server_dn, LDB_SCOPE_BASE,
+                         attrs, "(objectClass=*)");
+        if (ret != LDB_SUCCESS) {
+                DEBUG(1, ("Search for objectClass=* on dn %s"
+                          "returned %s\n", req1->names[0].str,
+                          ldb_strerror(ret)));
+                return WERR_OK;
+        }
+
+        if (res->count != 1) {
+                DEBUG(1, ("Search for objectClass=* on dn %s"
+                          "returned less than 1 objects\n", req1->names[0].str));
+                return WERR_OK;
+        }
+
+        str = ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName", NULL);
+        if (str != NULL) {
+                names[1].result_name = talloc_strdup(names, str);
+                W_ERROR_HAVE_NO_MEMORY(names[1].result_name);
+                names[1].status = DRSUAPI_DS_NAME_STATUS_OK;
+        }
+
+        dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, res->msgs[0], "serverReference");
+        if (dn != NULL) {
+                names[2].result_name = ldb_dn_alloc_linearized(names, dn);
+                W_ERROR_HAVE_NO_MEMORY(names[2].result_name);
+                names[2].status = DRSUAPI_DS_NAME_STATUS_OK;
+        }
+
+        talloc_free(dn);
+        talloc_free(res);
+
+        return WERR_OK;
+}

vendor/current/source4/dsdb/samdb/ldb_modules/acl.c

@@ -40 +40 @@
 #include "param/param.h"
 #include "dsdb/samdb/ldb_modules/util.h"
-#include "dsdb/samdb/ldb_modules/schema.h"
 #include "lib/util/tsort.h"
 #include "system/kerberos.h"
@@ -51 +50 @@
 
 struct acl_private {
-        bool acl_perform;
+        bool acl_search;
         const char **password_attrs;
+        void *cached_schema_ptr;
+        uint64_t cached_schema_metadata_usn;
+        uint64_t cached_schema_loaded_usn;
+        const char **confidential_attrs;
 };
 
@@ -59 +62 @@
         struct ldb_request *req;
         bool am_system;
+        bool am_administrator;
+        bool modify_search;
+        bool constructed_attrs;
         bool allowedAttributes;
         bool allowedAttributesEffective;
@@ -74 +80 @@
         struct acl_private *data;
         int ret;
-        unsigned int i;
+        unsigned int i, n, j;
         TALLOC_CTX *mem_ctx;
-        static const char *attrs[] = { "passwordAttribute", NULL };
+        static const char * const attrs[] = { "passwordAttribute", NULL };
+        static const char * const secret_attrs[] = {
+                DSDB_SECRET_ATTRIBUTES
+        };
         struct ldb_result *res;
         struct ldb_message *msg;
@@ -90 +99 @@
         }
 
-        data = talloc(module, struct acl_private);
+        data = talloc_zero(module, struct acl_private);
         if (data == NULL) {
                 return ldb_oom(ldb);
         }
 
-        data->password_attrs = NULL;
-        data->acl_perform = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
-                                         NULL, "acl", "perform", false);
+        data->acl_search = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
+                                        NULL, "acl", "search", true);
         ldb_module_set_private(module, data);
 
@@ -108 +116 @@
                                     ldb_dn_new(mem_ctx, ldb, "@KLUDGEACL"),
                                     attrs,
-                                    DSDB_FLAG_NEXT_MODULE, NULL);
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM,
+                                    NULL);
         if (ret != LDB_SUCCESS) {
                 goto done;
@@ -127 +137 @@
                 goto done;
         }
-        data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
+        data->password_attrs = talloc_array(data, const char *,
+                        password_attributes->num_values +
+                        ARRAY_SIZE(secret_attrs) + 1);
         if (!data->password_attrs) {
                 talloc_free(mem_ctx);
                 return ldb_oom(ldb);
         }
+
+        n = 0;
         for (i=0; i < password_attributes->num_values; i++) {
-                data->password_attrs[i] = (const char *)password_attributes->values[i].data;
+                data->password_attrs[n] = (const char *)password_attributes->values[i].data;
                 talloc_steal(data->password_attrs, password_attributes->values[i].data);
-        }
-        data->password_attrs[i] = NULL;
+                n++;
+        }
+
+        for (i=0; i < ARRAY_SIZE(secret_attrs); i++) {
+                bool found = false;
+
+                for (j=0; j < n; j++) {
+                        if (strcasecmp(data->password_attrs[j], secret_attrs[i]) == 0) {
+                                found = true;
+                                break;
+                        }
+                }
+
+                if (found) {
+                        continue;
+                }
+
+                data->password_attrs[n] = talloc_strdup(data->password_attrs,
+                                                        secret_attrs[i]);
+                if (data->password_attrs[n] == NULL) {
+                        talloc_free(mem_ctx);
+                        return ldb_oom(ldb);
+                }
+                n++;
+        }
+        data->password_attrs[n] = NULL;
 
 done:
@@ -154 +192 @@
         const char **attr_list;
         int i, ret;
+        const struct dsdb_class *objectclass;
 
         /* If we don't have a schema yet, we can't do anything... */
@@ -178 +217 @@
                 return LDB_ERR_OPERATIONS_ERROR;
         }
+
+        /*
+         * Get the top-most structural object class for the ACL check
+         */
+        objectclass = dsdb_get_last_structural_class(ac->schema,
+                                                     oc_el);
+        if (objectclass == NULL) {
+                ldb_asprintf_errstring(ldb, "acl_read: Failed to find a structural class for %s",
+                                       ldb_dn_get_linearized(sd_msg->dn));
+                talloc_free(mem_ctx);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
         if (ac->allowedAttributes) {
                 for (i=0; attr_list && attr_list[i]; i++) {
@@ -225 +277 @@
                                                             sid,
                                                             SEC_ADS_WRITE_PROP,
-                                                            attr);
+                                                            attr,
+                                                            objectclass);
                         if (ret == LDB_SUCCESS) {
                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
@@ -336 +389 @@
 
                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
-                        ret = acl_check_access_on_class(module,
-                                                        schema,
-                                                        msg,
-                                                        sd,
-                                                        sid,
-                                                        SEC_ADS_CREATE_CHILD,
-                                                        sclass->possibleInferiors[j]);
+                        const struct dsdb_class *sc;
+
+                        sc = dsdb_class_by_lDAPDisplayName(schema,
+                                                           sclass->possibleInferiors[j]);
+                        if (!sc) {
+                                /* We don't know this class?  what is going on? */
+                                continue;
+                        }
+
+                        ret = acl_check_access_on_objectclass(module, ac,
+                                                              sd, sid,
+                                                              SEC_ADS_CREATE_CHILD,
+                                                              sc);
                         if (ret == LDB_SUCCESS) {
                                 ldb_msg_add_string(msg, "allowedChildClassesEffective",
@@ -374 +433 @@
                                  struct acl_context *ac)
 {
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct ldb_message_element *rightsEffective;
         int ret;
@@ -394 +454 @@
         if (ac->am_system || as_system) {
                 flags = SECINFO_OWNER | SECINFO_GROUP |  SECINFO_SACL |  SECINFO_DACL;
-        }
-        else {
+        } else {
+                const struct dsdb_class *objectclass;
+                const struct dsdb_attribute *attr;
+
+                objectclass = dsdb_get_structural_oc_from_msg(ac->schema, sd_msg);
+                if (objectclass == NULL) {
+                        return ldb_operr(ldb);
+                }
+
+                attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
+                                                         "nTSecurityDescriptor");
+                if (attr == NULL) {
+                        return ldb_operr(ldb);
+                }
+
                 /* Get the security descriptor from the message */
-                ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), msg, sd_msg, &sd);
+                ret = dsdb_get_sd_from_ldb_message(ldb, msg, sd_msg, &sd);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -407 +480 @@
                                                     sid,
                                                     SEC_STD_WRITE_OWNER,
-                                                    NULL);
+                                                    attr,
+                                                    objectclass);
                 if (ret == LDB_SUCCESS) {
                         flags |= SECINFO_OWNER | SECINFO_GROUP;
@@ -416 +490 @@
                                                     sid,
                                                     SEC_STD_WRITE_DAC,
-                                                    NULL);
+                                                    attr,
+                                                    objectclass);
                 if (ret == LDB_SUCCESS) {
                         flags |= SECINFO_DACL;
@@ -425 +500 @@
                                                     sid,
                                                     SEC_FLAG_SYSTEM_SECURITY,
-                                                    NULL);
+                                                    attr,
+                                                    objectclass);
                 if (ret == LDB_SUCCESS) {
                         flags |= SECINFO_SACL;
@@ -450 +526 @@
         char *serviceType;
         char *serviceName;
-        const char *realm;
         const char *forest_name = samdb_forest_name(ldb, mem_ctx);
         const char *base_domain = samdb_default_domain_name(ldb, mem_ctx);
@@ -458 +533 @@
                 (userAccountControl & UF_PARTIAL_SECRETS_ACCOUNT);
 
+        if (strcasecmp_m(spn_value, samAccountName) == 0) {
+                /* MacOS X sets this value, and setting an SPN of your
+                 * own samAccountName is both pointless and safe */
+                return LDB_SUCCESS;
+        }
+
         kerr = smb_krb5_init_context_basic(mem_ctx,
                                            lp_ctx,
@@ -472 +553 @@
         }
 
-        instanceName = principal->name.name_string.val[1];
-        serviceType = principal->name.name_string.val[0];
-        realm = krb5_principal_get_realm(krb_ctx, principal);
-        if (principal->name.name_string.len == 3) {
-                serviceName = principal->name.name_string.val[2];
+        if (krb5_princ_size(krb_ctx, principal) < 2) {
+                goto fail;
+        }
+
+        instanceName = smb_krb5_principal_get_comp_string(mem_ctx, krb_ctx,
+                                                          principal, 1);
+        serviceType = smb_krb5_principal_get_comp_string(mem_ctx, krb_ctx,
+                                                         principal, 0);
+        if (krb5_princ_size(krb_ctx, principal) == 3) {
+                serviceName = smb_krb5_principal_get_comp_string(mem_ctx, krb_ctx,
+                                                                 principal, 2);
         } else {
                 serviceName = NULL;
@@ -504 +591 @@
         /* instanceName can be samAccountName without $ or dnsHostName
          * or "ntds_guid._msdcs.forest_domain for DC objects */
-        if (strncasecmp(instanceName, samAccountName, strlen(samAccountName) - 1) == 0) {
+        if (strlen(instanceName) == (strlen(samAccountName) - 1)
+            && strncasecmp(instanceName, samAccountName, strlen(samAccountName) - 1) == 0) {
                 goto success;
-        } else if (strcasecmp(instanceName, dnsHostName) == 0) {
+        } else if (dnsHostName != NULL && strcasecmp(instanceName, dnsHostName) == 0) {
                 goto success;
         } else if (is_dc) {
@@ -534 +622 @@
                          struct security_descriptor *sd,
                          struct dom_sid *sid,
-                         const struct GUID *oc_guid,
-                         const struct dsdb_attribute *attr)
+                         const struct dsdb_attribute *attr,
+                         const struct dsdb_class *objectclass)
 {
         int ret;
@@ -569 +657 @@
                                           sid,
                                           SEC_ADS_WRITE_PROP,
-                                          attr) == LDB_SUCCESS) {
+                                          attr, objectclass) == LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
                 return LDB_SUCCESS;
@@ -592 +680 @@
                                     acl_attrs,
                                     DSDB_FLAG_NEXT_MODULE |
-                                    DSDB_SEARCH_SHOW_DELETED, req);
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_RECYCLED,
+                                    req);
         if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
@@ -606 +696 @@
                                  LDB_SCOPE_ONELEVEL,
                                  netbios_attrs,
-                                 DSDB_FLAG_NEXT_MODULE,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
                                  req,
                                  "(ncName=%s)",
@@ -655 +746 @@
 {
         int ret;
-        struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.add.message->dn);
+        struct ldb_dn *parent;
         struct ldb_context *ldb;
         const struct dsdb_schema *schema;
-        struct ldb_message_element *oc_el;
-        const struct GUID *guid;
-        struct ldb_dn *nc_root;
-        struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
-
+        const struct dsdb_class *objectclass;
+        struct ldb_control *as_system;
+        struct ldb_message_element *el;
+        unsigned int instanceType = 0;
+
+        if (ldb_dn_is_special(req->op.add.message->dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
         if (as_system != NULL) {
                 as_system->critical = 0;
@@ -670 +766 @@
                 return ldb_next_request(module, req);
         }
-        if (ldb_dn_is_special(req->op.add.message->dn)) {
-                return ldb_next_request(module, req);
-        }
 
         ldb = ldb_module_get_ctx(module);
 
-        /* Creating an NC. There is probably something we should do here,
-         * but we will establish that later */
-
-        ret = dsdb_find_nc_root(ldb, req, req->op.add.message->dn, &nc_root);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-        if (ldb_dn_compare(nc_root, req->op.add.message->dn) == 0) {
-                talloc_free(nc_root);
-                return ldb_next_request(module, req);
-        }
-        talloc_free(nc_root);
+        parent = ldb_dn_get_parent(req, req->op.add.message->dn);
+        if (parent == NULL) {
+                return ldb_oom(ldb);
+        }
 
         schema = dsdb_get_schema(ldb, req);
@@ -694 +779 @@
         }
 
-        oc_el = ldb_msg_find_element(req->op.add.message, "objectClass");
-        if (!oc_el || oc_el->num_values == 0) {
-                DEBUG(10,("acl:operation error %s\n", ldb_dn_get_linearized(req->op.add.message->dn)));
+        objectclass = dsdb_get_structural_oc_from_msg(schema, req->op.add.message);
+        if (!objectclass) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "acl: unable to find or validate structural objectClass on %s\n",
+                                       ldb_dn_get_linearized(req->op.add.message->dn));
                 return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
         }
 
-        guid = class_schemaid_guid_by_lDAPDisplayName(schema,
-                                                      (char *)oc_el->values[oc_el->num_values-1].data);
-        ret = dsdb_module_check_access_on_dn(module, req, parent, SEC_ADS_CREATE_CHILD, guid, req);
-        if (ret != LDB_SUCCESS) {
+        el = ldb_msg_find_element(req->op.add.message, "instanceType");
+        if ((el != NULL) && (el->num_values != 1)) {
+                ldb_set_errstring(ldb, "acl: the 'instanceType' attribute is single-valued!");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
+                                                 "instanceType", 0);
+        if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
+                static const char *no_attrs[] = { NULL };
+                struct ldb_result *partition_res;
+                struct ldb_dn *partitions_dn;
+
+                partitions_dn = samdb_partitions_dn(ldb, req);
+                if (!partitions_dn) {
+                        ldb_set_errstring(ldb, "acl: CN=partitions dn could not be generated!");
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+
+                ret = dsdb_module_search(module, req, &partition_res,
+                                         partitions_dn, LDB_SCOPE_ONELEVEL,
+                                         no_attrs,
+                                         DSDB_FLAG_NEXT_MODULE |
+                                         DSDB_FLAG_AS_SYSTEM |
+                                         DSDB_SEARCH_ONE_ONLY |
+                                         DSDB_SEARCH_SHOW_RECYCLED,
+                                         req,
+                                         "(&(nCName=%s)(objectClass=crossRef))",
+                                         ldb_dn_get_linearized(req->op.add.message->dn));
+
+                if (ret == LDB_SUCCESS) {
+                        /* Check that we can write to the crossRef object MS-ADTS 3.1.1.5.2.8.2 */
+                        ret = dsdb_module_check_access_on_dn(module, req, partition_res->msgs[0]->dn,
+                                                             SEC_ADS_WRITE_PROP,
+                                                             &objectclass->schemaIDGUID, req);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                                       "acl: ACL check failed on crossRef object %s: %s\n",
+                                                       ldb_dn_get_linearized(partition_res->msgs[0]->dn),
+                                                       ldb_errstring(ldb));
+                                return ret;
+                        }
+
+                        /*
+                         * TODO: Remaining checks, like if we are
+                         * the naming master etc need to be handled
+                         * in the instanceType module
+                         */
+                        return ldb_next_request(module, req);
+                }
+
+                /* Check that we can create a crossRef object MS-ADTS 3.1.1.5.2.8.2 */
+                ret = dsdb_module_check_access_on_dn(module, req, partitions_dn,
+                                                     SEC_ADS_CREATE_CHILD,
+                                                     &objectclass->schemaIDGUID, req);
+                if (ret == LDB_ERR_NO_SUCH_OBJECT &&
+                    ldb_request_get_control(req, LDB_CONTROL_RELAX_OID))
+                {
+                        /* Allow provision bootstrap */
+                        ret = LDB_SUCCESS;
+                }
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                               "acl: ACL check failed on CN=Partitions crossRef container %s: %s\n",
+                                               ldb_dn_get_linearized(partitions_dn), ldb_errstring(ldb));
+                        return ret;
+                }
+
+                /*
+                 * TODO: Remaining checks, like if we are the naming
+                 * master and adding the crossRef object need to be
+                 * handled in the instanceType module
+                 */
+                return ldb_next_request(module, req);
+        }
+
+        ret = dsdb_module_check_access_on_dn(module, req, parent,
+                                             SEC_ADS_CREATE_CHILD,
+                                             &objectclass->schemaIDGUID, req);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "acl: unable to get access to %s\n",
+                                       ldb_dn_get_linearized(req->op.add.message->dn));
                 return ret;
         }
@@ -715 +881 @@
                                      struct security_descriptor *sd,
                                      struct dom_sid *sid,
-                                     const struct GUID *oc_guid,
-                                     const struct dsdb_attribute *attr)
+                                     const struct dsdb_attribute *attr,
+                                     const struct dsdb_class *objectclass)
 {
         int ret;
@@ -729 +895 @@
                                           sid,
                                           SEC_ADS_WRITE_PROP,
-                                          attr) == LDB_SUCCESS) {
+                                          attr, objectclass) == LDB_SUCCESS) {
                 return LDB_SUCCESS;
         }
@@ -771 +937 @@
                                      struct security_descriptor *sd,
                                      struct dom_sid *sid,
-                                     const struct GUID *oc_guid,
+                                     const struct dsdb_class *objectclass,
                                      bool userPassword)
 {
@@ -851 +1017 @@
 }
 
+
 static int acl_modify(struct ldb_module *module, struct ldb_request *req)
 {
@@ -857 +1024 @@
         const struct dsdb_schema *schema;
         unsigned int i;
-        const struct GUID *guid;
-        uint32_t access_granted;
-        struct object_tree *root = NULL;
-        struct object_tree *new_node = NULL;
-        NTSTATUS status;
+        const struct dsdb_class *objectclass;
         struct ldb_result *acl_res;
         struct security_descriptor *sd;
         struct dom_sid *sid = NULL;
-        struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
-        bool userPassword = dsdb_user_password_support(module, req, req);
-        TALLOC_CTX *tmp_ctx = talloc_new(req);
+        struct ldb_control *as_system;
+        struct ldb_control *is_undelete;
+        bool userPassword;
+        TALLOC_CTX *tmp_ctx;
+        const struct ldb_message *msg = req->op.mod.message;
         static const char *acl_attrs[] = {
                 "nTSecurityDescriptor",
@@ -875 +1040 @@
         };
 
+        if (ldb_dn_is_special(msg->dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
         if (as_system != NULL) {
                 as_system->critical = 0;
         }
 
+        is_undelete = ldb_request_get_control(req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID);
+
         /* Don't print this debug statement if elements[0].name is going to be NULL */
-        if(req->op.mod.message->num_elements > 0)
-        {
-                DEBUG(10, ("ldb:acl_modify: %s\n", req->op.mod.message->elements[0].name));
+        if (msg->num_elements > 0) {
+                DEBUG(10, ("ldb:acl_modify: %s\n", msg->elements[0].name));
         }
         if (dsdb_module_am_system(module) || as_system) {
                 return ldb_next_request(module, req);
         }
-        if (ldb_dn_is_special(req->op.mod.message->dn)) {
-                return ldb_next_request(module, req);
-        }
-        ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res, req->op.mod.message->dn,
+
+        tmp_ctx = talloc_new(req);
+        if (tmp_ctx == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res, msg->dn,
                                     acl_attrs,
-                                    DSDB_FLAG_NEXT_MODULE, req);
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_RECYCLED,
+                                    req);
 
         if (ret != LDB_SUCCESS) {
                 goto fail;
         }
+
+        userPassword = dsdb_user_password_support(module, req, req);
 
         schema = dsdb_get_schema(ldb, tmp_ctx);
         if (!schema) {
-                ret = LDB_ERR_OPERATIONS_ERROR;
-                goto fail;
+                talloc_free(tmp_ctx);
+                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
+                                 "acl_modify: Error obtaining schema.");
         }
 
@@ -915 +1095 @@
         }
 
-        guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
-        if (!guid) {
+        objectclass = dsdb_get_structural_oc_from_msg(schema, acl_res->msgs[0]);
+        if (!objectclass) {
                 talloc_free(tmp_ctx);
                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
-                                 "acl_modify: Error retrieving object class GUID.");
+                                 "acl_modify: Error retrieving object class for GUID.");
         }
         sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
-        if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
-                                   &root, &new_node)) {
-                talloc_free(tmp_ctx);
-                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
-                                 "acl_modify: Error adding new node in object tree.");
-        }
-        for (i=0; i < req->op.mod.message->num_elements; i++){
+        for (i=0; i < msg->num_elements; i++) {
+                const struct ldb_message_element *el = &msg->elements[i];
                 const struct dsdb_attribute *attr;
-                attr = dsdb_attribute_by_lDAPDisplayName(schema,
-                                                         req->op.mod.message->elements[i].name);
-
-                if (ldb_attr_cmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) {
-                        status = sec_access_check_ds(sd, acl_user_token(module),
-                                             SEC_STD_WRITE_DAC,
-                                             &access_granted,
-                                             NULL,
-                                             sid);
-
-                        if (!NT_STATUS_IS_OK(status)) {
-                                DEBUG(10, ("Object %s has no write dacl access\n",
-                                           ldb_dn_get_linearized(req->op.mod.message->dn)));
+
+                /*
+                 * This basic attribute existence check with the right errorcode
+                 * is needed since this module is the first one which requests
+                 * schema attribute information.
+                 * The complete attribute checking is done in the
+                 * "objectclass_attrs" module behind this one.
+                 *
+                 * NOTE: "clearTextPassword" is not defined in the schema.
+                 */
+                attr = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
+                if (!attr && ldb_attr_cmp("clearTextPassword", el->name) != 0) {
+                        ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' "
+                                               "on entry '%s' was not found in the schema!",
+                                               req->op.mod.message->elements[i].name,
+                                       ldb_dn_get_linearized(req->op.mod.message->dn));
+                        ret =  LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        goto fail;
+                }
+
+                if (ldb_attr_cmp("nTSecurityDescriptor", el->name) == 0) {
+                        uint32_t sd_flags = dsdb_request_sd_flags(req, NULL);
+                        uint32_t access_mask = 0;
+
+                        if (sd_flags & (SECINFO_OWNER|SECINFO_GROUP)) {
+                                access_mask |= SEC_STD_WRITE_OWNER;
+                        }
+                        if (sd_flags & SECINFO_DACL) {
+                                access_mask |= SEC_STD_WRITE_DAC;
+                        }
+                        if (sd_flags & SECINFO_SACL) {
+                                access_mask |= SEC_FLAG_SYSTEM_SECURITY;
+                        }
+
+                        ret = acl_check_access_on_attribute(module,
+                                                            tmp_ctx,
+                                                            sd,
+                                                            sid,
+                                                            access_mask,
+                                                            attr,
+                                                            objectclass);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                                       "Object %s has no write dacl access\n",
+                                                       ldb_dn_get_linearized(msg->dn));
                                 dsdb_acl_debug(sd,
                                                acl_user_token(module),
-                                               req->op.mod.message->dn,
+                                               msg->dn,
                                                true,
                                                10);
@@ -951 +1158 @@
                                 goto fail;
                         }
-                }
-                else if (ldb_attr_cmp("member", req->op.mod.message->elements[i].name) == 0) {
+                } else if (ldb_attr_cmp("member", el->name) == 0) {
                         ret = acl_check_self_membership(tmp_ctx,
                                                         module,
@@ -958 +1164 @@
                                                         sd,
                                                         sid,
-                                                        guid,
-                                                        attr);
+                                                        attr,
+                                                        objectclass);
                         if (ret != LDB_SUCCESS) {
                                 goto fail;
                         }
-                }
-                else if (ldb_attr_cmp("dBCSPwd", req->op.mod.message->elements[i].name) == 0) {
+                } else if (ldb_attr_cmp("dBCSPwd", el->name) == 0) {
                         /* this one is not affected by any rights, we should let it through
                            so that passwords_hash returns the correct error */
                         continue;
-                }
-                else if (ldb_attr_cmp("unicodePwd", req->op.mod.message->elements[i].name) == 0 ||
-                         (userPassword && ldb_attr_cmp("userPassword", req->op.mod.message->elements[i].name) == 0) ||
-                         ldb_attr_cmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) {
+                } else if (ldb_attr_cmp("unicodePwd", el->name) == 0 ||
+                           (userPassword && ldb_attr_cmp("userPassword", el->name) == 0) ||
+                           ldb_attr_cmp("clearTextPassword", el->name) == 0) {
                         ret = acl_check_password_rights(tmp_ctx,
                                                         module,
@@ -977 +1181 @@
                                                         sd,
                                                         sid,
-                                                        guid,
+                                                        objectclass,
                                                         userPassword);
                         if (ret != LDB_SUCCESS) {
                                 goto fail;
                         }
-                } else if (ldb_attr_cmp("servicePrincipalName", req->op.mod.message->elements[i].name) == 0) {
+                } else if (ldb_attr_cmp("servicePrincipalName", el->name) == 0) {
                         ret = acl_check_spn(tmp_ctx,
                                             module,
@@ -988 +1192 @@
                                             sd,
                                             sid,
-                                            guid,
-                                            attr);
+                                            attr,
+                                            objectclass);
                         if (ret != LDB_SUCCESS) {
                                 goto fail;
                         }
+                } else if (is_undelete != NULL && (ldb_attr_cmp("isDeleted", el->name) == 0)) {
+                        /*
+                         * in case of undelete op permissions on
+                         * isDeleted are irrelevant and
+                         * distinguishedName is removed by the
+                         * tombstone_reanimate module
+                         */
+                        continue;
                 } else {
-
-                /* This basic attribute existence check with the right errorcode
-                 * is needed since this module is the first one which requests
-                 * schema attribute information.
-                 * The complete attribute checking is done in the
-                 * "objectclass_attrs" module behind this one.
-                 */
-                        if (!attr) {
-                                ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!",
-                                                       req->op.mod.message->elements[i].name,
-                                               ldb_dn_get_linearized(req->op.mod.message->dn));
-                                ret =  LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        ret = acl_check_access_on_attribute(module,
+                                                            tmp_ctx,
+                                                            sd,
+                                                            sid,
+                                                            SEC_ADS_WRITE_PROP,
+                                                            attr,
+                                                            objectclass);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                                       "Object %s has no write property access\n",
+                                                       ldb_dn_get_linearized(msg->dn));
+                                dsdb_acl_debug(sd,
+                                               acl_user_token(module),
+                                               msg->dn,
+                                               true,
+                                               10);
+                                ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
                                 goto fail;
                         }
-                        if (!insert_in_object_tree(tmp_ctx,
-                                                   &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP,
-                                                   &new_node, &new_node)) {
-                                DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n"));
-                                ret = LDB_ERR_OPERATIONS_ERROR;
-                                goto fail;
-                        }
-
-                        if (!insert_in_object_tree(tmp_ctx,
-                                                   &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) {
-                                DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n"));
-                                ret = LDB_ERR_OPERATIONS_ERROR;
-                                goto fail;
-                        }
-                }
-        }
-
-        if (root->num_of_children > 0) {
-                status = sec_access_check_ds(sd, acl_user_token(module),
-                                             SEC_ADS_WRITE_PROP,
-                                             &access_granted,
-                                             root,
-                                             sid);
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(10, ("Object %s has no write property access\n",
-                                   ldb_dn_get_linearized(req->op.mod.message->dn)));
-                        dsdb_acl_debug(sd,
-                                  acl_user_token(module),
-                                  req->op.mod.message->dn,
-                                  true,
-                                  10);
-                        ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
-                        goto fail;
                 }
         }
@@ -1058 +1241 @@
 {
         int ret;
-        struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.del.dn);
+        struct ldb_dn *parent;
         struct ldb_context *ldb;
         struct ldb_dn *nc_root;
-        struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
-
+        struct ldb_control *as_system;
+        const struct dsdb_schema *schema;
+        const struct dsdb_class *objectclass;
+        struct security_descriptor *sd = NULL;
+        struct dom_sid *sid = NULL;
+        struct ldb_result *acl_res;
+        static const char *acl_attrs[] = {
+                "nTSecurityDescriptor",
+                "objectClass",
+                "objectSid",
+                NULL
+        };
+
+        if (ldb_dn_is_special(req->op.del.dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
         if (as_system != NULL) {
                 as_system->critical = 0;
         }
 
-        DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn)));
         if (dsdb_module_am_system(module) || as_system) {
                 return ldb_next_request(module, req);
         }
-        if (ldb_dn_is_special(req->op.del.dn)) {
-                return ldb_next_request(module, req);
-        }
+
+        DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn)));
 
         ldb = ldb_module_get_ctx(module);
+
+        parent = ldb_dn_get_parent(req, req->op.del.dn);
+        if (parent == NULL) {
+                return ldb_oom(ldb);
+        }
 
         /* Make sure we aren't deleting a NC */
@@ -1092 +1294 @@
         talloc_free(nc_root);
 
+        ret = dsdb_module_search_dn(module, req, &acl_res,
+                                    req->op.del.dn, acl_attrs,
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_RECYCLED, req);
+        /* we sould be able to find the parent */
+        if (ret != LDB_SUCCESS) {
+                DEBUG(10,("acl: failed to find object %s\n",
+                          ldb_dn_get_linearized(req->op.rename.olddn)));
+                return ret;
+        }
+
+        ret = dsdb_get_sd_from_ldb_message(ldb, req, acl_res->msgs[0], &sd);
+        if (ret != LDB_SUCCESS) {
+                return ldb_operr(ldb);
+        }
+        if (!sd) {
+                return ldb_operr(ldb);
+        }
+
+        schema = dsdb_get_schema(ldb, req);
+        if (!schema) {
+                return ldb_operr(ldb);
+        }
+
+        sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
+
+        objectclass = dsdb_get_structural_oc_from_msg(schema, acl_res->msgs[0]);
+        if (!objectclass) {
+                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
+                                 "acl_modify: Error retrieving object class for GUID.");
+        }
+
+        if (ldb_request_get_control(req, LDB_CONTROL_TREE_DELETE_OID)) {
+                ret = acl_check_access_on_objectclass(module, req, sd, sid,
+                                                      SEC_ADS_DELETE_TREE,
+                                                      objectclass);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+
+                return ldb_next_request(module, req);
+        }
+
         /* First check if we have delete object right */
-        ret = dsdb_module_check_access_on_dn(module, req, req->op.del.dn,
-                                             SEC_STD_DELETE, NULL, req);
+        ret = acl_check_access_on_objectclass(module, req, sd, sid,
+                                              SEC_STD_DELETE,
+                                              objectclass);
         if (ret == LDB_SUCCESS) {
                 return ldb_next_request(module, req);
@@ -1102 +1349 @@
          * child on the parent */
         ret = dsdb_module_check_access_on_dn(module, req, parent,
-                                             SEC_ADS_DELETE_CHILD, NULL, req);
+                                             SEC_ADS_DELETE_CHILD,
+                                             &objectclass->schemaIDGUID,
+                                             req);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -1108 +1357 @@
 
         return ldb_next_request(module, req);
+}
+static int acl_check_reanimate_tombstone(TALLOC_CTX *mem_ctx,
+                                         struct ldb_module *module,
+                                         struct ldb_request *req,
+                                         struct ldb_dn *nc_root)
+{
+        int ret;
+        struct ldb_result *acl_res;
+        struct security_descriptor *sd = NULL;
+        struct dom_sid *sid = NULL;
+        static const char *acl_attrs[] = {
+                "nTSecurityDescriptor",
+                "objectClass",
+                "objectSid",
+                NULL
+        };
+
+        ret = dsdb_module_search_dn(module, mem_ctx, &acl_res,
+                                    nc_root, acl_attrs,
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_RECYCLED, req);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(10,("acl: failed to find object %s\n",
+                          ldb_dn_get_linearized(nc_root)));
+                return ret;
+        }
+
+        ret = dsdb_get_sd_from_ldb_message(mem_ctx, req, acl_res->msgs[0], &sd);
+        sid = samdb_result_dom_sid(mem_ctx, acl_res->msgs[0], "objectSid");
+        if (ret != LDB_SUCCESS || !sd) {
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
+        return acl_check_extended_right(mem_ctx, sd, acl_user_token(module),
+                                        GUID_DRS_REANIMATE_TOMBSTONE,
+                                        SEC_ADS_CONTROL_ACCESS, sid);
 }
 
@@ -1113 +1398 @@
 {
         int ret;
-        struct ldb_dn *oldparent = ldb_dn_get_parent(req, req->op.rename.olddn);
-        struct ldb_dn *newparent = ldb_dn_get_parent(req, req->op.rename.newdn);
+        struct ldb_dn *oldparent;
+        struct ldb_dn *newparent;
         const struct dsdb_schema *schema;
+        const struct dsdb_class *objectclass;
+        const struct dsdb_attribute *attr = NULL;
         struct ldb_context *ldb;
         struct security_descriptor *sd = NULL;
         struct dom_sid *sid = NULL;
         struct ldb_result *acl_res;
-        const struct GUID *guid;
         struct ldb_dn *nc_root;
-        struct object_tree *root = NULL;
-        struct object_tree *new_node = NULL;
-        struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
-        TALLOC_CTX *tmp_ctx = talloc_new(req);
-        NTSTATUS status;
-        uint32_t access_granted;
+        struct ldb_control *as_system;
+        struct ldb_control *is_undelete;
+        TALLOC_CTX *tmp_ctx;
         const char *rdn_name;
         static const char *acl_attrs[] = {
@@ -1136 +1419 @@
         };
 
+        if (ldb_dn_is_special(req->op.rename.olddn)) {
+                return ldb_next_request(module, req);
+        }
+
+        as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
         if (as_system != NULL) {
                 as_system->critical = 0;
@@ -1144 +1432 @@
                 return ldb_next_request(module, req);
         }
-        if (ldb_dn_is_special(req->op.rename.olddn)) {
-                return ldb_next_request(module, req);
-        }
 
         ldb = ldb_module_get_ctx(module);
+
+        tmp_ctx = talloc_new(req);
+        if (tmp_ctx == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        oldparent = ldb_dn_get_parent(tmp_ctx, req->op.rename.olddn);
+        if (oldparent == NULL) {
+                return ldb_oom(ldb);
+        }
+        newparent = ldb_dn_get_parent(tmp_ctx, req->op.rename.newdn);
+        if (newparent == NULL) {
+                return ldb_oom(ldb);
+        }
 
         /* Make sure we aren't renaming/moving a NC */
@@ -1163 +1462 @@
                                        LDB_ERR_UNWILLING_TO_PERFORM);
         }
+
+        /* special check for undelete operation */
+        is_undelete = ldb_request_get_control(req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID);
+        if (is_undelete != NULL) {
+                is_undelete->critical = 0;
+                ret = acl_check_reanimate_tombstone(tmp_ctx, module, req, nc_root);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+        }
         talloc_free(nc_root);
 
@@ -1170 +1480 @@
                                     req->op.rename.olddn, acl_attrs,
                                     DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
                                     DSDB_SEARCH_SHOW_RECYCLED, req);
         /* we sould be able to find the parent */
@@ -1179 +1490 @@
         }
 
+        ret = dsdb_get_sd_from_ldb_message(ldb, req, acl_res->msgs[0], &sd);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+        if (!sd) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+
         schema = dsdb_get_schema(ldb, acl_res);
         if (!schema) {
@@ -1185 +1506 @@
         }
 
-        guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
-        if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
-                                   &root, &new_node)) {
+        sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
+
+        objectclass = dsdb_get_structural_oc_from_msg(schema, acl_res->msgs[0]);
+        if (!objectclass) {
+                talloc_free(tmp_ctx);
+                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
+                                 "acl_modify: Error retrieving object class for GUID.");
+        }
+
+        attr = dsdb_attribute_by_lDAPDisplayName(schema, "name");
+        if (attr == NULL) {
                 talloc_free(tmp_ctx);
                 return ldb_operr(ldb);
-        };
-
-        guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
-                                                          "name");
-        if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
-                                   &new_node, &new_node)) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        };
-
-        rdn_name = ldb_dn_get_rdn_name(req->op.rename.olddn);
-        if (rdn_name == NULL) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-        guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
-                                                          rdn_name);
-        if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
-                                   &new_node, &new_node)) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        };
-
-        ret = dsdb_get_sd_from_ldb_message(ldb, req, acl_res->msgs[0], &sd);
-
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-        /* Theoretically we pass the check if the object has no sd */
-        if (!sd) {
-                talloc_free(tmp_ctx);
-                return LDB_SUCCESS;
-        }
-        sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
-        status = sec_access_check_ds(sd, acl_user_token(module),
-                                     SEC_ADS_WRITE_PROP,
-                                     &access_granted,
-                                     root,
-                                     sid);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(10, ("Object %s has no wp on name\n",
-                           ldb_dn_get_linearized(req->op.rename.olddn)));
+        }
+
+        ret = acl_check_access_on_attribute(module, tmp_ctx, sd, sid,
+                                            SEC_ADS_WRITE_PROP,
+                                            attr, objectclass);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "Object %s has no wp on %s\n",
+                                       ldb_dn_get_linearized(req->op.rename.olddn),
+                                       attr->lDAPDisplayName);
                 dsdb_acl_debug(sd,
                           acl_user_token(module),
@@ -1243 +1538 @@
         }
 
+        rdn_name = ldb_dn_get_rdn_name(req->op.rename.olddn);
+        if (rdn_name == NULL) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+
+        attr = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
+        if (attr == NULL) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+
+        ret = acl_check_access_on_attribute(module, tmp_ctx, sd, sid,
+                                            SEC_ADS_WRITE_PROP,
+                                            attr, objectclass);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "Object %s has no wp on %s\n",
+                                       ldb_dn_get_linearized(req->op.rename.olddn),
+                                       attr->lDAPDisplayName);
+                dsdb_acl_debug(sd,
+                          acl_user_token(module),
+                          req->op.rename.olddn,
+                          true,
+                          10);
+                talloc_free(tmp_ctx);
+                return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+        }
+
         if (ldb_dn_compare(oldparent, newparent) == 0) {
                 /* regular rename, not move, nothing more to do */
@@ -1250 +1574 @@
 
         /* new parent should have create child */
-        root = NULL;
-        new_node = NULL;
-        guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
-        if (!guid) {
-                DEBUG(10,("acl:renamed object has no object class\n"));
-                talloc_free(tmp_ctx);
-                return ldb_module_done(req, NULL, NULL,  LDB_ERR_OPERATIONS_ERROR);
-        }
-
-        ret = dsdb_module_check_access_on_dn(module, req, newparent, SEC_ADS_CREATE_CHILD, guid, req);
-        if (ret != LDB_SUCCESS) {
-                DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
+        ret = dsdb_module_check_access_on_dn(module, req, newparent,
+                                             SEC_ADS_CREATE_CHILD,
+                                             &objectclass->schemaIDGUID, req);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "acl:access_denied renaming %s",
+                                       ldb_dn_get_linearized(req->op.rename.olddn));
                 talloc_free(tmp_ctx);
                 return ret;
         }
+
         /* do we have delete object on the object? */
-
-        status = sec_access_check_ds(sd, acl_user_token(module),
-                                     SEC_STD_DELETE,
-                                     &access_granted,
-                                     NULL,
-                                     sid);
-
-        if (NT_STATUS_IS_OK(status)) {
-                talloc_free(tmp_ctx);
-                return ldb_next_request(module, req);
-        }
-        /* what about delete child on the current parent */
-        ret = dsdb_module_check_access_on_dn(module, req, oldparent, SEC_ADS_DELETE_CHILD, NULL, req);
-        if (ret != LDB_SUCCESS) {
-                DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
-                talloc_free(tmp_ctx);
-                return ldb_module_done(req, NULL, NULL, ret);
-        }
-
+        /* this access is not necessary for undelete ops */
+        if (is_undelete == NULL) {
+                ret = acl_check_access_on_objectclass(module, tmp_ctx, sd, sid,
+                                                      SEC_STD_DELETE,
+                                                      objectclass);
+                if (ret == LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ldb_next_request(module, req);
+                }
+                /* what about delete child on the current parent */
+                ret = dsdb_module_check_access_on_dn(module, req, oldparent,
+                                                     SEC_ADS_DELETE_CHILD,
+                                                     &objectclass->schemaIDGUID,
+                                                     req);
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                               "acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn));
+                        talloc_free(tmp_ctx);
+                        return ldb_module_done(req, NULL, NULL, ret);
+                }
+        }
         talloc_free(tmp_ctx);
 
@@ -1290 +1612 @@
 }
 
+static int acl_search_update_confidential_attrs(struct acl_context *ac,
+                                                struct acl_private *data)
+{
+        struct dsdb_attribute *a;
+        uint32_t n = 0;
+
+        if (data->acl_search) {
+                /*
+                 * If acl:search is activated, the acl_read module
+                 * protects confidential attributes.
+                 */
+                return LDB_SUCCESS;
+        }
+
+        if ((ac->schema == data->cached_schema_ptr) &&
+            (ac->schema->loaded_usn == data->cached_schema_loaded_usn) &&
+            (ac->schema->metadata_usn == data->cached_schema_metadata_usn))
+        {
+                return LDB_SUCCESS;
+        }
+
+        data->cached_schema_ptr = NULL;
+        data->cached_schema_loaded_usn = 0;
+        data->cached_schema_metadata_usn = 0;
+        TALLOC_FREE(data->confidential_attrs);
+
+        if (ac->schema == NULL) {
+                return LDB_SUCCESS;
+        }
+
+        for (a = ac->schema->attributes; a; a = a->next) {
+                const char **attrs = data->confidential_attrs;
+
+                if (!(a->searchFlags & SEARCH_FLAG_CONFIDENTIAL)) {
+                        continue;
+                }
+
+                attrs = talloc_realloc(data, attrs, const char *, n + 2);
+                if (attrs == NULL) {
+                        TALLOC_FREE(data->confidential_attrs);
+                        return ldb_module_oom(ac->module);
+                }
+
+                attrs[n] = a->lDAPDisplayName;
+                attrs[n+1] = NULL;
+                n++;
+
+                data->confidential_attrs = attrs;
+        }
+
+        data->cached_schema_ptr = ac->schema;
+        data->cached_schema_loaded_usn = ac->schema->loaded_usn;
+        data->cached_schema_metadata_usn = ac->schema->metadata_usn;
+
+        return LDB_SUCCESS;
+}
+
 static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 {
-        struct ldb_context *ldb;
         struct acl_context *ac;
         struct acl_private *data;
@@ -1307 +1685 @@
         ac = talloc_get_type(req->context, struct acl_context);
         data = talloc_get_type(ldb_module_get_private(ac->module), struct acl_private);
-        ldb = ldb_module_get_ctx(ac->module);
-
         if (!ares) {
                 return ldb_module_done(ac->req, NULL, NULL,
@@ -1320 +1696 @@
         switch (ares->type) {
         case LDB_REPLY_ENTRY:
-                if (ac->allowedAttributes 
-                    || ac->allowedChildClasses
-                    || ac->allowedChildClassesEffective
-                    || ac->allowedAttributesEffective
-                    || ac->sDRightsEffective) {
+                if (ac->constructed_attrs) {
                         ret = dsdb_module_search_dn(ac->module, ac, &acl_res, ares->message->dn, 
                                                     acl_attrs,
-                                                    DSDB_FLAG_NEXT_MODULE, req);
+                                                    DSDB_FLAG_NEXT_MODULE |
+                                                    DSDB_FLAG_AS_SYSTEM |
+                                                    DSDB_SEARCH_SHOW_RECYCLED,
+                                                    req);
                         if (ret != LDB_SUCCESS) {
                                 return ldb_module_done(ac->req, NULL, NULL, ret);
                         }
-                        if (ac->allowedAttributes || ac->allowedAttributesEffective) {
-                                ret = acl_allowedAttributes(ac->module, ac->schema, acl_res->msgs[0], ares->message, ac);
-                                if (ret != LDB_SUCCESS) {
-                                        return ldb_module_done(ac->req, NULL, NULL, ret);
+                }
+
+                if (ac->allowedAttributes || ac->allowedAttributesEffective) {
+                        ret = acl_allowedAttributes(ac->module, ac->schema,
+                                                    acl_res->msgs[0],
+                                                    ares->message, ac);
+                        if (ret != LDB_SUCCESS) {
+                                return ldb_module_done(ac->req, NULL, NULL, ret);
+                        }
+                }
+
+                if (ac->allowedChildClasses) {
+                        ret = acl_childClasses(ac->module, ac->schema,
+                                               acl_res->msgs[0],
+                                               ares->message,
+                                               "allowedChildClasses");
+                        if (ret != LDB_SUCCESS) {
+                                return ldb_module_done(ac->req, NULL, NULL, ret);
+                        }
+                }
+
+                if (ac->allowedChildClassesEffective) {
+                        ret = acl_childClassesEffective(ac->module, ac->schema,
+                                                        acl_res->msgs[0],
+                                                        ares->message, ac);
+                        if (ret != LDB_SUCCESS) {
+                                return ldb_module_done(ac->req, NULL, NULL, ret);
+                        }
+                }
+
+                if (ac->sDRightsEffective) {
+                        ret = acl_sDRightsEffective(ac->module,
+                                                    acl_res->msgs[0],
+                                                    ares->message, ac);
+                        if (ret != LDB_SUCCESS) {
+                                return ldb_module_done(ac->req, NULL, NULL, ret);
+                        }
+                }
+
+                if (data == NULL) {
+                        return ldb_module_send_entry(ac->req, ares->message,
+                                                     ares->controls);
+                }
+
+                if (ac->am_system) {
+                        return ldb_module_send_entry(ac->req, ares->message,
+                                                     ares->controls);
+                }
+
+                if (data->password_attrs != NULL) {
+                        for (i = 0; data->password_attrs[i]; i++) {
+                                if ((!ac->userPassword) &&
+                                    (ldb_attr_cmp(data->password_attrs[i],
+                                                  "userPassword") == 0))
+                                {
+                                                continue;
                                 }
-                        }
-                        if (ac->allowedChildClasses) {
-                                ret = acl_childClasses(ac->module, ac->schema, acl_res->msgs[0],
-                                                       ares->message, "allowedChildClasses");
-                                if (ret != LDB_SUCCESS) {
-                                        return ldb_module_done(ac->req, NULL, NULL, ret);
-                                }
-                        }
-                        if (ac->allowedChildClassesEffective) {
-                                ret = acl_childClassesEffective(ac->module, ac->schema,
-                                                                acl_res->msgs[0], ares->message, ac);
-                                if (ret != LDB_SUCCESS) {
-                                        return ldb_module_done(ac->req, NULL, NULL, ret);
-                                }
-                        }
-                        if (ac->sDRightsEffective) {
-                                ret = acl_sDRightsEffective(ac->module, 
-                                                            acl_res->msgs[0], ares->message, ac);
-                                if (ret != LDB_SUCCESS) {
-                                        return ldb_module_done(ac->req, NULL, NULL, ret);
-                                }
-                        }
-                }
-                if (data && data->password_attrs) {
-                        if (!ac->am_system) {
-                                for (i = 0; data->password_attrs[i]; i++) {
-                                        if ((!ac->userPassword) &&
-                                            (ldb_attr_cmp(data->password_attrs[i],
-                                                          "userPassword") == 0))
-                                                continue;
-
-                                        ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
-                                }
-                        }
-                }
+
+                                ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
+                        }
+                }
+
+                if (ac->am_administrator) {
+                        return ldb_module_send_entry(ac->req, ares->message,
+                                                     ares->controls);
+                }
+
+                ret = acl_search_update_confidential_attrs(ac, data);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+
+                if (data->confidential_attrs != NULL) {
+                        for (i = 0; data->confidential_attrs[i]; i++) {
+                                ldb_msg_remove_attr(ares->message,
+                                                    data->confidential_attrs[i]);
+                        }
+                }
+
                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 
@@ -1388 +1802 @@
         struct ldb_context *ldb;
         struct acl_context *ac;
+        struct ldb_parse_tree *down_tree;
         struct ldb_request *down_req;
         struct acl_private *data;
@@ -1393 +1808 @@
         unsigned int i;
 
+        if (ldb_dn_is_special(req->op.search.base)) {
+                return ldb_next_request(module, req);
+        }
+
         ldb = ldb_module_get_ctx(module);
 
@@ -1404 +1823 @@
         ac->req = req;
         ac->am_system = dsdb_module_am_system(module);
+        ac->am_administrator = dsdb_module_am_administrator(module);
+        ac->constructed_attrs = false;
+        ac->modify_search = true;
         ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
         ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
@@ -1409 +1831 @@
         ac->allowedChildClassesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedChildClassesEffective");
         ac->sDRightsEffective = ldb_attr_in_list(req->op.search.attrs, "sDRightsEffective");
-        ac->userPassword = dsdb_user_password_support(module, ac, req);
+        ac->userPassword = true;
         ac->schema = dsdb_get_schema(ldb, ac);
 
-        /* replace any attributes in the parse tree that are private,
-           so we don't allow a search for 'userPassword=penguin',
-           just as we would not allow that attribute to be returned */
+        ac->constructed_attrs |= ac->allowedAttributes;
+        ac->constructed_attrs |= ac->allowedChildClasses;
+        ac->constructed_attrs |= ac->allowedChildClassesEffective;
+        ac->constructed_attrs |= ac->allowedAttributesEffective;
+        ac->constructed_attrs |= ac->sDRightsEffective;
+
+        if (data == NULL) {
+                ac->modify_search = false;
+        }
         if (ac->am_system) {
-                /* FIXME: We should copy the tree and keep the original unmodified. */
-                /* remove password attributes */
-                if (data && data->password_attrs) {
-                        for (i = 0; data->password_attrs[i]; i++) {
-                                if ((!ac->userPassword) &&
-                                    (ldb_attr_cmp(data->password_attrs[i],
-                                                  "userPassword") == 0))
-                                                continue;
-
-                                ldb_parse_tree_attr_replace(req->op.search.tree,
-                                                            data->password_attrs[i],
-                                                            "kludgeACLredactedattribute");
-                        }
-                }
-        }
+                ac->modify_search = false;
+        }
+
+        if (!ac->constructed_attrs && !ac->modify_search) {
+                talloc_free(ac);
+                return ldb_next_request(module, req);
+        }
+
+        if (!ac->am_system) {
+                ac->userPassword = dsdb_user_password_support(module, ac, req);
+        }
+
+        ret = acl_search_update_confidential_attrs(ac, data);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        down_tree = ldb_parse_tree_copy_shallow(ac, req->op.search.tree);
+        if (down_tree == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        if (!ac->am_system && data->password_attrs) {
+                for (i = 0; data->password_attrs[i]; i++) {
+                        if ((!ac->userPassword) &&
+                            (ldb_attr_cmp(data->password_attrs[i],
+                                          "userPassword") == 0))
+                        {
+                                continue;
+                        }
+
+                        ldb_parse_tree_attr_replace(down_tree,
+                                                    data->password_attrs[i],
+                                                    "kludgeACLredactedattribute");
+                }
+        }
+
+        if (!ac->am_system && !ac->am_administrator && data->confidential_attrs) {
+                for (i = 0; data->confidential_attrs[i]; i++) {
+                        ldb_parse_tree_attr_replace(down_tree,
+                                                    data->confidential_attrs[i],
+                                                    "kludgeACLredactedattribute");
+                }
+        }
+
         ret = ldb_build_search_req_ex(&down_req,
                                       ldb, ac,
                                       req->op.search.base,
                                       req->op.search.scope,
-                                      req->op.search.tree,
+                                      down_tree,
                                       req->op.search.attrs,
                                       req->controls,

vendor/current/source4/dsdb/samdb/ldb_modules/acl_read.c

@@ -45 +45 @@
         const char * const *attrs;
         const struct dsdb_schema *schema;
-        bool sd;
-        bool instance_type;
-        bool object_sid;
+        uint32_t sd_flags;
+        bool added_nTSecurityDescriptor;
+        bool added_instanceType;
+        bool added_objectSid;
+        bool added_objectClass;
+        bool indirsync;
 };
 
@@ -55 +58 @@
 
 static void aclread_mark_inaccesslible(struct ldb_message_element *el) {
-         el->flags |= LDB_FLAG_INTERNAL_INACCESSIBLE_ATTRIBUTE;
+        el->flags |= LDB_FLAG_INTERNAL_INACCESSIBLE_ATTRIBUTE;
 }
 
@@ -64 +67 @@
 static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
 {
-         struct ldb_context *ldb;
-         struct aclread_context *ac;
-         struct ldb_message *ret_msg;
-         struct ldb_message *msg;
-         int ret, num_of_attrs = 0;
-         unsigned int i, k = 0;
-         struct security_descriptor *sd;
-         struct dom_sid *sid = NULL;
-         TALLOC_CTX *tmp_ctx;
-         uint32_t instanceType;
-
-         ac = talloc_get_type(req->context, struct aclread_context);
-         ldb = ldb_module_get_ctx(ac->module);
-         if (!ares) {
-                 return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR );
-         }
-         if (ares->error != LDB_SUCCESS) {
-                 return ldb_module_done(ac->req, ares->controls,
-                                        ares->response, ares->error);
-         }
-         tmp_ctx = talloc_new(ac);
-         switch (ares->type) {
-         case LDB_REPLY_ENTRY:
-                 msg = ares->message;
-                 ret = dsdb_get_sd_from_ldb_message(ldb, tmp_ctx, msg, &sd);
-                 if (ret != LDB_SUCCESS) {
-                         DEBUG(10, ("acl_read: cannot get descriptor\n"));
-                         ret = LDB_ERR_OPERATIONS_ERROR;
-                         goto fail;
-                 }
-                 sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
-                 /* get the object instance type */
-                 instanceType = ldb_msg_find_attr_as_uint(msg,
+        struct ldb_context *ldb;
+        struct aclread_context *ac;
+        struct ldb_message *ret_msg;
+        struct ldb_message *msg;
+        int ret, num_of_attrs = 0;
+        unsigned int i, k = 0;
+        struct security_descriptor *sd;
+        struct dom_sid *sid = NULL;
+        TALLOC_CTX *tmp_ctx;
+        uint32_t instanceType;
+        const struct dsdb_class *objectclass;
+
+        ac = talloc_get_type(req->context, struct aclread_context);
+        ldb = ldb_module_get_ctx(ac->module);
+        if (!ares) {
+                return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR );
+        }
+        if (ares->error != LDB_SUCCESS) {
+                return ldb_module_done(ac->req, ares->controls,
+                                       ares->response, ares->error);
+        }
+        tmp_ctx = talloc_new(ac);
+        switch (ares->type) {
+        case LDB_REPLY_ENTRY:
+                msg = ares->message;
+                ret = dsdb_get_sd_from_ldb_message(ldb, tmp_ctx, msg, &sd);
+                if (ret != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "acl_read: cannot get descriptor of %s: %s\n",
+                                      ldb_dn_get_linearized(msg->dn), ldb_strerror(ret));
+                        ret = LDB_ERR_OPERATIONS_ERROR;
+                        goto fail;
+                } else if (sd == NULL) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "acl_read: cannot get descriptor of %s (attribute not found)\n",
+                                      ldb_dn_get_linearized(msg->dn));
+                        ret = LDB_ERR_OPERATIONS_ERROR;
+                        goto fail;
+                }
+                /*
+                 * Get the most specific structural object class for the ACL check
+                 */
+                objectclass = dsdb_get_structural_oc_from_msg(ac->schema, msg);
+                if (objectclass == NULL) {
+                        ldb_asprintf_errstring(ldb, "acl_read: Failed to find a structural class for %s",
+                                               ldb_dn_get_linearized(msg->dn));
+                        ret = LDB_ERR_OPERATIONS_ERROR;
+                        goto fail;
+                }
+
+                sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
+                /* get the object instance type */
+                instanceType = ldb_msg_find_attr_as_uint(msg,
                                                          "instanceType", 0);
-                 if (!ldb_dn_is_null(msg->dn) && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD))
-                 {
+                if (!ldb_dn_is_null(msg->dn) && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD))
+                {
                         /* the object has a parent, so we have to check for visibility */
                         struct ldb_dn *parent_dn = ldb_dn_get_parent(tmp_ctx, msg->dn);
+
                         ret = dsdb_module_check_access_on_dn(ac->module,
                                                              tmp_ctx,
@@ -111 +135 @@
                                 return LDB_SUCCESS;
                         } else if (ret != LDB_SUCCESS) {
+                                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                              "acl_read: %s check parent %s - %s\n",
+                                              ldb_dn_get_linearized(msg->dn),
+                                              ldb_strerror(ret),
+                                              ldb_errstring(ldb));
                                 goto fail;
                         }
-                 }
-                 /* for every element in the message check RP */
-                 for (i=0; i < msg->num_elements; i++) {
-                         const struct dsdb_attribute *attr;
-                         bool is_sd, is_objectsid, is_instancetype;
-                         uint32_t access_mask;
-                         attr =  dsdb_attribute_by_lDAPDisplayName(ac->schema,
-                                                                   msg->elements[i].name);
-                         if (!attr) {
-                                 DEBUG(2, ("acl_read: cannot find attribute %s in schema\n",
-                                           msg->elements[i].name));
-                                 ret = LDB_ERR_OPERATIONS_ERROR;
-                                 goto fail;
-                         }
-                         is_sd = ldb_attr_cmp("nTSecurityDescriptor",
+                }
+
+                /* for every element in the message check RP */
+                for (i=0; i < msg->num_elements; i++) {
+                        const struct dsdb_attribute *attr;
+                        bool is_sd, is_objectsid, is_instancetype, is_objectclass;
+                        uint32_t access_mask;
+                        attr = dsdb_attribute_by_lDAPDisplayName(ac->schema,
+                                                                 msg->elements[i].name);
+                        if (!attr) {
+                                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                              "acl_read: %s cannot find attr[%s] in of schema\n",
+                                              ldb_dn_get_linearized(msg->dn),
+                                              msg->elements[i].name);
+                                ret = LDB_ERR_OPERATIONS_ERROR;
+                                goto fail;
+                        }
+                        is_sd = ldb_attr_cmp("nTSecurityDescriptor",
                                               msg->elements[i].name) == 0;
-                         is_objectsid = ldb_attr_cmp("objectSid",
-                                                     msg->elements[i].name) == 0;
-                         is_instancetype = ldb_attr_cmp("instanceType",
-                                                        msg->elements[i].name) == 0;
-                         /* these attributes were added to perform access checks and must be removed */
-                         if (is_objectsid && ac->object_sid) {
-                                 aclread_mark_inaccesslible(&msg->elements[i]);
-                                 continue;
-                         }
-                         if (is_instancetype && ac->instance_type) {
-                                 aclread_mark_inaccesslible(&msg->elements[i]);
-                                 continue;
-                         }
-                         if (is_sd && ac->sd) {
-                                 aclread_mark_inaccesslible(&msg->elements[i]);
-                                 continue;
-                         }
-                         /* nTSecurityDescriptor is a special case */
-                         if (is_sd) {
-                                 access_mask = SEC_FLAG_SYSTEM_SECURITY|SEC_STD_READ_CONTROL;
-                         } else {
-                                 access_mask = SEC_ADS_READ_PROP;
-                         }
-                         ret = acl_check_access_on_attribute(ac->module,
-                                                             tmp_ctx,
-                                                             sd,
-                                                             sid,
-                                                             access_mask,
-                                                             attr);
-
-                         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
-                                 /* do not return this entry if attribute is
-                                    part of the search filter */
-                                 if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
-                                                             msg->elements[i].name)) {
-                                         talloc_free(tmp_ctx);
-                                         return LDB_SUCCESS;
-                                 }
-                                 aclread_mark_inaccesslible(&msg->elements[i]);
-                         } else if (ret != LDB_SUCCESS) {
-                                 goto fail;
-                         }
-                 }
-                 for (i=0; i < msg->num_elements; i++) {
-                         if (!aclread_is_inaccessible(&msg->elements[i])) {
-                                 num_of_attrs++;
-                         }
-                 }
-                 /*create a new message to return*/
-                 ret_msg = ldb_msg_new(ac->req);
-                 ret_msg->dn = msg->dn;
-                 talloc_steal(ret_msg, msg->dn);
-                 ret_msg->num_elements = num_of_attrs;
-                 if (num_of_attrs > 0) {
-                         ret_msg->elements = talloc_array(ret_msg,
-                                                          struct ldb_message_element,
-                                                          num_of_attrs);
-                         if (ret_msg->elements == NULL) {
-                                 return ldb_oom(ldb);
-                         }
-                         for (i=0; i < msg->num_elements; i++) {
-                                 bool to_remove = aclread_is_inaccessible(&msg->elements[i]);
-                                 if (!to_remove) {
-                                         ret_msg->elements[k] = msg->elements[i];
-                                         talloc_steal(ret_msg->elements, msg->elements[i].values);
-                                         k++;
-                                 }
-                         }
-                 } else {
-                         ret_msg->elements = NULL;
-                 }
-                 talloc_free(tmp_ctx);
-
-                 return ldb_module_send_entry(ac->req, ret_msg, ares->controls);
-         case LDB_REPLY_REFERRAL:
-                 return ldb_module_send_referral(ac->req, ares->referral);
-         case LDB_REPLY_DONE:
-                 return ldb_module_done(ac->req, ares->controls,
+                        is_objectsid = ldb_attr_cmp("objectSid",
+                                                    msg->elements[i].name) == 0;
+                        is_instancetype = ldb_attr_cmp("instanceType",
+                                                       msg->elements[i].name) == 0;
+                        is_objectclass = ldb_attr_cmp("objectClass",
+                                                      msg->elements[i].name) == 0;
+                        /* these attributes were added to perform access checks and must be removed */
+                        if (is_objectsid && ac->added_objectSid) {
+                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                continue;
+                        }
+                        if (is_instancetype && ac->added_instanceType) {
+                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                continue;
+                        }
+                        if (is_objectclass && ac->added_objectClass) {
+                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                continue;
+                        }
+                        if (is_sd && ac->added_nTSecurityDescriptor) {
+                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                continue;
+                        }
+                        /* nTSecurityDescriptor is a special case */
+                        if (is_sd) {
+                                access_mask = 0;
+
+                                if (ac->sd_flags & (SECINFO_OWNER|SECINFO_GROUP)) {
+                                        access_mask |= SEC_STD_READ_CONTROL;
+                                }
+                                if (ac->sd_flags & SECINFO_DACL) {
+                                        access_mask |= SEC_STD_READ_CONTROL;
+                                }
+                                if (ac->sd_flags & SECINFO_SACL) {
+                                        access_mask |= SEC_FLAG_SYSTEM_SECURITY;
+                                }
+                        } else {
+                                access_mask = SEC_ADS_READ_PROP;
+                        }
+
+                        if (attr->searchFlags & SEARCH_FLAG_CONFIDENTIAL) {
+                                access_mask |= SEC_ADS_CONTROL_ACCESS;
+                        }
+
+                        if (access_mask == 0) {
+                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                continue;
+                        }
+
+                        ret = acl_check_access_on_attribute(ac->module,
+                                                            tmp_ctx,
+                                                            sd,
+                                                            sid,
+                                                            access_mask,
+                                                            attr,
+                                                            objectclass);
+
+                        /*
+                         * Dirsync control needs the replpropertymetadata attribute
+                         * so return it as it will be removed by the control
+                         * in anycase.
+                         */
+                        if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+                                if (!ac->indirsync) {
+                                        /*
+                                         * do not return this entry if attribute is
+                                         * part of the search filter
+                                         */
+                                        if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
+                                                                msg->elements[i].name)) {
+                                                talloc_free(tmp_ctx);
+                                                return LDB_SUCCESS;
+                                        }
+                                        aclread_mark_inaccesslible(&msg->elements[i]);
+                                } else {
+                                        /*
+                                         * We are doing dirysnc answers
+                                         * and the object shouldn't be returned (normally)
+                                         * but we will return it without replPropertyMetaData
+                                         * so that the dirysync module will do what is needed
+                                         * (remove the object if it is not deleted, or return
+                                         * just the objectGUID if it's deleted).
+                                         */
+                                        if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
+                                                                msg->elements[i].name)) {
+                                                ldb_msg_remove_attr(msg, "replPropertyMetaData");
+                                                break;
+                                        } else {
+                                                aclread_mark_inaccesslible(&msg->elements[i]);
+                                        }
+                                }
+                        } else if (ret != LDB_SUCCESS) {
+                                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                              "acl_read: %s check attr[%s] gives %s - %s\n",
+                                              ldb_dn_get_linearized(msg->dn),
+                                              msg->elements[i].name,
+                                              ldb_strerror(ret),
+                                              ldb_errstring(ldb));
+                                goto fail;
+                        }
+                }
+                for (i=0; i < msg->num_elements; i++) {
+                        if (!aclread_is_inaccessible(&msg->elements[i])) {
+                                num_of_attrs++;
+                        }
+                }
+                /*create a new message to return*/
+                ret_msg = ldb_msg_new(ac->req);
+                ret_msg->dn = msg->dn;
+                talloc_steal(ret_msg, msg->dn);
+                ret_msg->num_elements = num_of_attrs;
+                if (num_of_attrs > 0) {
+                        ret_msg->elements = talloc_array(ret_msg,
+                                                         struct ldb_message_element,
+                                                         num_of_attrs);
+                        if (ret_msg->elements == NULL) {
+                                return ldb_oom(ldb);
+                        }
+                        for (i=0; i < msg->num_elements; i++) {
+                                bool to_remove = aclread_is_inaccessible(&msg->elements[i]);
+                                if (!to_remove) {
+                                        ret_msg->elements[k] = msg->elements[i];
+                                        talloc_steal(ret_msg->elements, msg->elements[i].name);
+                                        talloc_steal(ret_msg->elements, msg->elements[i].values);
+                                        k++;
+                                }
+                        }
+                        /*
+                         * This should not be needed, but some modules
+                         * may allocate values on the wrong context...
+                         */
+                        talloc_steal(ret_msg->elements, msg);
+                } else {
+                        ret_msg->elements = NULL;
+                }
+                talloc_free(tmp_ctx);
+
+                return ldb_module_send_entry(ac->req, ret_msg, ares->controls);
+        case LDB_REPLY_REFERRAL:
+                return ldb_module_send_referral(ac->req, ares->referral);
+        case LDB_REPLY_DONE:
+                return ldb_module_done(ac->req, ares->controls,
                                         ares->response, LDB_SUCCESS);
 
-         }
-         return LDB_SUCCESS;
+        }
+        return LDB_SUCCESS;
 fail:
-         talloc_free(tmp_ctx);
-         return ldb_module_done(ac->req, NULL, NULL, ret);
+        talloc_free(tmp_ctx);
+        return ldb_module_done(ac->req, NULL, NULL, ret);
 }
 
@@ -224 +320 @@
         struct ldb_request *down_req;
         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
+        uint32_t flags = ldb_req_get_custom_flags(req);
         struct ldb_result *res;
         struct aclread_private *p;
+        bool need_sd = false;
+        bool explicit_sd_flags = false;
         bool is_untrusted = ldb_req_is_untrusted(req);
+        static const char * const _all_attrs[] = { "*", NULL };
+        bool all_attrs = false;
         const char * const *attrs = NULL;
         uint32_t instanceType;
         static const char *acl_attrs[] = {
-                 "instanceType",
-                 NULL
+                "instanceType",
+                NULL
         };
 
@@ -254 +355 @@
                                             acl_attrs,
                                             DSDB_FLAG_NEXT_MODULE |
-                                            DSDB_SEARCH_SHOW_DELETED, req);
+                                            DSDB_FLAG_AS_SYSTEM |
+                                            DSDB_SEARCH_SHOW_RECYCLED,
+                                            req);
                 if (ret != LDB_SUCCESS) {
                         return ldb_error(ldb, ret,
-                                         "acl_read: Error retrieving instanceType for base.");
+                                        "acl_read: Error retrieving instanceType for base.");
                 }
                 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0],
-                                                         "instanceType", 0);
+                                                        "instanceType", 0);
                 if (instanceType != 0 && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD))
                 {
@@ -284 +387 @@
         ac->req = req;
         ac->schema = dsdb_get_schema(ldb, req);
+        if (flags & DSDB_ACL_CHECKS_DIRSYNC_FLAG) {
+                ac->indirsync = true;
+        } else {
+                ac->indirsync = false;
+        }
         if (!ac->schema) {
                 return ldb_operr(ldb);
         }
-        ac->sd = !(ldb_attr_in_list(req->op.search.attrs, "nTSecurityDescriptor"));
-        if (req->op.search.attrs && !ldb_attr_in_list(req->op.search.attrs, "*")) {
-                if (!ldb_attr_in_list(req->op.search.attrs, "instanceType")) {
-                        ac->instance_type = true;
-                        attrs = ldb_attr_list_copy_add(ac, req->op.search.attrs, "instanceType");
-                } else {
-                        attrs = req->op.search.attrs;
+
+        attrs = req->op.search.attrs;
+        if (attrs == NULL) {
+                all_attrs = true;
+                attrs = _all_attrs;
+        } else if (attrs[0] == NULL) {
+                all_attrs = true;
+                attrs = _all_attrs;
+        } else if (ldb_attr_in_list(attrs, "*")) {
+                all_attrs = true;
+        }
+
+        /*
+         * In theory we should also check for the SD control but control verification is
+         * expensive so we'd better had the ntsecuritydescriptor to the list of
+         * searched attribute and then remove it !
+         */
+        ac->sd_flags = dsdb_request_sd_flags(ac->req, &explicit_sd_flags);
+
+        if (ldb_attr_in_list(attrs, "nTSecurityDescriptor")) {
+                need_sd = false;
+        } else if (explicit_sd_flags && all_attrs) {
+                need_sd = false;
+        } else {
+                need_sd = true;
+        }
+
+        if (!all_attrs) {
+                if (!ldb_attr_in_list(attrs, "instanceType")) {
+                        attrs = ldb_attr_list_copy_add(ac, attrs, "instanceType");
+                        if (attrs == NULL) {
+                                return ldb_oom(ldb);
+                        }
+                        ac->added_instanceType = true;
                 }
                 if (!ldb_attr_in_list(req->op.search.attrs, "objectSid")) {
-                        ac->object_sid = true;
                         attrs = ldb_attr_list_copy_add(ac, attrs, "objectSid");
-                }
-        }
-
-        if (ac->sd) {
-                /* avoid replacing all attributes with nTSecurityDescriptor
-                 * if attribute list is empty */
-                if (!attrs) {
-                        attrs = ldb_attr_list_copy_add(ac, attrs, "*");
-                }
+                        if (attrs == NULL) {
+                                return ldb_oom(ldb);
+                        }
+                        ac->added_objectSid = true;
+                }
+                if (!ldb_attr_in_list(req->op.search.attrs, "objectClass")) {
+                        attrs = ldb_attr_list_copy_add(ac, attrs, "objectClass");
+                        if (attrs == NULL) {
+                                return ldb_oom(ldb);
+                        }
+                        ac->added_objectClass = true;
+                }
+        }
+
+        if (need_sd) {
                 attrs = ldb_attr_list_copy_add(ac, attrs, "nTSecurityDescriptor");
-        }
+                if (attrs == NULL) {
+                        return ldb_oom(ldb);
+                }
+                ac->added_nTSecurityDescriptor = true;
+        }
+
         ac->attrs = req->op.search.attrs;
         ret = ldb_build_search_req_ex(&down_req,
@@ -334 +479 @@
                 return ldb_module_oom(module);
         }
-        p->enabled = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"), NULL, "acl", "search", false);
+        p->enabled = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"), NULL, "acl", "search", true);
         ldb_module_set_private(module, p);
         return ldb_next_init(module);

vendor/current/source4/dsdb/samdb/ldb_modules/acl_util.c

@@ -75 +75 @@
                                     acl_attrs,
                                     DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
                                     DSDB_SEARCH_SHOW_RECYCLED,
                                     parent);
         if (ret != LDB_SUCCESS) {
-                DEBUG(0,("access_check: failed to find object %s\n", ldb_dn_get_linearized(dn)));
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "access_check: failed to find object %s\n",
+                                       ldb_dn_get_linearized(dn));
                 return ret;
         }
@@ -89 +92 @@
 }
 
-int dsdb_module_check_access_on_guid(struct ldb_module *module,
-                                     TALLOC_CTX *mem_ctx,
-                                     struct GUID *guid,
-                                     uint32_t access_mask,
-                                     const struct GUID *oc_guid,
-                                     struct ldb_request *parent)
-{
-        int ret;
-        struct ldb_result *acl_res;
-        static const char *acl_attrs[] = {
-                "nTSecurityDescriptor",
-                "objectSid",
-                NULL
-        };
-        struct ldb_context *ldb = ldb_module_get_ctx(module);
-        struct auth_session_info *session_info
-                = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
-        if(!session_info) {
-                return ldb_operr(ldb);
-        }
-        ret = dsdb_module_search(module, mem_ctx, &acl_res, NULL, LDB_SCOPE_SUBTREE,
-                                 acl_attrs,
-                                 DSDB_FLAG_NEXT_MODULE |
-                                 DSDB_SEARCH_SHOW_RECYCLED,
-                                 parent,
-                                 "objectGUID=%s", GUID_string(mem_ctx, guid));
-
-        if (ret != LDB_SUCCESS || acl_res->count == 0) {
-                DEBUG(0,("access_check: failed to find object %s\n", GUID_string(mem_ctx, guid)));
-                return ret;
-        }
-        return dsdb_check_access_on_dn_internal(ldb, acl_res,
-                                                mem_ctx,
-                                                session_info->security_token,
-                                                acl_res->msgs[0]->dn,
-                                                access_mask,
-                                                oc_guid);
-}
-
 int acl_check_access_on_attribute(struct ldb_module *module,
                                   TALLOC_CTX *mem_ctx,
@@ -133 +97 @@
                                   struct dom_sid *rp_sid,
                                   uint32_t access_mask,
-                                  const struct dsdb_attribute *attr)
+                                  const struct dsdb_attribute *attr,
+                                  const struct dsdb_class *objectclass)
 {
         int ret;
@@ -142 +107 @@
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
         struct security_token *token = acl_user_token(module);
-        if (attr) {
-                if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
-                        if (!insert_in_object_tree(tmp_ctx,
-                                                   &attr->attributeSecurityGUID,
-                                                   access_mask, &root,
-                                                   &new_node)) {
-                                DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
-                                goto fail;
-                        }
-
-                        if (!insert_in_object_tree(tmp_ctx,
-                                                   &attr->schemaIDGUID,
-                                                   access_mask, &new_node,
-                                                   &new_node)) {
-                                DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
-                                goto fail;
-                        }
+
+        if (!insert_in_object_tree(tmp_ctx,
+                                   &objectclass->schemaIDGUID,
+                                   access_mask, NULL,
+                                   &root)) {
+                DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
+                goto fail;
+        }
+        new_node = root;
+
+        if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
+                if (!insert_in_object_tree(tmp_ctx,
+                                           &attr->attributeSecurityGUID,
+                                           access_mask, new_node,
+                                           &new_node)) {
+                        DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
+                        goto fail;
                 }
-                else {
-                        if (!insert_in_object_tree(tmp_ctx,
-                                                   &attr->schemaIDGUID,
-                                                   access_mask, &root,
-                                                   &new_node)) {
-                                DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
-                                goto fail;
-                        }
-                }
-        }
+        }
+
+        if (!insert_in_object_tree(tmp_ctx,
+                                   &attr->schemaIDGUID,
+                                   access_mask, new_node,
+                                   &new_node)) {
+                DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
+                goto fail;
+        }
+
         status = sec_access_check_ds(sd, token,
                                      access_mask,
@@ -188 +153 @@
 }
 
+int acl_check_access_on_objectclass(struct ldb_module *module,
+                                    TALLOC_CTX *mem_ctx,
+                                    struct security_descriptor *sd,
+                                    struct dom_sid *rp_sid,
+                                    uint32_t access_mask,
+                                    const struct dsdb_class *objectclass)
+{
+        int ret;
+        NTSTATUS status;
+        uint32_t access_granted;
+        struct object_tree *root = NULL;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        struct security_token *token = acl_user_token(module);
+
+        if (!insert_in_object_tree(tmp_ctx,
+                                   &objectclass->schemaIDGUID,
+                                   access_mask, NULL,
+                                   &root)) {
+                DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
+                goto fail;
+        }
+
+        status = sec_access_check_ds(sd, token,
+                                     access_mask,
+                                     &access_granted,
+                                     root,
+                                     rp_sid);
+        if (!NT_STATUS_IS_OK(status)) {
+                ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+        } else {
+                ret = LDB_SUCCESS;
+        }
+        talloc_free(tmp_ctx);
+        return ret;
+fail:
+        talloc_free(tmp_ctx);
+        return ldb_operr(ldb_module_get_ctx(module));
+}
 
 /* checks for validated writes */
@@ -201 +204 @@
         uint32_t access_granted;
         struct object_tree *root = NULL;
-        struct object_tree *new_node = NULL;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
@@ -207 +209 @@
 
         if (!insert_in_object_tree(tmp_ctx, &right, right_type,
-                                   &root, &new_node)) {
+                                   NULL, &root)) {
                 DEBUG(10, ("acl_ext_right: cannot add to object tree\n"));
                 talloc_free(tmp_ctx);
@@ -239 +241 @@
                                session_info->info->account_name);
 }
+
+uint32_t dsdb_request_sd_flags(struct ldb_request *req, bool *explicit)
+{
+        struct ldb_control *sd_control;
+        uint32_t sd_flags = 0;
+
+        if (explicit) {
+                *explicit = false;
+        }
+
+        sd_control = ldb_request_get_control(req, LDB_CONTROL_SD_FLAGS_OID);
+        if (sd_control) {
+                struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
+
+                sd_flags = sdctr->secinfo_flags;
+
+                if (explicit) {
+                        *explicit = true;
+                }
+
+                /* mark it as handled */
+                sd_control->critical = 0;
+        }
+
+        /* we only care for the last 4 bits */
+        sd_flags &= 0x0000000F;
+
+        /*
+         * MS-ADTS 3.1.1.3.4.1.11 says that no bits
+         * equals all 4 bits
+         */
+        if (sd_flags == 0) {
+                sd_flags = SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL | SECINFO_SACL;
+        }
+
+        return sd_flags;
+}
+
+int dsdb_module_schedule_sd_propagation(struct ldb_module *module,
+                                        struct ldb_dn *nc_root,
+                                        struct ldb_dn *dn,
+                                        bool include_self)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct dsdb_extended_sec_desc_propagation_op *op;
+        int ret;
+
+        op = talloc_zero(module, struct dsdb_extended_sec_desc_propagation_op);
+        if (op == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        op->nc_root = nc_root;
+        op->dn = dn;
+        op->include_self = include_self;
+
+        ret = dsdb_module_extended(module, op, NULL,
+                                   DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID,
+                                   op,
+                                   DSDB_FLAG_TOP_MODULE |
+                                   DSDB_FLAG_AS_SYSTEM |
+                                   DSDB_FLAG_TRUSTED,
+                                   NULL);
+        TALLOC_FREE(op);
+        return ret;
+}

vendor/current/source4/dsdb/samdb/ldb_modules/descriptor.c

@@ -40 +40 @@
 #include "librpc/gen_ndr/ndr_security.h"
 #include "libcli/security/security.h"
-#include "dsdb/samdb/ldb_modules/schema.h"
 #include "auth/auth.h"
 #include "param/param.h"
-#include "util.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "lib/util/binsearch.h"
+
+struct descriptor_changes {
+        struct descriptor_changes *prev, *next;
+        struct descriptor_changes *children;
+        struct ldb_dn *nc_root;
+        struct ldb_dn *dn;
+        bool force_self;
+        bool force_children;
+        struct ldb_dn *stopped_dn;
+};
 
 struct descriptor_data {
-        int _dummy;
+        TALLOC_CTX *trans_mem;
+        struct descriptor_changes *changes;
 };
 
@@ -58 +69 @@
         struct ldb_message_element *sd_element;
         struct ldb_val *sd_val;
+        uint32_t sd_flags;
         int (*step_fn)(struct descriptor_context *);
 };
 
-struct dom_sid *get_default_ag(TALLOC_CTX *mem_ctx,
+static struct dom_sid *get_default_ag(TALLOC_CTX *mem_ctx,
                                struct ldb_dn *dn,
                                struct security_token *token,
@@ -88 +100 @@
                 } else if (security_token_has_sid(token, da_sid)) {
                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
+                } else if (security_token_is_system(token)) {
+                        dag_sid = dom_sid_dup(mem_ctx, sa_sid);
                 } else {
                         dag_sid = NULL;
@@ -96 +110 @@
                 } else if (security_token_has_sid(token, da_sid)) {
                         dag_sid = dom_sid_dup(mem_ctx, da_sid);
+                } else if (security_token_is_system(token)) {
+                        dag_sid = dom_sid_dup(mem_ctx, ea_sid);
                 } else {
                         dag_sid = NULL;
@@ -104 +120 @@
                 } else if (security_token_has_sid(token, ea_sid)) {
                                 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
+                } else if (security_token_is_system(token)) {
+                        dag_sid = dom_sid_dup(mem_ctx, da_sid);
                 } else {
                         dag_sid = NULL;
@@ -136 +154 @@
                                          struct dom_sid *dag)
 {
-        if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008) {
-                return dag;
-        }
-
-        return NULL;
+        /*
+         * This depends on the function level of the DC
+         * which is 2008R2 in our case. Which means it is
+         * higher than 2003 and we should use the
+         * "default administrator group" also as owning group.
+         *
+         * This matches dcpromo for a 2003 domain
+         * on a Windows 2008R2 DC.
+         */
+        return dag;
 }
 
@@ -159 +182 @@
 
         if (sd_flags & (SECINFO_OWNER)) {
-                final_sd->owner_sid = talloc_memdup(mem_ctx, new_sd->owner_sid, sizeof(struct dom_sid));
+                if (new_sd->owner_sid) {
+                        final_sd->owner_sid = talloc_memdup(mem_ctx, new_sd->owner_sid, sizeof(struct dom_sid));
+                }
                 final_sd->type |= new_sd->type & SEC_DESC_OWNER_DEFAULTED;
         }
         else if (old_sd) {
-                final_sd->owner_sid = talloc_memdup(mem_ctx, old_sd->owner_sid, sizeof(struct dom_sid));
+                if (old_sd->owner_sid) {
+                        final_sd->owner_sid = talloc_memdup(mem_ctx, old_sd->owner_sid, sizeof(struct dom_sid));
+                }
                 final_sd->type |= old_sd->type & SEC_DESC_OWNER_DEFAULTED;
         }
 
         if (sd_flags & (SECINFO_GROUP)) {
-                final_sd->group_sid = talloc_memdup(mem_ctx, new_sd->group_sid, sizeof(struct dom_sid));
+                if (new_sd->group_sid) {
+                        final_sd->group_sid = talloc_memdup(mem_ctx, new_sd->group_sid, sizeof(struct dom_sid));
+                }
                 final_sd->type |= new_sd->type & SEC_DESC_GROUP_DEFAULTED;
         } 
         else if (old_sd) {
-                final_sd->group_sid = talloc_memdup(mem_ctx, old_sd->group_sid, sizeof(struct dom_sid));
+                if (old_sd->group_sid) {
+                        final_sd->group_sid = talloc_memdup(mem_ctx, old_sd->group_sid, sizeof(struct dom_sid));
+                }
                 final_sd->type |= old_sd->type & SEC_DESC_GROUP_DEFAULTED;
         }
@@ -231 +262 @@
         struct dom_sid *default_owner;
         struct dom_sid *default_group;
+        struct security_descriptor *default_descriptor = NULL;
+        struct GUID *object_list = NULL;
+
+        if (objectclass != NULL) {
+                default_descriptor = get_sd_unpacked(module, mem_ctx, objectclass);
+                object_list = talloc_zero_array(mem_ctx, struct GUID, 2);
+                if (object_list == NULL) {
+                        return NULL;
+                }
+                object_list[0] = objectclass->schemaIDGUID;
+        }
 
         if (object) {
@@ -246 +288 @@
                 }
         } else {
-                user_descriptor = get_sd_unpacked(module, mem_ctx, objectclass);
+                user_descriptor = default_descriptor;
         }
 
@@ -279 +321 @@
         }
 
+        if (user_descriptor && default_descriptor &&
+            (user_descriptor->dacl == NULL))
+        {
+                user_descriptor->dacl = default_descriptor->dacl;
+                user_descriptor->type |= default_descriptor->type & (
+                        SEC_DESC_DACL_PRESENT |
+                        SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
+                        SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
+                        SEC_DESC_DACL_TRUSTED);
+        }
+
+        if (user_descriptor && default_descriptor &&
+            (user_descriptor->sacl == NULL))
+        {
+                user_descriptor->sacl = default_descriptor->sacl;
+                user_descriptor->type |= default_descriptor->type & (
+                        SEC_DESC_SACL_PRESENT |
+                        SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
+                        SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
+                        SEC_DESC_SERVER_SECURITY);
+        }
+
+
+        if (!(sd_flags & SECINFO_OWNER) && user_descriptor) {
+                user_descriptor->owner_sid = NULL;
+
+                /*
+                 * We need the correct owner sid
+                 * when calculating the DACL or SACL
+                 */
+                if (old_descriptor) {
+                        user_descriptor->owner_sid = old_descriptor->owner_sid;
+                }
+        }
+        if (!(sd_flags & SECINFO_GROUP) && user_descriptor) {
+                user_descriptor->group_sid = NULL;
+
+                /*
+                 * We need the correct group sid
+                 * when calculating the DACL or SACL
+                 */
+                if (old_descriptor) {
+                        user_descriptor->group_sid = old_descriptor->group_sid;
+                }
+        }
+        if (!(sd_flags & SECINFO_DACL) && user_descriptor) {
+                user_descriptor->dacl = NULL;
+
+                /*
+                 * We add SEC_DESC_DACL_PROTECTED so that
+                 * create_security_descriptor() skips
+                 * the unused inheritance calculation
+                 */
+                user_descriptor->type |= SEC_DESC_DACL_PROTECTED;
+        }
+        if (!(sd_flags & SECINFO_SACL) && user_descriptor) {
+                user_descriptor->sacl = NULL;
+
+                /*
+                 * We add SEC_DESC_SACL_PROTECTED so that
+                 * create_security_descriptor() skips
+                 * the unused inheritance calculation
+                 */
+                user_descriptor->type |= SEC_DESC_SACL_PROTECTED;
+        }
+
         default_owner = get_default_ag(mem_ctx, dn,
                                        session_info->security_token, ldb);
         default_group = get_default_group(mem_ctx, ldb, default_owner);
-        new_sd = create_security_descriptor(mem_ctx, parent_descriptor, user_descriptor, true,
-                                            NULL, SEC_DACL_AUTO_INHERIT|SEC_SACL_AUTO_INHERIT,
+        new_sd = create_security_descriptor(mem_ctx,
+                                            parent_descriptor,
+                                            user_descriptor,
+                                            true,
+                                            object_list,
+                                            SEC_DACL_AUTO_INHERIT |
+                                            SEC_SACL_AUTO_INHERIT,
                                             session_info->security_token,
                                             default_owner, default_group,
@@ -386 +499 @@
 {
         struct descriptor_context *ac;
-        struct ldb_control *sd_control;
         struct ldb_val *sd_val = NULL;
         struct ldb_message_element *sd_el;
         DATA_BLOB *show_sd;
-        int ret;
-        uint32_t sd_flags = 0;
+        int ret = LDB_SUCCESS;
 
         ac = talloc_get_type(req->context, struct descriptor_context);
@@ -404 +515 @@
         }
 
-        sd_control = ldb_request_get_control(ac->req, LDB_CONTROL_SD_FLAGS_OID);
-        if (sd_control) {
-                struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
-                sd_flags = sdctr->secinfo_flags;
-                /* we only care for the last 4 bits */
-                sd_flags = sd_flags & 0x0000000F;
-                if (sd_flags == 0) {
-                        /* MS-ADTS 3.1.1.3.4.1.11 says that no bits
-                           equals all 4 bits */
-                        sd_flags = 0xF;
-                }
-        }
-
         switch (ares->type) {
         case LDB_REPLY_ENTRY:
-                if (sd_flags != 0) {
-                        sd_el = ldb_msg_find_element(ares->message, "nTSecurityDescriptor");
-                        if (sd_el) {
-                                sd_val = sd_el->values;
-                        }
-                }
+                sd_el = ldb_msg_find_element(ares->message, "nTSecurityDescriptor");
+                if (sd_el) {
+                        sd_val = sd_el->values;
+                }
+
                 if (sd_val) {
                         show_sd = descr_get_descriptor_to_show(ac->module, ac->req,
-                                                               sd_val, sd_flags);
+                                                               sd_val, ac->sd_flags);
                         if (!show_sd) {
                                 ret = LDB_ERR_OPERATIONS_ERROR;
@@ -455 +552 @@
 static int descriptor_add(struct ldb_module *module, struct ldb_request *req)
 {
-        struct ldb_context *ldb;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct ldb_request *add_req;
         struct ldb_message *msg;
@@ -461 +558 @@
         const struct ldb_val *parent_sd = NULL;
         const struct ldb_val *user_sd;
-        struct ldb_dn *parent_dn, *dn, *nc_root;
+        struct ldb_dn *dn = req->op.add.message->dn;
+        struct ldb_dn *parent_dn, *nc_root;
         struct ldb_message_element *objectclass_element, *sd_element;
         int ret;
@@ -468 +566 @@
         const struct dsdb_class *objectclass;
         static const char * const parent_attrs[] = { "nTSecurityDescriptor", NULL };
-
-        ldb = ldb_module_get_ctx(module);
-        dn = req->op.add.message->dn;
+        uint32_t instanceType;
+        bool isNC = false;
+        uint32_t sd_flags = dsdb_request_sd_flags(req, NULL);
+
+        /* do not manipulate our control entries */
+        if (ldb_dn_is_special(dn)) {
+                return ldb_next_request(module, req);
+        }
+
         user_sd = ldb_msg_find_ldb_val(req->op.add.message, "nTSecurityDescriptor");
         sd_element = ldb_msg_find_element(req->op.add.message, "nTSecurityDescriptor");
@@ -480 +584 @@
         ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: %s\n", ldb_dn_get_linearized(dn));
 
-        /* do not manipulate our control entries */
-        if (ldb_dn_is_special(dn)) {
-                return ldb_next_request(module, req);
-        }
-
-        /* if the object has a parent, retrieve its SD to
-         * use for calculation. Unfortunately we do not yet have
-         * instanceType, so we use dsdb_find_nc_root. */
-        parent_dn = ldb_dn_get_parent(req, dn);
-        if (parent_dn == NULL) {
-                return ldb_oom(ldb);
-        }
-
-        ret = dsdb_find_nc_root(ldb, req, dn, &nc_root);
-        if (ret != LDB_SUCCESS) {
-                ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: Could not find NC root for %s\n",
-                          ldb_dn_get_linearized(dn));
-                return ret;
-        }
-
-        if (ldb_dn_compare(dn, nc_root) != 0) {
+        instanceType = ldb_msg_find_attr_as_uint(req->op.add.message, "instanceType", 0);
+
+        if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
+                isNC = true;
+        }
+
+        if (!isNC) {
+                ret = dsdb_find_nc_root(ldb, req, dn, &nc_root);
+                if (ret != LDB_SUCCESS) {
+                        ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_add: Could not find NC root for %s\n",
+                                ldb_dn_get_linearized(dn));
+                        return ret;
+                }
+
+                if (ldb_dn_compare(dn, nc_root) == 0) {
+                        DEBUG(0, ("Found DN %s being a NC by the old method\n", ldb_dn_get_linearized(dn)));
+                        isNC = true;
+                }
+        }
+
+        if (isNC) {
+                DEBUG(2, ("DN: %s is a NC\n", ldb_dn_get_linearized(dn)));
+        }
+        if (!isNC) {
+                /* if the object has a parent, retrieve its SD to
+                 * use for calculation. Unfortunately we do not yet have
+                 * instanceType, so we use dsdb_find_nc_root. */
+
+                parent_dn = ldb_dn_get_parent(req, dn);
+                if (parent_dn == NULL) {
+                        return ldb_oom(ldb);
+                }
+
                 /* we aren't any NC */
                 ret = dsdb_module_search_dn(module, req, &parent_res, parent_dn,
                                             parent_attrs,
-                                            DSDB_FLAG_NEXT_MODULE,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_FLAG_AS_SYSTEM |
+                                            DSDB_SEARCH_SHOW_RECYCLED,
                                             req);
                 if (ret != LDB_SUCCESS) {
@@ -524 +642 @@
         }
 
-        objectclass = get_last_structural_class(schema, objectclass_element, req);
+        objectclass = dsdb_get_last_structural_class(schema,
+                                                     objectclass_element);
         if (objectclass == NULL) {
                 return ldb_operr(ldb);
         }
 
+        /*
+         * The SD_FLAG control is ignored on add
+         * and we default to all bits set.
+         */
+        sd_flags = SECINFO_OWNER|SECINFO_GROUP|SECINFO_SACL|SECINFO_DACL;
+
         sd = get_new_descriptor(module, dn, req,
                                 objectclass, parent_sd,
-                                user_sd, NULL, 0);
+                                user_sd, NULL, sd_flags);
+        if (sd == NULL) {
+                return ldb_operr(ldb);
+        }
         msg = ldb_msg_copy_shallow(req, req->op.add.message);
-        if (sd != NULL) {
-                if (sd_element != NULL) {
-                        sd_element->values[0] = *sd;
-                } else {
-                        ret = ldb_msg_add_steal_value(msg,
-                                                      "nTSecurityDescriptor",
-                                                      sd);
-                        if (ret != LDB_SUCCESS) {
-                                return ret;
-                        }
+        if (msg == NULL) {
+                return ldb_oom(ldb);
+        }
+        if (sd_element != NULL) {
+                sd_element->values[0] = *sd;
+        } else {
+                ret = ldb_msg_add_steal_value(msg,
+                                              "nTSecurityDescriptor",
+                                              sd);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
                 }
         }
@@ -562 +691 @@
 static int descriptor_modify(struct ldb_module *module, struct ldb_request *req)
 {
-        struct ldb_context *ldb;
-        struct ldb_control *sd_recalculate_control, *sd_flags_control;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct ldb_request *mod_req;
         struct ldb_message *msg;
@@ -570 +698 @@
         const struct ldb_val *parent_sd = NULL;
         const struct ldb_val *user_sd;
-        struct ldb_dn *parent_dn, *dn;
-        struct ldb_message_element *objectclass_element;
+        struct ldb_dn *dn = req->op.mod.message->dn;
+        struct ldb_dn *parent_dn;
+        struct ldb_message_element *objectclass_element, *sd_element;
         int ret;
-        uint32_t instanceType, sd_flags = 0;
+        uint32_t instanceType;
+        bool explicit_sd_flags = false;
+        uint32_t sd_flags = dsdb_request_sd_flags(req, &explicit_sd_flags);
         const struct dsdb_schema *schema;
         DATA_BLOB *sd;
@@ -581 +712 @@
                                                       "instanceType",
                                                       "objectClass", NULL };
-        ldb = ldb_module_get_ctx(module);
-        dn = req->op.mod.message->dn;
-        user_sd = ldb_msg_find_ldb_val(req->op.mod.message, "nTSecurityDescriptor");
-        /* This control forces the recalculation of the SD also when
-         * no modification is performed. */
-        sd_recalculate_control = ldb_request_get_control(req,
-                                             LDB_CONTROL_RECALCULATE_SD_OID);
-        if (!user_sd && !sd_recalculate_control) {
-                return ldb_next_request(module, req);
-        }
-
-        ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_modify: %s\n", ldb_dn_get_linearized(dn));
+        struct ldb_control *sd_propagation_control;
+        int cmp_ret = -1;
 
         /* do not manipulate our control entries */
@@ -599 +720 @@
         }
 
+        sd_propagation_control = ldb_request_get_control(req,
+                                        DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+        if (sd_propagation_control != NULL) {
+                if (sd_propagation_control->data != module) {
+                        return ldb_operr(ldb);
+                }
+                if (req->op.mod.message->num_elements != 0) {
+                        return ldb_operr(ldb);
+                }
+                if (explicit_sd_flags) {
+                        return ldb_operr(ldb);
+                }
+                if (sd_flags != 0xF) {
+                        return ldb_operr(ldb);
+                }
+                if (sd_propagation_control->critical == 0) {
+                        return ldb_operr(ldb);
+                }
+
+                sd_propagation_control->critical = 0;
+        }
+
+        sd_element = ldb_msg_find_element(req->op.mod.message, "nTSecurityDescriptor");
+        if (sd_propagation_control == NULL && sd_element == NULL) {
+                return ldb_next_request(module, req);
+        }
+
+        /*
+         * nTSecurityDescriptor with DELETE is not supported yet.
+         * TODO: handle this correctly.
+         */
+        if (sd_propagation_control == NULL &&
+            LDB_FLAG_MOD_TYPE(sd_element->flags) == LDB_FLAG_MOD_DELETE)
+        {
+                return ldb_module_error(module,
+                                        LDB_ERR_UNWILLING_TO_PERFORM,
+                                        "MOD_DELETE for nTSecurityDescriptor "
+                                        "not supported yet");
+        }
+
+        user_sd = ldb_msg_find_ldb_val(req->op.mod.message, "nTSecurityDescriptor");
+        /* nTSecurityDescriptor without a value is an error, letting through so it is handled */
+        if (sd_propagation_control == NULL && user_sd == NULL) {
+                return ldb_next_request(module, req);
+        }
+
+        ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_modify: %s\n", ldb_dn_get_linearized(dn));
+
         ret = dsdb_module_search_dn(module, req, &current_res, dn,
                                     current_attrs,
-                                    DSDB_FLAG_NEXT_MODULE,
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_RECYCLED,
                                     req);
         if (ret != LDB_SUCCESS) {
@@ -621 +792 @@
                 ret = dsdb_module_search_dn(module, req, &parent_res, parent_dn,
                                             parent_attrs,
-                                            DSDB_FLAG_NEXT_MODULE,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_FLAG_AS_SYSTEM |
+                                            DSDB_SEARCH_SHOW_RECYCLED,
                                             req);
                 if (ret != LDB_SUCCESS) {
@@ -633 +806 @@
                 parent_sd = ldb_msg_find_ldb_val(parent_res->msgs[0], "nTSecurityDescriptor");
         }
-        sd_flags_control = ldb_request_get_control(req, LDB_CONTROL_SD_FLAGS_OID);
 
         schema = dsdb_get_schema(ldb, req);
@@ -642 +814 @@
         }
 
-        objectclass = get_last_structural_class(schema, objectclass_element, req);
+        objectclass = dsdb_get_last_structural_class(schema,
+                                                     objectclass_element);
         if (objectclass == NULL) {
                 return ldb_operr(ldb);
         }
 
-        if (sd_flags_control) {
-                struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_flags_control->data;
-                sd_flags = sdctr->secinfo_flags;
-                /* we only care for the last 4 bits */
-                sd_flags = sd_flags & 0x0000000F;
-        }
-        if (sd_flags != 0) {
-                old_sd = ldb_msg_find_ldb_val(current_res->msgs[0], "nTSecurityDescriptor");
+        old_sd = ldb_msg_find_ldb_val(current_res->msgs[0], "nTSecurityDescriptor");
+        if (old_sd == NULL) {
+                return ldb_operr(ldb);
+        }
+
+        if (sd_propagation_control != NULL) {
+                /*
+                 * This just triggers a recalculation of the
+                 * inherited aces.
+                 */
+                user_sd = old_sd;
         }
 
@@ -660 +836 @@
                                 objectclass, parent_sd,
                                 user_sd, old_sd, sd_flags);
+        if (sd == NULL) {
+                return ldb_operr(ldb);
+        }
         msg = ldb_msg_copy_shallow(req, req->op.mod.message);
-        if (sd != NULL) {
-                struct ldb_message_element *sd_element;
-                if (user_sd != NULL) {
-                        sd_element = ldb_msg_find_element(msg,
-                                                          "nTSecurityDescriptor");
-                        sd_element->values[0] = *sd;
-                } else if (sd_recalculate_control != NULL) {
-                        /* In this branch we really do force the recalculation
-                         * of the SD */
-                        ldb_msg_remove_attr(msg, "nTSecurityDescriptor");
-
-                        ret = ldb_msg_add_steal_value(msg,
-                                                      "nTSecurityDescriptor",
-                                                      sd);
-                        if (ret != LDB_SUCCESS) {
-                                return ldb_error(ldb, ret,
-                                         "descriptor_modify: Could not replace SD value in message.");
-                        }
-                        sd_element = ldb_msg_find_element(msg,
-                                                          "nTSecurityDescriptor");
-                        sd_element->flags = LDB_FLAG_MOD_REPLACE;
-                }
-        }
-
-        /* mark the controls as non-critical since we've handled them */
-        if (sd_flags_control != NULL) {
-                sd_flags_control->critical = 0;
-        }
-        if (sd_recalculate_control != NULL) {
-                sd_recalculate_control->critical = 0;
+        if (msg == NULL) {
+                return ldb_oom(ldb);
+        }
+        cmp_ret = data_blob_cmp(old_sd, sd);
+        if (sd_propagation_control != NULL) {
+                if (cmp_ret == 0) {
+                        /*
+                         * The nTSecurityDescriptor is unchanged,
+                         * which means we can stop the processing.
+                         *
+                         * We mark the control as critical again,
+                         * as we have not processed it, so the caller
+                         * can tell that the descriptor was unchanged.
+                         */
+                        sd_propagation_control->critical = 1;
+                        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+                }
+
+                ret = ldb_msg_add_empty(msg, "nTSecurityDescriptor",
+                                        LDB_FLAG_MOD_REPLACE,
+                                        &sd_element);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_oom(ldb);
+                }
+                ret = ldb_msg_add_value(msg, "nTSecurityDescriptor",
+                                        sd, NULL);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_oom(ldb);
+                }
+        } else if (cmp_ret != 0) {
+                struct ldb_dn *nc_root;
+
+                ret = dsdb_find_nc_root(ldb, msg, dn, &nc_root);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_oom(ldb);
+                }
+
+                ret = dsdb_module_schedule_sd_propagation(module, nc_root,
+                                                          dn, false);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+                sd_element->values[0] = *sd;
+        } else {
+                sd_element->values[0] = *sd;
         }
 
@@ -711 +905 @@
         int ret;
         struct ldb_context *ldb;
-        struct ldb_control *sd_control;
         struct ldb_request *down_req;
         struct descriptor_context *ac;
-
-        sd_control = ldb_request_get_control(req, LDB_CONTROL_SD_FLAGS_OID);
-        if (!sd_control) {
+        bool explicit_sd_flags = false;
+        uint32_t sd_flags = dsdb_request_sd_flags(req, &explicit_sd_flags);
+        bool show_sd = explicit_sd_flags;
+
+        if (!show_sd &&
+            ldb_attr_in_list(req->op.search.attrs, "nTSecurityDescriptor"))
+        {
+                show_sd = true;
+        }
+
+        if (!show_sd) {
                 return ldb_next_request(module, req);
         }
@@ -725 +926 @@
                 return ldb_operr(ldb);
         }
+        ac->sd_flags = sd_flags;
 
         ret = ldb_build_search_req_ex(&down_req, ldb, ac,
@@ -738 +940 @@
                 return ret;
         }
-        /* mark it as handled */
-        if (sd_control) {
-                sd_control->critical = 0;
-        }
 
         return ldb_next_request(ac->module, down_req);
 }
-/* TODO */
+
 static int descriptor_rename(struct ldb_module *module, struct ldb_request *req)
 {
         struct ldb_context *ldb = ldb_module_get_ctx(module);
-        ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn));
+        struct ldb_dn *olddn = req->op.rename.olddn;
+        struct ldb_dn *newdn = req->op.rename.newdn;
+        int ret;
 
         /* do not manipulate our control entries */
@@ -756 +956 @@
         }
 
+        ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_rename: %s\n",
+                  ldb_dn_get_linearized(olddn));
+
+        if (ldb_dn_compare(olddn, newdn) != 0) {
+                struct ldb_dn *nc_root;
+
+                ret = dsdb_find_nc_root(ldb, req, newdn, &nc_root);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_oom(ldb);
+                }
+
+                ret = dsdb_module_schedule_sd_propagation(module, nc_root,
+                                                          newdn, true);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+        }
+
         return ldb_next_request(module, req);
 }
 
+static int descriptor_extended_sec_desc_propagation(struct ldb_module *module,
+                                                    struct ldb_request *req)
+{
+        struct descriptor_data *descriptor_private =
+                talloc_get_type_abort(ldb_module_get_private(module),
+                struct descriptor_data);
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct dsdb_extended_sec_desc_propagation_op *op;
+        TALLOC_CTX *parent_mem = NULL;
+        struct descriptor_changes *parent_change = NULL;
+        struct descriptor_changes *c;
+        int ret;
+
+        op = talloc_get_type(req->op.extended.data,
+                             struct dsdb_extended_sec_desc_propagation_op);
+        if (op == NULL) {
+                ldb_debug(ldb, LDB_DEBUG_FATAL,
+                          "descriptor_extended_sec_desc_propagation: "
+                          "invalid extended data\n");
+                return LDB_ERR_PROTOCOL_ERROR;
+        }
+
+        if (descriptor_private->trans_mem == NULL) {
+                return ldb_module_operr(module);
+        }
+
+        parent_mem = descriptor_private->trans_mem;
+
+        for (c = descriptor_private->changes; c; c = c->next) {
+                ret = ldb_dn_compare(c->nc_root, op->nc_root);
+                if (ret != 0) {
+                        continue;
+                }
+
+                ret = ldb_dn_compare(c->dn, op->dn);
+                if (ret == 0) {
+                        if (op->include_self) {
+                                c->force_self = true;
+                        } else {
+                                c->force_children = true;
+                        }
+                        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+                }
+
+                ret = ldb_dn_compare_base(c->dn, op->dn);
+                if (ret != 0) {
+                        continue;
+                }
+
+                parent_mem = c;
+                parent_change = c;
+                break;
+        }
+
+        c = talloc_zero(parent_mem, struct descriptor_changes);
+        if (c == NULL) {
+                return ldb_module_oom(module);
+        }
+        c->nc_root = ldb_dn_copy(c, op->nc_root);
+        if (c->nc_root == NULL) {
+                return ldb_module_oom(module);
+        }
+        c->dn = ldb_dn_copy(c, op->dn);
+        if (c->dn == NULL) {
+                return ldb_module_oom(module);
+        }
+        if (op->include_self) {
+                c->force_self = true;
+        } else {
+                c->force_children = true;
+        }
+
+        if (parent_change != NULL) {
+                DLIST_ADD_END(parent_change->children, c);
+        } else {
+                DLIST_ADD_END(descriptor_private->changes, c);
+        }
+
+        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+}
+
+static int descriptor_extended(struct ldb_module *module, struct ldb_request *req)
+{
+        if (strcmp(req->op.extended.oid, DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID) == 0) {
+                return descriptor_extended_sec_desc_propagation(module, req);
+        }
+
+        return ldb_next_request(module, req);
+}
+
 static int descriptor_init(struct ldb_module *module)
 {
-        int ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
         struct ldb_context *ldb = ldb_module_get_ctx(module);
+        int ret;
+        struct descriptor_data *descriptor_private;
+
+        ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
         if (ret != LDB_SUCCESS) {
                 ldb_debug(ldb, LDB_DEBUG_ERROR,
@@ -768 +1079 @@
                 return ldb_operr(ldb);
         }
+
+        descriptor_private = talloc_zero(module, struct descriptor_data);
+        if (descriptor_private == NULL) {
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        ldb_module_set_private(module, descriptor_private);
+
         return ldb_next_init(module);
 }
 
+static int descriptor_sd_propagation_object(struct ldb_module *module,
+                                            struct ldb_message *msg,
+                                            bool *stop)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct ldb_request *sub_req;
+        struct ldb_result *mod_res;
+        struct ldb_control *sd_propagation_control;
+        int ret;
+
+        *stop = false;
+
+        mod_res = talloc_zero(msg, struct ldb_result);
+        if (mod_res == NULL) {
+                return ldb_module_oom(module);
+        }
+
+        ret = ldb_build_mod_req(&sub_req, ldb, mod_res,
+                                msg,
+                                NULL,
+                                mod_res,
+                                ldb_modify_default_callback,
+                                NULL);
+        LDB_REQ_SET_LOCATION(sub_req);
+        if (ret != LDB_SUCCESS) {
+                return ldb_module_operr(module);
+        }
+
+        ldb_req_mark_trusted(sub_req);
+
+        ret = ldb_request_add_control(sub_req,
+                                      DSDB_CONTROL_SEC_DESC_PROPAGATION_OID,
+                                      true, module);
+        if (ret != LDB_SUCCESS) {
+                return ldb_module_operr(module);
+        }
+
+        sd_propagation_control = ldb_request_get_control(sub_req,
+                                        DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+        if (sd_propagation_control == NULL) {
+                return ldb_module_operr(module);
+        }
+
+        ret = dsdb_request_add_controls(sub_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
+        if (ret != LDB_SUCCESS) {
+                return ldb_module_operr(module);
+        }
+
+        ret = descriptor_modify(module, sub_req);
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(sub_req->handle, LDB_WAIT_ALL);
+        }
+        if (ret != LDB_SUCCESS) {
+                return ldb_module_operr(module);
+        }
+
+        if (sd_propagation_control->critical != 0) {
+                *stop = true;
+        }
+
+        talloc_free(mod_res);
+
+        return LDB_SUCCESS;
+}
+
+static int descriptor_sd_propagation_msg_sort(struct ldb_message **m1,
+                                              struct ldb_message **m2)
+{
+        struct ldb_dn *dn1 = (*m1)->dn;
+        struct ldb_dn *dn2 = (*m2)->dn;
+
+        /*
+         * This sorts in tree order, parents first
+         */
+        return ldb_dn_compare(dn2, dn1);
+}
+
+static int descriptor_sd_propagation_dn_sort(struct ldb_dn *dn1,
+                                             struct ldb_dn *dn2)
+{
+        /*
+         * This sorts in tree order, parents first
+         */
+        return ldb_dn_compare(dn2, dn1);
+}
+
+static int descriptor_sd_propagation_recursive(struct ldb_module *module,
+                                               struct descriptor_changes *change)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct ldb_result *res = NULL;
+        unsigned int i;
+        const char * const no_attrs[] = { "@__NONE__", NULL };
+        struct descriptor_changes *c;
+        struct descriptor_changes *stopped_stack = NULL;
+        enum ldb_scope scope;
+        int ret;
+
+        /*
+         * First confirm this object has children, or exists (depending on change->force_self)
+         * 
+         * LDB_SCOPE_SUBTREE searches are expensive.
+         *
+         * Note: that we do not search for deleted/recycled objects
+         */
+        ret = dsdb_module_search(module,
+                                 change,
+                                 &res,
+                                 change->dn,
+                                 LDB_SCOPE_ONELEVEL,
+                                 no_attrs,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
+                                 NULL, /* parent_req */
+                                 "(objectClass=*)");
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (res->count == 0 && !change->force_self) {
+                TALLOC_FREE(res);
+                return LDB_SUCCESS;
+        } else if (res->count == 0 && change->force_self) {
+                scope = LDB_SCOPE_BASE;
+        } else {
+                scope = LDB_SCOPE_SUBTREE;
+        }
+
+        /*
+         * Note: that we do not search for deleted/recycled objects
+         */
+        ret = dsdb_module_search(module,
+                                 change,
+                                 &res,
+                                 change->dn,
+                                 scope,
+                                 no_attrs,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
+                                 NULL, /* parent_req */
+                                 "(objectClass=*)");
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        TYPESAFE_QSORT(res->msgs, res->count,
+                       descriptor_sd_propagation_msg_sort);
+
+        for (c = change->children; c; c = c->next) {
+                struct ldb_message *msg = NULL;
+
+                BINARY_ARRAY_SEARCH_P(res->msgs, res->count, dn, c->dn,
+                                      descriptor_sd_propagation_dn_sort,
+                                      msg);
+
+                if (msg == NULL) {
+                        ldb_debug(ldb, LDB_DEBUG_WARNING,
+                                "descriptor_sd_propagation_recursive: "
+                                "%s not found under %s",
+                                ldb_dn_get_linearized(c->dn),
+                                ldb_dn_get_linearized(change->dn));
+                        continue;
+                }
+
+                msg->elements = (struct ldb_message_element *)c;
+        }
+
+        DLIST_ADD(stopped_stack, change);
+
+        if (change->force_self) {
+                i = 0;
+        } else {
+                i = 1;
+        }
+
+        for (; i < res->count; i++) {
+                struct descriptor_changes *cur;
+                bool stop = false;
+
+                cur = talloc_get_type(res->msgs[i]->elements,
+                                      struct descriptor_changes);
+                res->msgs[i]->elements = NULL;
+                res->msgs[i]->num_elements = 0;
+
+                if (cur != NULL) {
+                        DLIST_REMOVE(change->children, cur);
+                }
+
+                for (c = stopped_stack; c; c = stopped_stack) {
+                        ret = ldb_dn_compare_base(c->dn,
+                                                  res->msgs[i]->dn);
+                        if (ret == 0) {
+                                break;
+                        }
+
+                        c->stopped_dn = NULL;
+                        DLIST_REMOVE(stopped_stack, c);
+                }
+
+                if (cur != NULL) {
+                        DLIST_ADD(stopped_stack, cur);
+                }
+
+                if (stopped_stack->stopped_dn != NULL) {
+                        ret = ldb_dn_compare_base(stopped_stack->stopped_dn,
+                                                  res->msgs[i]->dn);
+                        if (ret == 0) {
+                                continue;
+                        }
+                        stopped_stack->stopped_dn = NULL;
+                }
+
+                ret = descriptor_sd_propagation_object(module, res->msgs[i],
+                                                       &stop);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+
+                if (cur != NULL && cur->force_children) {
+                        continue;
+                }
+
+                if (stop) {
+                        stopped_stack->stopped_dn = res->msgs[i]->dn;
+                        continue;
+                }
+        }
+
+        TALLOC_FREE(res);
+        return LDB_SUCCESS;
+}
+
+static int descriptor_start_transaction(struct ldb_module *module)
+{
+        struct descriptor_data *descriptor_private =
+                talloc_get_type_abort(ldb_module_get_private(module),
+                struct descriptor_data);
+
+        if (descriptor_private->trans_mem != NULL) {
+                return ldb_module_operr(module);
+        }
+
+        descriptor_private->trans_mem = talloc_new(descriptor_private);
+        if (descriptor_private->trans_mem == NULL) {
+                return ldb_module_oom(module);
+        }
+        descriptor_private->changes = NULL;
+
+        return ldb_next_start_trans(module);
+}
+
+static int descriptor_prepare_commit(struct ldb_module *module)
+{
+        struct descriptor_data *descriptor_private =
+                talloc_get_type_abort(ldb_module_get_private(module),
+                struct descriptor_data);
+        struct descriptor_changes *c, *n;
+        int ret;
+
+        for (c = descriptor_private->changes; c; c = n) {
+                n = c->next;
+                DLIST_REMOVE(descriptor_private->changes, c);
+
+                ret = descriptor_sd_propagation_recursive(module, c);
+                if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                        continue;
+                }
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+        return ldb_next_prepare_commit(module);
+}
+
+static int descriptor_end_transaction(struct ldb_module *module)
+{
+        struct descriptor_data *descriptor_private =
+                talloc_get_type_abort(ldb_module_get_private(module),
+                struct descriptor_data);
+
+        TALLOC_FREE(descriptor_private->trans_mem);
+        descriptor_private->changes = NULL;
+
+        return ldb_next_end_trans(module);
+}
+
+static int descriptor_del_transaction(struct ldb_module *module)
+{
+        struct descriptor_data *descriptor_private =
+                talloc_get_type_abort(ldb_module_get_private(module),
+                struct descriptor_data);
+
+        TALLOC_FREE(descriptor_private->trans_mem);
+        descriptor_private->changes = NULL;
+
+        return ldb_next_del_trans(module);
+}
 
 static const struct ldb_module_ops ldb_descriptor_module_ops = {
-        .name          = "descriptor",
-        .search        = descriptor_search,
-        .add           = descriptor_add,
-        .modify        = descriptor_modify,
-        .rename        = descriptor_rename,
-        .init_context  = descriptor_init
+        .name              = "descriptor",
+        .search            = descriptor_search,
+        .add               = descriptor_add,
+        .modify            = descriptor_modify,
+        .rename            = descriptor_rename,
+        .init_context      = descriptor_init,
+        .extended          = descriptor_extended,
+        .start_transaction = descriptor_start_transaction,
+        .prepare_commit    = descriptor_prepare_commit,
+        .end_transaction   = descriptor_end_transaction,
+        .del_transaction   = descriptor_del_transaction,
 };
 

vendor/current/source4/dsdb/samdb/ldb_modules/extended_dn_in.c

@@ -34 +34 @@
 #include <ldb_errors.h>
 #include <ldb_module.h>
+#include "dsdb/samdb/samdb.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "lib/ldb-samba/ldb_matching_rules.h"
 
 /*
@@ -45 +48 @@
         struct ldb_request *req;
         struct ldb_dn *basedn;
+        struct ldb_dn *dn;
         char *wellknown_object;
         int extended_type;
 };
+
+static const char *wkattr[] = {
+        "wellKnownObjects",
+        "otherWellKnownObjects",
+        NULL
+};
+
+static const struct ldb_module_ops ldb_extended_dn_in_openldap_module_ops;
 
 /* An extra layer of indirection because LDB does not allow the original request to be altered */
@@ -86 +98 @@
         struct ldb_message_element *el;
         int ret;
-        unsigned int i;
+        unsigned int i, j;
         size_t wkn_len = 0;
         char *valstr = NULL;
@@ -104 +116 @@
         switch (ares->type) {
         case LDB_REPLY_ENTRY:
+                if (ac->basedn) {
+                        /* we have more than one match! This can
+                           happen as S-1-5-17 appears twice in a
+                           normal provision. We need to return
+                           NO_SUCH_OBJECT */
+                        const char *str = talloc_asprintf(req, "Duplicate base-DN matches found for '%s'",
+                                                          ldb_dn_get_extended_linearized(req, ac->dn, 1));
+                        ldb_set_errstring(ldb_module_get_ctx(ac->module), str);
+                        return ldb_module_done(ac->req, NULL, NULL,
+                                               LDB_ERR_NO_SUCH_OBJECT);
+                }
+
                 if (!ac->wellknown_object) {
                         ac->basedn = talloc_steal(ac, ares->message->dn);
@@ -111 +135 @@
                 wkn_len = strlen(ac->wellknown_object);
 
-                el = ldb_msg_find_element(ares->message, "wellKnownObjects");
-                if (!el) {
-                        ac->basedn = NULL;
-                        break;
-                }
-
-                for (i=0; i < el->num_values; i++) {
-                        valstr = talloc_strndup(ac,
-                                                (const char *)el->values[i].data,
-                                                el->values[i].length);
-                        if (!valstr) {
-                                ldb_oom(ldb_module_get_ctx(ac->module));
-                                return ldb_module_done(ac->req, NULL, NULL,
-                                                       LDB_ERR_OPERATIONS_ERROR);
-                        }
-
-                        if (strncasecmp(valstr, ac->wellknown_object, wkn_len) != 0) {
-                                talloc_free(valstr);
+                for (j=0; wkattr[j]; j++) {
+
+                        el = ldb_msg_find_element(ares->message, wkattr[j]);
+                        if (!el) {
+                                ac->basedn = NULL;
                                 continue;
                         }
 
-                        found = &valstr[wkn_len];
-                        break;
+                        for (i=0; i < el->num_values; i++) {
+                                valstr = talloc_strndup(ac,
+                                                        (const char *)el->values[i].data,
+                                                        el->values[i].length);
+                                if (!valstr) {
+                                        ldb_oom(ldb_module_get_ctx(ac->module));
+                                        return ldb_module_done(ac->req, NULL, NULL,
+                                                        LDB_ERR_OPERATIONS_ERROR);
+                                }
+
+                                if (strncasecmp(valstr, ac->wellknown_object, wkn_len) != 0) {
+                                        talloc_free(valstr);
+                                        continue;
+                                }
+
+                                found = &valstr[wkn_len];
+                                break;
+                        }
+                        if (found) {
+                                break;
+                        }
                 }
 
@@ -157 +187 @@
                 if (!ac->basedn) {
                         const char *str = talloc_asprintf(req, "Base-DN '%s' not found",
-                                                          ldb_dn_get_extended_linearized(req, ac->req->op.search.base, 1));
+                                                          ldb_dn_get_extended_linearized(req, ac->dn, 1));
                         ldb_set_errstring(ldb_module_get_ctx(ac->module), str);
                         return ldb_module_done(ac->req, NULL, NULL,
@@ -249 +279 @@
 }
 
+
+/*
+  windows ldap searchs don't allow a baseDN with more
+  than one extended component, or an extended
+  component and a string DN
+
+  We only enforce this over ldap, not for internal
+  use, as there are just too many places where we
+  internally want to use a DN that has come from a
+  search with extended DN enabled, or comes from a DRS
+  naming context.
+
+  Enforcing this would also make debugging samba much
+  harder, as we'd need to use ldb_dn_minimise() in a
+  lot of places, and that would lose the DN string
+  which is so useful for working out what a request is
+  for
+*/
+static bool ldb_dn_match_allowed(struct ldb_dn *dn, struct ldb_request *req)
+{
+        int num_components = ldb_dn_get_comp_num(dn);
+        int num_ex_components = ldb_dn_get_extended_comp_num(dn);
+
+        if (num_ex_components == 0) {
+                return true;
+        }
+
+        if ((num_components != 0 || num_ex_components != 1) &&
+            ldb_req_is_untrusted(req)) {
+                return false;
+        }
+        return true;
+}
+
+
+struct extended_dn_filter_ctx {
+        bool test_only;
+        bool matched;
+        struct ldb_module *module;
+        struct ldb_request *req;
+        struct dsdb_schema *schema;
+        uint32_t dsdb_flags;
+};
+
+/*
+  create a always non-matching node from a equality node
+ */
+static void set_parse_tree_false(struct ldb_parse_tree *tree)
+{
+        const char *attr = tree->u.equality.attr;
+        struct ldb_val value = tree->u.equality.value;
+        tree->operation = LDB_OP_EXTENDED;
+        tree->u.extended.attr = attr;
+        tree->u.extended.value = value;
+        tree->u.extended.rule_id = SAMBA_LDAP_MATCH_ALWAYS_FALSE;
+        tree->u.extended.dnAttributes = 0;
+}
+
+/*
+  called on all nodes in the parse tree
+ */
+static int extended_dn_filter_callback(struct ldb_parse_tree *tree, void *private_context)
+{
+        struct extended_dn_filter_ctx *filter_ctx;
+        int ret;
+        struct ldb_dn *dn = NULL;
+        const struct ldb_val *sid_val, *guid_val;
+        const char *no_attrs[] = { NULL };
+        struct ldb_result *res;
+        const struct dsdb_attribute *attribute = NULL;
+        bool has_extended_component = false;
+        enum ldb_scope scope;
+        struct ldb_dn *base_dn;
+        const char *expression;
+        uint32_t dsdb_flags;
+
+        if (tree->operation != LDB_OP_EQUALITY && tree->operation != LDB_OP_EXTENDED) {
+                return LDB_SUCCESS;
+        }
+
+        filter_ctx = talloc_get_type_abort(private_context, struct extended_dn_filter_ctx);
+
+        if (filter_ctx->test_only && filter_ctx->matched) {
+                /* the tree already matched */
+                return LDB_SUCCESS;
+        }
+
+        if (!filter_ctx->schema) {
+                /* Schema not setup yet */
+                return LDB_SUCCESS;
+        }
+        if (tree->operation == LDB_OP_EQUALITY) {
+                attribute = dsdb_attribute_by_lDAPDisplayName(filter_ctx->schema, tree->u.equality.attr);
+        } else if (tree->operation == LDB_OP_EXTENDED) {
+                attribute = dsdb_attribute_by_lDAPDisplayName(filter_ctx->schema, tree->u.extended.attr);
+        }
+        if (attribute == NULL) {
+                return LDB_SUCCESS;
+        }
+
+        if (attribute->dn_format != DSDB_NORMAL_DN) {
+                return LDB_SUCCESS;
+        }
+
+        if (tree->operation == LDB_OP_EQUALITY) {
+                has_extended_component = (memchr(tree->u.equality.value.data, '<',
+                                                 tree->u.equality.value.length) != NULL);
+        } else if (tree->operation == LDB_OP_EXTENDED) {
+                has_extended_component = (memchr(tree->u.extended.value.data, '<',
+                                                 tree->u.extended.value.length) != NULL);
+        }
+
+        /*
+         * Don't turn it into an extended DN if we're talking to OpenLDAP.
+         * We just check the module_ops pointer instead of adding a private
+         * pointer and a boolean to tell us the exact same thing.
+         */
+        if (!has_extended_component) {
+                if (!attribute->one_way_link) {
+                        return LDB_SUCCESS;
+                }
+
+                if (ldb_module_get_ops(filter_ctx->module) == &ldb_extended_dn_in_openldap_module_ops) {
+                        return LDB_SUCCESS;
+                }
+        }
+
+        if (tree->operation == LDB_OP_EQUALITY) {
+                dn = ldb_dn_from_ldb_val(filter_ctx, ldb_module_get_ctx(filter_ctx->module), &tree->u.equality.value);
+        } else if (tree->operation == LDB_OP_EXTENDED
+                   && (strcmp(tree->u.extended.rule_id, SAMBA_LDAP_MATCH_RULE_TRANSITIVE_EVAL) == 0)) {
+                dn = ldb_dn_from_ldb_val(filter_ctx, ldb_module_get_ctx(filter_ctx->module), &tree->u.extended.value);
+        }
+        if (dn == NULL) {
+                /* testing against windows shows that we don't raise
+                   an error here */
+                return LDB_SUCCESS;
+        }
+
+        guid_val = ldb_dn_get_extended_component(dn, "GUID");
+        sid_val  = ldb_dn_get_extended_component(dn, "SID");
+
+        if (!guid_val && !sid_val && (attribute->searchFlags & SEARCH_FLAG_ATTINDEX)) {
+                /* if it is indexed, then fixing the string DN will do
+                   no good here, as we will not find the attribute in
+                   the index. So for now fall through to a standard DN
+                   component comparison */
+                return LDB_SUCCESS;
+        }
+
+        if (filter_ctx->test_only) {
+                /* we need to copy the tree */
+                filter_ctx->matched = true;
+                return LDB_SUCCESS;
+        }
+
+        if (!ldb_dn_match_allowed(dn, filter_ctx->req)) {
+                /* we need to make this element of the filter always
+                   be false */
+                set_parse_tree_false(tree);
+                return LDB_SUCCESS;
+        }
+
+        dsdb_flags = filter_ctx->dsdb_flags | DSDB_FLAG_NEXT_MODULE;
+
+        if (guid_val) {
+                expression = talloc_asprintf(filter_ctx, "objectGUID=%s", ldb_binary_encode(filter_ctx, *guid_val));
+                scope = LDB_SCOPE_SUBTREE;
+                base_dn = NULL;
+                dsdb_flags |= DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
+        } else if (sid_val) {
+                expression = talloc_asprintf(filter_ctx, "objectSID=%s", ldb_binary_encode(filter_ctx, *sid_val));
+                scope = LDB_SCOPE_SUBTREE;
+                base_dn = NULL;
+                dsdb_flags |= DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
+        } else {
+                /* fallback to searching using the string DN as the base DN */
+                expression = "objectClass=*";
+                base_dn = dn;
+                scope = LDB_SCOPE_BASE;
+        }
+
+        ret = dsdb_module_search(filter_ctx->module,
+                                 filter_ctx,
+                                 &res,
+                                 base_dn,
+                                 scope,
+                                 no_attrs,
+                                 dsdb_flags,
+                                 filter_ctx->req,
+                                 "%s", expression);
+        if (scope == LDB_SCOPE_BASE && ret == LDB_ERR_NO_SUCH_OBJECT) {
+                /* note that this will need to change for multi-domain
+                   support */
+                set_parse_tree_false(tree);
+                return LDB_SUCCESS;
+        }
+
+        if (ret != LDB_SUCCESS) {
+                return LDB_SUCCESS;
+        }
+
+
+        if (res->count != 1) {
+                return LDB_SUCCESS;
+        }
+
+        /* replace the search expression element with the matching DN */
+        if (tree->operation == LDB_OP_EQUALITY) {
+                tree->u.equality.value.data =
+                        (uint8_t *)talloc_strdup(tree, ldb_dn_get_extended_linearized(tree, res->msgs[0]->dn, 1));
+                if (tree->u.equality.value.data == NULL) {
+                        return ldb_oom(ldb_module_get_ctx(filter_ctx->module));
+                }
+                tree->u.equality.value.length = strlen((const char *)tree->u.equality.value.data);
+        } else if (tree->operation == LDB_OP_EXTENDED) {
+                tree->u.extended.value.data =
+                        (uint8_t *)talloc_strdup(tree, ldb_dn_get_extended_linearized(tree, res->msgs[0]->dn, 1));
+                if (tree->u.extended.value.data == NULL) {
+                        return ldb_oom(ldb_module_get_ctx(filter_ctx->module));
+                }
+                tree->u.extended.value.length = strlen((const char *)tree->u.extended.value.data);
+        }
+        talloc_free(res);
+
+        filter_ctx->matched = true;
+        return LDB_SUCCESS;
+}
+
+/*
+  fix the parse tree to change any extended DN components to their
+  caconical form
+ */
+static int extended_dn_fix_filter(struct ldb_module *module,
+                                  struct ldb_request *req,
+                                  uint32_t default_dsdb_flags)
+{
+        struct extended_dn_filter_ctx *filter_ctx;
+        int ret;
+
+        filter_ctx = talloc_zero(req, struct extended_dn_filter_ctx);
+        if (filter_ctx == NULL) {
+                return ldb_module_oom(module);
+        }
+
+        /* first pass through the existing tree to see if anything
+           needs to be modified. Filtering DNs on the input side is rare,
+           so this avoids copying the parse tree in most cases */
+        filter_ctx->test_only = true;
+        filter_ctx->matched   = false;
+        filter_ctx->module    = module;
+        filter_ctx->req       = req;
+        filter_ctx->schema    = dsdb_get_schema(ldb_module_get_ctx(module), filter_ctx);
+        filter_ctx->dsdb_flags= default_dsdb_flags;
+
+        ret = ldb_parse_tree_walk(req->op.search.tree, extended_dn_filter_callback, filter_ctx);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(filter_ctx);
+                return ret;
+        }
+
+        if (!filter_ctx->matched) {
+                /* nothing matched, no need for a new parse tree */
+                talloc_free(filter_ctx);
+                return LDB_SUCCESS;
+        }
+
+        filter_ctx->test_only = false;
+        filter_ctx->matched   = false;
+
+        req->op.search.tree = ldb_parse_tree_copy_shallow(req, req->op.search.tree);
+        if (req->op.search.tree == NULL) {
+                return ldb_oom(ldb_module_get_ctx(module));
+        }
+
+        ret = ldb_parse_tree_walk(req->op.search.tree, extended_dn_filter_callback, filter_ctx);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(filter_ctx);
+                return ret;
+        }
+
+        talloc_free(filter_ctx);
+        return LDB_SUCCESS;
+}
+
+/*
+  fix DNs and filter expressions to cope with the semantics of
+  extended DNs
+ */
 static int extended_dn_in_fix(struct ldb_module *module, struct ldb_request *req, struct ldb_dn *dn)
 {
@@ -262 +581 @@
                 NULL
         };
-        static const char *wkattr[] = {
-                "wellKnownObjects",
-                NULL
-        };
-        bool all_partitions = false;
+        uint32_t dsdb_flags = DSDB_FLAG_AS_SYSTEM | DSDB_SEARCH_SHOW_EXTENDED_DN;
+
+        if (ldb_request_get_control(req, LDB_CONTROL_SHOW_DELETED_OID)) {
+                dsdb_flags |= DSDB_SEARCH_SHOW_DELETED;
+        }
+        if (ldb_request_get_control(req, LDB_CONTROL_SHOW_RECYCLED_OID)) {
+                dsdb_flags |= DSDB_SEARCH_SHOW_RECYCLED;
+        }
+        if (ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                dsdb_flags |= DSDB_SEARCH_SHOW_RECYCLED;
+        }
+
+        if (req->operation == LDB_SEARCH) {
+                ret = extended_dn_fix_filter(module, req, dsdb_flags);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
 
         if (!ldb_dn_has_extended(dn)) {
@@ -274 +606 @@
                 /* It looks like we need to map the DN */
                 const struct ldb_val *sid_val, *guid_val, *wkguid_val;
-                int num_components = ldb_dn_get_comp_num(dn);
-                int num_ex_components = ldb_dn_get_extended_comp_num(dn);
-
-                /*
-                  windows ldap searchs don't allow a baseDN with more
-                  than one extended component, or an extended
-                  component and a string DN
-
-                  We only enforce this over ldap, not for internal
-                  use, as there are just too many places where we
-                  internally want to use a DN that has come from a
-                  search with extended DN enabled, or comes from a DRS
-                  naming context.
-
-                  Enforcing this would also make debugging samba much
-                  harder, as we'd need to use ldb_dn_minimise() in a
-                  lot of places, and that would lose the DN string
-                  which is so useful for working out what a request is
-                  for
-                 */
-                if ((num_components != 0 || num_ex_components != 1) &&
-                    ldb_req_is_untrusted(req)) {
+
+                if (!ldb_dn_match_allowed(dn, req)) {
                         return ldb_error(ldb_module_get_ctx(module),
                                          LDB_ERR_INVALID_DN_SYNTAX, "invalid number of DN components");
@@ -304 +616 @@
                 wkguid_val = ldb_dn_get_extended_component(dn, "WKGUID");
 
-                if (sid_val) {
-                        all_partitions = true;
-                        base_dn = ldb_get_default_basedn(ldb_module_get_ctx(module));
-                        base_dn_filter = talloc_asprintf(req, "(objectSid=%s)", 
+                /*
+                  prioritise the GUID - we have had instances of
+                  duplicate SIDs in the database in the
+                  ForeignSecurityPrinciples due to provision errors
+                 */
+                if (guid_val) {
+                        dsdb_flags |= DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
+                        base_dn = NULL;
+                        base_dn_filter = talloc_asprintf(req, "(objectGUID=%s)",
+                                                         ldb_binary_encode(req, *guid_val));
+                        if (!base_dn_filter) {
+                                return ldb_oom(ldb_module_get_ctx(module));
+                        }
+                        base_dn_scope = LDB_SCOPE_SUBTREE;
+                        base_dn_attrs = no_attr;
+
+                } else if (sid_val) {
+                        dsdb_flags |= DSDB_SEARCH_SEARCH_ALL_PARTITIONS;
+                        base_dn = NULL;
+                        base_dn_filter = talloc_asprintf(req, "(objectSid=%s)",
                                                          ldb_binary_encode(req, *sid_val));
                         if (!base_dn_filter) {
@@ -314 +642 @@
                         base_dn_scope = LDB_SCOPE_SUBTREE;
                         base_dn_attrs = no_attr;
-
-                } else if (guid_val) {
-
-                        all_partitions = true;
-                        base_dn = ldb_get_default_basedn(ldb_module_get_ctx(module));
-                        base_dn_filter = talloc_asprintf(req, "(objectGUID=%s)", 
-                                                         ldb_binary_encode(req, *guid_val));
-                        if (!base_dn_filter) {
-                                return ldb_oom(ldb_module_get_ctx(module));
-                        }
-                        base_dn_scope = LDB_SCOPE_SUBTREE;
-                        base_dn_attrs = no_attr;
-
 
                 } else if (wkguid_val) {
@@ -374 +689 @@
                 ac->module = module;
                 ac->req = req;
+                ac->dn = dn;
                 ac->basedn = NULL;  /* Filled in if the search finds the DN by SID/GUID etc */
                 ac->wellknown_object = wellknown_object;
@@ -386 +702 @@
                                            base_dn_filter,
                                            base_dn_attrs,
-                                           req->controls,
+                                           NULL,
                                            ac, extended_base_callback,
                                            req);
@@ -394 +710 @@
                 }
 
-                if (all_partitions) {
-                        struct ldb_search_options_control *control;
-                        control = talloc(down_req, struct ldb_search_options_control);
-                        control->search_options = 2;
-                        ret = ldb_request_replace_control(down_req,
-                                                      LDB_CONTROL_SEARCH_OPTIONS_OID,
-                                                      true, control);
-                        if (ret != LDB_SUCCESS) {
-                                ldb_oom(ldb_module_get_ctx(module));
-                                return ret;
-                        }
+                ret = dsdb_request_add_controls(down_req, dsdb_flags);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
                 }
 
@@ -440 +748 @@
 };
 
+static const struct ldb_module_ops ldb_extended_dn_in_openldap_module_ops = {
+        .name              = "extended_dn_in_openldap",
+        .search            = extended_dn_in_search,
+        .modify            = extended_dn_in_modify,
+        .del               = extended_dn_in_del,
+        .rename            = extended_dn_in_rename,
+};
+
 int ldb_extended_dn_in_module_init(const char *version)
 {
+        int ret;
         LDB_MODULE_CHECK_VERSION(version);
+        ret = ldb_register_module(&ldb_extended_dn_in_openldap_module_ops);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
         return ldb_register_module(&ldb_extended_dn_in_module_ops);
 }

vendor/current/source4/dsdb/samdb/ldb_modules/extended_dn_out.c

@@ -41 +41 @@
 #include "librpc/ndr/libndr.h"
 #include "dsdb/samdb/samdb.h"
-#include "util.h"
+#include "dsdb/samdb/ldb_modules/util.h"
 
 struct extended_dn_out_private {
@@ -77 +77 @@
 
         for (cur = schema->attributes; cur; cur = cur->next) {
-                if (dsdb_dn_oid_to_format(cur->syntax->ldap_oid) != DSDB_NORMAL_DN) {
+                if (cur->dn_format != DSDB_NORMAL_DN) {
                         continue;
                 }
@@ -83 +83 @@
                         = talloc_realloc(p, dereference_control->dereference,
                                          struct dsdb_openldap_dereference *, i + 2);
-                if (!dereference_control) {
+                if (!dereference_control->dereference) {
                         return ldb_oom(ldb);
                 }
@@ -139 +139 @@
 
         return true;
-}
-
-/* Fix the DN so that the relative attribute names are in upper case so that the DN:
-   cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
-   CN=Adminstrator,CN=users,DC=samba,DC=example,DC=com
-*/
-
-
-static int fix_dn(struct ldb_context *ldb, struct ldb_dn *dn)
-{
-        int i, ret;
-        char *upper_rdn_attr;
-
-        for (i=0; i < ldb_dn_get_comp_num(dn); i++) {
-                /* We need the attribute name in upper case */
-                upper_rdn_attr = strupper_talloc(dn,
-                                                 ldb_dn_get_component_name(dn, i));
-                if (!upper_rdn_attr) {
-                        return ldb_oom(ldb);
-                }
-                
-                /* And replace it with CN=foo (we need the attribute in upper case */
-                ret = ldb_dn_set_component(dn, i, upper_rdn_attr,
-                                           *ldb_dn_get_component_val(dn, i));
-                talloc_free(upper_rdn_attr);
-                if (ret != LDB_SUCCESS) {
-                        return ret;
-                }
-        }
-        return LDB_SUCCESS;
 }
 
@@ -350 +320 @@
 };
 
+
+/*
+   fix one-way links to have the right string DN, to cope with
+   renames of the target
+*/
+static int fix_one_way_link(struct extended_search_context *ac, struct ldb_dn *dn,
+                            bool is_deleted_objects, bool *remove_value)
+{
+        struct GUID guid;
+        NTSTATUS status;
+        int ret;
+        struct ldb_dn *real_dn;
+        uint32_t search_flags;
+        TALLOC_CTX *tmp_ctx = talloc_new(ac);
+        const char *attrs[] = { NULL };
+        struct ldb_result *res;
+
+        (*remove_value) = false;
+
+        status = dsdb_get_extended_dn_guid(dn, &guid, "GUID");
+        if (!NT_STATUS_IS_OK(status)) {
+                /* this is a strange DN that doesn't have a GUID! just
+                   return the current DN string?? */
+                talloc_free(tmp_ctx);
+                return LDB_SUCCESS;
+        }
+
+        search_flags = DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SEARCH_ALL_PARTITIONS | DSDB_SEARCH_ONE_ONLY;
+
+        if (ldb_request_get_control(ac->req, LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID) ||
+            is_deleted_objects) {
+                search_flags |= DSDB_SEARCH_SHOW_DELETED;
+        }
+
+        ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
+                                 search_flags, ac->req, "objectguid=%s", GUID_string(tmp_ctx, &guid));
+        if (ret != LDB_SUCCESS || res->count != 1) {
+                /* if we can't resolve this GUID, then we don't
+                   display the link. This could be a link to a NC that we don't
+                   have, or it could be a link to a deleted object
+                */
+                (*remove_value) = true;
+                talloc_free(tmp_ctx);
+                return LDB_SUCCESS;
+        }
+        real_dn = res->msgs[0]->dn;
+
+        if (strcmp(ldb_dn_get_linearized(dn), ldb_dn_get_linearized(real_dn)) == 0) {
+                /* its already correct */
+                talloc_free(tmp_ctx);
+                return LDB_SUCCESS;
+        }
+
+        /* fix the DN by replacing its components with those from the
+         * real DN
+         */
+        if (!ldb_dn_replace_components(dn, real_dn)) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb_module_get_ctx(ac->module));
+        }
+        talloc_free(tmp_ctx);
+
+        return LDB_SUCCESS;
+}
+
+
+/*
+  this is called to post-process the results from the search
+ */
 static int extended_callback(struct ldb_request *req, struct ldb_reply *ares,
                 int (*handle_dereference)(struct ldb_dn *dn,
@@ -391 +430 @@
 
         if (p && p->normalise) {
-                ret = fix_dn(ldb, ares->message->dn);
+                ret = dsdb_fix_dn_rdncase(ldb, ares->message->dn);
                 if (ret != LDB_SUCCESS) {
                         return ldb_module_done(ac->req, NULL, NULL, ret);
@@ -439 +478 @@
                 bool make_extended_dn;
                 const struct dsdb_attribute *attribute;
+
                 attribute = dsdb_attribute_by_lDAPDisplayName(ac->schema, msg->elements[i].name);
                 if (!attribute) {
@@ -461 +501 @@
 
                 /* Look to see if this attributeSyntax is a DN */
-                if (dsdb_dn_oid_to_format(attribute->syntax->ldap_oid) == DSDB_INVALID_DN) {
+                if (attribute->dn_format == DSDB_INVALID_DN) {
                         continue;
                 }
@@ -477 +517 @@
                         struct dsdb_dn *dsdb_dn = NULL;
                         struct ldb_val *plain_dn = &msg->elements[i].values[j];         
+                        bool is_deleted_objects = false;
 
                         if (!checked_reveal_control) {
@@ -512 +553 @@
                         dn = dsdb_dn->dn;
 
+                        /* we need to know if this is a link to the
+                           deleted objects container for fixing one way
+                           links */
+                        if (dsdb_dn->extra_part.length == 16) {
+                                char *hex_string = data_blob_hex_string_upper(req, &dsdb_dn->extra_part);
+                                if (hex_string && strcmp(hex_string, DS_GUID_DELETED_OBJECTS_CONTAINER) == 0) {
+                                        is_deleted_objects = true;
+                                }
+                                talloc_free(hex_string);
+                        }
+
                         /* don't let users see the internal extended
                            GUID components */
                         if (!have_reveal_control) {
-                                const char *accept[] = { "GUID", "SID", "WKGUID", NULL };
+                                const char *accept[] = { "GUID", "SID", NULL };
                                 ldb_dn_extended_filter(dn, accept);
                         }
 
                         if (p->normalise) {
-                                ret = fix_dn(ldb, dn);
+                                ret = dsdb_fix_dn_rdncase(ldb, dn);
                                 if (ret != LDB_SUCCESS) {
                                         talloc_free(dsdb_dn);
@@ -545 +597 @@
                                 }
                         }
+
+                        /* note that we don't fixup objectCategory as
+                           it should not be possible to move
+                           objectCategory elements in the schema */
+                        if (attribute->one_way_link &&
+                            strcasecmp(attribute->lDAPDisplayName, "objectCategory") != 0) {
+                                bool remove_value;
+                                ret = fix_one_way_link(ac, dn, is_deleted_objects, &remove_value);
+                                if (ret != LDB_SUCCESS) {
+                                        talloc_free(dsdb_dn);
+                                        return ldb_module_done(ac->req, NULL, NULL, ret);
+                                }
+                                if (remove_value &&
+                                    !ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS)) {
+                                        /* we show these with REVEAL
+                                           to allow dbcheck to find and
+                                           cleanup these orphaned links */
+                                        memmove(&msg->elements[i].values[j],
+                                                &msg->elements[i].values[j+1],
+                                                (msg->elements[i].num_values-(j+1))*sizeof(struct ldb_val));
+                                        msg->elements[i].num_values--;
+                                        j--;
+                                        continue;
+                                }
+                        }
                         
                         if (make_extended_dn) {
@@ -602 +679 @@
         struct ldb_context *ldb = ldb_module_get_ctx(module);
         int ret;
-        bool critical;
 
         struct extended_dn_out_private *p = talloc_get_type(ldb_module_get_private(module), struct extended_dn_out_private);
@@ -701 +777 @@
         /* mark extended DN and storage format controls as done */
         if (control) {
-                critical = control->critical;
                 control->critical = 0;
         }

vendor/current/source4/dsdb/samdb/ldb_modules/extended_dn_store.c

@@ -277 +277 @@
 
         ret = dsdb_request_add_controls(os->search_req,
-                                        DSDB_SEARCH_SHOW_RECYCLED|DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED |
+                                        DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
         if (ret != LDB_SUCCESS) {
                 talloc_free(os);
@@ -326 +328 @@
 
                 /* We only setup an extended DN GUID on DN elements */
-                if (dsdb_dn_oid_to_format(schema_attr->syntax->ldap_oid) == DSDB_INVALID_DN) {
+                if (schema_attr->dn_format == DSDB_INVALID_DN) {
                         continue;
                 }
@@ -401 +403 @@
 
                 /* We only setup an extended DN GUID on these particular DN objects */
-                if (dsdb_dn_oid_to_format(schema_attr->syntax->ldap_oid) == DSDB_INVALID_DN) {
+                if (schema_attr->dn_format == DSDB_INVALID_DN) {
                         continue;
                 }

vendor/current/source4/dsdb/samdb/ldb_modules/instancetype.c

@@ -78 +78 @@
                         /*
                          * If we have a NC add operation then we need also the
-                         * "TYPE_WRITE" flag in order to succeed.
-                        */
-                        if (!(instanceType & INSTANCE_TYPE_WRITE)) {
-                                ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD was set, then also TYPE_WRITE is requested!");
-                                return LDB_ERR_UNWILLING_TO_PERFORM;
+                         * "TYPE_WRITE" flag in order to succeed,
+                         * unless this NC is not instantiated
+                         */
+                        if (ldb_request_get_control(req, DSDB_CONTROL_PARTIAL_REPLICA)) {
+                                if (!(instanceType & INSTANCE_TYPE_UNINSTANT)) {
+                                        ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD "
+                                                          "was set, and we are creating a new NC "
+                                                          "over DsAddEntry then also TYPE_UNINSTANT is requested!");
+                                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                                }
+                        } else {
+                                if (!(instanceType & INSTANCE_TYPE_WRITE)) {
+                                        ldb_set_errstring(ldb, "instancetype: if TYPE_IS_NC_HEAD "
+                                                          "was set, then also TYPE_WRITE is requested!");
+                                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                                }
                         }
+
+                        /*
+                         * TODO: Confirm we are naming master or start
+                         * a remote call to the naming master to
+                         * create the crossRef object
+                         */
                 }
 
@@ -135 +152 @@
         el = ldb_msg_find_element(req->op.mod.message, "instanceType");
         if (el != NULL) {
-                ldb_set_errstring(ldb, "instancetype: the 'instanceType' attribute can never be changed!");
-                return LDB_ERR_CONSTRAINT_VIOLATION;
+                /* Except to allow dbcheck to fix things, this must never be modified */
+                if (!ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                        ldb_set_errstring(ldb, "instancetype: the 'instanceType' attribute can never be changed!");
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
         }
-
         return ldb_next_request(module, req);
 }

vendor/current/source4/dsdb/samdb/ldb_modules/linked_attributes.c

@@ -4 +4 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
    Copyright (C) Simo Sorce <idra@samba.org> 2008
+   Copyright (C) Matthieu Patou <mat@matws.net> 2011
+   Copyright (C) Andrew Tridgell 2009
 
    This program is free software; you can redistribute it and/or modify
@@ -46 +48 @@
         struct GUID guid;
         char *name;
-        char *value;
 };
 
@@ -60 +61 @@
         struct ldb_module *module;
         struct ldb_request *req;
-        struct ldb_dn *add_dn;
-        struct ldb_dn *del_dn;
+        struct ldb_dn *mod_dn;
         struct replace_context *rc;
         struct la_op_store *ops;
         struct ldb_extended *op_response;
         struct ldb_control **op_controls;
+        /*
+         * For futur use
+         * will tell which GC to use for resolving links
+         */
+        char *gc_dns_name;
 };
+
+
+static int handle_verify_name_control(TALLOC_CTX *ctx, struct ldb_context *ldb,
+                                        struct ldb_control *control, struct la_context *ac)
+{
+        /*
+         * If we are a GC let's remove the control,
+         * if there is a specified GC check that is us.
+         */
+        struct ldb_verify_name_control *lvnc = (struct ldb_verify_name_control *)control->data;
+        if (samdb_is_gc(ldb)) {
+                /* Because we can't easily talloc a struct ldb_dn*/
+                struct ldb_dn **dn = talloc_array(ctx, struct ldb_dn *, 1);
+                int ret = samdb_server_reference_dn(ldb, ctx, dn);
+                const char *dns;
+
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+
+                dns = samdb_dn_to_dnshostname(ldb, ctx, *dn);
+                if (!dns) {
+                        return ldb_operr(ldb);
+                }
+                if (!lvnc->gc || strcasecmp(dns, lvnc->gc) == 0) {
+                        if (!ldb_save_controls(control, ctx, NULL)) {
+                                return ldb_operr(ldb);
+                        }
+                } else {
+                        control->critical = true;
+                }
+                talloc_free(dn);
+        } else {
+                /* For the moment we don't remove the control is this case in order
+                 * to fail the request. It's better than having the client thinking
+                 * that we honnor its control.
+                 * Hopefully only a very small set of usecase should hit this problem.
+                 */
+                if (lvnc->gc) {
+                        ac->gc_dns_name = talloc_strdup(ac, lvnc->gc);
+                }
+                control->critical = true;
+        }
+
+        return LDB_SUCCESS;
+}
 
 static struct la_context *linked_attributes_init(struct ldb_module *module,
@@ -92 +143 @@
   turn a DN into a GUID
  */
-static int la_guid_from_dn(struct la_context *ac, struct ldb_dn *dn, struct GUID *guid)
+static int la_guid_from_dn(struct ldb_module *module,
+                           struct ldb_request *parent,
+                           struct ldb_dn *dn, struct GUID *guid)
 {
         NTSTATUS status;
@@ -104 +157 @@
                 DEBUG(4,(__location__ ": Unable to parse GUID for dn %s\n",
                          ldb_dn_get_linearized(dn)));
-                return ldb_operr(ldb_module_get_ctx(ac->module));
-        }
-
-        ret = dsdb_find_guid_by_dn(ldb_module_get_ctx(ac->module), dn, guid);
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
+
+        ret = dsdb_module_guid_by_dn(module, dn, guid, parent);
         if (ret != LDB_SUCCESS) {
                 DEBUG(4,(__location__ ": Failed to find GUID for dn %s\n",
@@ -144 +197 @@
         os->op = op;
 
-        ret = la_guid_from_dn(ac, op_dn, &os->guid);
+        ret = la_guid_from_dn(ac->module, ac->req, op_dn, &os->guid);
         talloc_free(op_dn);
         if (ret == LDB_ERR_NO_SUCH_OBJECT && ac->req->operation == LDB_DELETE) {
@@ -167 +220 @@
         /* Do deletes before adds */
         if (op == LA_OP_ADD) {
-                DLIST_ADD_END(ac->ops, os, struct la_op_store *);
+                DLIST_ADD_END(ac->ops, os);
         } else {
                 /* By adding to the head of the list, we do deletes before
@@ -191 +244 @@
         struct ldb_control *ctrl;
         unsigned int i, j;
+        struct ldb_control *control;
         int ret;
 
@@ -200 +254 @@
         }
 
-        if (!(ctrl = ldb_request_get_control(req, DSDB_CONTROL_APPLY_LINKS))) {
-                /* don't do anything special for linked attributes, repl_meta_data has done it */
-                return ldb_next_request(module, req);
-        }
-        ctrl->critical = false;
-
         ac = linked_attributes_init(module, req);
         if (!ac) {
                 return ldb_operr(ldb);
         }
+
+        control = ldb_request_get_control(req, LDB_CONTROL_VERIFY_NAME_OID);
+        if (control != NULL && control->data != NULL) {
+                ret = handle_verify_name_control(req, ldb, control, ac);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+        }
+
+        if (!(ctrl = ldb_request_get_control(req, DSDB_CONTROL_APPLY_LINKS))) {
+                /* don't do anything special for linked attributes, repl_meta_data has done it */
+                talloc_free(ac);
+                return ldb_next_request(module, req);
+        }
+        ctrl->critical = false;
 
         if (!ac->schema) {
@@ -216 +279 @@
                 return ldb_next_request(module, req);
         }
+
 
         /* Need to ensure we only have forward links being specified */
@@ -229 +293 @@
                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
                 }
-                /* We have a valid attribute, now find out if it is a forward link */
-                if ((schema_attr->linkID == 0)) {
+
+                /* this could be a link with no partner, in which case
+                   there is no special work to do */
+                if (schema_attr->linkID == 0) {
                         continue;
                 }
 
-                if ((schema_attr->linkID & 1) == 1) {
-                        unsigned int functional_level;
-
-                        functional_level = dsdb_functional_level(ldb);
-                        SMB_ASSERT(functional_level > DS_DOMAIN_FUNCTION_2000);
-                }
+                /* this part of the code should only be handling forward links */
+                SMB_ASSERT((schema_attr->linkID & 1) == 0);
 
                 /* Even link IDs are for the originating attribute */
-                target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID + 1);
+                target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID ^ 1);
                 if (!target_attr) {
                         /*
@@ -320 +382 @@
                 }
 
-                ac->add_dn = ac->del_dn = talloc_steal(ac, ares->message->dn);
+                ac->mod_dn = talloc_steal(ac, ares->message->dn);
 
                 /* We don't populate 'rc' for ADD - it can't be deleting elements anyway */
@@ -346 +408 @@
                         }
 
-                        target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID + 1);
+                        target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID ^ 1);
                         if (!target_attr) {
                                 /*
@@ -413 +475 @@
         /* Apply the modify to the linked entry */
 
+        struct ldb_control *control;
         struct ldb_context *ldb;
         unsigned int i, j;
@@ -428 +491 @@
         }
 
-        if (!(ctrl = ldb_request_get_control(req, DSDB_CONTROL_APPLY_LINKS))) {
-                /* don't do anything special for linked attributes, repl_meta_data has done it */
-                return ldb_next_request(module, req);
-        }
-        ctrl->critical = false;
-
         ac = linked_attributes_init(module, req);
         if (!ac) {
                 return ldb_operr(ldb);
         }
+
+        control = ldb_request_get_control(req, LDB_CONTROL_VERIFY_NAME_OID);
+        if (control != NULL && control->data != NULL) {
+                ret = handle_verify_name_control(req, ldb, control, ac);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+        }
+
+        if (!(ctrl = ldb_request_get_control(req, DSDB_CONTROL_APPLY_LINKS))) {
+                /* don't do anything special for linked attributes, repl_meta_data has done it */
+                talloc_free(ac);
+                return ldb_next_request(module, req);
+        }
+        ctrl->critical = false;
 
         if (!ac->schema) {
@@ -469 +541 @@
                 }
 
-                if ((schema_attr->linkID & 1) == 1) {
-                        unsigned int functional_level;
-
-                        functional_level = dsdb_functional_level(ldb);
-                        SMB_ASSERT(functional_level > DS_DOMAIN_FUNCTION_2000);
-                }
+                /* this part of the code should only be handling forward links */
+                SMB_ASSERT((schema_attr->linkID & 1) == 0);
+
                 /* Now find the target attribute */
-                target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID + 1);
+                target_attr = dsdb_attribute_by_linkID(ac->schema, schema_attr->linkID ^ 1);
                 if (!target_attr) {
                         /*
@@ -573 +642 @@
                 /* We need to figure out our own extended DN, to fill in as the backlink target */
                 if (ret == LDB_SUCCESS) {
-                        ret = ldb_request_add_control(search_req,
-                                                      LDB_CONTROL_EXTENDED_DN_OID,
-                                                      false, NULL);
+                        ret = dsdb_request_add_controls(search_req,
+                                                        DSDB_SEARCH_SHOW_RECYCLED |
+                                                        DSDB_SEARCH_SHOW_EXTENDED_DN);
                 }
                 if (ret == LDB_SUCCESS) {
@@ -593 +662 @@
 
 static int linked_attributes_fix_links(struct ldb_module *module,
+                                       struct GUID self_guid,
                                        struct ldb_dn *old_dn, struct ldb_dn *new_dn,
                                        struct ldb_message_element *el, struct dsdb_schema *schema,
@@ -619 +689 @@
                 struct ldb_message *msg;
                 struct ldb_message_element *el2;
+                struct GUID link_guid;
 
                 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], schema_attr->syntax->ldap_oid);
@@ -626 +697 @@
                 }
 
-                ret = dsdb_module_search_dn(module, tmp_ctx, &res, dsdb_dn->dn,
-                                            attrs,
-                                            DSDB_FLAG_NEXT_MODULE |
-                                            DSDB_SEARCH_SHOW_RECYCLED |
-                                            DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
-                                            DSDB_SEARCH_REVEAL_INTERNALS, parent);
+                ret = la_guid_from_dn(module, parent, dsdb_dn->dn, &link_guid);
                 if (ret != LDB_SUCCESS) {
-                        ldb_asprintf_errstring(ldb, "Linked attribute %s->%s between %s and %s - remote not found - %s",
+                        ldb_asprintf_errstring(ldb, "Linked attribute %s->%s between %s and %s - GUID not found - %s",
                                                el->name, target->lDAPDisplayName,
                                                ldb_dn_get_linearized(old_dn),
@@ -641 +707 @@
                         return ret;
                 }
+
+                /*
+                 * get the existing message from the db for the object with
+                 * this GUID, returning attribute being modified. We will then
+                 * use this msg as the basis for a modify call
+                 */
+                ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
+                                         DSDB_FLAG_NEXT_MODULE |
+                                         DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
+                                         DSDB_SEARCH_SHOW_RECYCLED |
+                                         DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
+                                         DSDB_SEARCH_REVEAL_INTERNALS,
+                                         parent,
+                                         "objectGUID=%s", GUID_string(tmp_ctx, &link_guid));
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb, "Linked attribute %s->%s between %s and %s - target GUID %s not found - %s",
+                                               el->name, target->lDAPDisplayName,
+                                               ldb_dn_get_linearized(old_dn),
+                                               ldb_dn_get_linearized(dsdb_dn->dn),
+                                               GUID_string(tmp_ctx, &link_guid),
+                                               ldb_errstring(ldb));
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+                if (res->count == 0) {
+                        /* Forward link without backlink object remaining - nothing to do here */
+                        continue;
+                }
+                if (res->count != 1) {
+                        ldb_asprintf_errstring(ldb, "Linked attribute %s->%s between %s and %s - target GUID %s found more than once!",
+                                               el->name, target->lDAPDisplayName,
+                                               ldb_dn_get_linearized(old_dn),
+                                               ldb_dn_get_linearized(dsdb_dn->dn),
+                                               GUID_string(tmp_ctx, &link_guid));
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+
                 msg = res->msgs[0];
 
@@ -664 +768 @@
                 for (j=0; j<el2->num_values; j++) {
                         struct dsdb_dn *dsdb_dn2;
+                        struct GUID link_guid2;
+
                         dsdb_dn2 = dsdb_dn_parse(msg, ldb, &el2->values[j], target->syntax->ldap_oid);
                         if (dsdb_dn2 == NULL) {
@@ -669 +775 @@
                                 return LDB_ERR_INVALID_DN_SYNTAX;
                         }
-                        if (ldb_dn_compare(old_dn, dsdb_dn2->dn) != 0) {
+
+                        ret = la_guid_from_dn(module, parent, dsdb_dn2->dn, &link_guid2);
+                        if (ret != LDB_SUCCESS) {
+                                talloc_free(tmp_ctx);
+                                return ret;
+                        }
+
+                        /*
+                         * By comparing using the GUID we ensure that
+                         * even if somehow the name has got out of
+                         * sync, this rename will fix it.
+                         *
+                         * If somehow we don't have a GUID on the DN
+                         * in the DB, the la_guid_from_dn call will be
+                         * more costly, but still give us a GUID.
+                         * dbcheck will fix this if run.
+                         */
+                        if (!GUID_equal(&self_guid, &link_guid2)) {
                                 continue;
                         }
+
                         ret = ldb_dn_update_components(dsdb_dn2->dn, new_dn);
                         if (ret != LDB_SUCCESS) {
@@ -718 +842 @@
         struct dsdb_schema *schema;
         int ret;
+        struct GUID guid;
+
         /*
            - load the current msg
@@ -727 +853 @@
                                     NULL,
                                     DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_SEARCH_SHOW_EXTENDED_DN |
                                     DSDB_SEARCH_SHOW_RECYCLED, req);
         if (ret != LDB_SUCCESS) {
@@ -738 +865 @@
 
         msg = res->msgs[0];
+
+        ret = la_guid_from_dn(module, req, msg->dn, &guid);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
 
         for (i=0; i<msg->num_elements; i++) {
@@ -746 +878 @@
                         continue;
                 }
-                ret = linked_attributes_fix_links(module, msg->dn, req->op.rename.newdn, el,
+                ret = linked_attributes_fix_links(module, guid, msg->dn, req->op.rename.newdn, el,
                                                   schema, schema_attr, req);
                 if (ret != LDB_SUCCESS) {
@@ -868 +1000 @@
 
                 if (ret == LDB_SUCCESS) {
-                        ret = ldb_request_add_control(search_req,
-                                                      LDB_CONTROL_EXTENDED_DN_OID,
-                                                      false, NULL);
+                        ret = dsdb_request_add_controls(search_req,
+                                                        DSDB_SEARCH_SHOW_RECYCLED |
+                                                        DSDB_SEARCH_SHOW_EXTENDED_DN);
                 }
                 if (ret != LDB_SUCCESS) {
@@ -931 +1063 @@
                              struct GUID *guid, struct ldb_dn **dn)
 {
-        return dsdb_find_dn_by_guid(ldb_module_get_ctx(ac->module), ac, guid, dn);
+        return dsdb_module_dn_by_guid(ac->module, ac, guid, dn, ac->req);
 }
 
@@ -941 +1073 @@
         struct ldb_context *ldb;
         int ret;
+
+        if (ac->mod_dn == NULL) {
+                /* we didn't find the DN that we searched for */
+                return LDB_SUCCESS;
+        }
 
         ldb = ldb_module_get_ctx(ac->module);
@@ -970 +1107 @@
         }
         ret_el->num_values = 1;
-        if (op->op == LA_OP_ADD) {
-                ret_el->values[0] = data_blob_string_const(ldb_dn_get_extended_linearized(new_msg, ac->add_dn, 1));
-        } else {
-                ret_el->values[0] = data_blob_string_const(ldb_dn_get_extended_linearized(new_msg, ac->del_dn, 1));
-        }
+        ret_el->values[0] = data_blob_string_const(ldb_dn_get_extended_linearized(new_msg, ac->mod_dn, 1));
 
         /* a backlink should never be single valued. Unfortunately the
@@ -997 +1130 @@
         ret = dsdb_module_modify(module, new_msg, DSDB_FLAG_NEXT_MODULE, ac->req);
         if (ret != LDB_SUCCESS) {
-                ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
+                ldb_debug(ldb, LDB_DEBUG_WARNING, __location__ ": failed to apply linked attribute change '%s'\n%s\n",
                           ldb_errstring(ldb),
                           ldb_ldif_message_string(ldb, op, LDB_CHANGETYPE_MODIFY, new_msg));
@@ -1095 +1228 @@
 }
 
+static int linked_attributes_ldb_init(struct ldb_module *module)
+{
+        int ret;
+
+        ret = ldb_mod_register_control(module, LDB_CONTROL_VERIFY_NAME_OID);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
+                        "verify_name: Unable to register control with rootdse!\n");
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
+
+        return ldb_next_init(module);
+}
+
 
 static const struct ldb_module_ops ldb_linked_attributes_module_ops = {
@@ -1101 +1248 @@
         .modify            = linked_attributes_modify,
         .rename            = linked_attributes_rename,
+        .init_context      = linked_attributes_ldb_init,
         .start_transaction = linked_attributes_start_transaction,
         .prepare_commit    = linked_attributes_prepare_commit,

vendor/current/source4/dsdb/samdb/ldb_modules/local_password.c

@@ -44 +44 @@
 
    This allows the password database to be synchronised in a multi-master
-   fashion, seperate to the more difficult concerns of the main
+   fashion, separate to the more difficult concerns of the main
    database. (With passwords, the last writer always wins)
 
@@ -182 +182 @@
         }
 
-        remote_message = ldb_msg_copy_shallow(remote_req, req->op.add.message);
+        remote_message = ldb_msg_copy_shallow(ac, req->op.add.message);
         if (remote_message == NULL) {
                 return ldb_operr(ldb);

vendor/current/source4/dsdb/samdb/ldb_modules/new_partition.c

@@ -37 +37 @@
 #include "dsdb/samdb/samdb.h"
 #include "../libds/common/flags.h"
+#include "dsdb/common/util.h"
 
 struct np_context {
@@ -65 +66 @@
 
         if (ares->type != LDB_REPLY_DONE) {
-                ldb_set_errstring(ldb, "Invalid reply type!");
+                ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
                 return ldb_module_done(ac->req, NULL, NULL,
                                         LDB_ERR_OPERATIONS_ERROR);
@@ -123 +124 @@
                                      ldb, ac, DSDB_EXTENDED_CREATE_PARTITION_OID, ex_op, 
                                      NULL, ac, np_part_mod_callback, req);
+
+        /* if the parent was asking for a partial replica, then we
+         * need the extended operation to also ask for a partial
+         * replica */
+        if (ldb_request_get_control(req, DSDB_CONTROL_PARTIAL_REPLICA)) {
+                ret = dsdb_request_add_controls(ac->part_add, DSDB_MODIFY_PARTIAL_REPLICA);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
         
         LDB_REQ_SET_LOCATION(ac->part_add);
@@ -154 +166 @@
 
                 if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
-                        return ldb_next_request(module, req);
-                }
-
-                if (instanceType & INSTANCE_TYPE_UNINSTANT) {
-                        DEBUG(0,(__location__ ": Skipping uninstantiated partition %s\n",
-                                 ldb_dn_get_linearized(req->op.add.message->dn)));
                         return ldb_next_request(module, req);
                 }

vendor/current/source4/dsdb/samdb/ldb_modules/objectclass.c

@@ -4 +4 @@
    Copyright (C) Simo Sorce  2006-2008
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
-   Copyright (C) Matthias Dieter Wallnöfer 2010
+   Copyright (C) Matthias Dieter Wallnöfer 2010-2011
 
    This program is free software; you can redistribute it and/or modify
@@ -38 +38 @@
 #include "includes.h"
 #include "ldb_module.h"
-#include "util/dlinklist.h"
 #include "dsdb/samdb/samdb.h"
 #include "librpc/ndr/libndr.h"
@@ -46 +45 @@
 #include "param/param.h"
 #include "../libds/common/flags.h"
-#include "dsdb/samdb/ldb_modules/schema.h"
-#include "util.h"
+#include "dsdb/samdb/ldb_modules/util.h"
 
 struct oc_context {
@@ -59 +57 @@
 
         int (*step_fn)(struct oc_context *);
-};
-
-struct class_list {
-        struct class_list *prev, *next;
-        const struct dsdb_class *objectclass;
 };
 
@@ -89 +82 @@
 static int objectclass_do_add(struct oc_context *ac);
 
-/* Sort objectClasses into correct order, and validate that all
- * objectClasses specified actually exist in the schema
+/*
+ * This checks if we have unrelated object classes in our entry's "objectClass"
+ * attribute. That means "unsatisfied" abstract classes (no concrete subclass)
+ * or two or more disjunct structural ones.
+ * If one of these conditions are true, blame.
  */
-
-static int objectclass_sort(struct ldb_module *module,
-                            const struct dsdb_schema *schema,
-                            TALLOC_CTX *mem_ctx,
-                            struct ldb_message_element *objectclass_element,
-                            struct class_list **sorted_out) 
-{
-        struct ldb_context *ldb;
-        unsigned int i, lowest;
-        struct class_list *unsorted = NULL, *sorted = NULL, *current = NULL, *poss_parent = NULL, *new_parent = NULL, *current_lowest = NULL;
-
-        ldb = ldb_module_get_ctx(module);
-
-        /* DESIGN:
-         *
-         * We work on 4 different 'bins' (implemented here as linked lists):
-         *
-         * * sorted:       the eventual list, in the order we wish to push
-         *                 into the database.  This is the only ordered list.
-         *
-         * * parent_class: The current parent class 'bin' we are
-         *                 trying to find subclasses for
-         *
-         * * subclass:     The subclasses we have found so far
-         *
-         * * unsorted:     The remaining objectClasses
-         *
-         * The process is a matter of filtering objectClasses up from
-         * unsorted into sorted.  Order is irrelevent in the later 3 'bins'.
-         * 
-         * We start with 'top' (found and promoted to parent_class
-         * initially).  Then we find (in unsorted) all the direct
-         * subclasses of 'top'.  parent_classes is concatenated onto
-         * the end of 'sorted', and subclass becomes the list in
-         * parent_class.
-         *
-         * We then repeat, until we find no more subclasses.  Any left
-         * over classes are added to the end.
-         *
-         */
-
-        /* Firstly, dump all the objectClass elements into the
-         * unsorted bin, except for 'top', which is special */
-        for (i=0; i < objectclass_element->num_values; i++) {
-                current = talloc(mem_ctx, struct class_list);
-                if (!current) {
-                        return ldb_oom(ldb);
-                }
-                current->objectclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &objectclass_element->values[i]);
-                if (!current->objectclass) {
-                        ldb_asprintf_errstring(ldb, "objectclass %.*s is not a valid objectClass in schema", 
-                                               (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
-                        /* This looks weird, but windows apparently returns this for invalid objectClass values */
-                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
-                } else if (current->objectclass->isDefunct) {
-                        ldb_asprintf_errstring(ldb, "objectclass %.*s marked as isDefunct objectClass in schema - not valid for new objects", 
-                                               (int)objectclass_element->values[i].length, (const char *)objectclass_element->values[i].data);
-                        /* This looks weird, but windows apparently returns this for invalid objectClass values */
-                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
-                }
-
-                /* Don't add top to list, we will do that later */
-                if (ldb_attr_cmp("top", current->objectclass->lDAPDisplayName) != 0) {
-                        DLIST_ADD_END(unsorted, current, struct class_list *);
-                }
-        }
-
-        /* Add top here, to prevent duplicates */
-        current = talloc(mem_ctx, struct class_list);
-        current->objectclass = dsdb_class_by_lDAPDisplayName(schema, "top");
-        DLIST_ADD_END(sorted, current, struct class_list *);
-
-
-        /* For each object:  find parent chain */
-        for (current = unsorted; schema && current; current = current->next) {
-                for (poss_parent = unsorted; poss_parent; poss_parent = poss_parent->next) {
-                        if (ldb_attr_cmp(poss_parent->objectclass->lDAPDisplayName, current->objectclass->subClassOf) == 0) {
-                                break;
-                        }
-                }
-                /* If we didn't get to the end of the list, we need to add this parent */
-                if (poss_parent || (ldb_attr_cmp("top", current->objectclass->subClassOf) == 0)) {
+static int check_unrelated_objectclasses(struct ldb_module *module,
+                                        const struct dsdb_schema *schema,
+                                        const struct dsdb_class *struct_objectclass,
+                                        struct ldb_message_element *objectclass_element)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        unsigned int i;
+        bool found;
+
+        if (schema == NULL) {
+                return LDB_SUCCESS;
+        }
+
+        for (i = 0; i < objectclass_element->num_values; i++) {
+                const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema,
+                                                                                           &objectclass_element->values[i]);
+                const struct dsdb_class *tmp_class2 = struct_objectclass;
+
+                /* Pointer comparison can be used due to the same schema str. */
+                if (tmp_class == NULL ||
+                    tmp_class == struct_objectclass ||
+                    tmp_class->objectClassCategory > 2 ||
+                    ldb_attr_cmp(tmp_class->lDAPDisplayName, "top") == 0) {
                         continue;
                 }
 
-                new_parent = talloc(mem_ctx, struct class_list);
-                new_parent->objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass->subClassOf);
-                DLIST_ADD_END(unsorted, new_parent, struct class_list *);
-        }
-
-        do
-        {
-                lowest = UINT_MAX;
-                current_lowest = NULL;
-                for (current = unsorted; schema && current; current = current->next) {
-                        if(current->objectclass->subClass_order < lowest) {
-                                current_lowest = current;
-                                lowest = current->objectclass->subClass_order;
-                        }
-                }
-
-                if(current_lowest != NULL) {
-                        DLIST_REMOVE(unsorted,current_lowest);
-                        DLIST_ADD_END(sorted,current_lowest, struct class_list *);
-                }
-        } while(unsorted);
-
-
-        if (!unsorted) {
-                *sorted_out = sorted;
-                return LDB_SUCCESS;
-        }
-
-        if (!schema) {
-                /* If we don't have schema yet, then just merge the lists again */
-                DLIST_CONCATENATE(sorted, unsorted, struct class_list *);
-                *sorted_out = sorted;
-                return LDB_SUCCESS;
-        }
-
-        /* This shouldn't happen, and would break MMC, perhaps there
-         * was no 'top', a conflict in the objectClasses or some other
-         * schema error?
-         */
-        ldb_asprintf_errstring(ldb, "objectclass %s is not a valid objectClass in objectClass chain", unsorted->objectclass->lDAPDisplayName);
-        return LDB_ERR_OBJECT_CLASS_VIOLATION;
+                found = false;
+                while (!found &&
+                       ldb_attr_cmp(tmp_class2->lDAPDisplayName, "top") != 0) {
+                        tmp_class2 = dsdb_class_by_lDAPDisplayName(schema,
+                                                                   tmp_class2->subClassOf);
+                        if (tmp_class2 == tmp_class) {
+                                found = true;
+                        }
+                }
+                if (found) {
+                        continue;
+                }
+
+                ldb_asprintf_errstring(ldb,
+                                       "objectclass: the objectclass '%s' seems to be unrelated to %s!",
+                                       tmp_class->lDAPDisplayName,
+                                       struct_objectclass->lDAPDisplayName);
+                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+        }
+
+        return LDB_SUCCESS;
 }
 
@@ -270 +187 @@
 }
 
-static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares)
-{
-        struct oc_context *ac;
-
-        ac = talloc_get_type(req->context, struct oc_context);
-
-        if (!ares) {
-                return ldb_module_done(ac->req, NULL, NULL,
-                                        LDB_ERR_OPERATIONS_ERROR);
-        }
-
-        if (ares->type == LDB_REPLY_REFERRAL) {
-                return ldb_module_send_referral(ac->req, ares->referral);
-        }
-
-        if (ares->error != LDB_SUCCESS) {
-                return ldb_module_done(ac->req, ares->controls,
-                                        ares->response, ares->error);
-        }
-
-        if (ares->type != LDB_REPLY_DONE) {
-                talloc_free(ares);
-                return ldb_module_done(ac->req, NULL, NULL,
-                                        LDB_ERR_OPERATIONS_ERROR);
-        }
-
-        return ldb_module_done(ac->req, ares->controls,
-                                ares->response, ares->error);
-}
-
 /* Fix up the DN to be in the standard form, taking particular care to match the parent DN
 
@@ -355 +242 @@
 
 
-        /* And replace it with CN=foo (we need the attribute in upper case */
+        /* And replace it with CN=foo (we need the attribute in upper case) */
         return ldb_dn_set_component(*fixed_dn, 0, upper_rdn_attr, *rdn_val);
 }
 
-
-static int objectclass_do_add(struct oc_context *ac);
 
 static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
@@ -436 +321 @@
         }
 
+        ret = dsdb_request_add_controls(search_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
         ac->step_fn = objectclass_do_add;
 
@@ -450 +342 @@
         struct ldb_control *rodc_control;
 
-        if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
+        if (ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
                 return false;
         }
@@ -468 +360 @@
         struct ldb_message_element *objectclass_element, *el;
         struct ldb_message *msg;
-        TALLOC_CTX *mem_ctx;
-        struct class_list *sorted, *current;
         const char *rdn_name = NULL;
         char *value;
@@ -516 +406 @@
 
         if (ac->schema != NULL) {
+                /*
+                 * Notice: by the normalization function call in "ldb_request()"
+                 * case "LDB_ADD" we have always only *one* "objectClass"
+                 * attribute at this stage!
+                 */
+
                 objectclass_element = ldb_msg_find_element(msg, "objectClass");
                 if (!objectclass_element) {
@@ -528 +424 @@
                 }
 
-                mem_ctx = talloc_new(ac);
-                if (mem_ctx == NULL) {
-                        return ldb_module_oom(ac->module);
-                }
-
-                /* Here we do now get the "objectClass" list from the
-                 * database. */
-                ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
-                                       objectclass_element, &sorted);
+                /* Now do the sorting */
+                ret = dsdb_sort_objectClass_attr(ldb, ac->schema,
+                                                 objectclass_element, msg,
+                                                 objectclass_element);
                 if (ret != LDB_SUCCESS) {
-                        talloc_free(mem_ctx);
                         return ret;
                 }
-                
-                ldb_msg_remove_element(msg, objectclass_element);
-
-                /* Well, now we shouldn't find any additional "objectClass"
-                 * message element (required by the AD specification). */
-                objectclass_element = ldb_msg_find_element(msg, "objectClass");
-                if (objectclass_element != NULL) {
-                        ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, only one 'objectclass' attribute specification is allowed!",
-                                               ldb_dn_get_linearized(msg->dn));
-                        talloc_free(mem_ctx);
-                        return LDB_ERR_OBJECT_CLASS_VIOLATION;
-                }
-
-                /* We must completely replace the existing objectClass entry,
-                 * because we need it sorted. */
-                ret = ldb_msg_add_empty(msg, "objectClass", 0, NULL);
-                if (ret != LDB_SUCCESS) {
-                        talloc_free(mem_ctx);
-                        return ret;
-                }
-
-                /* Move from the linked list back into an ldb msg */
-                for (current = sorted; current; current = current->next) {
-                        const char *objectclass_name = current->objectclass->lDAPDisplayName;
-
-                        ret = ldb_msg_add_string(msg, "objectClass", objectclass_name);
-                        if (ret != LDB_SUCCESS) {
-                                ldb_set_errstring(ldb,
-                                                  "objectclass: could not re-add sorted "
-                                                  "objectclass to modify msg");
-                                talloc_free(mem_ctx);
-                                return ret;
-                        }
-                }
-
-                talloc_free(mem_ctx);
-
-                /* Retrive the message again so get_last_structural_class works */
-                objectclass_element = ldb_msg_find_element(msg, "objectClass");
-
-                /* Make sure its valid to add an object of this type */
-                objectclass = get_last_structural_class(ac->schema,
-                                                        objectclass_element, ac->req);
-                if(objectclass == NULL) {
+
+                /*
+                 * Get the new top-most structural object class and check for
+                 * unrelated structural classes
+                 */
+                objectclass = dsdb_get_last_structural_class(ac->schema,
+                                                             objectclass_element);
+                if (objectclass == NULL) {
                         ldb_asprintf_errstring(ldb,
                                                "Failed to find a structural class for %s",
                                                ldb_dn_get_linearized(msg->dn));
                         return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+
+                ret = check_unrelated_objectclasses(ac->module, ac->schema,
+                                                    objectclass,
+                                                    objectclass_element);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
                 }
 
@@ -735 +596 @@
                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "serversContainer") == 0
                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSDSA") == 0) {
+                        if (ldb_attr_cmp(objectclass->lDAPDisplayName, "site") == 0)
+                                systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
                         systemFlags |= (int32_t)(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
-
                 } else if (ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLink") == 0
+                                || ldb_attr_cmp(objectclass->lDAPDisplayName, "subnet") == 0
                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "siteLinkBridge") == 0
                                 || ldb_attr_cmp(objectclass->lDAPDisplayName, "nTDSConnection") == 0) {
                         systemFlags |= (int32_t)(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
                 }
-
                 /* TODO: If parent object is site or subnet, also add (SYSTEM_FLAG_CONFIG_ALLOW_RENAME) */
 
@@ -763 +625 @@
         }
 
-        ret = ldb_msg_sanity_check(ldb, msg);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
         ret = ldb_build_add_req(&add_req, ldb, ac,
                                 msg,
                                 ac->req->controls,
-                                ac, oc_op_callback,
+                                ac->req, dsdb_next_callback,
                                 ac->req);
         LDB_REQ_SET_LOCATION(add_req);
@@ -857 +714 @@
         }
 
-        ret = ldb_build_mod_req(&down_req, ldb, ac,
-                                msg,
-                                req->controls, ac,
-                                oc_changes ? oc_modify_callback : oc_op_callback,
-                                req);
+        if (oc_changes) {
+                ret = ldb_build_mod_req(&down_req, ldb, ac,
+                                        msg,
+                                        req->controls, ac,
+                                        oc_modify_callback,
+                                        req);
+        } else {
+                ret = ldb_build_mod_req(&down_req, ldb, ac,
+                                        msg,
+                                        req->controls, req,
+                                        dsdb_next_callback,
+                                        req);
+        }
         LDB_REQ_SET_LOCATION(down_req);
         if (ret != LDB_SUCCESS) {
@@ -917 +782 @@
         }
 
+        ret = dsdb_request_add_controls(search_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
+        if (ret != LDB_SUCCESS) {
+                return ldb_module_done(ac->req, NULL, NULL, ret);
+        }
+
         ac->step_fn = objectclass_do_mod;
 
@@ -931 +803 @@
         struct ldb_context *ldb;
         struct ldb_request *mod_req;
-        char *value;
         struct ldb_message_element *oc_el_entry, *oc_el_change;
         struct ldb_val *vals;
         struct ldb_message *msg;
-        TALLOC_CTX *mem_ctx;
-        struct class_list *sorted, *current;
         const struct dsdb_class *objectclass;
         unsigned int i, j, k;
-        bool found, replace = false;
+        bool found;
         int ret;
 
@@ -963 +832 @@
 
         msg->dn = ac->req->op.mod.message->dn;
-
-        mem_ctx = talloc_new(ac);
-        if (mem_ctx == NULL) {
-                return ldb_module_oom(ac->module);
-        }
 
         /* We've to walk over all "objectClass" message elements */
@@ -989 +853 @@
                                                                        (int)oc_el_change->values[i].length,
                                                                        (const char *)oc_el_change->values[i].data);
-                                                talloc_free(mem_ctx);
                                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
                                         }
@@ -999 +862 @@
                                                       oc_el_entry->num_values + 1);
                                 if (vals == NULL) {
-                                        talloc_free(mem_ctx);
                                         return ldb_module_oom(ac->module);
                                 }
@@ -1008 +870 @@
                         }
 
-                        objectclass = get_last_structural_class(ac->schema,
-                                                                oc_el_change, ac->req);
-                        if (objectclass != NULL) {
-                                ldb_asprintf_errstring(ldb,
-                                                       "objectclass: cannot add a new top-most structural objectclass '%s'!",
-                                                       objectclass->lDAPDisplayName);
-                                talloc_free(mem_ctx);
-                                return LDB_ERR_OBJECT_CLASS_VIOLATION;
-                        }
-
-                        /* Now do the sorting */
-                        ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
-                                               oc_el_entry, &sorted);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(mem_ctx);
-                                return ret;
-                        }
-
                         break;
 
                 case LDB_FLAG_MOD_REPLACE:
-                        /* Do the sorting for the change message element */
-                        ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
-                                               oc_el_change, &sorted);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(mem_ctx);
-                                return ret;
-                        }
-
-                        /* this is a replace */
-                        replace = true;
+                        /*
+                         * In this case the new "oc_el_entry" is simply
+                         * "oc_el_change"
+                         */
+                        oc_el_entry = oc_el_change;
 
                         break;
 
                 case LDB_FLAG_MOD_DELETE:
-                        /* get the actual top-most structural objectclass */
-                        objectclass = get_last_structural_class(ac->schema,
-                                                                oc_el_entry, ac->req);
-                        if (objectclass == NULL) {
-                                /* no structural objectclass? */
-                                talloc_free(mem_ctx);
-                                return ldb_operr(ldb);
-                        }
-
                         /* Merge the two message elements */
                         for (i = 0; i < oc_el_change->num_values; i++) {
@@ -1078 +908 @@
                                                                (int)oc_el_change->values[i].length,
                                                                (const char *)oc_el_change->values[i].data);
-                                        talloc_free(mem_ctx);
                                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
                                 }
                         }
 
-                        /* Make sure that the top-most structural object class
-                         * hasn't been deleted */
-                        found = false;
-                        for (i = 0; i < oc_el_entry->num_values; i++) {
-                                if (ldb_attr_cmp(objectclass->lDAPDisplayName,
-                                                 (char *)oc_el_entry->values[i].data) == 0) {
-                                        found = true;
-                                        break;
-                                }
-                        }
-                        if (!found) {
-                                ldb_asprintf_errstring(ldb,
-                                                       "objectclass: cannot delete the top-most structural objectclass '%s'!",
-                                                       objectclass->lDAPDisplayName);
-                                talloc_free(mem_ctx);
-                                return LDB_ERR_OBJECT_CLASS_VIOLATION;
-                        }
-
-                        /* Now do the sorting */
-                        ret = objectclass_sort(ac->module, ac->schema, mem_ctx,
-                                               oc_el_entry, &sorted);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(mem_ctx);
-                                return ret;
-                        }
-
                         break;
                 }
 
-                /* (Re)-add an empty "objectClass" attribute on the object
-                 * classes change message "msg". */
-                ldb_msg_remove_attr(msg, "objectClass");
-                ret = ldb_msg_add_empty(msg, "objectClass",
-                                        LDB_FLAG_MOD_REPLACE, &oc_el_change);
+                /* Now do the sorting */
+                ret = dsdb_sort_objectClass_attr(ldb, ac->schema, oc_el_entry,
+                                                 msg, oc_el_entry);
                 if (ret != LDB_SUCCESS) {
-                        talloc_free(mem_ctx);
                         return ret;
                 }
 
-                /* Move from the linked list back into an ldb msg */
-                for (current = sorted; current; current = current->next) {
-                        value = talloc_strdup(msg,
-                                              current->objectclass->lDAPDisplayName);
-                        if (value == NULL) {
-                                talloc_free(mem_ctx);
-                                return ldb_module_oom(ac->module);
-                        }
-                        ret = ldb_msg_add_string(msg, "objectClass", value);
-                        if (ret != LDB_SUCCESS) {
-                                ldb_set_errstring(ldb,
-                                                  "objectclass: could not re-add sorted objectclasses!");
-                                talloc_free(mem_ctx);
-                                return ret;
-                        }
-                }
-
-                if (replace) {
-                        /* Well, on replace we are nearly done: we have to test
-                         * if the change and entry message element are identical
-                         * ly. We can use "ldb_msg_element_compare" since now
-                         * the specified objectclasses match for sure in case.
-                         */
-                        ret = ldb_msg_element_compare(oc_el_entry,
-                                                      oc_el_change);
-                        if (ret == 0) {
-                                ret = ldb_msg_element_compare(oc_el_change,
-                                                              oc_el_entry);
-                        }
-                        if (ret == 0) {
-                                /* they are the same so we are done in this
-                                 * case */
-                                talloc_free(mem_ctx);
-                                return ldb_module_done(ac->req, NULL, NULL,
-                                                       LDB_SUCCESS);
-                        } else {
-                                ldb_set_errstring(ldb,
-                                                  "objectclass: the specified objectclasses are not exactly the same as on the entry!");
-                                talloc_free(mem_ctx);
-                                return LDB_ERR_OBJECT_CLASS_VIOLATION;
-                        }
-                }
-
-                /* Now we've applied all changes from "oc_el_change" to
-                 * "oc_el_entry" therefore the new "oc_el_entry" will be
-                 * "oc_el_change". */
-                oc_el_entry = oc_el_change;
-        }
-
-        talloc_free(mem_ctx);
+                /*
+                 * Get the new top-most structural object class and check for
+                 * unrelated structural classes
+                 */
+                objectclass = dsdb_get_last_structural_class(ac->schema,
+                                                             oc_el_entry);
+                if (objectclass == NULL) {
+                        ldb_set_errstring(ldb,
+                                          "objectclass: cannot delete all structural objectclasses!");
+                        return LDB_ERR_OBJECT_CLASS_VIOLATION;
+                }
+
+                /* Check for unrelated objectclasses */
+                ret = check_unrelated_objectclasses(ac->module, ac->schema,
+                                                    objectclass,
+                                                    oc_el_entry);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+        /* Now add the new object class attribute to the change message */
+        ret = ldb_msg_add(msg, oc_el_entry, LDB_FLAG_MOD_REPLACE);
+        if (ret != LDB_SUCCESS) {
+                ldb_module_oom(ac->module);
+                return ret;
+        }
 
         /* Now we have the real and definitive change left to do */
@@ -1178 +955 @@
                                 msg,
                                 ac->req->controls,
-                                ac, oc_op_callback,
+                                ac->req, dsdb_next_callback,
                                 ac->req);
         LDB_REQ_SET_LOCATION(mod_req);
@@ -1236 +1013 @@
            deletes will be refused as we will think the target parent
            does not exist */
-        ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
-                                      false, NULL);
-
+        ret = dsdb_request_add_controls(search_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -1286 +1063 @@
         }
 
+        ret = dsdb_request_add_controls(search_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
         ac->step_fn = objectclass_do_rename2;
 
@@ -1322 +1106 @@
                         return ldb_operr(ldb);
                 }
-                objectclass = get_last_structural_class(ac->schema, oc_el_entry, ac->req);
+                objectclass = dsdb_get_last_structural_class(ac->schema,
+                                                             oc_el_entry);
                 if (objectclass == NULL) {
                         /* existing entry without a valid object class? */
@@ -1408 +1193 @@
                                    ac->req->op.rename.olddn, fixed_dn,
                                    ac->req->controls,
-                                   ac, oc_op_callback,
+                                   ac->req, dsdb_next_callback,
                                    ac->req);
         LDB_REQ_SET_LOCATION(rename_req);
@@ -1425 +1210 @@
         static const char * const attrs[] = { "nCName", "objectClass",
                                               "systemFlags",
+                                              "isDeleted",
                                               "isCriticalSystemObject", NULL };
         struct ldb_context *ldb;
@@ -1464 +1250 @@
         }
 
+        ret = dsdb_request_add_controls(search_req,
+                                        DSDB_FLAG_AS_SYSTEM |
+                                        DSDB_SEARCH_SHOW_RECYCLED);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
         ac->step_fn = objectclass_do_delete;
 
@@ -1488 +1281 @@
 
         /* DC's ntDSDSA object */
-        if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb)) == 0) {
+        if (ldb_dn_compare(ac->req->op.del.dn, samdb_ntds_settings_dn(ldb, ac)) == 0) {
                 ldb_asprintf_errstring(ldb, "objectclass: Cannot delete %s, it's the DC's ntDSDSA object!",
                                        ldb_dn_get_linearized(ac->req->op.del.dn));
@@ -1496 +1289 @@
         /* DC's rIDSet object */
         /* Perform this check only when it does exist - this is needed in order
-         * to don't let existing provisions break. */
+         * to don't let existing provisions break, and to delete . */
         ret = samdb_rid_set_dn(ldb, ac, &dn);
-        if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
+        if ((ret != LDB_SUCCESS) && (ret != LDB_ERR_NO_SUCH_ATTRIBUTE)
+            && (ret != LDB_ERR_NO_SUCH_OBJECT)) {
+                ldb_asprintf_errstring(ldb, "objectclass: Unable to determine if %s, is this DC's rIDSet object: %s ",
+                                       ldb_dn_get_linearized(ac->req->op.del.dn),
+                                       ldb_errstring(ldb));
                 return ret;
         }
@@ -1509 +1306 @@
                 }
                 talloc_free(dn);
+        }
+
+        /* Only trusted request from system account are allowed to delete
+         * deleted objects.
+         */
+        if (ldb_msg_check_string_attribute(ac->search_res->message, "isDeleted", "TRUE") &&
+                        (ldb_req_is_untrusted(ac->req) ||
+                                !dsdb_module_am_system(ac->module))) {
+                ldb_asprintf_errstring(ldb, "Delete of '%s' failed",
+                                                ldb_dn_get_linearized(ac->req->op.del.dn));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
         }
 
@@ -1550 +1358 @@
                                                                    "isCriticalSystemObject", false);
                 if (isCriticalSystemObject) {
-                        ldb_asprintf_errstring(ldb,
+                        /*
+                         * Following the explaination from Microsoft
+                         * https://lists.samba.org/archive/cifs-protocol/2011-August/002046.html
+                         * "I finished the investigation on this behavior.
+                         * As per MS-ADTS 3.1.5.5.7.2 , when a tree deletion is performed ,
+                         * every object in the tree will be checked to see if it has isCriticalSystemObject
+                         * set to TRUE, including the root node on which the delete operation is performed
+                         * But there is an exception  if the root object is a SAM specific objects(3.1.1.5.2.3 MS-ADTS)
+                         * Its deletion is done through SAM manger and isCriticalSystemObject attribute is not checked
+                         * The root node of the tree delete in your case is CN=ARES,OU=Domain Controllers,DC=w2k8r2,DC=home,DC=matws,DC=net
+                         * which is a SAM object  with  user class.  Therefore the tree deletion is performed without any error
+                         */
+
+                        if (samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "group") == NULL &&
+                            samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "samDomain") == NULL &&
+                            samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "samServer") == NULL &&
+                            samdb_find_attribute(ldb, ac->search_res->message, "objectClass", "user") == NULL) {
+                                        ldb_asprintf_errstring(ldb,
                                                "objectclass: Cannot tree-delete %s, it's a critical system object!",
                                                ldb_dn_get_linearized(ac->req->op.del.dn));
                         return LDB_ERR_UNWILLING_TO_PERFORM;
+                        }
                 }
         }

vendor/current/source4/dsdb/samdb/ldb_modules/objectclass_attrs.c

@@ -73 +73 @@
 static int oc_op_callback(struct ldb_request *req, struct ldb_reply *ares);
 
-/* checks correctness of dSHeuristics attribute
- * as described in MS-ADTS 7.1.1.2.4.1.2 dSHeuristics */
+/*
+ * Checks the correctness of the "dSHeuristics" attribute as described in both
+ * MS-ADTS 7.1.1.2.4.1.2 dSHeuristics and MS-ADTS 3.1.1.5.3.2 Constraints
+ */
 static int oc_validate_dsheuristics(struct ldb_message_element *el)
 {
         if (el->num_values > 0) {
-                if (el->values[0].length > DS_HR_LDAP_BYPASS_UPPER_LIMIT_BOUNDS) {
-                        return LDB_ERR_CONSTRAINT_VIOLATION;
-                } else if (el->values[0].length >= DS_HR_TENTH_CHAR
-                           && el->values[0].data[DS_HR_TENTH_CHAR-1] != '1') {
-                        return LDB_ERR_CONSTRAINT_VIOLATION;
-                }
-        }
-
+                if ((el->values[0].length >= DS_HR_NINETIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_NINETIETH_CHAR-1] != '9')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_EIGHTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_EIGHTIETH_CHAR-1] != '8')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_SEVENTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_SEVENTIETH_CHAR-1] != '7')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_SIXTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_SIXTIETH_CHAR-1] != '6')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_FIFTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_FIFTIETH_CHAR-1] != '5')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_FOURTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_FOURTIETH_CHAR-1] != '4')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_THIRTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_THIRTIETH_CHAR-1] != '3')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_TWENTIETH_CHAR) &&
+                    (el->values[0].data[DS_HR_TWENTIETH_CHAR-1] != '2')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+                if ((el->values[0].length >= DS_HR_TENTH_CHAR) &&
+                    (el->values[0].data[DS_HR_TENTH_CHAR-1] != '1')) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+        }
+
+        return LDB_SUCCESS;
+}
+
+/*
+  auto normalise values on input
+ */
+static int oc_auto_normalise(struct ldb_context *ldb, const struct dsdb_attribute *attr,
+                             struct ldb_message *msg, struct ldb_message_element *el)
+{
+        int i;
+        bool values_copied = false;
+
+        for (i=0; i<el->num_values; i++) {
+                struct ldb_val v;
+                int ret;
+                ret = attr->ldb_schema_attribute->syntax->canonicalise_fn(ldb, el->values, &el->values[i], &v);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+                if (data_blob_cmp(&v, &el->values[i]) == 0) {
+                        /* no need to replace it */
+                        talloc_free(v.data);
+                        continue;
+                }
+
+                /* we need to copy the values array on the first change */
+                if (!values_copied) {
+                        struct ldb_val *v2;
+                        v2 = talloc_array(msg->elements, struct ldb_val, el->num_values);
+                        if (v2 == NULL) {
+                                return ldb_oom(ldb);
+                        }
+                        memcpy(v2, el->values, sizeof(struct ldb_val) * el->num_values);
+                        el->values = v2;
+                        values_copied = true;
+                }
+
+                el->values[i] = v;
+        }
         return LDB_SUCCESS;
 }
@@ -122 +193 @@
                                                          msg->elements[i].name);
                 if (attr == NULL) {
+                        if (ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK) &&
+                            ac->req->operation != LDB_ADD) {
+                                /* we allow this for dbcheck to fix
+                                   broken attributes */
+                                goto no_attribute;
+                        }
                         ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' was not found in the schema!",
                                                msg->elements[i].name,
@@ -128 +205 @@
                 }
 
-                if ((attr->linkID & 1) == 1) {
+                if ((attr->linkID & 1) == 1 &&
+                    !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
+                    !ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
                         /* Odd is for the target.  Illegal to modify */
                         ldb_asprintf_errstring(ldb, 
@@ -140 +219 @@
                         werr = attr->syntax->validate_ldb(&syntax_ctx, attr,
                                                           &msg->elements[i]);
-                        if (!W_ERROR_IS_OK(werr)) {
+                        if (!W_ERROR_IS_OK(werr) &&
+                            !ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
                                 ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' contains at least one invalid value!",
                                                        msg->elements[i].name,
@@ -167 +247 @@
                 }
 
+                /* auto normalise some attribute values */
+                if (attr->syntax->auto_normalise) {
+                        ret = oc_auto_normalise(ldb, attr, msg, &msg->elements[i]);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+                }
+
                 /* Substitute the attribute name to match in case */
                 msg->elements[i].name = attr->lDAPDisplayName;
         }
 
+no_attribute:
         if (ac->req->operation == LDB_ADD) {
                 ret = ldb_build_add_req(&child_req, ldb, ac,
@@ -211 +300 @@
         unsigned int i;
         bool found;
+        bool isSchemaAttr = false;
 
         ldb = ldb_module_get_ctx(ac->module);
@@ -241 +331 @@
          *  manipulated by client machines over the LDAPv3 transport."
          */
-        if (ldb_req_is_untrusted(ac->req)) {
-                for (i = 0; i < oc_element->num_values; i++) {
-                        if ((strcmp((char *)oc_element->values[i].data,
-                                    "secret") == 0) ||
-                            (strcmp((char *)oc_element->values[i].data,
-                                    "trustedDomain") == 0)) {
+        for (i = 0; i < oc_element->num_values; i++) {
+                char * attname = (char *)oc_element->values[i].data;
+                if (ldb_req_is_untrusted(ac->req)) {
+                        if (strcmp(attname, "secret") == 0 ||
+                            strcmp(attname, "trustedDomain") == 0) {
                                 ldb_asprintf_errstring(ldb, "objectclass_attrs: LSA objectclasses (entry '%s') cannot be created or changed over LDAP!",
                                                        ldb_dn_get_linearized(ac->search_res->message->dn));
                                 return LDB_ERR_UNWILLING_TO_PERFORM;
                         }
+                }
+                if (strcmp(attname, "attributeSchema") == 0) {
+                        isSchemaAttr = true;
                 }
         }
@@ -296 +388 @@
                                                          msg->elements[i].name);
                 if (attr == NULL) {
+                        if (ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK)) {
+                                /* allow this to make it possible for dbcheck
+                                   to remove bad attributes */
+                                continue;
+                        }
                         return ldb_operr(ldb);
                 }
@@ -312 +409 @@
                 }
                 if (!found) {
-                        ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
-                                               msg->elements[i].name,
-                                               ldb_dn_get_linearized(msg->dn));
-                        return LDB_ERR_OBJECT_CLASS_VIOLATION;
-                }
-        }
-
-        if (found_must_contain[0] != NULL) {
+                        /* we allow this for dbcheck to fix the rest of this broken entry */
+                        if (!ldb_request_get_control(ac->req, DSDB_CONTROL_DBCHECK) || 
+                            ac->req->operation == LDB_ADD) {
+                                ldb_asprintf_errstring(ldb, "objectclass_attrs: attribute '%s' on entry '%s' does not exist in the specified objectclasses!",
+                                                       msg->elements[i].name,
+                                                       ldb_dn_get_linearized(msg->dn));
+                                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+                        }
+                }
+        }
+
+        if (found_must_contain[0] != NULL &&
+            ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE") == 0) {
                 ldb_asprintf_errstring(ldb, "objectclass_attrs: at least one mandatory attribute ('%s') on entry '%s' wasn't specified!",
                                        found_must_contain[0],
@@ -326 +428 @@
         }
 
+        if (isSchemaAttr) {
+                /* Before really adding an attribute in the database,
+                        * let's check that we can translate it into a dbsd_attribute and
+                        * that we can find a valid syntax object.
+                        * If not it's better to reject this attribute than not be able
+                        * to start samba next time due to schema being unloadable.
+                        */
+                struct dsdb_attribute *att = talloc(ac, struct dsdb_attribute);
+                const struct dsdb_syntax *attrSyntax;
+                WERROR status;
+
+                status= dsdb_attribute_from_ldb(ac->schema, msg, att);
+                if (!W_ERROR_IS_OK(status)) {
+                        ldb_set_errstring(ldb,
+                                                "objectclass: failed to translate the schemaAttribute to a dsdb_attribute");
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+
+                attrSyntax = dsdb_syntax_for_attribute(att);
+                if (!attrSyntax) {
+                        ldb_set_errstring(ldb,
+                                                "objectclass: unknown attribute syntax");
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        }
         return ldb_module_done(ac->req, ac->mod_ares->controls,
                                ac->mod_ares->response, LDB_SUCCESS);
@@ -474 +601 @@
 {
         struct ldb_context *ldb;
+        struct ldb_control *sd_propagation_control;
+        int ret;
+
         struct oc_context *ac;
 
@@ -482 +612 @@
         /* do not manipulate our control entries */
         if (ldb_dn_is_special(req->op.mod.message->dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        sd_propagation_control = ldb_request_get_control(req,
+                                        DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+        if (sd_propagation_control != NULL) {
+                if (req->op.mod.message->num_elements != 1) {
+                        return ldb_module_operr(module);
+                }
+                ret = strcmp(req->op.mod.message->elements[0].name,
+                             "nTSecurityDescriptor");
+                if (ret != 0) {
+                        return ldb_module_operr(module);
+                }
+
                 return ldb_next_request(module, req);
         }

vendor/current/source4/dsdb/samdb/ldb_modules/operational.c

@@ -85 +85 @@
 };
 
+enum search_type {
+        TOKEN_GROUPS,
+        TOKEN_GROUPS_GLOBAL_AND_UNIVERSAL,
+        TOKEN_GROUPS_NO_GC_ACCEPTABLE
+};
+
 /*
   construct a canonical name from a message
@@ -128 +134 @@
   construct the token groups for SAM objects from a message
 */
-static int construct_token_groups(struct ldb_module *module,
-                                  struct ldb_message *msg, enum ldb_scope scope,
-                                  struct ldb_request *parent)
-{
-        struct ldb_context *ldb = ldb_module_get_ctx(module);;
+static int construct_generic_token_groups(struct ldb_module *module,
+                                          struct ldb_message *msg, enum ldb_scope scope,
+                                          struct ldb_request *parent,
+                                          const char *attribute_string,
+                                          enum search_type type)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
         TALLOC_CTX *tmp_ctx = talloc_new(msg);
         unsigned int i;
         int ret;
-        const char *filter;
+        const char *filter = NULL;
 
         NTSTATUS status;
@@ -190 +198 @@
 
         /* only return security groups */
-        filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
-                                 GROUP_TYPE_SECURITY_ENABLED);
+        switch(type) {
+        case TOKEN_GROUPS_GLOBAL_AND_UNIVERSAL:
+                filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u)(|(groupType:1.2.840.113556.1.4.803:=%u)(groupType:1.2.840.113556.1.4.803:=%u)))",
+                                         GROUP_TYPE_SECURITY_ENABLED, GROUP_TYPE_ACCOUNT_GROUP, GROUP_TYPE_UNIVERSAL_GROUP);
+                break;
+        case TOKEN_GROUPS_NO_GC_ACCEPTABLE:
+        case TOKEN_GROUPS:
+                filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
+                                         GROUP_TYPE_SECURITY_ENABLED);
+                break;
+        }
+
         if (!filter) {
                 talloc_free(tmp_ctx);
@@ -254 +272 @@
 
         for (i=0; i < num_groupSIDs; i++) {
-                ret = samdb_msg_add_dom_sid(ldb, msg, msg, "tokenGroups", &groupSIDs[i]);
+                ret = samdb_msg_add_dom_sid(ldb, msg, msg, attribute_string, &groupSIDs[i]);
                 if (ret) {
                         talloc_free(tmp_ctx);
@@ -264 +282 @@
 }
 
+static int construct_token_groups(struct ldb_module *module,
+                                  struct ldb_message *msg, enum ldb_scope scope,
+                                  struct ldb_request *parent)
+{
+        /**
+         * TODO: Add in a limiting domain when we start to support
+         * trusted domains.
+         */
+        return construct_generic_token_groups(module, msg, scope, parent,
+                                              "tokenGroups",
+                                              TOKEN_GROUPS);
+}
+
+static int construct_token_groups_no_gc(struct ldb_module *module,
+                                        struct ldb_message *msg, enum ldb_scope scope,
+                                        struct ldb_request *parent)
+{
+        /**
+         * TODO: Add in a limiting domain when we start to support
+         * trusted domains.
+         */
+        return construct_generic_token_groups(module, msg, scope, parent,
+                                              "tokenGroupsNoGCAcceptable",
+                                              TOKEN_GROUPS);
+}
+
+static int construct_global_universal_token_groups(struct ldb_module *module,
+                                                   struct ldb_message *msg, enum ldb_scope scope,
+                                                   struct ldb_request *parent)
+{
+        return construct_generic_token_groups(module, msg, scope, parent,
+                                              "tokenGroupsGlobalAndUniversal",
+                                              TOKEN_GROUPS_GLOBAL_AND_UNIVERSAL);
+}
 /*
   construct the parent GUID for an entry from a message
@@ -284 +336 @@
                                     DSDB_FLAG_NEXT_MODULE |
                                     DSDB_SEARCH_SHOW_RECYCLED, parent);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
 
         instanceType = ldb_msg_find_attr_as_uint(res->msgs[0],
@@ -307 +362 @@
         /* not NC, so the object should have a parent*/
         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
-                DEBUG(4,(__location__ ": Parent dn for %s does not exist \n",
-                         ldb_dn_get_linearized(msg->dn)));
-                return ldb_operr(ldb_module_get_ctx(module));
+                return ldb_error(ldb_module_get_ctx(module), LDB_ERR_OPERATIONS_ERROR, 
+                                 talloc_asprintf(msg, "Parent dn for %s does not exist", 
+                                                 ldb_dn_get_linearized(msg->dn)));
         } else if (ret != LDB_SUCCESS) {
                 return ret;
@@ -320 +375 @@
         }
 
-        v = data_blob_dup_talloc(parent_res, parent_guid);
+        v = data_blob_dup_talloc(parent_res, *parent_guid);
         if (!v.data) {
                 talloc_free(parent_res);
@@ -328 +383 @@
         talloc_free(parent_res);
         return ret;
+}
+
+static int construct_modifyTimeStamp(struct ldb_module *module,
+                                        struct ldb_message *msg, enum ldb_scope scope,
+                                        struct ldb_request *parent)
+{
+        struct operational_data *data = talloc_get_type(ldb_module_get_private(module), struct operational_data);
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+
+        /* We may be being called before the init function has finished */
+        if (!data) {
+                return LDB_SUCCESS;
+        }
+
+        /* Try and set this value up, if possible.  Don't worry if it
+         * fails, we may not have the DB set up yet.
+         */
+        if (!data->aggregate_dn) {
+                data->aggregate_dn = samdb_aggregate_schema_dn(ldb, data);
+        }
+
+        if (data->aggregate_dn && ldb_dn_compare(data->aggregate_dn, msg->dn) == 0) {
+                /*
+                 * If we have the DN for the object with common name = Aggregate and
+                 * the request is for this DN then let's do the following:
+                 * 1) search the object which changedUSN correspond to the one of the loaded
+                 * schema.
+                 * 2) Get the whenChanged attribute
+                 * 3) Generate the modifyTimestamp out of the whenChanged attribute
+                 */
+                const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
+                char *value = ldb_timestring(msg, schema->ts_last_change);
+
+                return ldb_msg_add_string(msg, "modifyTimeStamp", value);
+        }
+        return ldb_msg_copy_attr(msg, "whenChanged", "modifyTimeStamp");
 }
 
@@ -372 +463 @@
         if (!ldb) {
                 DEBUG(4, (__location__ ": Failed to get ldb \n"));
-                return ldb_operr(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
         }
 
@@ -527 +618 @@
                 return LDB_SUCCESS;
         }
-        if (!omd_value) {
-                return LDB_SUCCESS;
-        }
 
         omd = talloc(msg, struct replPropertyMetaDataBlob);
@@ -568 +656 @@
 }
 
+#define _UF_TRUST_ACCOUNTS ( \
+        UF_WORKSTATION_TRUST_ACCOUNT | \
+        UF_SERVER_TRUST_ACCOUNT | \
+        UF_INTERDOMAIN_TRUST_ACCOUNT \
+)
+#define _UF_NO_EXPIRY_ACCOUNTS ( \
+        UF_SMARTCARD_REQUIRED | \
+        UF_DONT_EXPIRE_PASSWD | \
+        _UF_TRUST_ACCOUNTS \
+)
+
+/*
+  calculate msDS-UserPasswordExpiryTimeComputed
+*/
+static NTTIME get_msds_user_password_expiry_time_computed(struct ldb_module *module,
+                                                struct ldb_message *msg,
+                                                struct ldb_dn *domain_dn)
+{
+        int64_t pwdLastSet, maxPwdAge;
+        uint32_t userAccountControl;
+        NTTIME ret;
+
+        userAccountControl = ldb_msg_find_attr_as_uint(msg,
+                                        "userAccountControl",
+                                        0);
+        if (userAccountControl & _UF_NO_EXPIRY_ACCOUNTS) {
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        pwdLastSet = ldb_msg_find_attr_as_int64(msg, "pwdLastSet", 0);
+        if (pwdLastSet == 0) {
+                return 0;
+        }
+
+        if (pwdLastSet <= -1) {
+                /*
+                 * This can't really happen...
+                 */
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        if (pwdLastSet >= 0x7FFFFFFFFFFFFFFFULL) {
+                /*
+                 * Somethings wrong with the clock...
+                 */
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        /*
+         * Note that maxPwdAge is a stored as negative value.
+         *
+         * Possible values are in the range of:
+         *
+         * maxPwdAge: -864000000001
+         * to
+         * maxPwdAge: -9223372036854775808 (-0x8000000000000000ULL)
+         *
+         */
+        maxPwdAge = samdb_search_int64(ldb_module_get_ctx(module), msg, 0,
+                                       domain_dn, "maxPwdAge", NULL);
+        if (maxPwdAge >= -864000000000) {
+                /*
+                 * This is not really possible...
+                 */
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        if (maxPwdAge == -0x8000000000000000ULL) {
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        /*
+         * Note we already catched maxPwdAge == -0x8000000000000000ULL
+         * and pwdLastSet >= 0x7FFFFFFFFFFFFFFFULL above.
+         *
+         * Remember maxPwdAge is a negative number,
+         * so it results in the following.
+         *
+         * 0x7FFFFFFFFFFFFFFEULL + 0x7FFFFFFFFFFFFFFFULL
+         * =
+         * 0xFFFFFFFFFFFFFFFFULL
+         */
+        ret = pwdLastSet - maxPwdAge;
+        if (ret >= 0x7FFFFFFFFFFFFFFFULL) {
+                return 0x7FFFFFFFFFFFFFFFULL;
+        }
+
+        return ret;
+}
+
+
+/*
+  construct msDS-User-Account-Control-Computed attr
+*/
+static int construct_msds_user_account_control_computed(struct ldb_module *module,
+                                                        struct ldb_message *msg, enum ldb_scope scope,
+                                                        struct ldb_request *parent)
+{
+        uint32_t userAccountControl;
+        uint32_t msDS_User_Account_Control_Computed = 0;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        NTTIME now;
+        struct ldb_dn *nc_root;
+        int ret;
+
+        ret = dsdb_find_nc_root(ldb, msg, msg->dn, &nc_root);
+        if (ret != 0) {
+                ldb_asprintf_errstring(ldb,
+                                       "Failed to find NC root of DN: %s: %s",
+                                       ldb_dn_get_linearized(msg->dn),
+                                       ldb_errstring(ldb_module_get_ctx(module)));
+                return ret;
+        }
+        if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) != 0) {
+                /* Only calculate this on our default NC */
+                return 0;
+        }
+        /* Test account expire time */
+        unix_to_nt_time(&now, time(NULL));
+
+        userAccountControl = ldb_msg_find_attr_as_uint(msg,
+                                                       "userAccountControl",
+                                                       0);
+        if (!(userAccountControl & _UF_TRUST_ACCOUNTS)) {
+
+                int64_t lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
+                if (lockoutTime != 0) {
+                        int64_t lockoutDuration = samdb_search_int64(ldb,
+                                                                     msg, 0, nc_root,
+                                                                     "lockoutDuration", NULL);
+                        if (lockoutDuration >= 0) {
+                                msDS_User_Account_Control_Computed |= UF_LOCKOUT;
+                        } else if (lockoutTime - lockoutDuration >= now) {
+                                msDS_User_Account_Control_Computed |= UF_LOCKOUT;
+                        }
+                }
+        }
+
+        if (!(userAccountControl & _UF_NO_EXPIRY_ACCOUNTS)) {
+                NTTIME must_change_time
+                        = get_msds_user_password_expiry_time_computed(module,
+                                                                      msg, nc_root);
+                /* check for expired password */
+                if (must_change_time < now) {
+                        msDS_User_Account_Control_Computed |= UF_PASSWORD_EXPIRED;
+                }
+        }
+
+        return samdb_msg_add_int64(ldb,
+                                   msg->elements, msg,
+                                   "msDS-User-Account-Control-Computed",
+                                   msDS_User_Account_Control_Computed);
+}
+
+/*
+  construct msDS-UserPasswordExpiryTimeComputed
+*/
+static int construct_msds_user_password_expiry_time_computed(struct ldb_module *module,
+                                                             struct ldb_message *msg, enum ldb_scope scope,
+                                                             struct ldb_request *parent)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct ldb_dn *nc_root;
+        int64_t password_expiry_time;
+        int ret;
+
+        ret = dsdb_find_nc_root(ldb, msg, msg->dn, &nc_root);
+        if (ret != 0) {
+                ldb_asprintf_errstring(ldb,
+                                       "Failed to find NC root of DN: %s: %s",
+                                       ldb_dn_get_linearized(msg->dn),
+                                       ldb_errstring(ldb));
+                return ret;
+        }
+
+        if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) != 0) {
+                /* Only calculate this on our default NC */
+                return 0;
+        }
+
+        password_expiry_time
+                = get_msds_user_password_expiry_time_computed(module, msg,
+                                                              nc_root);
+
+        return samdb_msg_add_int64(ldb,
+                                   msg->elements, msg,
+                                   "msDS-UserPasswordExpiryTimeComputed",
+                                   password_expiry_time);
+}
+
+
 struct op_controls_flags {
         bool sd;
@@ -574 +853 @@
 
 static bool check_keep_control_for_attribute(struct op_controls_flags* controls_flags, const char* attr) {
-        if (ldb_attr_cmp(attr, "msDS-KeyVersionNumber") == 0 && controls_flags->bypassoperational) {
+        if (controls_flags->bypassoperational && ldb_attr_cmp(attr, "msDS-KeyVersionNumber") == 0 ) {
                 return true;
         }
@@ -593 +872 @@
 
 
+struct op_attributes_replace {
+        const char *attr;
+        const char *replace;
+        const char * const *extra_attrs;
+        int (*constructor)(struct ldb_module *, struct ldb_message *, enum ldb_scope, struct ldb_request *);
+};
+
+
+static const char *objectSid_attr[] =
+{
+        "objectSid",
+        NULL
+};
+
+
+static const char *objectCategory_attr[] =
+{
+        "objectCategory",
+        NULL
+};
+
+
+static const char *user_account_control_computed_attrs[] =
+{
+        "lockoutTime",
+        "pwdLastSet",
+        NULL
+};
+
+
+static const char *user_password_expiry_time_computed_attrs[] =
+{
+        "pwdLastSet",
+        NULL
+};
+
+
 /*
   a list of attribute names that are hidden, but can be searched for
   using another (non-hidden) name to produce the correct result
 */
-static const struct {
-        const char *attr;
-        const char *replace;
-        const char *extra_attr;
-        int (*constructor)(struct ldb_module *, struct ldb_message *, enum ldb_scope, struct ldb_request *);
-} search_sub[] = {
+static const struct op_attributes_replace search_sub[] = {
         { "createTimeStamp", "whenCreated", NULL , NULL },
-        { "modifyTimeStamp", "whenChanged", NULL , NULL },
+        { "modifyTimeStamp", "whenChanged", NULL , construct_modifyTimeStamp},
         { "structuralObjectClass", "objectClass", NULL , NULL },
         { "canonicalName", NULL, NULL , construct_canonical_name },
-        { "primaryGroupToken", "objectClass", "objectSid", construct_primary_group_token },
-        { "tokenGroups", "primaryGroupID", "objectSid", construct_token_groups },
+        { "primaryGroupToken", "objectClass", objectSid_attr, construct_primary_group_token },
+        { "tokenGroups", "primaryGroupID", objectSid_attr, construct_token_groups },
+        { "tokenGroupsNoGCAcceptable", "primaryGroupID", objectSid_attr, construct_token_groups_no_gc},
+        { "tokenGroupsGlobalAndUniversal", "primaryGroupID", objectSid_attr, construct_global_universal_token_groups },
         { "parentGUID", NULL, NULL, construct_parent_guid },
         { "subSchemaSubEntry", NULL, NULL, construct_subschema_subentry },
-        { "msDS-isRODC", "objectClass", "objectCategory", construct_msds_isrodc },
-        { "msDS-KeyVersionNumber", "replPropertyMetaData", NULL, construct_msds_keyversionnumber }
+        { "msDS-isRODC", "objectClass", objectCategory_attr, construct_msds_isrodc },
+        { "msDS-KeyVersionNumber", "replPropertyMetaData", NULL, construct_msds_keyversionnumber },
+        { "msDS-User-Account-Control-Computed", "userAccountControl", user_account_control_computed_attrs,
+          construct_msds_user_account_control_computed },
+        { "msDS-UserPasswordExpiryTimeComputed", "userAccountControl", user_password_expiry_time_computed_attrs,
+          construct_msds_user_password_expiry_time_computed }
 };
 
@@ -629 +946 @@
   Some of these are attributes that were once stored, but are now calculated
 */
-static const struct {
+struct op_attributes_operations {
         const char *attr;
         enum op_remove op;
-} operational_remove[] = {
+};
+
+static const struct op_attributes_operations operational_remove[] = {
         { "nTSecurityDescriptor",    OPERATIONAL_SD_FLAGS },
         { "msDS-KeyVersionNumber",   OPERATIONAL_REMOVE_UNLESS_CONTROL  },
@@ -654 +973 @@
                                            const char * const *attrs_searched_for,
                                            struct op_controls_flags* controls_flags,
+                                           struct op_attributes_operations *list,
+                                           unsigned int list_size,
+                                           struct op_attributes_replace *list_replace,
+                                           unsigned int list_replace_size,
                                            struct ldb_request *parent)
 {
@@ -663 +986 @@
 
         /* removed any attrs that should not be shown to the user */
-        for (i=0; i<ARRAY_SIZE(operational_remove); i++) {
-                switch (operational_remove[i].op) {
-                case OPERATIONAL_REMOVE_UNASKED:
-                        if (ldb_attr_in_list(attrs_from_user, operational_remove[i].attr)) {
-                                continue;
-                        }
-                        if (ldb_attr_in_list(attrs_searched_for, operational_remove[i].attr)) {
-                                continue;
-                        }
-                case OPERATIONAL_REMOVE_ALWAYS:
-                        ldb_msg_remove_attr(msg, operational_remove[i].attr);
-                        break;
-                case OPERATIONAL_REMOVE_UNLESS_CONTROL:
-                        if (!check_keep_control_for_attribute(controls_flags, operational_remove[i].attr)) {
-                                ldb_msg_remove_attr(msg, operational_remove[i].attr);
-                                break;
-                        } else {
-                                continue;
-                        }
-                case OPERATIONAL_SD_FLAGS:
-                        if (controls_flags->sd ||
-                            ldb_attr_in_list(attrs_from_user, operational_remove[i].attr)) {
-                                continue;
-                        }
-                        ldb_msg_remove_attr(msg, operational_remove[i].attr);
-                        break;
-                }
-        }
-
-        for (a=0;attrs_from_user && attrs_from_user[a];a++) {
-                if (check_keep_control_for_attribute(controls_flags, attrs_from_user[a])) {
+        for (i=0; i < list_size; i++) {
+                ldb_msg_remove_attr(msg, list[i].attr);
+        }
+
+        for (a=0; a < list_replace_size; a++) {
+                if (check_keep_control_for_attribute(controls_flags,
+                                                     list_replace[a].attr)) {
                         continue;
                 }
-                for (i=0;i<ARRAY_SIZE(search_sub);i++) {
-                        if (ldb_attr_cmp(attrs_from_user[a], search_sub[i].attr) != 0) {
-                                continue;
-                        }
-
-                        /* construct the new attribute, using either a supplied
-                           constructor or a simple copy */
-                        constructed_attributes = true;
-                        if (search_sub[i].constructor != NULL) {
-                                if (search_sub[i].constructor(module, msg, scope, parent) != LDB_SUCCESS) {
-                                        goto failed;
-                                }
-                        } else if (ldb_msg_copy_attr(msg,
-                                                     search_sub[i].replace,
-                                                     search_sub[i].attr) != LDB_SUCCESS) {
+
+                /* construct the new attribute, using either a supplied
+                        constructor or a simple copy */
+                constructed_attributes = true;
+                if (list_replace[a].constructor != NULL) {
+                        if (list_replace[a].constructor(module, msg, scope, parent) != LDB_SUCCESS) {
                                 goto failed;
                         }
+                } else if (ldb_msg_copy_attr(msg,
+                                             list_replace[a].replace,
+                                             list_replace[a].attr) != LDB_SUCCESS) {
+                        goto failed;
                 }
         }
@@ -721 +1015 @@
          */
         if ((constructed_attributes) && (!ldb_attr_in_list(attrs_from_user, "*"))) {
-                for (i=0;i<ARRAY_SIZE(search_sub);i++) {
+                for (i=0; i < list_replace_size; i++) {
                         /* remove the added search helper attributes, unless
                          * they were asked for by the user */
-                        if (search_sub[i].replace != NULL && 
-                            !ldb_attr_in_list(attrs_from_user, search_sub[i].replace)) {
-                                ldb_msg_remove_attr(msg, search_sub[i].replace);
-                        }
-                        if (search_sub[i].extra_attr != NULL && 
-                            !ldb_attr_in_list(attrs_from_user, search_sub[i].extra_attr)) {
-                                ldb_msg_remove_attr(msg, search_sub[i].extra_attr);
+                        if (list_replace[i].replace != NULL &&
+                            !ldb_attr_in_list(attrs_from_user, list_replace[i].replace)) {
+                                ldb_msg_remove_attr(msg, list_replace[i].replace);
+                        }
+                        if (list_replace[i].extra_attrs != NULL) {
+                                unsigned int j;
+                                for (j=0; list_replace[i].extra_attrs[j]; j++) {
+                                        if (!ldb_attr_in_list(attrs_from_user, list_replace[i].extra_attrs[j])) {
+                                                ldb_msg_remove_attr(msg, list_replace[i].extra_attrs[j]);
+                                        }
+                                }
                         }
                 }
@@ -754 +1052 @@
         const char * const *attrs;
         struct op_controls_flags* controls_flags;
+        struct op_attributes_operations *list_operations;
+        unsigned int list_operations_size;
+        struct op_attributes_replace *attrs_to_replace;
+        unsigned int attrs_to_replace_size;
 };
 
@@ -781 +1083 @@
                                                       ac->attrs,
                                                       req->op.search.attrs,
-                                                      ac->controls_flags, req);
+                                                      ac->controls_flags,
+                                                      ac->list_operations,
+                                                      ac->list_operations_size,
+                                                      ac->attrs_to_replace,
+                                                      ac->attrs_to_replace_size,
+                                                      req);
                 if (ret != 0) {
                         return ldb_module_done(ac->req, NULL, NULL,
@@ -799 +1106 @@
         talloc_free(ares);
         return LDB_SUCCESS;
+}
+
+static struct op_attributes_operations* operation_get_op_list(TALLOC_CTX *ctx,
+                                                              const char* const* attrs,
+                                                              const char* const* searched_attrs,
+                                                              struct op_controls_flags* controls_flags)
+{
+        int idx = 0;
+        int i;
+        struct op_attributes_operations *list = talloc_zero_array(ctx,
+                                                                  struct op_attributes_operations,
+                                                                  ARRAY_SIZE(operational_remove) + 1);
+
+        if (list == NULL) {
+                return NULL;
+        }
+
+        for (i=0; i<ARRAY_SIZE(operational_remove); i++) {
+                switch (operational_remove[i].op) {
+                case OPERATIONAL_REMOVE_UNASKED:
+                        if (ldb_attr_in_list(attrs, operational_remove[i].attr)) {
+                                continue;
+                        }
+                        if (ldb_attr_in_list(searched_attrs, operational_remove[i].attr)) {
+                                continue;
+                        }
+                        list[idx].attr = operational_remove[i].attr;
+                        list[idx].op = OPERATIONAL_REMOVE_UNASKED;
+                        idx++;
+                        break;
+
+                case OPERATIONAL_REMOVE_ALWAYS:
+                        list[idx].attr = operational_remove[i].attr;
+                        list[idx].op = OPERATIONAL_REMOVE_ALWAYS;
+                        idx++;
+                        break;
+
+                case OPERATIONAL_REMOVE_UNLESS_CONTROL:
+                        if (!check_keep_control_for_attribute(controls_flags, operational_remove[i].attr)) {
+                                list[idx].attr = operational_remove[i].attr;
+                                list[idx].op = OPERATIONAL_REMOVE_UNLESS_CONTROL;
+                                idx++;
+                        }
+                        break;
+
+                case OPERATIONAL_SD_FLAGS:
+                        if (ldb_attr_in_list(attrs, operational_remove[i].attr)) {
+                                continue;
+                        }
+                        if (controls_flags->sd) {
+                                if (attrs == NULL) {
+                                        continue;
+                                }
+                                if (attrs[0] == NULL) {
+                                        continue;
+                                }
+                                if (ldb_attr_in_list(attrs, "*")) {
+                                        continue;
+                                }
+                        }
+                        list[idx].attr = operational_remove[i].attr;
+                        list[idx].op = OPERATIONAL_SD_FLAGS;
+                        idx++;
+                        break;
+                }
+        }
+
+        return list;
 }
 
@@ -845 +1220 @@
                 (ldb_request_get_control(req, LDB_CONTROL_BYPASS_OPERATIONAL_OID) != NULL);
 
+        ac->attrs_to_replace = NULL;
+        ac->attrs_to_replace_size = 0;
         /* in the list of attributes we are looking for, rename any
            attributes to the alias for any hidden attributes that can
@@ -853 +1230 @@
                 }
                 for (i=0;i<ARRAY_SIZE(search_sub);i++) {
-                        if (ldb_attr_cmp(ac->attrs[a], search_sub[i].attr) == 0 &&
-                            search_sub[i].replace) {
-
-                                if (search_sub[i].extra_attr) {
-                                        const char **search_attrs2;
-                                        /* Only adds to the end of the list */
+
+                        if (ldb_attr_cmp(ac->attrs[a], search_sub[i].attr) != 0 ) {
+                                continue;
+                        }
+
+                        ac->attrs_to_replace = talloc_realloc(ac,
+                                                              ac->attrs_to_replace,
+                                                              struct op_attributes_replace,
+                                                              ac->attrs_to_replace_size + 1);
+
+                        ac->attrs_to_replace[ac->attrs_to_replace_size] = search_sub[i];
+                        ac->attrs_to_replace_size++;
+                        if (!search_sub[i].replace) {
+                                continue;
+                        }
+
+                        if (search_sub[i].extra_attrs && search_sub[i].extra_attrs[0]) {
+                                unsigned int j;
+                                const char **search_attrs2;
+                                /* Only adds to the end of the list */
+                                for (j = 0; search_sub[i].extra_attrs[j]; j++) {
                                         search_attrs2 = ldb_attr_list_copy_add(req, search_attrs
                                                                                ? search_attrs
                                                                                : ac->attrs, 
-                                                                               search_sub[i].extra_attr);
+                                                                               search_sub[i].extra_attrs[j]);
                                         if (search_attrs2 == NULL) {
                                                 return ldb_operr(ldb);
@@ -870 +1262 @@
                                         search_attrs = search_attrs2;
                                 }
-
-                                if (!search_attrs) {
-                                        search_attrs = ldb_attr_list_copy(req, ac->attrs);
-                                        if (search_attrs == NULL) {
-                                                return ldb_operr(ldb);
-                                        }
+                        }
+
+                        if (!search_attrs) {
+                                search_attrs = ldb_attr_list_copy(req, ac->attrs);
+                                if (search_attrs == NULL) {
+                                        return ldb_operr(ldb);
                                 }
-                                /* Despite the ldb_attr_list_copy_add, this is safe as that fn only adds to the end */
-                                search_attrs[a] = search_sub[i].replace;
-                        }
-                }
-        }
-
+                        }
+                        /* Despite the ldb_attr_list_copy_add, this is safe as that fn only adds to the end */
+                        search_attrs[a] = search_sub[i].replace;
+                }
+        }
+        ac->list_operations = operation_get_op_list(ac, ac->attrs,
+                                                    search_attrs == NULL?req->op.search.attrs:search_attrs,
+                                                    ac->controls_flags);
+        ac->list_operations_size = 0;
+        i = 0;
+
+        while (ac->list_operations && ac->list_operations[i].attr != NULL) {
+                i++;
+        }
+        ac->list_operations_size = i;
         ret = ldb_build_search_req_ex(&down_req, ldb, ac,
                                         req->op.search.base,

vendor/current/source4/dsdb/samdb/ldb_modules/partition.c

@@ -135 +135 @@
         struct ldb_request *nreq;
         int ret;
-        struct partition_private_data *data;
         struct ldb_control *partition_ctrl;
 
         ac = talloc_get_type(req->context, struct partition_context);
-        data = talloc_get_type(ldb_module_get_private(ac->module), struct partition_private_data);
 
         if (!ares) {
@@ -399 +397 @@
 }
 
+
+/**
+ * send an operation to the top partition, then copy the resulting
+ * object to all other partitions
+ */
+static int partition_copy_all(struct ldb_module *module,
+                              struct partition_context *ac,
+                              struct ldb_request *req,
+                              struct ldb_dn *dn)
+{
+        unsigned int i;
+        struct partition_private_data *data = talloc_get_type(ldb_module_get_private(module),
+                                                              struct partition_private_data);
+        int ret, search_ret;
+        struct ldb_result *res;
+
+        /* do the request on the top level sam.ldb synchronously */
+        ret = ldb_next_request(module, req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        /* now fetch the resulting object, and then copy it to all the
+         * other partitions. We need this approach to cope with the
+         * partitions getting out of sync. If for example the
+         * @ATTRIBUTES object exists on one partition but not the
+         * others then just doing each of the partitions in turn will
+         * lead to an error
+         */
+        search_ret = dsdb_module_search_dn(module, ac, &res, dn, NULL, DSDB_FLAG_NEXT_MODULE, req);
+        if (search_ret != LDB_SUCCESS && ret != LDB_ERR_NO_SUCH_OBJECT) {
+                return search_ret;
+        }
+
+        /* now delete the object in the other partitions. Once that is
+           done we will re-add the object, if search_ret was not
+           LDB_ERR_NO_SUCH_OBJECT
+        */
+        for (i=0; data->partitions && data->partitions[i]; i++) {
+                int pret;
+                pret = dsdb_module_del(data->partitions[i]->module, dn, DSDB_FLAG_NEXT_MODULE, req);
+                if (pret != LDB_SUCCESS && pret != LDB_ERR_NO_SUCH_OBJECT) {
+                        /* we should only get success or no
+                           such object from the other partitions */
+                        return pret;
+                }
+        }
+
+
+        if (search_ret != LDB_ERR_NO_SUCH_OBJECT) {
+                /* now re-add in the other partitions */
+                for (i=0; data->partitions && data->partitions[i]; i++) {
+                        int pret;
+                        pret = dsdb_module_add(data->partitions[i]->module, res->msgs[0], DSDB_FLAG_NEXT_MODULE, req);
+                        if (pret != LDB_SUCCESS) {
+                                return pret;
+                        }
+                }
+        }
+
+        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+}
+
 /**
  * Figure out which backend a request needs to be aimed at.  Some
@@ -428 +493 @@
                                 }
                                 
-                                return partition_send_all(module, ac, req);
+                                return partition_copy_all(module, ac, req, dn);
                         }
                 }
@@ -477 +542 @@
         struct ldb_control *search_control = ldb_request_get_control(req, LDB_CONTROL_SEARCH_OPTIONS_OID);
         struct ldb_control *domain_scope_control = ldb_request_get_control(req, LDB_CONTROL_DOMAIN_SCOPE_OID);
+        struct ldb_control *no_gc_control = ldb_request_get_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG);
         
         struct ldb_search_options_control *search_options = NULL;
@@ -484 +550 @@
         bool domain_scope = false, phantom_root = false;
 
-        /* see if we are still up-to-date */
-        ret = partition_reload_if_required(module, data, req);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
         p = find_partition(data, NULL, req);
         if (p != NULL) {
@@ -518 +578 @@
         }
 
+        /* Special DNs without specified partition should go further */
+        if (ldb_dn_is_special(req->op.search.base)) {
+                return ldb_next_request(module, req);
+        }
+
         /* Locate the options */
         domain_scope = (search_options
@@ -543 +608 @@
         /* Search from the base DN */
         if (ldb_dn_is_null(req->op.search.base)) {
+                if (!phantom_root) {
+                        return ldb_error(ldb, LDB_ERR_NO_SUCH_OBJECT, "empty base DN");
+                }
                 return partition_send_all(module, ac, req);
         }
@@ -548 +616 @@
         for (i=0; data->partitions[i]; i++) {
                 bool match = false, stop = false;
+
+                if (data->partitions[i]->partial_replica && no_gc_control != NULL) {
+                        if (ldb_dn_compare_base(data->partitions[i]->ctrl->dn,
+                                                req->op.search.base) == 0) {
+                                /* base DN is in a partial replica
+                                   with the NO_GLOBAL_CATALOG
+                                   control. This partition is invisible */
+                                /* DEBUG(0,("DENYING NON-GC OP: %s\n", ldb_module_call_chain(req, req))); */
+                                continue;
+                        }
+                }
 
                 if (phantom_root) {
@@ -615 +694 @@
                                 /* Initialise the referrals list */
                                 if (ac->referrals == NULL) {
-                                        ac->referrals = (const char **) str_list_make_empty(ac);
+                                        char **l = str_list_make_empty(ac);
+                                        ac->referrals = discard_const_p(const char *, l);
                                         if (ac->referrals == NULL) {
                                                 return ldb_oom(ldb);
@@ -726 +806 @@
 static int partition_start_trans(struct ldb_module *module)
 {
-        unsigned int i;
+        int i;
         int ret;
         struct partition_private_data *data = talloc_get_type(ldb_module_get_private(module),
@@ -733 +813 @@
         /* Figure out which partition it is under */
         /* Skip the lot if 'data' isn't here yet (initialization) */
-        if ((module && ldb_module_flags(ldb_module_get_ctx(module)) & LDB_FLG_ENABLE_TRACING)) {
+        if (ldb_module_flags(ldb_module_get_ctx(module)) & LDB_FLG_ENABLE_TRACING) {
                 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_TRACE, "partition_start_trans() -> (metadata partition)");
         }
@@ -743 +823 @@
         ret = partition_reload_if_required(module, data, NULL);
         if (ret != LDB_SUCCESS) {
+                ldb_next_del_trans(module);
+                return ret;
+        }
+
+        ret = partition_metadata_start_trans(module);
+        if (ret != LDB_SUCCESS) {
+                ldb_next_del_trans(module);
                 return ret;
         }
@@ -758 +845 @@
                         }
                         ldb_next_del_trans(module);
+                        partition_metadata_del_trans(module);
                         return ret;
                 }
@@ -773 +861 @@
         struct partition_private_data *data = talloc_get_type(ldb_module_get_private(module),
                                                               struct partition_private_data);
+        int ret;
 
         for (i=0; data && data->partitions && data->partitions[i]; i++) {
-                int ret;
-
                 if ((module && ldb_module_flags(ldb_module_get_ctx(module)) & LDB_FLG_ENABLE_TRACING)) {
                         ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_TRACE, "partition_prepare_commit() -> %s",
@@ -793 +880 @@
                 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_TRACE, "partition_prepare_commit() -> (metadata partition)");
         }
-        return ldb_next_prepare_commit(module);
+
+        ret = ldb_next_prepare_commit(module);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        /* metadata prepare commit must come last, as other partitions could modify
+         * the database inside the prepare commit method of a module */
+        return partition_metadata_prepare_commit(module);
 }
 
@@ -812 +907 @@
         } else {
                 data->in_transaction--;
+        }
+
+        ret2 = partition_metadata_end_trans(module);
+        if (ret2 != LDB_SUCCESS) {
+                ret = ret2;
         }
 
@@ -845 +945 @@
         struct partition_private_data *data = talloc_get_type(ldb_module_get_private(module),
                                                               struct partition_private_data);
+        ret = partition_metadata_del_trans(module);
+        if (ret != LDB_SUCCESS) {
+                final_ret = ret;
+        }
+
         for (i=0; data && data->partitions && data->partitions[i]; i++) {
                 if ((module && ldb_module_flags(ldb_module_get_ctx(module)) & LDB_FLG_ENABLE_TRACING)) {
@@ -876 +981 @@
 
 int partition_primary_sequence_number(struct ldb_module *module, TALLOC_CTX *mem_ctx, 
-                                     enum ldb_sequence_type type, uint64_t *seq_number) 
+                                      uint64_t *seq_number,
+                                      struct ldb_request *parent)
 {
         int ret;
         struct ldb_result *res;
         struct ldb_seqnum_request *tseq;
-        struct ldb_request *treq;
         struct ldb_seqnum_result *seqr;
-        res = talloc_zero(mem_ctx, struct ldb_result);
-        if (res == NULL) {
+
+        tseq = talloc_zero(mem_ctx, struct ldb_seqnum_request);
+        if (tseq == NULL) {
                 return ldb_oom(ldb_module_get_ctx(module));
         }
-        tseq = talloc_zero(res, struct ldb_seqnum_request);
-        if (tseq == NULL) {
+        tseq->type = LDB_SEQ_HIGHEST_SEQ;
+        
+        ret = dsdb_module_extended(module, tseq, &res,
+                                   LDB_EXTENDED_SEQUENCE_NUMBER,
+                                   tseq,
+                                   DSDB_FLAG_NEXT_MODULE,
+                                   parent);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tseq);
+                return ret;
+        }
+        
+        seqr = talloc_get_type_abort(res->extended->data,
+                                     struct ldb_seqnum_result);
+        if (seqr->flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
                 talloc_free(res);
-                return ldb_oom(ldb_module_get_ctx(module));
-        }
-        tseq->type = type;
-        
-        ret = ldb_build_extended_req(&treq, ldb_module_get_ctx(module), res,
-                                     LDB_EXTENDED_SEQUENCE_NUMBER,
-                                     tseq,
-                                     NULL,
-                                     res,
-                                     ldb_extended_default_callback,
-                                     NULL);
-        LDB_REQ_SET_LOCATION(treq);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return ret;
-        }
-        
-        ret = ldb_next_request(module, treq);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return ret;
-        }
-        ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return ret;
-        }
-        
-        seqr = talloc_get_type(res->extended->data,
-                               struct ldb_seqnum_result);
-        if (seqr->flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
-                ret = LDB_ERR_OPERATIONS_ERROR;
-                ldb_set_errstring(ldb_module_get_ctx(module), "Primary backend in partitions module returned a timestamp based seq number (must return a normal number)");
-                talloc_free(res);
-                return ret;
-        } else {
-                *seq_number = seqr->seq_num;
-        }
-        talloc_free(res);
+                return ldb_module_error(module, LDB_ERR_OPERATIONS_ERROR,
+                        "Primary backend in partition module returned a timestamp based seq");
+        }
+
+        *seq_number = seqr->seq_num;
+        talloc_free(tseq);
         return LDB_SUCCESS;
 }
 
-/* FIXME: This function is still semi-async */
-static int partition_sequence_number(struct ldb_module *module, struct ldb_request *req)
+
+/*
+ * Older version of sequence number as sum of sequence numbers for each partition
+ */
+int partition_sequence_number_from_partitions(struct ldb_module *module,
+                                              uint64_t *seqr)
 {
         int ret;
         unsigned int i;
         uint64_t seq_number = 0;
-        uint64_t timestamp_sequence = 0;
-        uint64_t timestamp = 0;
         struct partition_private_data *data = talloc_get_type(ldb_module_get_private(module),
                                                               struct partition_private_data);
-        struct ldb_seqnum_request *seq;
-        struct ldb_seqnum_result *seqr;
-        struct ldb_request *treq;
-        struct ldb_seqnum_request *tseq;
-        struct ldb_seqnum_result *tseqr;
-        struct ldb_extended *ext;
-        struct ldb_result *res;
-        struct dsdb_partition *p;
-
-        p = find_partition(data, NULL, req);
-        if (p != NULL) {
-                /* the caller specified what partition they want the
-                 * sequence number operation on - just pass it on
-                 */
-                return ldb_next_request(p->module, req);                
-        }
-
-        seq = talloc_get_type(req->op.extended.data, struct ldb_seqnum_request);
-
-        switch (seq->type) {
-        case LDB_SEQ_NEXT:
-        case LDB_SEQ_HIGHEST_SEQ:
-
-                ret = partition_primary_sequence_number(module, req, seq->type, &seq_number);
-                if (ret != LDB_SUCCESS) {
-                        return ret;
-                }
-
-                /* Skip the lot if 'data' isn't here yet (initialisation) */
-                for (i=0; data && data->partitions && data->partitions[i]; i++) {
-
-                        res = talloc_zero(req, struct ldb_result);
-                        if (res == NULL) {
-                                return ldb_oom(ldb_module_get_ctx(module));
-                        }
-                        tseq = talloc_zero(res, struct ldb_seqnum_request);
-                        if (tseq == NULL) {
-                                talloc_free(res);
-                                return ldb_oom(ldb_module_get_ctx(module));
-                        }
-                        tseq->type = seq->type;
-
-                        ret = ldb_build_extended_req(&treq, ldb_module_get_ctx(module), res,
-                                                     LDB_EXTENDED_SEQUENCE_NUMBER,
-                                                     tseq,
-                                                     NULL,
-                                                     res,
-                                                     ldb_extended_default_callback,
-                                                     req);
-                        LDB_REQ_SET_LOCATION(treq);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-
-                        ret = ldb_request_add_control(treq,
-                                                      DSDB_CONTROL_CURRENT_PARTITION_OID,
-                                                      false, data->partitions[i]->ctrl);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-
-                        ret = partition_request(data->partitions[i]->module, treq);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-                        ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-                        tseqr = talloc_get_type(res->extended->data,
-                                                struct ldb_seqnum_result);
-                        if (tseqr->flags & LDB_SEQ_TIMESTAMP_SEQUENCE) {
-                                timestamp_sequence = MAX(timestamp_sequence,
-                                                         tseqr->seq_num);
-                        } else {
-                                seq_number += tseqr->seq_num;
-                        }
-                        talloc_free(res);
-                }
-                /* fall through */
-        case LDB_SEQ_HIGHEST_TIMESTAMP:
-
-                res = talloc_zero(req, struct ldb_result);
+
+        ret = partition_primary_sequence_number(module, data, &seq_number, NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        
+        /* Skip the lot if 'data' isn't here yet (initialisation) */
+        for (i=0; data && data->partitions && data->partitions[i]; i++) {
+                struct ldb_seqnum_request *tseq;
+                struct ldb_seqnum_result *tseqr;
+                struct ldb_request *treq;
+                struct ldb_result *res = talloc_zero(data, struct ldb_result);
                 if (res == NULL) {
                         return ldb_oom(ldb_module_get_ctx(module));
                 }
-
                 tseq = talloc_zero(res, struct ldb_seqnum_request);
                 if (tseq == NULL) {
@@ -1038 +1050 @@
                         return ldb_oom(ldb_module_get_ctx(module));
                 }
-                tseq->type = LDB_SEQ_HIGHEST_TIMESTAMP;
-
+                tseq->type = LDB_SEQ_HIGHEST_SEQ;
+                
                 ret = ldb_build_extended_req(&treq, ldb_module_get_ctx(module), res,
                                              LDB_EXTENDED_SEQUENCE_NUMBER,
@@ -1046 +1058 @@
                                              res,
                                              ldb_extended_default_callback,
-                                             req);
+                                             NULL);
                 LDB_REQ_SET_LOCATION(treq);
                 if (ret != LDB_SUCCESS) {
@@ -1052 +1064 @@
                         return ret;
                 }
-
-                ret = ldb_next_request(module, treq);
+                
+                ret = partition_request(data->partitions[i]->module, treq);
                 if (ret != LDB_SUCCESS) {
                         talloc_free(res);
@@ -1063 +1075 @@
                         return ret;
                 }
-
                 tseqr = talloc_get_type(res->extended->data,
-                                           struct ldb_seqnum_result);
-                timestamp = tseqr->seq_num;
-
+                                        struct ldb_seqnum_result);
+                seq_number += tseqr->seq_num;
                 talloc_free(res);
-
-                /* Skip the lot if 'data' isn't here yet (initialisation) */
-                for (i=0; data && data->partitions && data->partitions[i]; i++) {
-
-                        res = talloc_zero(req, struct ldb_result);
-                        if (res == NULL) {
-                                return ldb_oom(ldb_module_get_ctx(module));
-                        }
-
-                        tseq = talloc_zero(res, struct ldb_seqnum_request);
-                        if (tseq == NULL) {
-                                talloc_free(res);
-                                return ldb_oom(ldb_module_get_ctx(module));
-                        }
-                        tseq->type = LDB_SEQ_HIGHEST_TIMESTAMP;
-
-                        ret = ldb_build_extended_req(&treq, ldb_module_get_ctx(module), res,
-                                                     LDB_EXTENDED_SEQUENCE_NUMBER,
-                                                     tseq,
-                                                     NULL,
-                                                     res,
-                                                     ldb_extended_default_callback,
-                                                     req);
-                        LDB_REQ_SET_LOCATION(treq);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-
-                        ret = ldb_request_add_control(treq,
-                                                      DSDB_CONTROL_CURRENT_PARTITION_OID,
-                                                      false, data->partitions[i]->ctrl);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-
-                        ret = partition_request(data->partitions[i]->module, treq);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-                        ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
-                        if (ret != LDB_SUCCESS) {
-                                talloc_free(res);
-                                return ret;
-                        }
-
-                        tseqr = talloc_get_type(res->extended->data,
-                                                  struct ldb_seqnum_result);
-                        timestamp = MAX(timestamp, tseqr->seq_num);
-
-                        talloc_free(res);
-                }
-
+        }
+
+        *seqr = seq_number;
+        return LDB_SUCCESS;
+}
+
+
+/*
+ * Newer version of sequence number using metadata tdb
+ */
+static int partition_sequence_number(struct ldb_module *module, struct ldb_request *req)
+{
+        struct ldb_extended *ext;
+        struct ldb_seqnum_request *seq;
+        struct ldb_seqnum_result *seqr;
+        uint64_t seq_number;
+        int ret;
+
+        seq = talloc_get_type_abort(req->op.extended.data, struct ldb_seqnum_request);
+        switch (seq->type) {
+        case LDB_SEQ_NEXT:
+                ret = partition_metadata_sequence_number_increment(module, &seq_number);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
                 break;
+
+        case LDB_SEQ_HIGHEST_SEQ:
+                ret = partition_metadata_sequence_number(module, &seq_number);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+                break;
+
+        case LDB_SEQ_HIGHEST_TIMESTAMP:
+                return ldb_module_error(module, LDB_ERR_OPERATIONS_ERROR,
+                                        "LDB_SEQ_HIGHEST_TIMESTAMP not supported");
         }
 
         ext = talloc_zero(req, struct ldb_extended);
         if (!ext) {
-                return ldb_oom(ldb_module_get_ctx(module));
+                return ldb_module_oom(module);
         }
         seqr = talloc_zero(ext, struct ldb_seqnum_result);
         if (seqr == NULL) {
                 talloc_free(ext);
-                return ldb_oom(ldb_module_get_ctx(module));
+                return ldb_module_oom(module);
         }
         ext->oid = LDB_EXTENDED_SEQUENCE_NUMBER;
         ext->data = seqr;
 
-        switch (seq->type) {
-        case LDB_SEQ_NEXT:
-        case LDB_SEQ_HIGHEST_SEQ:
-
-                /* Has someone above set a timebase sequence? */
-                if (timestamp_sequence) {
-                        seqr->seq_num = (((unsigned long long)timestamp << 24) | (seq_number & 0xFFFFFF));
-                } else {
-                        seqr->seq_num = seq_number;
-                }
-
-                if (timestamp_sequence > seqr->seq_num) {
-                        seqr->seq_num = timestamp_sequence;
-                        seqr->flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
-                }
-
-                seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
-                break;
-        case LDB_SEQ_HIGHEST_TIMESTAMP:
-                seqr->seq_num = timestamp;
-                break;
-        }
-
-        if (seq->type == LDB_SEQ_NEXT) {
-                seqr->seq_num++;
-        }
+        seqr->seq_num = seq_number;
+        seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
 
         /* send request done */
@@ -1183 +1150 @@
         }
 
-        /* see if we are still up-to-date */
-        ret = partition_reload_if_required(module, data, req);
-        if (ret != LDB_SUCCESS) {
-                return ret;
+        if (strcmp(req->op.extended.oid, DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID) == 0) {
+                /* Update the metadata.tdb to increment the schema version if needed*/
+                DEBUG(10, ("Incrementing the sequence_number after schema_update_now\n"));
+                ret = partition_metadata_inc_schema_sequence(module);
+                return ldb_module_done(req, NULL, NULL, ret);
         }
         

vendor/current/source4/dsdb/samdb/ldb_modules/partition.h

@@ -22 +22 @@
 #include <ldb_errors.h>
 #include <ldb_module.h>
+#include "lib/tdb_wrap/tdb_wrap.h"
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/samdb/ldb_modules/util.h"
@@ -32 +33 @@
         const char *backend_url;
         DATA_BLOB orig_record;
+        bool partial_replica; /* a GC partition */
 };
 
@@ -39 +41 @@
 };
 
+struct partition_metadata {
+        struct tdb_wrap *db;
+        int in_transaction;
+};
+
 struct partition_private_data {
         struct dsdb_partition **partitions;
         struct ldb_dn **replicate;
+        struct partition_metadata *metadata;
         
         struct partition_module **modules;

vendor/current/source4/dsdb/samdb/ldb_modules/partition_init.c

@@ -139 +139 @@
         struct ldb_result *res;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
-        const char *attrs[] = { "partition", "replicateEntries", "modules", "ldapBackend", NULL };
+        const char *attrs[] = { "partition", "replicateEntries", "modules", "ldapBackend",
+                                "partialReplica", NULL };
         /* perform search for @PARTITION, looking for module, replicateEntries and ldapBackend */
         ret = dsdb_module_search_dn(module, mem_ctx, &res, 
@@ -209 +210 @@
         int ret;
 
-        (*partition) = talloc(mem_ctx, struct dsdb_partition);
+        (*partition) = talloc_zero(mem_ctx, struct dsdb_partition);
         if (!*partition) {
                 return ldb_oom(ldb);
@@ -384 +385 @@
         struct ldb_message *msg;
         struct ldb_message_element *partition_attributes;
+        struct ldb_message_element *partial_replicas;
         TALLOC_CTX *mem_ctx;
 
@@ -396 +398 @@
         }
 
-        ret = partition_primary_sequence_number(module, mem_ctx, LDB_SEQ_HIGHEST_SEQ, &seq);
+        ret = partition_primary_sequence_number(module, mem_ctx, &seq, parent);
         if (ret != LDB_SUCCESS) {
                 talloc_free(mem_ctx);
@@ -415 +417 @@
 
         partition_attributes = ldb_msg_find_element(msg, "partition");
+        partial_replicas     = ldb_msg_find_element(msg, "partialReplica");
 
         for (i=0; partition_attributes && i < partition_attributes->num_values; i++) {
@@ -514 +517 @@
                         partition->ctrl->dn = talloc_steal(partition->ctrl, dn_res->msgs[0]->dn);
                         talloc_free(dn_res);
+                        if (data->ldapBackend) {
+                                ret = dsdb_fix_dn_rdncase(ldb, partition->ctrl->dn);
+                                if (ret) {
+                                        talloc_free(mem_ctx);
+                                        return ret;
+                                }
+                        }
                 } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
                         ldb_asprintf_errstring(ldb,
@@ -522 +532 @@
                         talloc_free(mem_ctx);
                         return ret;
+                }
+
+                /* see if it is a partial replica */
+                for (j=0; partial_replicas && j<partial_replicas->num_values; j++) {
+                        struct ldb_dn *pa_dn = ldb_dn_from_ldb_val(mem_ctx, ldb, &partial_replicas->values[j]);
+                        if (pa_dn != NULL && ldb_dn_compare(pa_dn, partition->ctrl->dn) == 0) {
+                                partition->partial_replica = true;
+                        }
+                        talloc_free(pa_dn);
                 }
 
@@ -696 +715 @@
         }
 
+        /* see if we are still up-to-date */
+        ret = partition_reload_if_required(module, data, req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
         for (i=0; data->partitions && data->partitions[i]; i++) {
                 if (ldb_dn_compare(data->partitions[i]->ctrl->dn, dn) == 0) {
@@ -759 +784 @@
                         return ret;
                 }
+
+                if (ldb_request_get_control(req, DSDB_CONTROL_PARTIAL_REPLICA)) {
+                        /* this new partition is a partial replica */
+                        ret = ldb_msg_add_empty(mod_msg, "partialReplica", LDB_FLAG_MOD_ADD, NULL);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+                        ret = ldb_msg_add_fmt(mod_msg, "partialReplica", "%s", ldb_dn_get_linearized(dn));
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+                }
                 
                 /* Perform modify on @PARTITION record */
@@ -852 +889 @@
         }
 
+        /* This loads metadata tdb. If it's missing, creates it */
+        ret = partition_metadata_init(module);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
         return ldb_next_init(module);
 }

vendor/current/source4/dsdb/samdb/ldb_modules/password_hash.c

@@ -44 +44 @@
 #include "../lib/crypto/crypto.h"
 #include "param/param.h"
+#include "lib/krb5_wrap/krb5_samba.h"
 
 /* If we have decided there is a reason to work on this request, then
@@ -96 +97 @@
         bool hash_values;
         bool userPassword;
+        bool pwd_last_set_bypass;
 };
 
@@ -301 +303 @@
                 }
 
+                if (scpp == NULL) {
+                        return ldb_error(ldb,
+                                         LDB_ERR_CONSTRAINT_VIOLATION,
+                                         "Primary:Packages missing");
+                }
+
+                if (scpk == NULL) {
+                        /*
+                         * If Primary:Kerberos is missing w2k8r2 reboots
+                         * when a password is changed.
+                         */
+                        return ldb_error(ldb,
+                                         LDB_ERR_CONSTRAINT_VIOLATION,
+                                         "Primary:Kerberos missing");
+                }
+
                 if (scpp) {
                         struct package_PackagesBlob *p;
@@ -629 +647 @@
         struct ldb_context *ldb;
         krb5_error_code krb5_ret;
-        Principal *salt_principal;
-        krb5_salt salt;
+        krb5_principal salt_principal;
+        krb5_data salt;
         krb5_keyblock key;
         krb5_data cleartext_data;
 
         ldb = ldb_module_get_ctx(io->ac->module);
-        cleartext_data.data = io->n.cleartext_utf8->data;
+        cleartext_data.data = (char *)io->n.cleartext_utf8->data;
         cleartext_data.length = io->n.cleartext_utf8->length;
 
         /* Many, many thanks to lukeh@padl.com for this
          * algorithm, described in his Nov 10 2004 mail to
-         * samba-technical@samba.org */
+         * samba-technical@lists.samba.org */
 
         /*
@@ -664 +682 @@
                 }
                 
-                krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
+                krb5_ret = smb_krb5_make_principal(io->smb_krb5_context->krb5_context,
                                                &salt_principal,
                                                io->ac->status->domain_data.realm,
@@ -682 +700 @@
                 }
 
-                krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
+                krb5_ret = smb_krb5_make_principal(io->smb_krb5_context->krb5_context,
                                                &salt_principal,
                                                io->ac->status->domain_data.realm,
                                                user_principal_name, NULL);
         } else {
-                krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
+                krb5_ret = smb_krb5_make_principal(io->smb_krb5_context->krb5_context,
                                                &salt_principal,
                                                io->ac->status->domain_data.realm,
@@ -704 +722 @@
          * create salt from salt_principal
          */
-        krb5_ret = krb5_get_pw_salt(io->smb_krb5_context->krb5_context,
+        krb5_ret = smb_krb5_get_pw_salt(io->smb_krb5_context->krb5_context,
                                     salt_principal, &salt);
         krb5_free_principal(io->smb_krb5_context->krb5_context, salt_principal);
@@ -717 +735 @@
         /* create a talloc copy */
         io->g.salt = talloc_strndup(io->ac,
-                                    (char *)salt.saltvalue.data,
-                                    salt.saltvalue.length);
-        krb5_free_salt(io->smb_krb5_context->krb5_context, salt);
+                                    (char *)salt.data,
+                                    salt.length);
+        kerberos_free_data_contents(io->smb_krb5_context->krb5_context, &salt);
         if (!io->g.salt) {
                 return ldb_oom(ldb);
         }
-        salt.saltvalue.data     = discard_const(io->g.salt);
-        salt.saltvalue.length   = strlen(io->g.salt);
+        /* now use the talloced copy of the salt */
+        salt.data       = discard_const(io->g.salt);
+        salt.length     = strlen(io->g.salt);
 
         /*
@@ -730 +749 @@
          * the salt and the cleartext password
          */
-        krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
-                                                ENCTYPE_AES256_CTS_HMAC_SHA1_96,
-                                                cleartext_data,
-                                                salt,
-                                                &key);
+        krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+                                                   NULL,
+                                                   &salt,
+                                                   &cleartext_data,
+                                                   ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+                                                   &key);
         if (krb5_ret) {
                 ldb_asprintf_errstring(ldb,
@@ -744 +764 @@
         }
         io->g.aes_256 = data_blob_talloc(io->ac,
-                                         key.keyvalue.data,
-                                         key.keyvalue.length);
+                                         KRB5_KEY_DATA(&key),
+                                         KRB5_KEY_LENGTH(&key));
         krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
         if (!io->g.aes_256.data) {
@@ -755 +775 @@
          * the salt and the cleartext password
          */
-        krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
-                                                ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-                                                cleartext_data,
-                                                salt,
-                                                &key);
+        krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+                                                   NULL,
+                                                   &salt,
+                                                   &cleartext_data,
+                                                   ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+                                                   &key);
         if (krb5_ret) {
                 ldb_asprintf_errstring(ldb,
@@ -769 +790 @@
         }
         io->g.aes_128 = data_blob_talloc(io->ac,
-                                         key.keyvalue.data,
-                                         key.keyvalue.length);
+                                         KRB5_KEY_DATA(&key),
+                                         KRB5_KEY_LENGTH(&key));
         krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
         if (!io->g.aes_128.data) {
@@ -780 +801 @@
          * the salt and the cleartext password
          */
-        krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
-                                                ENCTYPE_DES_CBC_MD5,
-                                                cleartext_data,
-                                                salt,
-                                                &key);
+        krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+                                                   NULL,
+                                                   &salt,
+                                                   &cleartext_data,
+                                                   ENCTYPE_DES_CBC_MD5,
+                                                   &key);
         if (krb5_ret) {
                 ldb_asprintf_errstring(ldb,
@@ -794 +816 @@
         }
         io->g.des_md5 = data_blob_talloc(io->ac,
-                                         key.keyvalue.data,
-                                         key.keyvalue.length);
+                                         KRB5_KEY_DATA(&key),
+                                         KRB5_KEY_LENGTH(&key));
         krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
         if (!io->g.des_md5.data) {
@@ -805 +827 @@
          * the salt and the cleartext password
          */
-        krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
-                                                ENCTYPE_DES_CBC_CRC,
-                                                cleartext_data,
-                                                salt,
-                                                &key);
+        krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+                                                   NULL,
+                                                   &salt,
+                                                   &cleartext_data,
+                                                   ENCTYPE_DES_CBC_CRC,
+                                                   &key);
         if (krb5_ret) {
                 ldb_asprintf_errstring(ldb,
@@ -819 +842 @@
         }
         io->g.des_crc = data_blob_talloc(io->ac,
-                                         key.keyvalue.data,
-                                         key.keyvalue.length);
+                                         KRB5_KEY_DATA(&key),
+                                         KRB5_KEY_LENGTH(&key));
         krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
         if (!io->g.des_crc.data) {
@@ -1664 +1687 @@
 static int setup_last_set_field(struct setup_password_fields_io *io)
 {
+        const struct ldb_message *msg = NULL;
+
+        switch (io->ac->req->operation) {
+        case LDB_ADD:
+                msg = io->ac->req->op.add.message;
+                break;
+        case LDB_MODIFY:
+                msg = io->ac->req->op.mod.message;
+                break;
+        default:
+                return LDB_ERR_OPERATIONS_ERROR;
+                break;
+        }
+
+        if (io->ac->pwd_last_set_bypass) {
+                struct ldb_message_element *el;
+
+                if (msg == NULL) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+
+                el = ldb_msg_find_element(msg, "pwdLastSet");
+                if (el == NULL) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+
+                io->g.last_set = samdb_result_nttime(msg, "pwdLastSet", 0);
+                return LDB_SUCCESS;
+        }
+
         /* set it as now */
         unix_to_nt_time(&io->g.last_set, time(NULL));
@@ -1690 +1743 @@
                                            g->cleartext_utf8->length,
                                            (void *)&cleartext_utf16_blob->data,
-                                           &cleartext_utf16_blob->length,
-                                           false)) {
+                                           &cleartext_utf16_blob->length)) {
                         if (g->cleartext_utf8->length != 0) {
                                 talloc_free(cleartext_utf16_blob);
@@ -1718 +1770 @@
                                            g->cleartext_utf16->length,
                                            (void *)&cleartext_utf8_blob->data,
-                                           &cleartext_utf8_blob->length,
-                                           false)) {
+                                           &cleartext_utf8_blob->length)) {
                         if (g->cleartext_utf16->length != 0) {
                                 /* We must bail out here, the input wasn't even
@@ -1828 +1879 @@
 }
 
+static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
+        struct ldb_message *mod_msg = NULL;
+        NTSTATUS status;
+        int ret;
+
+        status = dsdb_update_bad_pwd_count(io->ac, ldb,
+                                           io->ac->search_res->message,
+                                           io->ac->dom_res->message,
+                                           &mod_msg);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto done;
+        }
+
+        if (mod_msg == NULL) {
+                goto done;
+        }
+
+        /*
+         * OK, horrible semantics ahead.
+         *
+         * - We need to abort any existing transaction
+         * - create a transaction arround the badPwdCount update
+         * - re-open the transaction so the upper layer
+         *   doesn't know what happened.
+         *
+         * This is needed because returning an error to the upper
+         * layer will cancel the transaction and undo the badPwdCount
+         * update.
+         */
+
+        /*
+         * Checking errors here is a bit pointless.
+         * What can we do if we can't end the transaction?
+         */
+        ret = ldb_next_del_trans(io->ac->module);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb, LDB_DEBUG_FATAL,
+                          "Failed to abort transaction prior to update of badPwdCount of %s: %s",
+                          ldb_dn_get_linearized(io->ac->search_res->message->dn),
+                          ldb_errstring(ldb));
+                /*
+                 * just return the original error
+                 */
+                goto done;
+        }
+
+        /* Likewise, what should we do if we can't open a new transaction? */
+        ret = ldb_next_start_trans(io->ac->module);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb, LDB_DEBUG_ERROR,
+                          "Failed to open transaction to update badPwdCount of %s: %s",
+                          ldb_dn_get_linearized(io->ac->search_res->message->dn),
+                          ldb_errstring(ldb));
+                /*
+                 * just return the original error
+                 */
+                goto done;
+        }
+
+        ret = dsdb_module_modify(io->ac->module, mod_msg,
+                                 DSDB_FLAG_NEXT_MODULE,
+                                 io->ac->req);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb, LDB_DEBUG_ERROR,
+                          "Failed to update badPwdCount of %s: %s",
+                          ldb_dn_get_linearized(io->ac->search_res->message->dn),
+                          ldb_errstring(ldb));
+                /*
+                 * We can only ignore this...
+                 */
+        }
+
+        ret = ldb_next_end_trans(io->ac->module);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb, LDB_DEBUG_ERROR,
+                          "Failed to close transaction to update badPwdCount of %s: %s",
+                          ldb_dn_get_linearized(io->ac->search_res->message->dn),
+                          ldb_errstring(ldb));
+                /*
+                 * We can only ignore this...
+                 */
+        }
+
+        ret = ldb_next_start_trans(io->ac->module);
+        if (ret != LDB_SUCCESS) {
+                ldb_debug(ldb, LDB_DEBUG_ERROR,
+                          "Failed to open transaction after update of badPwdCount of %s: %s",
+                          ldb_dn_get_linearized(io->ac->search_res->message->dn),
+                          ldb_errstring(ldb));
+                /*
+                 * We can only ignore this...
+                 */
+        }
+
+done:
+        ret = LDB_ERR_CONSTRAINT_VIOLATION;
+        ldb_asprintf_errstring(ldb,
+                               "%08X: %s - check_password_restrictions: "
+                               "The old password specified doesn't match!",
+                               W_ERROR_V(WERR_INVALID_PASSWORD),
+                               ldb_strerror(ret));
+        return ret;
+}
+
 static int check_password_restrictions(struct setup_password_fields_io *io)
 {
         struct ldb_context *ldb;
         int ret;
-        enum samr_ValidationStatus stat;
 
         ldb = ldb_module_get_ctx(io->ac->module);
@@ -1852 +2008 @@
                    has no problems at all */
                 if (io->og.nt_hash) {
-                        if (!io->o.nt_hash) {
-                                ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                                ldb_asprintf_errstring(ldb,
-                                        "%08X: %s - check_password_restrictions: "
-                                        "There's no old nt_hash, which is needed "
-                                        "in order to change your password!",
-                                        W_ERROR_V(WERR_INVALID_PASSWORD),
-                                        ldb_strerror(ret));
-                                return ret;
-                        }
-
-                        if (memcmp(io->og.nt_hash->hash, io->o.nt_hash->hash, 16) != 0) {
-                                ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                                ldb_asprintf_errstring(ldb,
-                                        "%08X: %s - check_password_restrictions: "
-                                        "The old password specified doesn't match!",
-                                        W_ERROR_V(WERR_INVALID_PASSWORD),
-                                        ldb_strerror(ret));
-                                return ret;
+                        if (!io->o.nt_hash || memcmp(io->og.nt_hash->hash, io->o.nt_hash->hash, 16) != 0) {
+                                return make_error_and_update_badPwdCount(io);
                         }
 
@@ -1881 +2020 @@
                  * (as the SAMR operations request it). */
                 if (io->og.lm_hash) {
-                        if (!io->o.lm_hash && !nt_hash_checked) {
-                                ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                                ldb_asprintf_errstring(ldb,
-                                        "%08X: %s - check_password_restrictions: "
-                                        "There's no old lm_hash, which is needed "
-                                        "in order to change your password!",
-                                        W_ERROR_V(WERR_INVALID_PASSWORD),
-                                        ldb_strerror(ret));
-                                return ret;
-                        }
-
-                        if (io->o.lm_hash &&
-                            memcmp(io->og.lm_hash->hash, io->o.lm_hash->hash, 16) != 0) {
-                                ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                                ldb_asprintf_errstring(ldb,
-                                        "%08X: %s - check_password_restrictions: "
-                                        "The old password specified doesn't match!",
-                                        W_ERROR_V(WERR_INVALID_PASSWORD),
-                                        ldb_strerror(ret));
-                                return ret;
+                        if ((!io->o.lm_hash && !nt_hash_checked)
+                            || (io->o.lm_hash && memcmp(io->og.lm_hash->hash, io->o.lm_hash->hash, 16) != 0)) {
+                                return make_error_and_update_badPwdCount(io);
                         }
                 }
@@ -1908 +2030 @@
                 /* FIXME: Is this right? */
                 return LDB_SUCCESS;
+        }
+
+        /* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
+        if ((io->u.pwdLastSet - io->ac->status->domain_data.minPwdAge > io->g.last_set) &&
+            !io->ac->pwd_reset)
+        {
+                ret = LDB_ERR_CONSTRAINT_VIOLATION;
+                ldb_asprintf_errstring(ldb,
+                        "%08X: %s - check_password_restrictions: "
+                        "password is too young to change!",
+                        W_ERROR_V(WERR_PASSWORD_RESTRICTION),
+                        ldb_strerror(ret));
+                return ret;
         }
 
@@ -1916 +2051 @@
          */
         if (io->n.cleartext_utf8 != NULL) {
-                stat = samdb_check_password(io->n.cleartext_utf8,
-                                            io->ac->status->domain_data.pwdProperties,
-                                            io->ac->status->domain_data.minPwdLength);
-                switch (stat) {
+                enum samr_ValidationStatus vstat;
+                vstat = samdb_check_password(io->n.cleartext_utf8,
+                                             io->ac->status->domain_data.pwdProperties,
+                                             io->ac->status->domain_data.minPwdLength);
+                switch (vstat) {
                 case SAMR_VALIDATION_STATUS_SUCCESS:
                                 /* perfect -> proceed! */
@@ -1984 +2120 @@
                 /* checks the LM hash password history */
                 for (i = 0; i < io->o.lm_history_len; i++) {
-                        ret = memcmp(io->n.nt_hash, io->o.lm_history[i].hash, 16);
+                        ret = memcmp(io->n.lm_hash, io->o.lm_history[i].hash, 16);
                         if (ret == 0) {
                                 ret = LDB_ERR_CONSTRAINT_VIOLATION;
@@ -2015 +2151 @@
                         "%08X: %s - check_password_restrictions: "
                         "password can't be changed on this account!",
-                        W_ERROR_V(WERR_PASSWORD_RESTRICTION),
-                        ldb_strerror(ret));
-                return ret;
-        }
-
-        /* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
-        if (io->u.pwdLastSet - io->ac->status->domain_data.minPwdAge > io->g.last_set) {
-                ret = LDB_ERR_CONSTRAINT_VIOLATION;
-                ldb_asprintf_errstring(ldb,
-                        "%08X: %s - check_password_restrictions: "
-                        "password is too young to change!",
                         W_ERROR_V(WERR_PASSWORD_RESTRICTION),
                         ldb_strerror(ret));
@@ -2103 +2228 @@
         const struct ldb_val *quoted_utf16, *old_quoted_utf16, *lm_hash, *old_lm_hash;
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        struct loadparm_context *lp_ctx =
-                lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
-                                         struct loadparm_context);
+        struct loadparm_context *lp_ctx = talloc_get_type(
+                ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
         int ret;
 
@@ -2113 +2237 @@
 
         if (smb_krb5_init_context(ac,
-                                  ldb_get_event_context(ldb),
                                   (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm"),
                                   &io->smb_krb5_context) != 0) {
@@ -2138 +2261 @@
         }
 
+        if (io->u.userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) {
+                struct ldb_control *permit_trust = ldb_request_get_control(ac->req,
+                                DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID);
+
+                if (permit_trust == NULL) {
+                        ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+                        ldb_asprintf_errstring(ldb,
+                                "%08X: %s - setup_io: changing the interdomain trust password "
+                                "on %s not allowed via LDAP. Use LSA or NETLOGON",
+                                W_ERROR_V(WERR_ACCESS_DENIED),
+                                ldb_strerror(ret),
+                                ldb_dn_get_linearized(searched_msg->dn));
+                        return ret;
+                }
+        }
+
         /* Only non-trust accounts have restrictions (possibly this test is the
          * wrong way around, but we like to be restrictive if possible */
@@ -2143 +2282 @@
                 & (UF_INTERDOMAIN_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT
                         | UF_SERVER_TRUST_ACCOUNT));
-
-        if ((io->u.userAccountControl & UF_PASSWD_NOTREQD) != 0) {
-                /* see [MS-ADTS] 2.2.15 */
-                io->u.restrictions = 0;
-        }
 
         if (ac->userPassword) {
@@ -2160 +2294 @@
                         return ret;
                 }
+        }
+
+        if (io->n.cleartext_utf8 != NULL) {
+                struct ldb_val *cleartext_utf8_blob;
+                char *p;
+
+                cleartext_utf8_blob = talloc(io->ac, struct ldb_val);
+                if (!cleartext_utf8_blob) {
+                        return ldb_oom(ldb);
+                }
+
+                *cleartext_utf8_blob = *io->n.cleartext_utf8;
+
+                /* make sure we have a null terminated string */
+                p = talloc_strndup(cleartext_utf8_blob,
+                                   (const char *)io->n.cleartext_utf8->data,
+                                   io->n.cleartext_utf8->length);
+                if ((p == NULL) && (io->n.cleartext_utf8->length > 0)) {
+                        return ldb_oom(ldb);
+                }
+                cleartext_utf8_blob->data = (uint8_t *)p;
+
+                io->n.cleartext_utf8 = cleartext_utf8_blob;
         }
 
@@ -2198 +2355 @@
 
         /* Checks and converts the actual "unicodePwd" attribute */
-        if (quoted_utf16 &&
+        if (!ac->hash_values &&
+            quoted_utf16 &&
             quoted_utf16->length >= 4 &&
             quoted_utf16->data[0] == '"' &&
@@ -2254 +2412 @@
 
         /* Checks and converts the previous "unicodePwd" attribute */
-        if (old_quoted_utf16 &&
+        if (!ac->hash_values &&
+            old_quoted_utf16 &&
             old_quoted_utf16->length >= 4 &&
             old_quoted_utf16->data[0] == '"' &&
@@ -2485 +2644 @@
                 ctrl->critical = false;
         }
+
+        ac->pwd_last_set_bypass = false;
+        ctrl = ldb_request_get_control(ac->req,
+                                DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID);
+        if (ctrl != NULL) {
+                ac->pwd_last_set_bypass = true;
+
+                /* Mark the "bypass pwdLastSet" control as uncritical (done) */
+                ctrl->critical = false;
+        }
 }
 
@@ -2538 +2707 @@
         struct ph_context *ac;
         struct loadparm_context *lp_ctx;
-        int ret;
+        int ret = LDB_SUCCESS;
 
         ac = talloc_get_type(req->context, struct ph_context);
@@ -2587 +2756 @@
                         ac->status->domain_data.pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT;
 
-                talloc_free(ares);
-
                 /* For a domain DN, this puts things in dotted notation */
                 /* For builtin domains, this will give details for the host,
@@ -2603 +2770 @@
                 ac->status->reject_reason = SAM_PWD_CHANGE_NO_ERROR;
 
+                if (ac->dom_res != NULL) {
+                        talloc_free(ares);
+
+                        ldb_set_errstring(ldb, "Too many results");
+                        ret = LDB_ERR_OPERATIONS_ERROR;
+                        goto done;
+                }
+
+                ac->dom_res = talloc_steal(ac, ares);
                 ret = LDB_SUCCESS;
                 break;
@@ -2670 +2846 @@
                                               "minPwdAge",
                                               "minPwdLength",
+                                              "lockoutThreshold",
+                                              "lockOutObservationWindow",
                                               NULL };
         int ret;
@@ -2701 +2879 @@
 
         if (ldb_dn_is_special(req->op.add.message->dn)) { /* do not manipulate our control entries */
-                return ldb_next_request(module, req);
-        }
-
-        /* If the caller is manipulating the local passwords directly, let them pass */
-        if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
-                                req->op.add.message->dn) == 0) {
                 return ldb_next_request(module, req);
         }
@@ -2903 +3075 @@
         }
         
-        /* If the caller is manipulating the local passwords directly, let them pass */
-        if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
-                                req->op.mod.message->dn) == 0) {
-                return ldb_next_request(module, req);
-        }
-
         bypass = ldb_request_get_control(req,
                                          DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID);
@@ -3087 +3253 @@
         struct ldb_context *ldb;
         struct ph_context *ac;
-        int ret;
+        int ret = LDB_SUCCESS;
 
         ac = talloc_get_type(req->context, struct ph_context);
@@ -3167 +3333 @@
         static const char * const attrs[] = { "objectClass",
                                               "userAccountControl",
+                                              "msDS-User-Account-Control-Computed",
                                               "pwdLastSet",
                                               "sAMAccountName",
@@ -3176 +3343 @@
                                               "dBCSPwd",
                                               "unicodePwd",
+                                              "badPasswordTime",
+                                              "badPwdCount",
+                                              "lockoutTime",
                                               NULL };
         struct ldb_request *search_req;
@@ -3229 +3399 @@
         }
         
-        /* Get the old password from the database */
-        status = samdb_result_passwords(io.ac,
-                                        lp_ctx,
-                                        discard_const_p(struct ldb_message, searched_msg),
-                                        &io.o.lm_hash, &io.o.nt_hash);
+        if (io.ac->pwd_reset) {
+                /* Get the old password from the database */
+                status = samdb_result_passwords_no_lockout(io.ac,
+                                                           lp_ctx,
+                                                           discard_const_p(struct ldb_message, searched_msg),
+                                                           &io.o.lm_hash,
+                                                           &io.o.nt_hash);
+        } else {
+                /* Get the old password from the database */
+                status = samdb_result_passwords(io.ac,
+                                                lp_ctx,
+                                                discard_const_p(struct ldb_message, searched_msg),
+                                                &io.o.lm_hash, &io.o.nt_hash);
+        }
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
+                ldb_asprintf_errstring(ldb,
+                                       "%08X: check_password: "
+                                       "Password change not permitted, account locked out!",
+                                       W_ERROR_V(WERR_ACCOUNT_LOCKED_OUT));
+                return LDB_ERR_CONSTRAINT_VIOLATION;
+        }
+
         if (!NT_STATUS_IS_OK(status)) {
+                /*
+                 * This only happens if the database has gone weird,
+                 * not if we are just missing the passwords
+                 */
                 return ldb_operr(ldb);
         }

vendor/current/source4/dsdb/samdb/ldb_modules/proxy.c

@@ -139 +139 @@
 
         ret = ldb_connect(proxy->upstream, url, 0, NULL);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 ldb_debug(ldb, LDB_DEBUG_FATAL, "proxy failed to connect to %s\n", url);
                 goto failed;
@@ -340 +340 @@
 
         newtree = proxy_convert_tree(ac, proxy, req->op.search.tree);
+        if (newtree == NULL) {
+                goto failed;
+        }
 
         /* convert the basedn of this search */

vendor/current/source4/dsdb/samdb/ldb_modules/ranged_results.c

@@ -96 +96 @@
                 char *p, *new_attr;
                 const char *end_str;
-                unsigned int start, end, orig_num_values;
+                unsigned int start, end;
                 struct ldb_message_element *el;
                 struct ldb_val *orig_values;
@@ -147 +147 @@
                 } else {
                         orig_values = el->values;
-                        orig_num_values = el->num_values;
                         
                         if ((start + end < start) || (start + end < end)) {

vendor/current/source4/dsdb/samdb/ldb_modules/repl_meta_data.c

@@ -3 +3 @@
 
    Copyright (C) Simo Sorce  2004-2008
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
-   Copyright (C) Andrew Tridgell 2005
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2013
+   Copyright (C) Andrew Tridgell 2005-2009
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
-   Copyright (C) Matthieu Patou <mat@samba.org> 2010
+   Copyright (C) Matthieu Patou <mat@samba.org> 2010-2011
 
    This program is free software; you can redistribute it and/or modify
@@ -51 +51 @@
 #include "lib/util/tsort.h"
 
+/*
+ * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
+ * Deleted Objects Container
+ */
+static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
+
 struct replmd_private {
         TALLOC_CTX *la_ctx;
@@ -62 +68 @@
                 uint64_t mod_usn_urgent;
         } *ncs;
+        struct ldb_dn *schema_dn;
 };
 
@@ -87 +94 @@
         uint64_t seq_num;
         bool is_urgent;
+
+        bool isDeleted;
 };
+
+static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar);
+static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete);
 
 enum urgent_situation {
@@ -95 +107 @@
 };
 
+enum deletion_state {
+        OBJECT_NOT_DELETED=1,
+        OBJECT_DELETED=2,
+        OBJECT_RECYCLED=3,
+        OBJECT_TOMBSTONE=4,
+        OBJECT_REMOVED=5
+};
+
+static void replmd_deletion_state(struct ldb_module *module,
+                                  const struct ldb_message *msg,
+                                  enum deletion_state *current_state,
+                                  enum deletion_state *next_state)
+{
+        int ret;
+        bool enabled = false;
+
+        if (msg == NULL) {
+                *current_state = OBJECT_REMOVED;
+                if (next_state != NULL) {
+                        *next_state = OBJECT_REMOVED;
+                }
+                return;
+        }
+
+        ret = dsdb_recyclebin_enabled(module, &enabled);
+        if (ret != LDB_SUCCESS) {
+                enabled = false;
+        }
+
+        if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
+                if (!enabled) {
+                        *current_state = OBJECT_TOMBSTONE;
+                        if (next_state != NULL) {
+                                *next_state = OBJECT_REMOVED;
+                        }
+                        return;
+                }
+
+                if (ldb_msg_check_string_attribute(msg, "isRecycled", "TRUE")) {
+                        *current_state = OBJECT_RECYCLED;
+                        if (next_state != NULL) {
+                                *next_state = OBJECT_REMOVED;
+                        }
+                        return;
+                }
+
+                *current_state = OBJECT_DELETED;
+                if (next_state != NULL) {
+                        *next_state = OBJECT_RECYCLED;
+                }
+                return;
+        }
+
+        *current_state = OBJECT_NOT_DELETED;
+        if (next_state == NULL) {
+                return;
+        }
+
+        if (enabled) {
+                *next_state = OBJECT_DELETED;
+        } else {
+                *next_state = OBJECT_TOMBSTONE;
+        }
+}
 
 static const struct {
@@ -147 +223 @@
 
 
-static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
+static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar);
 
 /*
@@ -165 +241 @@
         }
         ldb_module_set_private(module, replmd_private);
+
+        replmd_private->schema_dn = ldb_get_schema_basedn(ldb);
 
         return ldb_next_init(module);
@@ -255 +333 @@
 
         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
-        if (ret != LDB_SUCCESS) {
+        if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
+                /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
+                   cope with possible corruption where the backlink has
+                   already been removed */
+                DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
+                         ldb_dn_get_linearized(target_dn),
+                         ldb_dn_get_linearized(source_dn),
+                         ldb_errstring(ldb)));
+                ret = LDB_SUCCESS;
+        } else if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
                                        bl->active?"add":"remove",
@@ -387 +474 @@
 
         if (ares->error != LDB_SUCCESS) {
-                DEBUG(0,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
+                DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
                 return ldb_module_done(ac->req, controls,
                                         ares->response, ares->error);
@@ -440 +527 @@
 
         if (ac->apply_mode) {
-                talloc_free(ares);
-                ac->index_current++;
-
-                ret = replmd_replicated_apply_next(ac);
+                ret = replmd_replicated_apply_isDeleted(ac);
                 if (ret != LDB_SUCCESS) {
                         return ldb_module_done(ac->req, NULL, NULL, ret);
@@ -580 +664 @@
                                                    const uint32_t *rdn_attid)
 {
-        if (m1->attid == m2->attid) {
+        /*
+         * This assignment seems inoccous, but it is critical for the
+         * system, as we need to do the comparisons as a unsigned
+         * quantity, not signed (enums are signed integers)
+         */
+        uint32_t attid_1 = m1->attid;
+        uint32_t attid_2 = m2->attid;
+
+        if (attid_1 == attid_2) {
                 return 0;
         }
@@ -589 +681 @@
          * which means m1 is greater than m2
          */
-        if (m1->attid == *rdn_attid) {
+        if (attid_1 == *rdn_attid) {
                 return 1;
         }
@@ -598 +690 @@
          * which means m2 is greater than m1
          */
-        if (m2->attid == *rdn_attid) {
+        if (attid_2 == *rdn_attid) {
                 return -1;
         }
 
-        return m1->attid > m2->attid ? 1 : -1;
-}
-
-static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
-                                                const struct dsdb_schema *schema,
-                                                struct ldb_dn *dn)
+        /*
+         * See above regarding this being an unsigned comparison.
+         * Otherwise when the high bit is set on non-standard
+         * attributes, they would end up first, before objectClass
+         * (0).
+         */
+        return attid_1 > attid_2 ? 1 : -1;
+}
+
+static int replmd_replPropertyMetaDataCtr1_verify(struct ldb_context *ldb,
+                                                  struct replPropertyMetaDataCtr1 *ctr1,
+                                                  const struct dsdb_attribute *rdn_sa,
+                                                  struct ldb_dn *dn)
+{
+        if (ctr1->count == 0) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "No elements found in replPropertyMetaData for %s!\n",
+                              ldb_dn_get_linearized(dn));
+                return LDB_ERR_CONSTRAINT_VIOLATION;
+        }
+        if (ctr1->array[ctr1->count - 1].attid != rdn_sa->attributeID_id) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "No rDN found in replPropertyMetaData for %s!\n",
+                              ldb_dn_get_linearized(dn));
+                return LDB_ERR_CONSTRAINT_VIOLATION;
+        }
+
+        /* the objectClass attribute is value 0x00000000, so must be first */
+        if (ctr1->array[0].attid != DRSUAPI_ATTID_objectClass) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "No objectClass found in replPropertyMetaData for %s!\n",
+                              ldb_dn_get_linearized(dn));
+                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+        }
+
+        return LDB_SUCCESS;
+}
+
+static int replmd_replPropertyMetaDataCtr1_sort_and_verify(struct ldb_context *ldb,
+                                                           struct replPropertyMetaDataCtr1 *ctr1,
+                                                           const struct dsdb_schema *schema,
+                                                           struct ldb_dn *dn)
 {
         const char *rdn_name;
@@ -614 +742 @@
         rdn_name = ldb_dn_get_rdn_name(dn);
         if (!rdn_name) {
-                DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
-                return LDB_ERR_OPERATIONS_ERROR;
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              __location__ ": No rDN for %s?\n",
+                              ldb_dn_get_linearized(dn));
+                return LDB_ERR_INVALID_DN_SYNTAX;
         }
 
         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
         if (rdn_sa == NULL) {
-                DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
-                return LDB_ERR_OPERATIONS_ERROR;
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              __location__ ": No sa found for rDN %s for %s\n",
+                              rdn_name, ldb_dn_get_linearized(dn));
+                return LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE;
         }
 
@@ -627 +759 @@
                  rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
 
-        LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
-
-        return LDB_SUCCESS;
+        LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id,
+                           replmd_replPropertyMetaData1_attid_sort);
+        return replmd_replPropertyMetaDataCtr1_verify(ldb, ctr1, rdn_sa, dn);
 }
 
@@ -737 +869 @@
 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
 {
+        struct samldb_msds_intid_persistant *msds_intid_struct;
         struct ldb_context *ldb;
         struct ldb_control *control;
@@ -758 +891 @@
         bool remove_current_guid = false;
         bool is_urgent = false;
+        bool is_schema_nc = false;
         struct ldb_message_element *objectclass_el;
+        struct replmd_private *replmd_private =
+                talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
 
         /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
@@ -873 +1009 @@
         }
 
+        is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
+
         for (i=0; i < msg->num_elements; i++) {
                 struct ldb_message_element *e = &msg->elements[i];
@@ -907 +1045 @@
                 }
 
-                m->attid                        = sa->attributeID_id;
-                m->version                      = 1;
-                m->originating_change_time      = now;
+                m->attid   = dsdb_attribute_get_attid(sa, is_schema_nc);
+                m->version = 1;
+                if (m->attid == 0x20030) {
+                        const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
+                        const char* rdn;
+
+                        if (rdn_val == NULL) {
+                                ldb_oom(ldb);
+                                talloc_free(ac);
+                                return LDB_ERR_OPERATIONS_ERROR;
+                        }
+
+                        rdn = (const char*)rdn_val->data;
+                        if (strcmp(rdn, "Deleted Objects") == 0) {
+                                /*
+                                 * Set the originating_change_time to 29/12/9999 at 23:59:59
+                                 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
+                                 */
+                                m->originating_change_time      = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
+                        } else {
+                                m->originating_change_time      = now;
+                        }
+                } else {
+                        m->originating_change_time      = now;
+                }
                 m->originating_invocation_id    = *our_invocation_id;
                 m->originating_usn              = ac->seq_num;
@@ -922 +1082 @@
          * sort meta data array, and move the rdn attribute entry to the end
          */
-        ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
-        if (ret != LDB_SUCCESS) {
+        ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &nmd.ctr.ctr1, ac->schema, msg->dn);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "%s: error during direct ADD: %s", __func__, ldb_errstring(ldb));
                 talloc_free(ac);
                 return ret;
@@ -977 +1138 @@
         replmd_ldb_message_sort(msg, ac->schema);
 
+        /*
+         * Assert that we do have an objectClass
+         */
         objectclass_el = ldb_msg_find_element(msg, "objectClass");
+        if (objectclass_el == NULL) {
+                ldb_asprintf_errstring(ldb, __location__
+                                       ": objectClass missing on %s\n",
+                                       ldb_dn_get_linearized(msg->dn));
+                talloc_free(ac);
+                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+        }
         is_urgent = replmd_check_urgent_objectclass(objectclass_el,
                                                         REPL_URGENT_ON_CREATE);
@@ -1017 +1188 @@
                 control->critical = 0;
         }
-
+        if (ldb_dn_compare_base(replmd_private->schema_dn, req->op.add.message->dn) != 0) {
+
+                /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
+                msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
+                if (msds_intid_struct) {
+                        msds_intid_struct->usn = ac->seq_num;
+                }
+        }
         /* go on with the call chain */
         return ldb_next_request(module, down_req);
@@ -1034 +1212 @@
                                       uint64_t *seq_num,
                                       const struct GUID *our_invocation_id,
-                                      NTTIME now)
+                                      NTTIME now,
+                                      bool is_schema_nc,
+                                      struct ldb_request *req)
 {
         uint32_t i;
         const struct dsdb_attribute *a;
         struct replPropertyMetaData1 *md1;
+        bool may_skip = false;
+        uint32_t attid;
 
         a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
         if (a == NULL) {
+                if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
+                        /* allow this to make it possible for dbcheck
+                           to remove bad attributes */
+                        return LDB_SUCCESS;
+                }
+
                 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
                          el->name));
@@ -1047 +1235 @@
         }
 
+        attid = dsdb_attribute_get_attid(a, is_schema_nc);
+
         if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
                 return LDB_SUCCESS;
         }
 
-        /* if the attribute's value haven't changed then return LDB_SUCCESS     */
-        if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
-                return LDB_SUCCESS;
+        /*
+         * if the attribute's value haven't changed, and this isn't
+         * just a delete of everything then return LDB_SUCCESS Unless
+         * we have the provision control or if the attribute is
+         * interSiteTopologyGenerator as this page explain:
+         * http://support.microsoft.com/kb/224815 this attribute is
+         * periodicaly written by the DC responsible for the intersite
+         * generation in a given site
+         *
+         * Unchanged could be deleting or replacing an already-gone
+         * thing with an unconstrained delete/empty replace or a
+         * replace with the same value, but not an add with the same
+         * value because that could be about adding a duplicate (which
+         * is for someone else to error out on).
+         */
+        if (old_el != NULL && ldb_msg_element_equal_ordered(el, old_el)) {
+                if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
+                        may_skip = true;
+                }
+        } else if (old_el == NULL && el->num_values == 0) {
+                if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
+                        may_skip = true;
+                } else if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
+                        may_skip = true;
+                }
+        }
+
+        if (may_skip) {
+                if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
+                    !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
+                        /*
+                         * allow this to make it possible for dbcheck
+                         * to rebuild broken metadata
+                         */
+                        return LDB_SUCCESS;
+                }
         }
 
         for (i=0; i<omd->ctr.ctr1.count; i++) {
-                if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
+                /*
+                 * First check if we find it under the msDS-IntID,
+                 * then check if we find it under the OID and
+                 * prefixMap ID.
+                 *
+                 * This allows the administrator to simply re-write
+                 * the attributes and so restore replication, which is
+                 * likely what they will try to do.
+                 */
+                if (attid == omd->ctr.ctr1.array[i].attid) {
+                        break;
+                }
+
+                if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) {
+                        break;
+                }
         }
 
@@ -1096 +1334 @@
         md1 = &omd->ctr.ctr1.array[i];
         md1->version++;
-        md1->attid                     = a->attributeID_id;
-        md1->originating_change_time   = now;
+        md1->attid = attid;
+        if (md1->attid == 0x20030) {
+                const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
+                const char* rdn;
+
+                if (rdn_val == NULL) {
+                        ldb_oom(ldb);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+
+                rdn = (const char*)rdn_val->data;
+                if (strcmp(rdn, "Deleted Objects") == 0) {
+                        /*
+                         * Set the originating_change_time to 29/12/9999 at 23:59:59
+                         * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
+                         */
+                        md1->originating_change_time    = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
+                } else {
+                        md1->originating_change_time    = now;
+                }
+        } else {
+                md1->originating_change_time    = now;
+        }
         md1->originating_invocation_id = *our_invocation_id;
         md1->originating_usn           = *seq_num;
@@ -1127 +1386 @@
                               const struct dsdb_schema *schema,
                               struct ldb_request *req,
+                              const char * const *rename_attrs,
                               struct ldb_message *msg, uint64_t *seq_num,
-                              time_t t,
-                              bool *is_urgent)
+                              time_t t, bool is_schema_nc,
+                              bool *is_urgent, bool *rodc)
 {
         const struct ldb_val *omd_value;
@@ -1138 +1398 @@
         const struct GUID *our_invocation_id;
         int ret;
-        const char *attrs[] = { "replPropertyMetaData", "*", NULL };
-        const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
+        const char * const *attrs = NULL;
+        const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
+        const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
         struct ldb_result *res;
         struct ldb_context *ldb;
         struct ldb_message_element *objectclass_el;
         enum urgent_situation situation;
-        bool rodc, rmd_is_provided;
+        bool rmd_is_provided;
+        bool rmd_is_just_resorted = false;
+
+        if (rename_attrs) {
+                attrs = rename_attrs;
+        } else {
+                attrs = attrs1;
+        }
 
         ldb = ldb_module_get_ctx(module);
@@ -1160 +1428 @@
         if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
                 rmd_is_provided = true;
+                if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID)) {
+                        rmd_is_just_resorted = true;
+                }
         } else {
                 rmd_is_provided = false;
@@ -1168 +1439 @@
         if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
                 situation = REPL_URGENT_ON_DELETE;
+        } else if (rename_attrs) {
+                situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
         } else {
                 situation = REPL_URGENT_ON_UPDATE;
@@ -1176 +1449 @@
                 /* We check that it's the only attribute that is provided
                  * (it's a rare case so it's better to keep the code simplier)
-                 * We also check that the highest local_usn is bigger than
+                 * We also check that the highest local_usn is bigger or the same as
                  * uSNChanged. */
                 uint64_t db_seq;
@@ -1186 +1459 @@
                         return LDB_ERR_OPERATIONS_ERROR;
                 }
-                if (situation == REPL_URGENT_ON_DELETE) {
+                if (situation != REPL_URGENT_ON_UPDATE) {
                         DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
                         return LDB_ERR_OPERATIONS_ERROR;
@@ -1203 +1476 @@
                         return LDB_ERR_OPERATIONS_ERROR;
                 }
-                *seq_num = find_max_local_usn(omd);
 
                 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
@@ -1212 +1484 @@
                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
 
-                if (ret != LDB_SUCCESS || res->count != 1) {
-                        DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
-                                 ldb_dn_get_linearized(msg->dn)));
-                        return LDB_ERR_OPERATIONS_ERROR;
-                }
-
-                objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
-                if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
-                                                                situation)) {
-                        *is_urgent = true;
-                }
-
-                db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
-                if (*seq_num <= db_seq) {
-                        DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
-                                              " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
-                                 (long long)*seq_num, (long long)db_seq));
-                        return LDB_ERR_OPERATIONS_ERROR;
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+
+                if (rmd_is_just_resorted == false) {
+                        *seq_num = find_max_local_usn(omd);
+
+                        db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
+
+                        /*
+                         * The test here now allows for a new
+                         * replPropertyMetaData with no change, if was
+                         * just dbcheck re-sorting the values.
+                         */
+                        if (*seq_num <= db_seq) {
+                                DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)" \
+                                         " is less than uSNChanged (max = %lld uSNChanged = %lld)\n",
+                                         (long long)*seq_num, (long long)db_seq));
+                                return LDB_ERR_OPERATIONS_ERROR;
+                        }
                 }
 
@@ -1244 +1518 @@
                                             DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
-                if (ret != LDB_SUCCESS || res->count != 1) {
-                        DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
-                                 ldb_dn_get_linearized(msg->dn)));
-                        return LDB_ERR_OPERATIONS_ERROR;
-                }
-
-                objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
-                if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
-                                                                situation)) {
-                        *is_urgent = true;
+                if (ret != LDB_SUCCESS) {
+                        return ret;
                 }
 
@@ -1281 +1547 @@
                         old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
                         ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
-                                                         our_invocation_id, now);
+                                                         our_invocation_id,
+                                                         now, is_schema_nc,
+                                                         req);
                         if (ret != LDB_SUCCESS) {
                                 return ret;
                         }
 
-                        if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
+                        if (!*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
                                 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
                         }
@@ -1292 +1560 @@
                 }
         }
+
+        /*
+         * Assert that we have an objectClass attribute - this is major
+         * corruption if we don't have this!
+         */
+        objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
+        if (objectclass_el != NULL) {
+                /*
+                 * Now check if this objectClass means we need to do urgent replication
+                 */
+                if (!*is_urgent && replmd_check_urgent_objectclass(objectclass_el,
+                                                                   situation)) {
+                        *is_urgent = true;
+                }
+        } else if (!ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                ldb_asprintf_errstring(ldb, __location__
+                                       ": objectClass missing on %s\n",
+                                       ldb_dn_get_linearized(msg->dn));
+                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+        }
+
         /*
          * replmd_update_rpmd_element has done an update if the
          * seq_num is set
          */
-        if (*seq_num != 0) {
+        if (*seq_num != 0 || rmd_is_just_resorted == true) {
                 struct ldb_val *md_value;
                 struct ldb_message_element *el;
 
                 /*if we are RODC and this is a DRSR update then its ok*/
-                if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
-                        ret = samdb_rodc(ldb, &rodc);
+                if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
+                    && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
+                        unsigned instanceType;
+
+                        ret = samdb_rodc(ldb, rodc);
                         if (ret != LDB_SUCCESS) {
                                 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
-                        } else if (rodc) {
-                                ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
+                        } else if (*rodc) {
+                                ldb_set_errstring(ldb, "RODC modify is forbidden!");
                                 return LDB_ERR_REFERRAL;
+                        }
+
+                        instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
+                        if (!(instanceType & INSTANCE_TYPE_WRITE)) {
+                                return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
+                                                 "cannot change replicated attribute on partial replica");
                         }
                 }
@@ -1317 +1615 @@
                 }
 
-                ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
+                ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &omd.ctr.ctr1, schema, msg->dn);
                 if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb, "%s: %s", __func__, ldb_errstring(ldb));
                         return ret;
                 }
@@ -1426 +1725 @@
                                 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
                                                        ldb_dn_get_linearized(dn));
+                                if (ret == LDB_ERR_NO_SUCH_OBJECT &&
+                                    LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
+                                    ldb_attr_cmp(el->name, "member") == 0) {
+                                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                                }
                                 return ret;
                         }
@@ -1571 +1875 @@
 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
                                 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
-                                uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
+                                uint64_t usn, uint64_t local_usn, NTTIME nttime,
                                 uint32_t version, bool deleted)
 {
@@ -1594 +1898 @@
         tval = data_blob_string_const(tstring);
 
-        usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
+        usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)usn);
         if (!usn_string) {
                 return LDB_ERR_OPERATIONS_ERROR;
@@ -1625 +1929 @@
                 old_addtime = &tval;
         }
-        if (dsdb_dn != old_dsdb_dn) {
+        if (dsdb_dn != old_dsdb_dn ||
+            ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
                 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
                 if (ret != LDB_SUCCESS) return ret;
@@ -1742 +2047 @@
                                                        el->name, GUID_string(tmp_ctx, p->guid));
                                 talloc_free(tmp_ctx);
-                                return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
+                                /* error codes for 'member' need to be
+                                   special cased */
+                                if (ldb_attr_cmp(el->name, "member") == 0) {
+                                        return LDB_ERR_ENTRY_ALREADY_EXISTS;
+                                } else {
+                                        return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
+                                }
                         }
                         ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
@@ -1854 +2165 @@
                         ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
                                                el->name, GUID_string(tmp_ctx, p->guid));
-                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        if (ldb_attr_cmp(el->name, "member") == 0) {
+                                return LDB_ERR_UNWILLING_TO_PERFORM;
+                        } else {
+                                return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        }
                 }
                 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
@@ -1860 +2175 @@
                         ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
                                                el->name, GUID_string(tmp_ctx, p->guid));
-                        return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        if (ldb_attr_cmp(el->name, "member") == 0) {
+                                return LDB_ERR_UNWILLING_TO_PERFORM;
+                        } else {
+                                return LDB_ERR_NO_SUCH_ATTRIBUTE;
+                        }
                 }
         }
@@ -1998 +2317 @@
                                             old_num_values, p->guid, NULL)) != NULL) {
                         /* update in place */
-                        ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
+                        ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
                                                    old_p->dsdb_dn, invocation_id,
                                                    seq_num, seq_num, now, 0, false);
@@ -2120 +2439 @@
                 }
                 if ((schema_attr->linkID & 1) == 1) {
+                        if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
+                                continue;
+                        }
                         /* Odd is for the target.  Illegal to modify */
                         ldb_asprintf_errstring(ldb,
@@ -2142 +2464 @@
                         return LDB_ERR_UNWILLING_TO_PERFORM;
                 }
+                if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb,
+                                               "Attribute %s is single valued but more than one value has been supplied",
+                                               el->name);
+                        return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
+                } else {
+                        el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
+                }
+
+
+
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -2170 +2503 @@
 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
 {
+        struct samldb_msds_intid_persistant *msds_intid_struct;
         struct ldb_context *ldb;
         struct replmd_replicated_request *ac;
@@ -2176 +2510 @@
         time_t t = time(NULL);
         int ret;
-        bool is_urgent = false;
-        struct loadparm_context *lp_ctx;
-        char *referral;
+        bool is_urgent = false, rodc = false;
+        bool is_schema_nc = false;
         unsigned int functional_level;
-        const DATA_BLOB *guid_blob;
+        const struct ldb_message_element *guid_el = NULL;
+        struct ldb_control *sd_propagation_control;
+        struct replmd_private *replmd_private =
+                talloc_get_type(ldb_module_get_private(module), struct replmd_private);
 
         /* do not manipulate our control entries */
@@ -2187 +2523 @@
         }
 
+        sd_propagation_control = ldb_request_get_control(req,
+                                        DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+        if (sd_propagation_control != NULL) {
+                if (req->op.mod.message->num_elements != 1) {
+                        return ldb_module_operr(module);
+                }
+                ret = strcmp(req->op.mod.message->elements[0].name,
+                             "nTSecurityDescriptor");
+                if (ret != 0) {
+                        return ldb_module_operr(module);
+                }
+
+                return ldb_next_request(module, req);
+        }
+
         ldb = ldb_module_get_ctx(module);
 
         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
 
-        guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
-        if ( guid_blob != NULL ) {
+        guid_el = ldb_msg_find_element(req->op.mod.message, "objectGUID");
+        if (guid_el != NULL) {
                 ldb_set_errstring(ldb,
                                   "replmd_modify: it's not allowed to change the objectGUID!");
@@ -2204 +2555 @@
 
         functional_level = dsdb_functional_level(ldb);
-
-        lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
-                                 struct loadparm_context);
 
         /* we have to copy the message as the caller might have it as a const */
@@ -2219 +2567 @@
         ldb_msg_remove_attr(msg, "uSNChanged");
 
-        ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
-        if (ret == LDB_ERR_REFERRAL) {
+        is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
+
+        ret = replmd_update_rpmd(module, ac->schema, req, NULL,
+                                 msg, &ac->seq_num, t, is_schema_nc,
+                                 &is_urgent, &rodc);
+        if (rodc && (ret == LDB_ERR_REFERRAL)) {
+                struct loadparm_context *lp_ctx;
+                char *referral;
+
+                lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
+                                         struct loadparm_context);
+
                 referral = talloc_asprintf(req,
                                            "ldap://%s/%s",
@@ -2227 +2585 @@
                 ret = ldb_module_send_referral(req, referral);
                 talloc_free(ac);
-                return ldb_module_done(req, NULL, NULL, ret);
+                return ret;
         }
 
@@ -2288 +2646 @@
                 if (ret != LDB_SUCCESS) {
                         talloc_free(ac);
+                        ldb_operr(ldb);
                         return ret;
                 }
@@ -2294 +2653 @@
                 if (ret != LDB_SUCCESS) {
                         talloc_free(ac);
+                        ldb_operr(ldb);
                         return ret;
+                }
+        }
+
+        if (!ldb_dn_compare_base(replmd_private->schema_dn, msg->dn)) {
+                /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
+                msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
+                if (msds_intid_struct) {
+                        msds_intid_struct->usn = ac->seq_num;
                 }
         }
@@ -2351 +2719 @@
 {
         struct ldb_context *ldb;
-        struct replmd_replicated_request *ac;
         struct ldb_request *down_req;
         struct ldb_message *msg;
+        const struct dsdb_attribute *rdn_attr;
+        const char *rdn_name;
+        const struct ldb_val *rdn_val;
+        const char *attrs[5] = { NULL, };
         time_t t = time(NULL);
         int ret;
-
-        ac = talloc_get_type(req->context, struct replmd_replicated_request);
+        bool is_urgent = false, rodc = false;
+        bool is_schema_nc;
+        struct replmd_replicated_request *ac =
+                talloc_get_type(req->context, struct replmd_replicated_request);
+        struct replmd_private *replmd_private =
+                talloc_get_type(ldb_module_get_private(ac->module),
+                                struct replmd_private);
+
         ldb = ldb_module_get_ctx(ac->module);
 
@@ -2373 +2750 @@
         }
 
-        /* Get a sequence number from the backend */
-        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
         /* TODO:
          * - replace the old object with the newly constructed one
@@ -2390 +2761 @@
 
         msg->dn = ac->req->op.rename.newdn;
+
+        is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
+
+        rdn_name = ldb_dn_get_rdn_name(msg->dn);
+        if (rdn_name == NULL) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_operr(ldb));
+        }
+
+        /* normalize the rdn attribute name */
+        rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
+        if (rdn_attr == NULL) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_operr(ldb));
+        }
+        rdn_name = rdn_attr->lDAPDisplayName;
+
+        rdn_val = ldb_dn_get_rdn_val(msg->dn);
+        if (rdn_val == NULL) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_operr(ldb));
+        }
+
+        if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_oom(ldb));
+        }
+        if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_oom(ldb));
+        }
+        if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_oom(ldb));
+        }
+        if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_oom(ldb));
+        }
+
+        /*
+         * here we let replmd_update_rpmd() only search for
+         * the existing "replPropertyMetaData" and rdn_name attributes.
+         *
+         * We do not want the existing "name" attribute as
+         * the "name" attribute needs to get the version
+         * updated on rename even if the rdn value hasn't changed.
+         *
+         * This is the diff of the meta data, for a moved user
+         * on a w2k8r2 server:
+         *
+         * # record 1
+         * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
+         * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
+         *  replPropertyMetaData:     NDR: struct replPropertyMetaDataBlob
+         *         version                  : 0x00000001 (1)
+         *         reserved                 : 0x00000000 (0)
+         * @@ -66,11 +66,11 @@ replPropertyMetaData:     NDR: struct re
+         *                      local_usn                : 0x00000000000037a5 (14245)
+         *                 array: struct replPropertyMetaData1
+         *                      attid                    : DRSUAPI_ATTID_name (0x90001)
+         * -                    version                  : 0x00000001 (1)
+         * -                    originating_change_time  : Wed Feb  9 17:20:49 2011 CET
+         * +                    version                  : 0x00000002 (2)
+         * +                    originating_change_time  : Wed Apr  6 15:21:01 2011 CEST
+         *                      originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
+         * -                    originating_usn          : 0x00000000000037a5 (14245)
+         * -                    local_usn                : 0x00000000000037a5 (14245)
+         * +                    originating_usn          : 0x0000000000003834 (14388)
+         * +                    local_usn                : 0x0000000000003834 (14388)
+         *                 array: struct replPropertyMetaData1
+         *                      attid                    : DRSUAPI_ATTID_userAccountControl (0x90008)
+         *                      version                  : 0x00000004 (4)
+         */
+        attrs[0] = "replPropertyMetaData";
+        attrs[1] = "objectClass";
+        attrs[2] = "instanceType";
+        attrs[3] = rdn_name;
+        attrs[4] = NULL;
+
+        ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
+                                 msg, &ac->seq_num, t,
+                                 is_schema_nc, &is_urgent, &rodc);
+        if (rodc && (ret == LDB_ERR_REFERRAL)) {
+                struct ldb_dn *olddn = ac->req->op.rename.olddn;
+                struct loadparm_context *lp_ctx;
+                char *referral;
+
+                lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
+                                         struct loadparm_context);
+
+                referral = talloc_asprintf(req,
+                                           "ldap://%s/%s",
+                                           lpcfg_dnsdomain(lp_ctx),
+                                           ldb_dn_get_linearized(olddn));
+                ret = ldb_module_send_referral(req, referral);
+                talloc_free(ares);
+                return ldb_module_done(req, NULL, NULL, ret);
+        }
+
+        if (ret != LDB_SUCCESS) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL, ret);
+        }
+
+        if (ac->seq_num == 0) {
+                talloc_free(ares);
+                return ldb_module_done(ac->req, NULL, NULL,
+                                       ldb_error(ldb, ret,
+                                        "internal error seq_num == 0"));
+        }
+        ac->is_urgent = is_urgent;
 
         ret = ldb_build_mod_req(&down_req, ldb, ac,
@@ -2418 +2908 @@
         if (ret != LDB_SUCCESS) {
                 talloc_free(ac);
+                ldb_operr(ldb);
                 return ret;
         }
@@ -2424 +2915 @@
         if (ret != LDB_SUCCESS) {
                 talloc_free(ac);
+                ldb_operr(ldb);
                 return ret;
         }
@@ -2432 +2924 @@
 
 /*
-   remove links from objects that point at this object when an object
-   is deleted
+ * remove links from objects that point at this object when an object
+ * is deleted.  We remove it from the NEXT module per MS-DRSR 5.160
+ * RemoveObj which states that link removal due to the object being
+ * deleted is NOT an originating update - they just go away!
+ *
  */
 static int replmd_delete_remove_link(struct ldb_module *module,
@@ -2514 +3009 @@
   This also handles the mapping of delete to a rename operation
   to allow deletes to be replicated.
+
+  It also handles the incoming deleted objects, to ensure they are
+  fully deleted here.  In that case re_delete is true, and we do not
+  use this as a signal to change the deleted state, just reinforce it.
+
  */
-static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
+static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete)
 {
         int ret = LDB_ERR_OTHER;
@@ -2541 +3041 @@
                 "whenChanged", NULL};
         unsigned int i, el_count = 0;
-        enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
-                                                OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
         enum deletion_state deletion_state, next_deletion_state;
-        bool enabled;
 
         if (ldb_dn_is_special(req->op.del.dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        /*
+         * We have to allow dbcheck to remove an object that
+         * is beyond repair, and to do so totally.  This could
+         * mean we we can get a partial object from the other
+         * DC, causing havoc, so dbcheck suggests
+         * re-replication first.  dbcheck sets both DBCHECK
+         * and RELAX in this situation.
+         */
+        if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)
+            && ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                /* really, really remove it */
                 return ldb_next_request(module, req);
         }
@@ -2558 +3069 @@
         schema = dsdb_get_schema(ldb, tmp_ctx);
         if (!schema) {
+                talloc_free(tmp_ctx);
                 return LDB_ERR_OPERATIONS_ERROR;
         }
@@ -2571 +3083 @@
                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
         if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "repmd_delete: Failed to %s %s, because we failed to find it: %s",
+                                       re_delete ? "re-delete" : "delete",
+                                       ldb_dn_get_linearized(old_dn),
+                                       ldb_errstring(ldb_module_get_ctx(module)));
                 talloc_free(tmp_ctx);
                 return ret;
@@ -2576 +3093 @@
         old_msg = res->msgs[0];
 
-
-        ret = dsdb_recyclebin_enabled(module, &enabled);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
-                if (!enabled) {
-                        deletion_state = OBJECT_TOMBSTONE;
-                        next_deletion_state = OBJECT_REMOVED;
-                } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
-                        deletion_state = OBJECT_RECYCLED;
-                        next_deletion_state = OBJECT_REMOVED;
-                } else {
-                        deletion_state = OBJECT_DELETED;
-                        next_deletion_state = OBJECT_RECYCLED;
-                }
-        } else {
-                deletion_state = OBJECT_NOT_DELETED;
-                if (enabled) {
-                        next_deletion_state = OBJECT_DELETED;
-                } else {
-                        next_deletion_state = OBJECT_TOMBSTONE;
-                }
+        replmd_deletion_state(module, old_msg,
+                              &deletion_state,
+                              &next_deletion_state);
+
+        /* This supports us noticing an incoming isDeleted and acting on it */
+        if (re_delete) {
+                SMB_ASSERT(deletion_state > OBJECT_NOT_DELETED);
+                next_deletion_state = deletion_state;
         }
 
         if (next_deletion_state == OBJECT_REMOVED) {
-                struct auth_session_info *session_info =
-                                (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
-                if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
-                        ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
-                                        ldb_dn_get_linearized(old_msg->dn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-
-                /* it is already deleted - really remove it this time */
-                talloc_free(tmp_ctx);
-                return ldb_next_request(module, req);
+                /*
+                 * We have to prevent objects being deleted, even if
+                 * the administrator really wants them gone, as
+                 * without the tombstone, we can get a partial object
+                 * from the other DC, causing havoc.
+                 *
+                 * The only other valid case is when the 180 day
+                 * timeout has expired, when relax is specified.
+                 */
+                if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
+                        /* it is already deleted - really remove it this time */
+                        talloc_free(tmp_ctx);
+                        return ldb_next_request(module, req);
+                }
+
+                ldb_asprintf_errstring(ldb, "Refusing to delete tombstone object %s.  "
+                                       "This check is to prevent corruption of the replicated state.",
+                                       ldb_dn_get_linearized(old_msg->dn));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
         }
 
@@ -2633 +3141 @@
         msg->dn = old_dn;
 
-        if (deletion_state == OBJECT_NOT_DELETED){
-                /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
-                disallow_move_on_delete =
-                        (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
-                                & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
-
-                /* work out where we will be renaming this object to */
-                if (!disallow_move_on_delete) {
-                        ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
-                                                          &new_dn);
-                        if (ret != LDB_SUCCESS) {
-                                /* this is probably an attempted delete on a partition
-                                 * that doesn't allow delete operations, such as the
-                                 * schema partition */
-                                ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
-                                                           ldb_dn_get_linearized(old_dn));
-                                talloc_free(tmp_ctx);
-                                return LDB_ERR_UNWILLING_TO_PERFORM;
-                        }
-                } else {
+        /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
+        disallow_move_on_delete =
+                (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
+                 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
+
+        /* work out where we will be renaming this object to */
+        if (!disallow_move_on_delete) {
+                struct ldb_dn *deleted_objects_dn;
+                ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
+                                                  &deleted_objects_dn);
+
+                /*
+                 * We should not move objects if we can't find the
+                 * deleted objects DN.  Not moving (or otherwise
+                 * harming) the Deleted Objects DN itself is handled
+                 * in the caller.
+                 */
+                if (re_delete && (ret != LDB_SUCCESS)) {
                         new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
                         if (new_dn == NULL) {
@@ -2659 +3165 @@
                                 return LDB_ERR_OPERATIONS_ERROR;
                         }
-                }
-
+                } else if (ret != LDB_SUCCESS) {
+                        /* this is probably an attempted delete on a partition
+                         * that doesn't allow delete operations, such as the
+                         * schema partition */
+                        ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
+                                               ldb_dn_get_linearized(old_dn));
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                } else {
+                        new_dn = deleted_objects_dn;
+                }
+        } else {
+                new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
+                if (new_dn == NULL) {
+                        ldb_module_oom(module);
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+        }
+
+        if (deletion_state == OBJECT_NOT_DELETED) {
                 /* get the objects GUID from the search we just did */
                 guid = samdb_result_guid(old_msg, "objectGUID");
@@ -2666 +3191 @@
                 /* Add a formatted child */
                 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
-                                                rdn_name,
-                                                ldb_dn_escape_value(tmp_ctx, *rdn_value),
-                                                GUID_string(tmp_ctx, &guid));
+                                            rdn_name,
+                                            ldb_dn_escape_value(tmp_ctx, *rdn_value),
+                                            GUID_string(tmp_ctx, &guid));
                 if (!retb) {
-                        DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
-                                        ldb_dn_get_linearized(new_dn)));
+                        ldb_asprintf_errstring(ldb, __location__
+                                               ": Unable to add a formatted child to dn: %s",
+                                               ldb_dn_get_linearized(new_dn));
                         talloc_free(tmp_ctx);
                         return LDB_ERR_OPERATIONS_ERROR;
@@ -2678 +3204 @@
                 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
                 if (ret != LDB_SUCCESS) {
-                        DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
-                        ldb_module_oom(module);
+                        ldb_asprintf_errstring(ldb, __location__
+                                               ": Failed to add isDeleted string to the msg");
                         talloc_free(tmp_ctx);
                         return ret;
                 }
                 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
+        } else {
+                /*
+                 * No matter what has happened with other renames etc, try again to
+                 * get this to be under the deleted DN. See MS-DRSR 5.160 RemoveObj
+                 */
+
+                struct ldb_dn *rdn = ldb_dn_copy(tmp_ctx, old_dn);
+                retb = ldb_dn_remove_base_components(rdn, ldb_dn_get_comp_num(rdn) - 1);
+                if (!retb) {
+                        ldb_asprintf_errstring(ldb, __location__
+                                               ": Unable to add a prepare rdn of %s",
+                                               ldb_dn_get_linearized(rdn));
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+                SMB_ASSERT(ldb_dn_get_comp_num(rdn) == 1);
+
+                retb = ldb_dn_add_child(new_dn, rdn);
+                if (!retb) {
+                        ldb_asprintf_errstring(ldb, __location__
+                                               ": Unable to add rdn %s to base dn: %s",
+                                               ldb_dn_get_linearized(rdn),
+                                               ldb_dn_get_linearized(new_dn));
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
         }
 
@@ -2703 +3255 @@
          */
 
-        /* we need the storage form of the parent GUID */
-        ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
-                                    ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
-                                    DSDB_FLAG_NEXT_MODULE |
-                                    DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
-                                    DSDB_SEARCH_REVEAL_INTERNALS|
-                                    DSDB_SEARCH_SHOW_RECYCLED, req);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        if (deletion_state == OBJECT_NOT_DELETED){
-                ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
-                                                   ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
+        if (deletion_state == OBJECT_NOT_DELETED) {
+                struct ldb_dn *parent_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
+                char *parent_dn_str = NULL;
+
+                /* we need the storage form of the parent GUID */
+                ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
+                                            parent_dn, NULL,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
+                                            DSDB_SEARCH_REVEAL_INTERNALS|
+                                            DSDB_SEARCH_SHOW_RECYCLED, req);
                 if (ret != LDB_SUCCESS) {
-                        DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
-                        ldb_module_oom(module);
+                        ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                               "repmd_delete: Failed to %s %s, "
+                                               "because we failed to find it's parent (%s): %s",
+                                               re_delete ? "re-delete" : "delete",
+                                               ldb_dn_get_linearized(old_dn),
+                                               ldb_dn_get_linearized(parent_dn),
+                                               ldb_errstring(ldb_module_get_ctx(module)));
                         talloc_free(tmp_ctx);
                         return ret;
                 }
-                msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
-        }
-
-        switch (next_deletion_state){
-
-        case OBJECT_DELETED:
-
-                ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
+
+                /*
+                 * Now we can use the DB version,
+                 * it will have the extended DN info in it
+                 */
+                parent_dn = parent_res->msgs[0]->dn;
+                parent_dn_str = ldb_dn_get_extended_linearized(tmp_ctx,
+                                                               parent_dn,
+                                                               1);
+                if (parent_dn_str == NULL) {
+                        talloc_free(tmp_ctx);
+                        return ldb_module_oom(module);
+                }
+
+                ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
+                                               parent_dn_str);
                 if (ret != LDB_SUCCESS) {
-                        DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
-                        ldb_module_oom(module);
+                        ldb_asprintf_errstring(ldb, __location__
+                                               ": Failed to add lastKnownParent "
+                                               "string when deleting %s",
+                                               ldb_dn_get_linearized(old_dn));
                         talloc_free(tmp_ctx);
                         return ret;
                 }
-                msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
-
-                ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
-                if (ret != LDB_SUCCESS) {
-                        talloc_free(tmp_ctx);
-                        ldb_module_oom(module);
-                        return ret;
-                }
-
-                ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
-                if (ret != LDB_SUCCESS) {
-                        talloc_free(tmp_ctx);
-                        ldb_module_oom(module);
-                        return ret;
-                }
-
-                break;
+                msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
+
+                if (next_deletion_state == OBJECT_DELETED) {
+                        ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb, __location__
+                                                       ": Failed to add msDS-LastKnownRDN "
+                                                       "string when deleting %s",
+                                                       ldb_dn_get_linearized(old_dn));
+                                talloc_free(tmp_ctx);
+                                return ret;
+                        }
+                        msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
+                }
+        }
+
+        switch (next_deletion_state) {
 
         case OBJECT_RECYCLED:
         case OBJECT_TOMBSTONE:
 
-                /* we also mark it as recycled, meaning this object can't be
-                   recovered (we are stripping its attributes) */
-                if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
+                /*
+                 * MS-ADTS 3.1.1.5.5.1.1 Tombstone Requirements
+                 * describes what must be removed from a tombstone
+                 * object
+                 *
+                 * MS-ADTS 3.1.1.5.5.1.3 Recycled-Object Requirements
+                 * describes what must be removed from a recycled
+                 * object
+                 *
+                 */
+
+                /*
+                 * we also mark it as recycled, meaning this object can't be
+                 * recovered (we are stripping its attributes).
+                 * This is done only if we have this schema object of course ...
+                 * This behavior is identical to the one of Windows 2008R2 which
+                 * always set the isRecycled attribute, even if the recycle-bin is
+                 * not activated and what ever the forest level is.
+                 */
+                if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
                         ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
                         if (ret != LDB_SUCCESS) {
@@ -2769 +3349 @@
                                 return ret;
                         }
-                        msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
+                        msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
                 }
 
@@ -2785 +3365 @@
                                 continue;
                         }
-                        if (sa->linkID && sa->linkID & 1) {
+                        if (sa->linkID && (sa->linkID & 1)) {
+                                /*
+                                  we have a backlink in this object
+                                  that needs to be removed. We're not
+                                  allowed to remove it directly
+                                  however, so we instead setup a
+                                  modify to delete the corresponding
+                                  forward link
+                                 */
                                 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
                                 if (ret != LDB_SUCCESS) {
+                                        const char *old_dn_str
+                                                = ldb_dn_get_linearized(old_dn);
+                                        ldb_asprintf_errstring(ldb,
+                                                               __location__
+                                                               ": Failed to remove backlink of "
+                                                               "%s when deleting %s",
+                                                               el->name,
+                                                               old_dn_str);
                                         talloc_free(tmp_ctx);
                                         return LDB_ERR_OPERATIONS_ERROR;
                                 }
+                                /* now we continue, which means we
+                                   won't remove this backlink
+                                   directly
+                                */
                                 continue;
                         }
-                        if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
-                                continue;
+                        if (!sa->linkID) {
+                                if (ldb_attr_in_list(preserved_attrs, el->name)) {
+                                        continue;
+                                }
+                                if (sa->searchFlags & SEARCH_FLAG_PRESERVEONDELETE) {
+                                        continue;
+                                }
                         }
                         ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
@@ -2803 +3408 @@
                         }
                 }
+
+                /* Duplicate with the below - we remove the
+                 * samAccountType as an originating update, in case it
+                 * somehow came back.  The objectCategory will have
+                 * gone in the above */
+                ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        ldb_module_oom(module);
+                        return ret;
+                }
+
+                break;
+
+        case OBJECT_DELETED:
+                /*
+                 * MS-ADTS 3.1.1.5.5.1.2 Deleted-Object Requirements
+                 * describes what must be removed from a deleted
+                 * object
+                 */
+
+                ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        ldb_module_oom(module);
+                        return ret;
+                }
+
+                ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        ldb_module_oom(module);
+                        return ret;
+                }
+
                 break;
 
@@ -2845 +3485 @@
         }
 
+        /*
+         * TODO: Per MS-DRSR 5.160 RemoveObj we should remove links directly, not as an originating update!
+         *
+         */
+
         ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
         if (ret != LDB_SUCCESS) {
@@ -2853 +3498 @@
         }
 
-        if (deletion_state == OBJECT_NOT_DELETED) {
+        /*
+         * No matter what has happned with other renames, try again to
+         * get this to be under the deleted DN.
+         */
+        if (strcmp(ldb_dn_get_linearized(old_dn), ldb_dn_get_linearized(new_dn)) != 0) {
                 /* now rename onto the new DN */
                 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
@@ -2871 +3520 @@
 }
 
+static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
+{
+        return replmd_delete_internals(module, req, false);
+}
 
 
@@ -2885 +3538 @@
 }
 
-static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
-{
-        struct ldb_context *ldb;
-        struct ldb_request *change_req;
-        enum ndr_err_code ndr_err;
-        struct ldb_message *msg;
-        struct replPropertyMetaDataBlob *md;
-        struct ldb_val md_value;
-        unsigned int i;
-        int ret;
-
-        /*
-         * TODO: check if the parent object exist
-         */
-
-        /*
-         * TODO: handle the conflict case where an object with the
-         *       same name exist
-         */
-
-        ldb = ldb_module_get_ctx(ar->module);
-        msg = ar->objs->objects[ar->index_current].msg;
-        md = ar->objs->objects[ar->index_current].meta_data;
-
-        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        /* remove any message elements that have zero values */
-        for (i=0; i<msg->num_elements; i++) {
-                struct ldb_message_element *el = &msg->elements[i];
-
-                if (el->num_values == 0) {
-                        DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
-                                 el->name));
-                        memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
-                        msg->num_elements--;
-                        i--;
-                        continue;
-                }
-        }
-
-        /*
-         * the meta data array is already sorted by the caller
-         */
-        for (i=0; i < md->ctr.ctr1.count; i++) {
-                md->ctr.ctr1.array[i].local_usn = ar->seq_num;
-        }
-        ndr_err = ndr_push_struct_blob(&md_value, msg, md,
-                                       (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
-                return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
-        }
-        ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        replmd_ldb_message_sort(msg, ar->schema);
-
-        if (DEBUGLVL(4)) {
-                char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
-                DEBUG(4, ("DRS replication add message:\n%s\n", s));
-                talloc_free(s);
-        }
-
-        ret = ldb_build_add_req(&change_req,
-                                ldb,
-                                ar,
-                                msg,
-                                ar->controls,
-                                ar,
-                                replmd_op_callback,
-                                ar->req);
-        LDB_REQ_SET_LOCATION(change_req);
-        if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
-
-        /* current partition control needed by "repmd_op_callback" */
-        ret = ldb_request_add_control(change_req,
-                                      DSDB_CONTROL_CURRENT_PARTITION_OID,
-                                      false, NULL);
-        if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
-
-        return ldb_next_request(ar->module, change_req);
-}
+
+static struct replPropertyMetaData1 *
+replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
+                                        enum drsuapi_DsAttributeId attid)
+{
+        uint32_t i;
+        struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
+
+        for (i = 0; i < rpmd_ctr->count; i++) {
+                if (rpmd_ctr->array[i].attid == attid) {
+                        return &rpmd_ctr->array[i];
+                }
+        }
+        return NULL;
+}
+
 
 /*
@@ -3024 +3586 @@
 }
 
-static struct replPropertyMetaData1 *
-replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
-                                        enum drsuapi_DsAttributeId attid)
-{
-        uint32_t i;
-        struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
-
-        for (i = 0; i < rpmd_ctr->count; i++) {
-                if (rpmd_ctr->array[i].attid == attid) {
-                        return &rpmd_ctr->array[i];
-                }
-        }
-        return NULL;
-}
-
+
+/*
+  form a conflict DN
+ */
+static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
+{
+        const struct ldb_val *rdn_val;
+        const char *rdn_name;
+        struct ldb_dn *new_dn;
+
+        rdn_val = ldb_dn_get_rdn_val(dn);
+        rdn_name = ldb_dn_get_rdn_name(dn);
+        if (!rdn_val || !rdn_name) {
+                return NULL;
+        }
+
+        new_dn = ldb_dn_copy(mem_ctx, dn);
+        if (!new_dn) {
+                return NULL;
+        }
+
+        if (!ldb_dn_remove_child_components(new_dn, 1)) {
+                return NULL;
+        }
+
+        if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
+                                  rdn_name,
+                                  ldb_dn_escape_value(new_dn, *rdn_val),
+                                  GUID_string(new_dn, guid))) {
+                return NULL;
+        }
+
+        return new_dn;
+}
+
+
+/*
+  perform a modify operation which sets the rDN and name attributes to
+  their current values. This has the effect of changing these
+  attributes to have been last updated by the current DC. This is
+  needed to ensure that renames performed as part of conflict
+  resolution are propogated to other DCs
+ */
+static int replmd_name_modify(struct replmd_replicated_request *ar,
+                              struct ldb_request *req, struct ldb_dn *dn)
+{
+        struct ldb_message *msg;
+        const char *rdn_name;
+        const struct ldb_val *rdn_val;
+        const struct dsdb_attribute *rdn_attr;
+        int ret;
+
+        msg = ldb_msg_new(req);
+        if (msg == NULL) {
+                goto failed;
+        }
+        msg->dn = dn;
+
+        rdn_name = ldb_dn_get_rdn_name(dn);
+        if (rdn_name == NULL) {
+                goto failed;
+        }
+
+        /* normalize the rdn attribute name */
+        rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
+        if (rdn_attr == NULL) {
+                goto failed;
+        }
+        rdn_name = rdn_attr->lDAPDisplayName;
+
+        rdn_val = ldb_dn_get_rdn_val(dn);
+        if (rdn_val == NULL) {
+                goto failed;
+        }
+
+        if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+                goto failed;
+        }
+        if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
+                goto failed;
+        }
+        if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+                goto failed;
+        }
+        if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
+                goto failed;
+        }
+
+        ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
+                         ldb_dn_get_linearized(dn),
+                         ldb_errstring(ldb_module_get_ctx(ar->module))));
+                return ret;
+        }
+
+        talloc_free(msg);
+
+        return LDB_SUCCESS;
+
+failed:
+        talloc_free(msg);
+        DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
+                 ldb_dn_get_linearized(dn)));
+        return LDB_ERR_OPERATIONS_ERROR;
+}
+
+
+/*
+  callback for conflict DN handling where we have renamed the incoming
+  record. After renaming it, we need to ensure the change of name and
+  rDN for the incoming record is seen as an originating update by this DC.
+
+  This also handles updating lastKnownParent for entries sent to lostAndFound
+ */
+static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+        struct replmd_replicated_request *ar =
+                talloc_get_type_abort(req->context, struct replmd_replicated_request);
+        struct ldb_dn *conflict_dn;
+        int ret;
+
+        if (ares->error != LDB_SUCCESS) {
+                /* call the normal callback for everything except success */
+                return replmd_op_callback(req, ares);
+        }
+
+        switch (req->operation) {
+        case LDB_ADD:
+                conflict_dn = req->op.add.message->dn;
+                break;
+        case LDB_MODIFY:
+                conflict_dn = req->op.mod.message->dn;
+                break;
+        default:
+                smb_panic("replmd_op_name_modify_callback called in unknown circumstances");
+        }
+
+        /* perform a modify of the rDN and name of the record */
+        ret = replmd_name_modify(ar, req, conflict_dn);
+        if (ret != LDB_SUCCESS) {
+                ares->error = ret;
+                return replmd_op_callback(req, ares);
+        }
+
+        if (ar->objs->objects[ar->index_current].last_known_parent) {
+                struct ldb_message *msg = ldb_msg_new(req);
+                if (msg == NULL) {
+                        ldb_module_oom(ar->module);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+
+                msg->dn = req->op.add.message->dn;
+
+                ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
+                                               ldb_dn_get_extended_linearized(msg, ar->objs->objects[ar->index_current].last_known_parent, 1));
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
+                        ldb_module_oom(ar->module);
+                        return ret;
+                }
+                msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
+
+                ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0,(__location__ ": Failed to modify lastKnownParent of lostAndFound DN '%s' - %s",
+                                 ldb_dn_get_linearized(msg->dn),
+                                 ldb_errstring(ldb_module_get_ctx(ar->module))));
+                        return ret;
+                }
+                TALLOC_FREE(msg);
+        }
+
+        return replmd_op_callback(req, ares);
+}
+
+/*
+  callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
+  This copes with the creation of conflict records in the case where
+  the DN exists, but with a different objectGUID
+ */
+static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
+{
+        struct ldb_dn *conflict_dn;
+        struct replmd_replicated_request *ar =
+                talloc_get_type_abort(req->context, struct replmd_replicated_request);
+        struct ldb_result *res;
+        const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
+        int ret;
+        const struct ldb_val *omd_value;
+        struct replPropertyMetaDataBlob omd, *rmd;
+        enum ndr_err_code ndr_err;
+        bool rename_incoming_record, rodc;
+        struct replPropertyMetaData1 *rmd_name, *omd_name;
+        struct ldb_message *msg;
+
+        req->callback = callback;
+
+        if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
+                /* call the normal callback for everything except
+                   conflicts */
+                return ldb_module_done(req, ares->controls, ares->response, ares->error);
+        }
+
+        ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to determine if we are an RODC when attempting to form conflict DN: %s", ldb_errstring(ldb_module_get_ctx(ar->module)));
+                return ldb_module_done(req, ares->controls, ares->response, LDB_ERR_OPERATIONS_ERROR);
+        }
+        /*
+         * we have a conflict, and need to decide if we will keep the
+         * new record or the old record
+         */
+
+        msg = ar->objs->objects[ar->index_current].msg;
+
+        switch (req->operation) {
+        case LDB_ADD:
+                conflict_dn = msg->dn;
+                break;
+        case LDB_RENAME:
+                conflict_dn = req->op.rename.newdn;
+                break;
+        default:
+                return ldb_module_done(req, ares->controls, ares->response, ldb_module_operr(ar->module));
+        }
+
+        if (rodc) {
+                /*
+                 * We are on an RODC, or were a GC for this
+                 * partition, so we have to fail this until
+                 * someone who owns the partition sorts it
+                 * out 
+                 */
+                ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), 
+                                       "Conflict adding object '%s' from incoming replication as we are read only for the partition.  \n"
+                                       " - We must fail the operation until a master for this partition resolves the conflict",
+                                       ldb_dn_get_linearized(conflict_dn));
+                goto failed;
+        }
+
+        /*
+         * first we need the replPropertyMetaData attribute from the
+         * old record
+         */
+        ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
+                                    attrs,
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_SEARCH_SHOW_DELETED |
+                                    DSDB_SEARCH_SHOW_RECYCLED, req);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
+                         ldb_dn_get_linearized(conflict_dn)));
+                goto failed;
+        }
+
+        omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
+        if (omd_value == NULL) {
+                DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
+                         ldb_dn_get_linearized(conflict_dn)));
+                goto failed;
+        }
+
+        ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
+                                       (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
+                         ldb_dn_get_linearized(conflict_dn)));
+                goto failed;
+        }
+
+        rmd = ar->objs->objects[ar->index_current].meta_data;
+
+        /* we decide which is newer based on the RPMD on the name
+           attribute.  See [MS-DRSR] ResolveNameConflict */
+        rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
+        omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
+        if (!rmd_name || !omd_name) {
+                DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
+                         ldb_dn_get_linearized(conflict_dn)));
+                goto failed;
+        }
+
+        rename_incoming_record = !(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) &&
+                !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
+
+        if (rename_incoming_record) {
+                struct GUID guid;
+                struct ldb_dn *new_dn;
+
+                /*
+                 * We want to run the original callback here, which
+                 * will return LDB_ERR_ENTRY_ALREADY_EXISTS to the
+                 * caller, which will in turn know to rename the
+                 * incoming record.  The error string is set in case
+                 * this isn't handled properly at some point in the
+                 * future.
+                 */
+                if (req->operation == LDB_RENAME) {
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                               "Unable to handle incoming renames where this would "
+                                               "create a conflict. Incoming record is %s (caller to handle)\n",
+                                               ldb_dn_get_extended_linearized(req, conflict_dn, 1));
+
+                        goto failed;
+                }
+
+                guid = samdb_result_guid(msg, "objectGUID");
+                if (GUID_all_zero(&guid)) {
+                        DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
+                                 ldb_dn_get_linearized(conflict_dn)));
+                        goto failed;
+                }
+                new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
+                if (new_dn == NULL) {
+                        DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
+                                 ldb_dn_get_linearized(conflict_dn)));
+                        goto failed;
+                }
+
+                DEBUG(2,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
+                         ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
+
+                /* re-submit the request, but with a different
+                   callback, so we don't loop forever. */
+                msg->dn = new_dn;
+                req->callback = replmd_op_name_modify_callback;
+
+                return ldb_next_request(ar->module, req);
+        } else {
+                /* we are renaming the existing record */
+                struct GUID guid;
+                struct ldb_dn *new_dn;
+
+                guid = samdb_result_guid(res->msgs[0], "objectGUID");
+                if (GUID_all_zero(&guid)) {
+                        DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
+                                 ldb_dn_get_linearized(conflict_dn)));
+                        goto failed;
+                }
+
+                new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
+                if (new_dn == NULL) {
+                        DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
+                                 ldb_dn_get_linearized(conflict_dn)));
+                        goto failed;
+                }
+
+                DEBUG(2,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
+                         ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
+
+                ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
+                                         DSDB_FLAG_OWN_MODULE, req);
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
+                                 ldb_dn_get_linearized(conflict_dn),
+                                 ldb_dn_get_linearized(new_dn),
+                                 ldb_errstring(ldb_module_get_ctx(ar->module))));
+                        goto failed;
+                }
+
+                /*
+                 * now we need to ensure that the rename is seen as an
+                 * originating update. We do that with a modify.
+                 */
+                ret = replmd_name_modify(ar, req, new_dn);
+                if (ret != LDB_SUCCESS) {
+                        goto failed;
+                }
+
+                return ldb_next_request(ar->module, req);
+        }
+
+failed:
+        /* on failure do the original callback. This means replication
+         * will stop with an error, but there is not much else we can
+         * do
+         */
+        return ldb_module_done(req, ares->controls, ares->response, ares->error);
+}
+
+/*
+  callback for replmd_replicated_apply_add()
+  This copes with the creation of conflict records in the case where
+  the DN exists, but with a different objectGUID
+ */
+static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+        struct replmd_replicated_request *ar =
+                talloc_get_type_abort(req->context, struct replmd_replicated_request);
+
+        if (ar->objs->objects[ar->index_current].last_known_parent) {
+                /* This is like a conflict DN, where we put the object in LostAndFound
+                   see MS-DRSR 4.1.10.6.10 FindBestParentObject */
+                return replmd_op_possible_conflict_callback(req, ares, replmd_op_name_modify_callback);
+        }
+
+        return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
+}
+
+/*
+  callback for replmd_replicated_handle_rename()
+  This copes with the creation of conflict records in the case where
+  the DN exists, but with a different objectGUID
+ */
+static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+        return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
+}
+
+/*
+  this is called when a new object comes in over DRS
+ */
+static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
+{
+        struct ldb_context *ldb;
+        struct ldb_request *change_req;
+        enum ndr_err_code ndr_err;
+        struct ldb_message *msg;
+        struct replPropertyMetaDataBlob *md;
+        struct ldb_val md_value;
+        unsigned int i;
+        int ret;
+        bool remote_isDeleted = false;
+        const struct dsdb_attribute *rdn_sa;
+        const char *rdn_name;
+
+        ldb = ldb_module_get_ctx(ar->module);
+        msg = ar->objs->objects[ar->index_current].msg;
+        md = ar->objs->objects[ar->index_current].meta_data;
+
+        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        /* remove any message elements that have zero values */
+        for (i=0; i<msg->num_elements; i++) {
+                struct ldb_message_element *el = &msg->elements[i];
+
+                if (el->num_values == 0) {
+                        if (ldb_attr_cmp(msg->elements[i].name, "objectClass") == 0) {
+                                ldb_asprintf_errstring(ldb, __location__
+                                                       ": empty objectClass sent on %s, aborting replication\n",
+                                                       ldb_dn_get_linearized(msg->dn));
+                                return replmd_replicated_request_error(ar, LDB_ERR_OBJECT_CLASS_VIOLATION);
+                        }
+
+                        DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
+                                 el->name));
+                        memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
+                        msg->num_elements--;
+                        i--;
+                        continue;
+                }
+        }
+
+        if (DEBUGLVL(4)) {
+                char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
+                DEBUG(4, ("DRS replication add message:\n%s\n", s));
+                talloc_free(s);
+        }
+
+        remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
+                                                     "isDeleted", false);
+
+        /*
+         * the meta data array is already sorted by the caller
+         */
+
+        rdn_name = ldb_dn_get_rdn_name(msg->dn);
+        if (rdn_name == NULL) {
+                ldb_asprintf_errstring(ldb, __location__ ": No rDN for %s?\n", ldb_dn_get_linearized(msg->dn));
+                return replmd_replicated_request_error(ar, LDB_ERR_INVALID_DN_SYNTAX);
+        }
+
+        rdn_sa = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
+        if (rdn_sa == NULL) {
+                ldb_asprintf_errstring(ldb, ": No schema attribute found for rDN %s for %s\n",
+                                       rdn_name, ldb_dn_get_linearized(msg->dn));
+                return replmd_replicated_request_error(ar, LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE);
+        }
+
+        ret = replmd_replPropertyMetaDataCtr1_verify(ldb, &md->ctr.ctr1, rdn_sa, msg->dn);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "%s: error during DRS repl ADD: %s", __func__, ldb_errstring(ldb));
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        for (i=0; i < md->ctr.ctr1.count; i++) {
+                md->ctr.ctr1.array[i].local_usn = ar->seq_num;
+        }
+        ndr_err = ndr_push_struct_blob(&md_value, msg, md,
+                                       (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
+                return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
+        }
+        ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
+        if (ret != LDB_SUCCESS) {
+                return replmd_replicated_request_error(ar, ret);
+        }
+
+        replmd_ldb_message_sort(msg, ar->schema);
+
+        if (!remote_isDeleted) {
+                ret = dsdb_module_schedule_sd_propagation(ar->module,
+                                                          ar->objs->partition_dn,
+                                                          msg->dn, true);
+                if (ret != LDB_SUCCESS) {
+                        return replmd_replicated_request_error(ar, ret);
+                }
+        }
+
+        ar->isDeleted = remote_isDeleted;
+
+        ret = ldb_build_add_req(&change_req,
+                                ldb,
+                                ar,
+                                msg,
+                                ar->controls,
+                                ar,
+                                replmd_op_add_callback,
+                                ar->req);
+        LDB_REQ_SET_LOCATION(change_req);
+        if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
+
+        /* current partition control needed by "repmd_op_callback" */
+        ret = ldb_request_add_control(change_req,
+                                      DSDB_CONTROL_CURRENT_PARTITION_OID,
+                                      false, NULL);
+        if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
+
+        if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
+                /* this tells the partition module to make it a
+                   partial replica if creating an NC */
+                ret = ldb_request_add_control(change_req,
+                                              DSDB_CONTROL_PARTIAL_REPLICA,
+                                              false, NULL);
+                if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
+        }
+
+        return ldb_next_request(ar->module, change_req);
+}
+
+static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
+                                                              struct ldb_reply *ares)
+{
+        struct replmd_replicated_request *ar = talloc_get_type(req->context,
+                                               struct replmd_replicated_request);
+        int ret;
+
+        if (!ares) {
+                return ldb_module_done(ar->req, NULL, NULL,
+                                        LDB_ERR_OPERATIONS_ERROR);
+        }
+        if (ares->error != LDB_SUCCESS &&
+            ares->error != LDB_ERR_NO_SUCH_OBJECT) {
+                /*
+                 * TODO: deal with the above error that the parent object doesn't exist
+                 */
+
+                return ldb_module_done(ar->req, ares->controls,
+                                        ares->response, ares->error);
+        }
+
+        switch (ares->type) {
+        case LDB_REPLY_ENTRY:
+        {
+                struct ldb_message *parent_msg = ares->message;
+                struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
+                struct ldb_dn *parent_dn;
+                int comp_num;
+
+                if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
+                    && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
+                        /* Per MS-DRSR 4.1.10.6.10
+                         * FindBestParentObject we need to move this
+                         * new object under a deleted object to
+                         * lost-and-found */
+                        struct ldb_dn *nc_root;
+
+                        ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
+                        if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                                       "No suitable NC root found for %s.  "
+                                                       "We need to move this object because parent object %s "
+                                                       "is deleted, but this object is not.",
+                                                       ldb_dn_get_linearized(msg->dn),
+                                                       ldb_dn_get_linearized(parent_msg->dn));
+                                return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
+                        } else if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                                       "Unable to find NC root for %s: %s. "
+                                                       "We need to move this object because parent object %s "
+                                                       "is deleted, but this object is not.",
+                                                       ldb_dn_get_linearized(msg->dn),
+                                                       ldb_errstring(ldb_module_get_ctx(ar->module)),
+                                                       ldb_dn_get_linearized(parent_msg->dn));
+                                return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
+                        }
+                        
+                        ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
+                                                nc_root,
+                                                DS_GUID_LOSTANDFOUND_CONTAINER,
+                                                &parent_dn);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                                       "Unable to find LostAndFound Container for %s "
+                                                       "in partition %s: %s. "
+                                                       "We need to move this object because parent object %s "
+                                                       "is deleted, but this object is not.",
+                                                       ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
+                                                       ldb_errstring(ldb_module_get_ctx(ar->module)),
+                                                       ldb_dn_get_linearized(parent_msg->dn));
+                                return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
+                        }
+                        ar->objs->objects[ar->index_current].last_known_parent
+                                = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
+                } else {
+                        parent_dn = parent_msg->dn;
+                }
+
+                comp_num = ldb_dn_get_comp_num(msg->dn);
+                if (comp_num > 1) {
+                        if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
+                                talloc_free(ares);
+                                return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
+                        }
+                }
+                if (!ldb_dn_add_base(msg->dn, parent_dn)) {
+                        talloc_free(ares);
+                        return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
+                }
+                break;
+        }
+        case LDB_REPLY_REFERRAL:
+                /* we ignore referrals */
+                break;
+
+        case LDB_REPLY_DONE:
+                if (ar->search_msg != NULL) {
+                        ret = replmd_replicated_apply_merge(ar);
+                } else {
+                        ret = replmd_replicated_apply_add(ar);
+                }
+                if (ret != LDB_SUCCESS) {
+                        return ldb_module_done(ar->req, NULL, NULL, ret);
+                }
+        }
+
+        talloc_free(ares);
+        return LDB_SUCCESS;
+}
+
+/*
+ * Look for the parent object, so we put the new object in the right
+ * place This is akin to NameObject in MS-DRSR - this routine and the
+ * callbacks find the right parent name, and correct name for this
+ * object
+ */
+
+static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
+{
+        struct ldb_context *ldb;
+        int ret;
+        char *tmp_str;
+        char *filter;
+        struct ldb_request *search_req;
+        static const char *attrs[] = {"isDeleted", NULL};
+
+        ldb = ldb_module_get_ctx(ar->module);
+
+        if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
+                if (ar->search_msg != NULL) {
+                        return replmd_replicated_apply_merge(ar);
+                } else {
+                        return replmd_replicated_apply_add(ar);
+                }
+        }
+
+        tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
+        if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
+
+        filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
+        if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
+        talloc_free(tmp_str);
+
+        ret = ldb_build_search_req(&search_req,
+                                   ldb,
+                                   ar,
+                                   ar->objs->partition_dn,
+                                   LDB_SCOPE_SUBTREE,
+                                   filter,
+                                   attrs,
+                                   NULL,
+                                   ar,
+                                   replmd_replicated_apply_search_for_parent_callback,
+                                   ar->req);
+        LDB_REQ_SET_LOCATION(search_req);
+
+        ret = dsdb_request_add_controls(search_req, 
+                                        DSDB_SEARCH_SHOW_RECYCLED|
+                                        DSDB_SEARCH_SHOW_DELETED|
+                                        DSDB_SEARCH_SHOW_EXTENDED_DN);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        return ldb_next_request(ar->module, search_req);
+}
 
 /*
@@ -3045 +4323 @@
 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
                                            struct ldb_message *msg,
-                                           struct replPropertyMetaDataBlob *rmd,
-                                           struct replPropertyMetaDataBlob *omd,
                                            struct ldb_request *parent)
 {
-        struct replPropertyMetaData1 *md_remote;
-        struct replPropertyMetaData1 *md_local;
-
-        if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
-                /* no rename */
-                return LDB_SUCCESS;
-        }
-
-        /* now we need to check for double renames. We could have a
-         * local rename pending which our replication partner hasn't
-         * received yet. We choose which one wins by looking at the
-         * attribute stamps on the two objects, the newer one wins
-         */
-        md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
-        md_local  = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
-        /* if there is no name attribute then we have to assume the
-           object we've received is in fact newer */
-        if (!md_remote || !md_local ||
-            replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
-                DEBUG(4,("replmd_replicated_request rename %s => %s\n",
-                         ldb_dn_get_linearized(ar->search_msg->dn),
-                         ldb_dn_get_linearized(msg->dn)));
-                /* pass rename to the next module
-                 * so it doesn't appear as an originating update */
-                return dsdb_module_rename(ar->module,
-                                          ar->search_msg->dn, msg->dn,
-                                          DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX, parent);
-        }
-
-        /* we're going to keep our old object */
-        DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
+        struct ldb_request *req;
+        int ret;
+        TALLOC_CTX *tmp_ctx = talloc_new(msg);
+        struct ldb_result *res;
+
+        DEBUG(4,("replmd_replicated_request rename %s => %s\n",
                  ldb_dn_get_linearized(ar->search_msg->dn),
                  ldb_dn_get_linearized(msg->dn)));
-        return LDB_SUCCESS;
+
+
+        res = talloc_zero(tmp_ctx, struct ldb_result);
+        if (!res) {
+                talloc_free(tmp_ctx);
+                return ldb_oom(ldb_module_get_ctx(ar->module));
+        }
+
+        /* pass rename to the next module
+         * so it doesn't appear as an originating update */
+        ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
+                                   ar->search_msg->dn, msg->dn,
+                                   NULL,
+                                   ar,
+                                   replmd_op_rename_callback,
+                                   parent);
+        LDB_REQ_SET_LOCATION(req);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        ret = ldb_next_request(ar->module, req);
+
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        talloc_free(tmp_ctx);
+        return ret;
 }
 
@@ -3101 +4387 @@
         unsigned int removed_attrs = 0;
         int ret;
+        int (*callback)(struct ldb_request *req, struct ldb_reply *ares) = replmd_op_callback;
+        bool isDeleted = false;
+        bool local_isDeleted = false;
+        bool remote_isDeleted = false;
+        bool take_remote_isDeleted = false;
+        bool sd_updated = false;
+        bool renamed = false;
 
         ldb = ldb_module_get_ctx(ar->module);
         msg = ar->objs->objects[ar->index_current].msg;
+
         rmd = ar->objs->objects[ar->index_current].meta_data;
         ZERO_STRUCT(omd);
@@ -3123 +4417 @@
         }
 
-        /* handle renames that come in over DRS */
-        ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
-        if (ret != LDB_SUCCESS) {
+        local_isDeleted = ldb_msg_find_attr_as_bool(ar->search_msg,
+                                                    "isDeleted", false);
+        remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
+                                                     "isDeleted", false);
+
+        if (strcmp(ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ar->search_msg->dn)) == 0) {
+                ret = LDB_SUCCESS;
+        } else {
+                /*
+                 * handle renames, even just by case that come in over
+                 * DRS.  Changes in the parent DN don't hit us here,
+                 * because the search for a parent will clean up those
+                 * components.
+                 *
+                 * We also have already filtered out the case where
+                 * the peer has an older name to what we have (see
+                 * replmd_replicated_apply_search_callback())
+                 */
+                renamed = true;
+                ret = replmd_replicated_handle_rename(ar, msg, ar->req);
+        }
+
+        /*
+         * This particular error code means that we already tried the
+         * conflict algrorithm, and the existing record name was newer, so we
+         * need to rename the incoming record
+         */
+        if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
+                struct GUID guid;
+                NTSTATUS status;
+                struct ldb_dn *new_dn;
+                status = GUID_from_ndr_blob(&ar->objs->objects[ar->index_current].guid_value, &guid);
+                /* This really, really can't fail */
+                SMB_ASSERT(NT_STATUS_IS_OK(status));
+
+                new_dn = replmd_conflict_dn(msg, msg->dn, &guid);
+                if (new_dn == NULL) {
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                                                  "Failed to form conflict DN for %s\n",
+                                                                  ldb_dn_get_linearized(msg->dn));
+
+                        return replmd_replicated_request_werror(ar, WERR_NOMEM);
+                }
+
+                ret = dsdb_module_rename(ar->module, ar->search_msg->dn, new_dn,
+                                         DSDB_FLAG_NEXT_MODULE, ar->req);
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
+                                               "Failed to rename incoming conflicting dn '%s' (was '%s') to '%s' - %s\n",
+                                               ldb_dn_get_linearized(msg->dn),
+                                               ldb_dn_get_linearized(ar->search_msg->dn),
+                                               ldb_dn_get_linearized(new_dn),
+                                               ldb_errstring(ldb_module_get_ctx(ar->module)));
+                        return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
+                }
+
+                /* Set the callback to one that will fix up the name to be a conflict DN */
+                callback = replmd_op_name_modify_callback;
+                msg->dn = new_dn;
+                renamed = true;
+        } else if (ret != LDB_SUCCESS) {
                 ldb_debug(ldb, LDB_DEBUG_FATAL,
                           "replmd_replicated_request rename %s => %s failed - %s\n",
@@ -3148 +4500 @@
         }
 
+        ar->seq_num = 0;
         /* now merge in the new meta data */
         for (i=0; i < rmd->ctr.ctr1.count; i++) {
@@ -3159 +4512 @@
                         }
 
-                        cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
-                                                                    &rmd->ctr.ctr1.array[i]);
+                        if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
+                                /*
+                                 * if we compare equal then do an
+                                 * update. This is used when a client
+                                 * asks for a FULL_SYNC, and can be
+                                 * used to recover a corrupt
+                                 * replica.
+                                 *
+                                 * This call is a bit tricky, what we
+                                 * are doing it turning the 'is_newer'
+                                 * call into a 'not is older' by
+                                 * swapping i and j, and negating the
+                                 * outcome.
+                                */
+                                cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
+                                                                             &nmd.ctr.ctr1.array[j]);
+                        } else {
+                                cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
+                                                                            &rmd->ctr.ctr1.array[i]);
+                        }
                         if (cmp) {
                                 /* replace the entry */
                                 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
+                                if (ar->seq_num == 0) {
+                                        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
+                                        if (ret != LDB_SUCCESS) {
+                                                return replmd_replicated_request_error(ar, ret);
+                                        }
+                                }
+                                nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
+                                switch (nmd.ctr.ctr1.array[j].attid) {
+                                case DRSUAPI_ATTID_ntSecurityDescriptor:
+                                        sd_updated = true;
+                                        break;
+                                case DRSUAPI_ATTID_isDeleted:
+                                        take_remote_isDeleted = true;
+                                        break;
+                                default:
+                                        break;
+                                }
                                 found = true;
                                 break;
@@ -3186 +4574 @@
 
                 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
+                if (ar->seq_num == 0) {
+                        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
+                        if (ret != LDB_SUCCESS) {
+                                return replmd_replicated_request_error(ar, ret);
+                        }
+                }
+                nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
+                switch (nmd.ctr.ctr1.array[ni].attid) {
+                case DRSUAPI_ATTID_ntSecurityDescriptor:
+                        sd_updated = true;
+                        break;
+                case DRSUAPI_ATTID_isDeleted:
+                        take_remote_isDeleted = true;
+                        break;
+                default:
+                        break;
+                }
                 ni++;
         }
@@ -3201 +4606 @@
          * sort the new meta data array
          */
-        ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
-        if (ret != LDB_SUCCESS) {
+        ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &nmd.ctr.ctr1, ar->schema, msg->dn);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "%s: error during DRS repl merge: %s", __func__, ldb_errstring(ldb));
                 return ret;
         }
+
+        /*
+         * Work out if this object is deleted, so we can prune any extra attributes.  See MS-DRSR 4.1.10.6.9
+         * UpdateObject.
+         *
+         * This also controls SD propagation below
+         */
+        if (take_remote_isDeleted) {
+                isDeleted = remote_isDeleted;
+        } else {
+                isDeleted = local_isDeleted;
+        }
+
+        ar->isDeleted = isDeleted;
 
         /*
@@ -3213 +4633 @@
                           ar->index_current);
 
-                ar->index_current++;
-                return replmd_replicated_apply_next(ar);
+                return replmd_replicated_apply_isDeleted(ar);
         }
 
@@ -3220 +4639 @@
                   ar->index_current, msg->num_elements);
 
-        ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
-        if (ret != LDB_SUCCESS) {
-                return replmd_replicated_request_error(ar, ret);
-        }
-
-        for (i=0; i<ni; i++) {
-                nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
+        if (renamed) {
+                sd_updated = true;
+        }
+
+        if (sd_updated && !isDeleted) {
+                ret = dsdb_module_schedule_sd_propagation(ar->module,
+                                                          ar->objs->partition_dn,
+                                                          msg->dn, true);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
         }
 
@@ -3259 +4682 @@
         for (i=0; i < msg->num_elements; i++) {
                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
+                if (ldb_attr_cmp(msg->elements[i].name, "objectClass") == 0) {
+                        if (msg->elements[i].num_values == 0) {
+                                ldb_asprintf_errstring(ldb, __location__
+                                                       ": objectClass removed on %s, aborting replication\n",
+                                                       ldb_dn_get_linearized(msg->dn));
+                                return replmd_replicated_request_error(ar, LDB_ERR_OBJECT_CLASS_VIOLATION);
+                        }
+                }
         }
 
@@ -3273 +4704 @@
                                 ar->controls,
                                 ar,
-                                replmd_op_callback,
+                                callback,
                                 ar->req);
         LDB_REQ_SET_LOCATION(change_req);
@@ -3314 +4745 @@
 
         case LDB_REPLY_DONE:
-                if (ar->search_msg != NULL) {
+        {
+                struct replPropertyMetaData1 *md_remote;
+                struct replPropertyMetaData1 *md_local;
+
+                struct replPropertyMetaDataBlob omd;
+                const struct ldb_val *omd_value;
+                struct replPropertyMetaDataBlob *rmd;
+                struct ldb_message *msg;
+
+                ar->objs->objects[ar->index_current].last_known_parent = NULL;
+
+                /*
+                 * This is the ADD case, find the appropriate parent,
+                 * as this object doesn't exist locally:
+                 */
+                if (ar->search_msg == NULL) {
+                        ret = replmd_replicated_apply_search_for_parent(ar);
+                        if (ret != LDB_SUCCESS) {
+                                return ldb_module_done(ar->req, NULL, NULL, ret);
+                        }
+                        talloc_free(ares);
+                        return LDB_SUCCESS;
+                }
+
+                /*
+                 * Otherwise, in the MERGE case, work out if we are
+                 * attempting a rename, and if so find the parent the
+                 * newly renamed object wants to belong under (which
+                 * may not be the parent in it's attached string DN
+                 */
+                rmd = ar->objs->objects[ar->index_current].meta_data;
+                ZERO_STRUCT(omd);
+                omd.version = 1;
+
+                /* find existing meta data */
+                omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
+                if (omd_value) {
+                        enum ndr_err_code ndr_err;
+                        ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
+                                                       (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
+                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                                NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
+                                return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
+                        }
+
+                        if (omd.version != 1) {
+                                return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
+                        }
+                }
+
+                /*
+                 * now we need to check for double renames. We could have a
+                 * local rename pending which our replication partner hasn't
+                 * received yet. We choose which one wins by looking at the
+                 * attribute stamps on the two objects, the newer one wins
+                 */
+                md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
+                md_local  = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
+                /* if there is no name attribute then we have to assume the
+                   object we've received is in fact newer */
+                if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING ||
+                    !md_remote || !md_local ||
+                    replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
+                        ret = replmd_replicated_apply_search_for_parent(ar);
+                } else {
+                        msg = ar->objs->objects[ar->index_current].msg;
+
+                        /* Otherwise, just merge on the existing object, force no rename */
+                        DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
+                                 ldb_dn_get_linearized(ar->search_msg->dn),
+                                 ldb_dn_get_linearized(msg->dn)));
+
+                        /*
+                         * This assignment ensures that the strcmp()
+                         * in replmd_replicated_apply_merge() avoids
+                         * the rename call
+                         */
+                        msg->dn = ar->search_msg->dn;
                         ret = replmd_replicated_apply_merge(ar);
-                } else {
-                        ret = replmd_replicated_apply_add(ar);
                 }
                 if (ret != LDB_SUCCESS) {
                         return ldb_module_done(ar->req, NULL, NULL, ret);
                 }
+        }
         }
 
@@ -3337 +4844 @@
         char *filter;
         struct ldb_request *search_req;
-        struct ldb_search_options_control *options;
 
         if (ar->index_current >= ar->objs->num_objects) {
@@ -3346 +4852 @@
         ldb = ldb_module_get_ctx(ar->module);
         ar->search_msg = NULL;
+        ar->isDeleted = false;
 
         tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
@@ -3367 +4874 @@
         LDB_REQ_SET_LOCATION(search_req);
 
-        ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
-                                      true, NULL);
+        ret = dsdb_request_add_controls(search_req, DSDB_SEARCH_SEARCH_ALL_PARTITIONS|DSDB_SEARCH_SHOW_RECYCLED);
+
         if (ret != LDB_SUCCESS) {
                 return ret;
         }
 
-        /* we need to cope with cross-partition links, so search for
-           the GUID over all partitions */
-        options = talloc(search_req, struct ldb_search_options_control);
-        if (options == NULL) {
-                DEBUG(0, (__location__ ": out of memory\n"));
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-        options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
-
-        ret = ldb_request_add_control(search_req,
-                                      LDB_CONTROL_SEARCH_OPTIONS_OID,
-                                      true, options);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
         return ldb_next_request(ar->module, search_req);
+}
+
+/*
+ * This is essentially a wrapper for replmd_replicated_apply_next()
+ *
+ * This is needed to ensure that both codepaths call this handler.
+ */
+static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar)
+{
+        struct ldb_dn *deleted_objects_dn;
+        struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
+        int ret = dsdb_get_deleted_objects_dn(ldb_module_get_ctx(ar->module), msg, msg->dn,
+                                              &deleted_objects_dn);
+        if (ar->isDeleted && (ret != LDB_SUCCESS || ldb_dn_compare(msg->dn, deleted_objects_dn) != 0)) {
+                /*
+                 * Do a delete here again, so that if there is
+                 * anything local that conflicts with this
+                 * object being deleted, it is removed.  This
+                 * includes links.  See MS-DRSR 4.1.10.6.9
+                 * UpdateObject.
+                 *
+                 * If the object is already deleted, and there
+                 * is no more work required, it doesn't do
+                 * anything.
+                 */
+
+                /* This has been updated to point to the DN we eventually did the modify on */
+
+                struct ldb_request *del_req;
+                struct ldb_result *res;
+
+                TALLOC_CTX *tmp_ctx = talloc_new(ar);
+                if (!tmp_ctx) {
+                        ret = ldb_oom(ldb_module_get_ctx(ar->module));
+                        return ret;
+                }
+
+                res = talloc_zero(tmp_ctx, struct ldb_result);
+                if (!res) {
+                        ret = ldb_oom(ldb_module_get_ctx(ar->module));
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+
+                /* Build a delete request, which hopefully will artually turn into nothing */
+                ret = ldb_build_del_req(&del_req, ldb_module_get_ctx(ar->module), tmp_ctx,
+                                        msg->dn,
+                                        NULL,
+                                        res,
+                                        ldb_modify_default_callback,
+                                        ar->req);
+                LDB_REQ_SET_LOCATION(del_req);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+
+                /*
+                 * This is the guts of the call, call back
+                 * into our delete code, but setting the
+                 * re_delete flag so we delete anything that
+                 * shouldn't be there on a deleted or recycled
+                 * object
+                 */
+                ret = replmd_delete_internals(ar->module, del_req, true);
+                if (ret == LDB_SUCCESS) {
+                        ret = ldb_wait(del_req->handle, LDB_WAIT_ALL);
+                }
+
+                talloc_free(tmp_ctx);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+        ar->index_current++;
+        return replmd_replicated_apply_next(ar);
 }
 
@@ -3410 +4978 @@
 
         if (ares->type != LDB_REPLY_DONE) {
-                ldb_set_errstring(ldb, "Invalid reply type\n!");
+                ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
                 return ldb_module_done(ar->req, NULL, NULL,
                                         LDB_ERR_OPERATIONS_ERROR);
@@ -3454 +5022 @@
         unix_to_nt_time(&now, t);
 
+        if (ar->search_msg == NULL) {
+                /* this happens for a REPL_OBJ call where we are
+                   creating the target object by replicating it. The
+                   subdomain join code does this for the partition DN
+                */
+                DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
+                return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
+        }
+
         instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
         if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
@@ -3484 +5061 @@
          * plus optional values from our old vector and the one from the source_dsa
          */
-        nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
+        nuv.ctr.ctr2.count = ouv.ctr.ctr2.count;
         if (ruv) nuv.ctr.ctr2.count += ruv->count;
         nuv.ctr.ctr2.cursors = talloc_array(ar,
@@ -3499 +5076 @@
         /* get our invocation_id if we have one already attached to the ldb */
         our_invocation_id = samdb_ntds_invocation_id(ldb);
+        if (our_invocation_id == NULL) {
+                DEBUG(0, ("repl_meta_data: Could not find our own server's invocationID!\n"));
+                return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);                
+        }
 
         /* merge in the source_dsa vector is available */
@@ -3518 +5099 @@
                         found = true;
 
-                        /*
-                         * we update only the highest_usn and not the latest_sync_success time,
-                         * because the last success stands for direct replication
-                         */
                         if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
-                                nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
+                                nuv.ctr.ctr2.cursors[j] = ruv->cursors[i];
                         }
                         break;
@@ -3532 +5109 @@
                 /* if it's not there yet, add it */
                 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
-                ni++;
-        }
-
-        /*
-         * merge in the current highwatermark for the source_dsa
-         */
-        found = false;
-        for (j=0; j < ni; j++) {
-                if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
-                                &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
-                        continue;
-                }
-
-                found = true;
-
-                /*
-                 * here we update the highest_usn and last_sync_success time
-                 * because we're directly replicating from the source_dsa
-                 *
-                 * and use the tmp_highest_usn because this is what we have just applied
-                 * to our ldb
-                 */
-                nuv.ctr.ctr2.cursors[j].highest_usn             = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
-                nuv.ctr.ctr2.cursors[j].last_sync_success       = now;
-                break;
-        }
-        if (!found) {
-                /*
-                 * here we update the highest_usn and last_sync_success time
-                 * because we're directly replicating from the source_dsa
-                 *
-                 * and use the tmp_highest_usn because this is what we have just applied
-                 * to our ldb
-                 */
-                nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
-                nuv.ctr.ctr2.cursors[ni].highest_usn            = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
-                nuv.ctr.ctr2.cursors[ni].last_sync_success      = now;
                 ni++;
         }
@@ -3607 +5147 @@
         nrf.version                                     = 1;
         nrf.ctr.ctr1                                    = *ar->objs->source_dsa;
-        nrf.ctr.ctr1.highwatermark.highest_usn          = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
+        nrf.ctr.ctr1.last_attempt                       = now;
+        nrf.ctr.ctr1.last_success                       = now;
+        nrf.ctr.ctr1.result_last_attempt                = WERR_OK;
 
         /*
@@ -3685 +5227 @@
         nrf_el->flags = LDB_FLAG_MOD_REPLACE;
 
-        if (DEBUGLVL(4)) {
+        if (CHECK_DEBUGLVL(4)) {
                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
                 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
@@ -3733 +5275 @@
 
         case LDB_REPLY_DONE:
-                if (ar->search_msg == NULL) {
-                        ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
-                } else {
-                        ret = replmd_replicated_uptodate_modify(ar);
-                }
+                ret = replmd_replicated_uptodate_modify(ar);
                 if (ret != LDB_SUCCESS) {
                         return ldb_module_done(ar->req, NULL, NULL, ret);
@@ -3792 +5330 @@
         struct replmd_private *replmd_private =
                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
+        struct dsdb_control_replicated_update *rep_update;
 
         ldb = ldb_module_get_ctx(module);
@@ -3832 +5371 @@
         }
 
-        /* This allows layers further down to know if a change came in over replication */
-        ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
+        /* This allows layers further down to know if a change came in
+           over replication and what the replication flags were */
+        rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
+        if (rep_update == NULL) {
+                return ldb_module_oom(module);
+        }
+        rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
+
+        ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -3893 +5439 @@
         struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct ldb_message *msg;
+        struct ldb_message *target_msg = NULL;
         TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
         const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
@@ -3903 +5450 @@
         time_t t = time(NULL);
         struct ldb_result *res;
-        const char *attrs[2];
+        struct ldb_result *target_res;
+        const char *attrs[4];
+        const char *attrs2[] = { "isDeleted", "isRecycled", NULL };
         struct parsed_dn *pdn_list, *pdn;
         struct GUID guid = GUID_zero();
@@ -3909 +5458 @@
         bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
         const struct GUID *our_invocation_id;
+
+        enum deletion_state deletion_state = OBJECT_NOT_DELETED;
+        enum deletion_state target_deletion_state = OBJECT_NOT_DELETED;
 
 /*
@@ -3954 +5506 @@
 
         attrs[0] = attr->lDAPDisplayName;
-        attrs[1] = NULL;
+        attrs[1] = "isDeleted";
+        attrs[2] = "isRecycled";
+        attrs[3] = NULL;
 
         /* get the existing message from the db for the object with
@@ -3979 +5533 @@
         msg = res->msgs[0];
 
-        if (msg->num_elements == 0) {
+        /*
+         * Check for deleted objects per MS-DRSR 4.1.10.6.13
+         * ProcessLinkValue, because link updates are not applied to
+         * recycled and tombstone objects.  We don't have to delete
+         * any existing link, that should have happened when the
+         * object deletion was replicated or initiated.
+         */
+
+        replmd_deletion_state(module, msg, &deletion_state, NULL);
+
+        if (deletion_state >= OBJECT_RECYCLED) {
+                talloc_free(tmp_ctx);
+                return LDB_SUCCESS;
+        }
+
+        old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
+        if (old_el == NULL) {
                 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
                 if (ret != LDB_SUCCESS) {
@@ -3987 +5557 @@
                 }
         } else {
-                old_el = &msg->elements[0];
                 old_el->flags = LDB_FLAG_MOD_REPLACE;
         }
@@ -4016 +5585 @@
                 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
                                        old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
+                talloc_free(tmp_ctx);
                 return LDB_ERR_OPERATIONS_ERROR;
         }
 
         ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
-        if (!NT_STATUS_IS_OK(ntstatus) && active) {
+        if (!NT_STATUS_IS_OK(ntstatus) && !active) {
+                /*
+                 * This strange behaviour (allowing a NULL/missing
+                 * GUID) originally comes from:
+                 *
+                 * commit e3054ce0fe0f8f62d2f5b2a77893e7a1479128bd
+                 * Author: Andrew Tridgell <tridge@samba.org>
+                 * Date:   Mon Dec 21 21:21:55 2009 +1100
+                 *
+                 *  s4-drs: cope better with NULL GUIDS from DRS
+                 *
+                 *  It is valid to get a NULL GUID over DRS for a deleted forward link. We
+                 *  need to match by DN if possible when seeing if we should update an
+                 *  existing link.
+                 *
+                 *  Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
+                 */
+
+                ret = dsdb_module_search_dn(module, tmp_ctx, &target_res,
+                                            dsdb_dn->dn, attrs2,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_SEARCH_SHOW_RECYCLED |
+                                            DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
+                                            DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
+                                            parent);
+        } else if (!NT_STATUS_IS_OK(ntstatus)) {
                 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
                                        old_el->name,
                                        ldb_dn_get_linearized(dsdb_dn->dn),
                                        ldb_dn_get_linearized(msg->dn));
+                talloc_free(tmp_ctx);
                 return LDB_ERR_OPERATIONS_ERROR;
-        }
-
-        /* re-resolve the DN by GUID, as the DRS server may give us an
-           old DN value */
-        ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
-        if (ret != LDB_SUCCESS) {
-                DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
+        } else {
+                ret = dsdb_module_search(module, tmp_ctx, &target_res,
+                                         NULL, LDB_SCOPE_SUBTREE,
+                                         attrs2,
+                                         DSDB_FLAG_NEXT_MODULE |
+                                         DSDB_SEARCH_SHOW_RECYCLED |
+                                         DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
+                                         DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
+                                         parent,
+                                         "objectGUID=%s",
+                                         GUID_string(tmp_ctx, &guid));
+        }
+
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module), "Failed to re-resolve GUID %s: %s\n",
+                                       GUID_string(tmp_ctx, &guid),
+                                       ldb_errstring(ldb_module_get_ctx(module)));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        if (target_res->count == 0) {
+                DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
                          GUID_string(tmp_ctx, &guid),
                          ldb_dn_get_linearized(dsdb_dn->dn)));
+        } else if (target_res->count != 1) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module), "More than one object found matching objectGUID %s\n",
+                                       GUID_string(tmp_ctx, &guid));
+                talloc_free(tmp_ctx);
+                return LDB_ERR_OPERATIONS_ERROR;
+        } else {
+                target_msg = target_res->msgs[0];
+                dsdb_dn->dn = talloc_steal(dsdb_dn, target_msg->dn);
+        }
+
+        /*
+         * Check for deleted objects per MS-DRSR 4.1.10.6.13
+         * ProcessLinkValue, because link updates are not applied to
+         * recycled and tombstone objects.  We don't have to delete
+         * any existing link, that should have happened when the
+         * object deletion was replicated or initiated.
+         */
+        replmd_deletion_state(module, target_msg,
+                              &target_deletion_state, NULL);
+
+        if (target_deletion_state >= OBJECT_RECYCLED) {
+                talloc_free(tmp_ctx);
+                return LDB_SUCCESS;
         }
 
@@ -4139 +5774 @@
         /* we only change whenChanged and uSNChanged if the seq_num
            has changed */
-        if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
+        ret = add_time_element(msg, "whenChanged", t);
+        if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-
-        if (add_uint64_element(ldb, msg, "uSNChanged",
-                               seq_num) != LDB_SUCCESS) {
+                ldb_operr(ldb);
+                return ret;
+        }
+
+        ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
+        if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
+                ldb_operr(ldb);
+                return ret;
         }
 

vendor/current/source4/dsdb/samdb/ldb_modules/resolve_oids.c

@@ -413 +413 @@
 static int resolve_oids_callback(struct ldb_request *req, struct ldb_reply *ares)
 {
-        struct ldb_context *ldb;
         struct resolve_oids_context *ac;
 
         ac = talloc_get_type_abort(req->context, struct resolve_oids_context);
-        ldb = ldb_module_get_ctx(ac->module);
 
         if (!ares) {

vendor/current/source4/dsdb/samdb/ldb_modules/ridalloc.c

@@ -35 +35 @@
 #include "param/param.h"
 #include "librpc/gen_ndr/ndr_misc.h"
+#include "dsdb/samdb/ldb_modules/ridalloc.h"
 
 /*
@@ -64 +65 @@
   completely run out of RIDs
  */
-static void ridalloc_poke_rid_manager(struct ldb_module *module)
+static int ridalloc_poke_rid_manager(struct ldb_module *module)
 {
-        struct messaging_context *msg;
-        struct server_id *server;
+        struct imessaging_context *msg;
+        unsigned num_servers;
+        struct server_id *servers;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct loadparm_context *lp_ctx =
                 (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm");
         TALLOC_CTX *tmp_ctx = talloc_new(module);
-
-        msg = messaging_client_init(tmp_ctx, lpcfg_messaging_path(tmp_ctx, lp_ctx),
+        NTSTATUS status;
+
+        msg = imessaging_client_init(tmp_ctx, lp_ctx,
                                     ldb_get_event_context(ldb));
         if (!msg) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                "Failed to send MSG_DREPL_ALLOCATE_RID, "
+                                "unable init client messaging context");
                 DEBUG(3,(__location__ ": Failed to create messaging context\n"));
                 talloc_free(tmp_ctx);
-                return;
-        }
-
-        server = irpc_servers_byname(msg, msg, "dreplsrv");
-        if (!server) {
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        status = irpc_servers_byname(msg, msg, "dreplsrv",
+                                     &num_servers, &servers);
+        if (!NT_STATUS_IS_OK(status)) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                "Failed to send MSG_DREPL_ALLOCATE_RID, "
+                                "unable to locate dreplsrv");
                 /* this means the drepl service is not running */
                 talloc_free(tmp_ctx);
-                return;
-        }
-
-        messaging_send(msg, server[0], MSG_DREPL_ALLOCATE_RID, NULL);
-
-        /* we don't care if the message got through */
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        status = imessaging_send(msg, servers[0], MSG_DREPL_ALLOCATE_RID, NULL);
+
+        /* Only error out if an error happened, not on STATUS_MORE_ENTRIES, ie a delayed message */
+        if (NT_STATUS_IS_ERR(status)) {
+                struct server_id_buf idbuf;
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                "Failed to send MSG_DREPL_ALLOCATE_RID to dreplsrv at %s: %s",
+                                server_id_str_buf(*servers, &idbuf),
+                                nt_errstr(status));
+                talloc_free(tmp_ctx);
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
         talloc_free(tmp_ctx);
+        return LDB_SUCCESS;
 }
 
@@ -263 +284 @@
                 .used_pool      = 0,
         };
+        const char *no_attrs[] = { NULL };
+        struct ldb_result *res;
 
         /*
@@ -339 +362 @@
         msg->dn = machine_dn;
 
-        ret = ldb_msg_add_string(msg, "rIDSetReferences", ldb_dn_get_linearized(rid_set_dn));
+        /* we need the extended DN of the RID Set object for
+         * rIDSetReferences */
+        ret = dsdb_module_search_dn(module, msg, &res, rid_set_dn, no_attrs,
+                                    DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, parent);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "Failed to find extended DN of RID Set %s - %s",
+                                       ldb_dn_get_linearized(msg->dn),
+                                       ldb_errstring(ldb));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        rid_set_dn = res->msgs[0]->dn;
+
+
+        ret = ldb_msg_add_string(msg, "rIDSetReferences", ldb_dn_get_extended_linearized(msg, rid_set_dn, 1));
         if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
@@ -372 +409 @@
         int ret;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct GUID fsmo_role_guid;
+        const struct GUID *our_ntds_guid;
+        NTSTATUS status;
 
         /* work out who is the RID Manager */
@@ -391 +431 @@
         }
 
-        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
-                ridalloc_poke_rid_manager(module);
-                ldb_asprintf_errstring(ldb, "Remote RID Set allocation needs refresh");
+        status = dsdb_get_extended_dn_guid(fsmo_role_dn, &fsmo_role_guid, "GUID");
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
+
+        our_ntds_guid = samdb_ntds_objectGUID(ldb_module_get_ctx(module));
+        if (!our_ntds_guid) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
+
+        if (!GUID_equal(&fsmo_role_guid, our_ntds_guid)) {
+                ret = ridalloc_poke_rid_manager(module);
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb,
+                                        "Request for remote creation of "
+                                        "RID Set for this DC failed: %s",
+                                        ldb_errstring(ldb));
+                } else {
+                        ldb_asprintf_errstring(ldb,
+                                        "Remote RID Set creation needed");
+                }
                 talloc_free(tmp_ctx);
                 return LDB_ERR_UNWILLING_TO_PERFORM;
@@ -413 +473 @@
         int ret;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
+        bool is_us;
 
         /* work out who is the RID Manager */
@@ -432 +493 @@
         }
 
-        if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
-                ridalloc_poke_rid_manager(module);
-                ldb_asprintf_errstring(ldb, "Remote RID Set allocation needs refresh");
+        ret = samdb_dn_is_our_ntdsa(ldb, fsmo_role_dn, &is_us);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "Failed to confirm if our ntdsDsa is %s: %s",
+                                       ldb_dn_get_linearized(fsmo_role_dn), ldb_errstring(ldb));
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+        
+        if (!is_us) {
+                ret = ridalloc_poke_rid_manager(module);
+                if (ret != LDB_SUCCESS) {
+                        ldb_asprintf_errstring(ldb, "Request for remote refresh of RID Set allocation failed: %s",
+                                               ldb_errstring(ldb));
+                } else {
+                        ldb_asprintf_errstring(ldb, "Remote RID Set refresh needed");
+                }
                 talloc_free(tmp_ctx);
                 return LDB_ERR_UNWILLING_TO_PERFORM;
@@ -528 +602 @@
                          */
                         ret = ridalloc_new_own_pool(module, &nridset.alloc_pool, parent);
-                        if (ret == LDB_ERR_UNWILLING_TO_PERFORM) {
-                                ridalloc_poke_rid_manager(module);
-                                talloc_free(tmp_ctx);
-                                return ret;
-                        }
                         if (ret != LDB_SUCCESS) {
+                                ldb_asprintf_errstring(ldb, "NO RID values available: %s",
+                                                       ldb_errstring(ldb));
                                 talloc_free(tmp_ctx);
                                 return ret;
@@ -566 +637 @@
          * if we are half-exhausted then try to get a new pool.
          */
-        if (nridset.next_rid > (prev_pool_hi + prev_pool_lo)/2) {
+        if (nridset.next_rid > (prev_pool_hi + prev_pool_lo)/2 &&
+            nridset.alloc_pool == nridset.prev_pool) {
                 /*
                  * if we are the RID Manager,
@@ -575 +647 @@
                 ret = ridalloc_new_own_pool(module, &nridset.alloc_pool, parent);
                 if (ret == LDB_ERR_UNWILLING_TO_PERFORM) {
-                        ridalloc_poke_rid_manager(module);
+                        ldb_reset_err_string(ldb);
                         ret = LDB_SUCCESS;
                 }

vendor/current/source4/dsdb/samdb/ldb_modules/rootdse.c

@@ -6 +6 @@
    Copyright (C) Andrew Tridgell 2005
    Copyright (C) Simo Sorce 2005-2008
+   Copyright (C) Matthieu Patou <mat@matws.net> 2011
 
    This program is free software; you can redistribute it and/or modify
@@ -34 +35 @@
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/ndr_irpc_c.h"
-
-struct private_data {
+#include "lib/tsocket/tsocket.h"
+#include "cldap_server/cldap_server.h"
+#include "lib/events/events.h"
+
+struct rootdse_private_data {
         unsigned int num_controls;
         char **controls;
@@ -41 +45 @@
         struct ldb_dn **partitions;
         bool block_anonymous;
+        struct tevent_context *saved_ev;
+        struct tevent_context *private_ev;
+};
+
+struct rootdse_context {
+        struct ldb_module *module;
+        struct ldb_request *req;
+        struct ldb_val netlogon;
 };
 
@@ -77 +89 @@
         struct ldb_context *ldb;
         int edn_type = 0;
+        unsigned int i;
+        struct ldb_message_element *el;
 
         ldb = ldb_module_get_ctx(module);
@@ -85 +99 @@
         }
 
-        v = discard_const_p(struct ldb_val, ldb_msg_find_ldb_val(msg, attrname));
-        if (v == NULL) {
+        el = ldb_msg_find_element(msg, attrname);
+        if (!el || el->num_values == 0) {
+                return LDB_SUCCESS;
+        }
+
+        for (i = 0; i < el->num_values; i++) {
+                v = &el->values[i];
+                if (v == NULL) {
+                        talloc_free(tmp_ctx);
+                        return LDB_SUCCESS;
+                }
+
+                dn_string = talloc_strndup(tmp_ctx, (const char *)v->data, v->length);
+                if (dn_string == NULL) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+
+                res = talloc_zero(tmp_ctx, struct ldb_result);
+                if (res == NULL) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+
+                dn = ldb_dn_new(tmp_ctx, ldb, dn_string);
+                if (dn == NULL) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+
+                ret = ldb_build_search_req(&req2, ldb, tmp_ctx,
+                                        dn,
+                                        LDB_SCOPE_BASE,
+                                        NULL,
+                                        no_attrs,
+                                        NULL,
+                                        res, ldb_search_default_callback,
+                                        req);
+                LDB_REQ_SET_LOCATION(req2);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+
+                ret = dsdb_request_add_controls(req2, DSDB_FLAG_AS_SYSTEM |
+                                                DSDB_SEARCH_SHOW_EXTENDED_DN);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ldb_error(ldb, ret, "Failed to add control");
+                }
+
+                ret = ldb_next_request(module, req2);
+                if (ret == LDB_SUCCESS) {
+                        ret = ldb_wait(req2->handle, LDB_WAIT_ALL);
+                }
+
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+
+                if (!res || res->count != 1) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+
+                dn2 = res->msgs[0]->dn;
+
+                v->data = (uint8_t *)ldb_dn_get_extended_linearized(msg->elements, dn2, edn_type);
+                if (v->data == NULL) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+                v->length = strlen((char *)v->data);
+        }
+
+        talloc_free(tmp_ctx);
+
+        return LDB_SUCCESS;
+}
+
+/*
+  see if we are master for a FSMO role
+ */
+static int dsdb_module_we_are_master(struct ldb_module *module, struct ldb_dn *dn, bool *master,
+                                     struct ldb_request *parent)
+{
+        const char *attrs[] = { "fSMORoleOwner", NULL };
+        TALLOC_CTX *tmp_ctx = talloc_new(parent);
+        struct ldb_result *res;
+        int ret;
+        struct ldb_dn *owner_dn;
+
+        ret = dsdb_module_search_dn(module, tmp_ctx, &res,
+                                    dn, attrs,
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_FLAG_AS_SYSTEM |
+                                    DSDB_SEARCH_SHOW_EXTENDED_DN,
+                                    parent);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        owner_dn = ldb_msg_find_attr_as_dn(ldb_module_get_ctx(module),
+                                           tmp_ctx, res->msgs[0], "fSMORoleOwner");
+        if (!owner_dn) {
+                *master = false;
                 talloc_free(tmp_ctx);
                 return LDB_SUCCESS;
         }
 
-        dn_string = talloc_strndup(tmp_ctx, (const char *)v->data, v->length);
-        if (dn_string == NULL) {
+        ret = samdb_dn_is_our_ntdsa(ldb_module_get_ctx(module), dn, master);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb_module_get_ctx(module), "Failed to confirm if our ntdsDsa is %s: %s",
+                                       ldb_dn_get_linearized(owner_dn), ldb_errstring(ldb_module_get_ctx(module)));
                 talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-
-        res = talloc_zero(tmp_ctx, struct ldb_result);
-        if (res == NULL) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-
-        dn = ldb_dn_new(tmp_ctx, ldb, dn_string);
-        if (dn == NULL) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-
-        ret = ldb_build_search_req(&req2, ldb, tmp_ctx,
-                                   dn,
-                                   LDB_SCOPE_BASE,
-                                   NULL,
-                                   no_attrs,
-                                   NULL,
-                                   res, ldb_search_default_callback,
-                                   req);
-        LDB_REQ_SET_LOCATION(req2);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-
-        ret = ldb_request_add_control(req2,
-                                      LDB_CONTROL_EXTENDED_DN_OID,
-                                      edn_control->critical, edn);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        ret = ldb_next_request(module, req2);
-        if (ret == LDB_SUCCESS) {
-                ret = ldb_wait(req2->handle, LDB_WAIT_ALL);
-        }
-        if (ret != LDB_SUCCESS) {
-                talloc_free(tmp_ctx);
-                return ret;
-        }
-
-        if (!res || res->count != 1) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-
-        dn2 = res->msgs[0]->dn;
-
-        v->data = (uint8_t *)ldb_dn_get_extended_linearized(msg->elements, dn2, edn_type);
-        if (v->data == NULL) {
-                talloc_free(tmp_ctx);
-                return ldb_operr(ldb);
-        }
-        v->length = strlen((char *)v->data);
-
-
+                return ret;
+        }
+        
         talloc_free(tmp_ctx);
-
         return LDB_SUCCESS;
 }
-
 
 /*
   add dynamically generated attributes to rootDSE result
 */
-static int rootdse_add_dynamic(struct ldb_module *module, struct ldb_message *msg,
-                               const char * const *attrs, struct ldb_request *req)
+static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *msg)
 {
         struct ldb_context *ldb;
-        struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
+        struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data);
+        const char * const *attrs = ac->req->op.search.attrs;
         char **server_sasl;
         const struct dsdb_schema *schema;
@@ -177 +238 @@
                 "configurationNamingContext",
                 "defaultNamingContext",
-                "dsServiceName",
                 "rootDomainNamingContext",
                 "schemaNamingContext",
                 "serverName",
+                "validFSMOs",
+                "namingContexts",
                 NULL
         };
-
-        ldb = ldb_module_get_ctx(module);
+        const char *guid_attrs[] = {
+                "dsServiceName",
+                NULL
+        };
+        unsigned int i;
+
+        ldb = ldb_module_get_ctx(ac->module);
         schema = dsdb_get_schema(ldb, NULL);
 
@@ -205 +272 @@
                 int ret;
                 const char *dns_attrs[] = { "dNSHostName", NULL };
-                ret = dsdb_module_search_dn(module, msg, &res, samdb_server_dn(ldb, msg),
-                                            dns_attrs, DSDB_FLAG_NEXT_MODULE, req);
+                ret = dsdb_module_search_dn(ac->module, msg, &res, samdb_server_dn(ldb, msg),
+                                            dns_attrs,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_FLAG_AS_SYSTEM,
+                                            ac->req);
                 if (ret == LDB_SUCCESS) {
                         const char *hostname = ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName", NULL);
                         if (hostname != NULL) {
-                                if (ldb_msg_add_string(msg, "dNSHostName", hostname)) {
+                                if (ldb_msg_add_string(msg, "dnsHostName", hostname)) {
                                         goto failed;
                                 }
@@ -223 +293 @@
                 char *ldap_service_name, *hostname;
 
-                hostname = talloc_strdup(msg, lpcfg_netbios_name(lp_ctx));
+                hostname = strlower_talloc(msg, lpcfg_netbios_name(lp_ctx));
                 if (hostname == NULL) {
                         goto failed;
                 }
-                strlower_m(hostname);
 
                 ldap_service_name = talloc_asprintf(msg, "%s:%s$@%s",
@@ -250 +319 @@
 
         if (priv && do_attribute(attrs, "supportedControl")) {
-                unsigned int i;
                 for (i = 0; i < priv->num_controls; i++) {
                         char *control = talloc_strdup(msg, priv->controls[i]);
@@ -264 +332 @@
 
         if (priv && do_attribute(attrs, "namingContexts")) {
-                unsigned int i;
                 for (i = 0; i < priv->num_partitions; i++) {
                         struct ldb_dn *dn = priv->partitions[i];
@@ -277 +344 @@
                                        char *);
         if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) {
-                unsigned int i;
                 for (i = 0; server_sasl && server_sasl[i]; i++) {
                         char *sasl_name = talloc_strdup(msg, server_sasl[i]);
@@ -338 +404 @@
 
         if (do_attribute_explicit(attrs, "validFSMOs")) {
-                const struct dsdb_naming_fsmo *naming_fsmo;
-                const struct dsdb_pdc_fsmo *pdc_fsmo;
-                const char *dn_str;
-
-                if (schema && schema->fsmo.we_are_master) {
-                        dn_str = ldb_dn_get_linearized(ldb_get_schema_basedn(ldb));
-                        if (dn_str && dn_str[0]) {
-                                if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != LDB_SUCCESS) {
-                                        goto failed;
-                                }
+                struct ldb_dn *dns[3];
+
+                dns[0] = ldb_get_schema_basedn(ldb);
+                dns[1] = samdb_partitions_dn(ldb, msg);
+                dns[2] = ldb_get_default_basedn(ldb);
+
+                for (i=0; i<3; i++) {
+                        bool master;
+                        int ret = dsdb_module_we_are_master(ac->module, dns[i], &master, ac->req);
+                        if (ret != LDB_SUCCESS) {
+                                goto failed;
                         }
-                }
-
-                naming_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_naming_fsmo"),
-                                              struct dsdb_naming_fsmo);
-                if (naming_fsmo && naming_fsmo->we_are_master) {
-                        dn_str = ldb_dn_get_linearized(samdb_partitions_dn(ldb, msg));
-                        if (dn_str && dn_str[0]) {
-                                if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != LDB_SUCCESS) {
-                                        goto failed;
-                                }
-                        }
-                }
-
-                pdc_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_pdc_fsmo"),
-                                           struct dsdb_pdc_fsmo);
-                if (pdc_fsmo && pdc_fsmo->we_are_master) {
-                        dn_str = ldb_dn_get_linearized(ldb_get_default_basedn(ldb));
-                        if (dn_str && dn_str[0]) {
-                                if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != LDB_SUCCESS) {
-                                        goto failed;
-                                }
+                        if (master && ldb_msg_add_fmt(msg, "validFSMOs", "%s",
+                                                      ldb_dn_get_linearized(dns[i])) != LDB_SUCCESS) {
+                                goto failed;
                         }
                 }
@@ -418 +467 @@
 
         if (do_attribute_explicit(attrs, "tokenGroups")) {
-                unsigned int i;
                 /* Obtain the user's session_info */
                 struct auth_session_info *session_info
@@ -434 +482 @@
         }
 
+        if (ac->netlogon.length > 0) {
+                if (ldb_msg_add_steal_value(msg, "netlogon", &ac->netlogon) != LDB_SUCCESS) {
+                        goto failed;
+                }
+        }
+
         /* TODO: lots more dynamic attributes should be added here */
 
-        edn_control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
+        edn_control = ldb_request_get_control(ac->req, LDB_CONTROL_EXTENDED_DN_OID);
+
+        /* convert any GUID attributes to be in the right form */
+        for (i=0; guid_attrs[i]; i++) {
+                struct ldb_result *res;
+                struct ldb_message_element *el;
+                struct ldb_dn *attr_dn;
+                const char *no_attrs[] = { NULL };
+                int ret;
+
+                if (!do_attribute(attrs, guid_attrs[i])) continue;
+
+                attr_dn = ldb_msg_find_attr_as_dn(ldb, ac->req, msg, guid_attrs[i]);
+                if (attr_dn == NULL) {
+                        continue;
+                }
+
+                ret = dsdb_module_search_dn(ac->module, ac->req, &res,
+                                            attr_dn, no_attrs,
+                                            DSDB_FLAG_NEXT_MODULE |
+                                            DSDB_FLAG_AS_SYSTEM |
+                                            DSDB_SEARCH_SHOW_EXTENDED_DN,
+                                            ac->req);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_operr(ldb);
+                }
+
+                el = ldb_msg_find_element(msg, guid_attrs[i]);
+                if (el == NULL) {
+                        return ldb_operr(ldb);
+                }
+
+                talloc_steal(el->values, res->msgs[0]->dn);
+                if (edn_control) {
+                        struct ldb_extended_dn_control *edn;
+                        int edn_type = 0;
+                        edn = talloc_get_type(edn_control->data, struct ldb_extended_dn_control);
+                        if (edn != NULL) {
+                                edn_type = edn->type;
+                        }
+                        el->values[0].data  = (uint8_t *)ldb_dn_get_extended_linearized(el->values,
+                                                                                        res->msgs[0]->dn,
+                                                                                        edn_type);
+                } else {
+                        el->values[0].data  = (uint8_t *)talloc_strdup(el->values,
+                                                                       ldb_dn_get_linearized(res->msgs[0]->dn));
+                }
+                if (el->values[0].data == NULL) {
+                        return ldb_oom(ldb);
+                }
+                el->values[0].length = strlen((const char *)el->values[0].data);
+        }
 
         /* if the client sent us the EXTENDED_DN control then we need
@@ -442 +547 @@
            this */
         if (edn_control) {
-                unsigned int i;
                 int ret;
                 for (i=0; dn_attrs[i]; i++) {
                         if (!do_attribute(attrs, dn_attrs[i])) continue;
-                        ret = expand_dn_in_message(module, msg, dn_attrs[i],
-                                                   edn_control, req);
+                        ret = expand_dn_in_message(ac->module, msg, dn_attrs[i],
+                                                   edn_control, ac->req);
                         if (ret != LDB_SUCCESS) {
                                 DEBUG(0,(__location__ ": Failed to expand DN in rootDSE for %s\n",
@@ -466 +570 @@
 */
 
-struct rootdse_context {
-        struct ldb_module *module;
-        struct ldb_request *req;
-};
-
 static struct rootdse_context *rootdse_init_context(struct ldb_module *module,
                                                     struct ldb_request *req)
@@ -509 +608 @@
         switch (ares->type) {
         case LDB_REPLY_ENTRY:
-                /*
-                 * if the client explicit asks for the 'netlogon' attribute
-                 * the reply_entry needs to be skipped
-                 */
-                if (ac->req->op.search.attrs &&
-                    ldb_attr_in_list(ac->req->op.search.attrs, "netlogon")) {
-                        talloc_free(ares);
-                        return LDB_SUCCESS;
-                }
-
                 /* for each record returned post-process to add any dynamic
                    attributes that have been asked for */
-                ret = rootdse_add_dynamic(ac->module, ares->message,
-                                          ac->req->op.search.attrs, ac->req);
+                ret = rootdse_add_dynamic(ac, ares->message);
                 if (ret != LDB_SUCCESS) {
                         talloc_free(ares);
@@ -568 +656 @@
 {
         unsigned int i, j;
-        struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
+        struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(module), struct rootdse_private_data);
         bool is_untrusted;
 
@@ -614 +702 @@
                 }
 
-                if (is_registered) {
+                /* If the control is DIRSYNC control then we keep the critical
+                 * flag as the dirsync module will need to act upon it
+                 */
+                if (is_registered && strcmp(req->controls[i]->oid,
+                                        LDB_CONTROL_DIRSYNC_OID)!= 0) {
                         req->controls[i]->critical = 0;
                 }
@@ -627 +719 @@
 {
         struct auth_session_info *session_info;
-        struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
+        struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(module), struct rootdse_private_data);
         bool is_untrusted = ldb_req_is_untrusted(req);
         bool is_anonymous = true;
@@ -652 +744 @@
 }
 
+static int rootdse_handle_netlogon(struct rootdse_context *ac)
+{
+        struct ldb_context *ldb;
+        struct ldb_parse_tree *tree;
+        struct loadparm_context *lp_ctx;
+        struct tsocket_address *src_addr;
+        TALLOC_CTX *tmp_ctx = talloc_new(ac->req);
+        const char *domain, *host, *user, *domain_guid;
+        char *src_addr_s = NULL;
+        struct dom_sid *domain_sid;
+        int acct_control = -1;
+        int version = -1;
+        NTSTATUS status;
+        struct netlogon_samlogon_response netlogon;
+        int ret = LDB_ERR_OPERATIONS_ERROR;
+
+        ldb = ldb_module_get_ctx(ac->module);
+        tree = ac->req->op.search.tree;
+        lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
+                                 struct loadparm_context);
+        src_addr = talloc_get_type(ldb_get_opaque(ldb, "remoteAddress"),
+                                   struct tsocket_address);
+        if (src_addr) {
+                src_addr_s = tsocket_address_inet_addr_string(src_addr,
+                                                              tmp_ctx);
+        }
+
+        status = parse_netlogon_request(tree, lp_ctx, tmp_ctx,
+                                        &domain, &host, &user, &domain_guid,
+                                        &domain_sid, &acct_control, &version);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto failed;
+        }
+
+        status = fill_netlogon_samlogon_response(ldb, tmp_ctx,
+                                                 domain, NULL, domain_sid,
+                                                 domain_guid,
+                                                 user, acct_control,
+                                                 src_addr_s,
+                                                 version, lp_ctx,
+                                                 &netlogon, false);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto failed;
+        }
+
+        status = push_netlogon_samlogon_response(&ac->netlogon, ac, &netlogon);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto failed;
+        }
+
+        ret = LDB_SUCCESS;
+failed:
+        talloc_free(tmp_ctx);
+        return ret;
+}
+
 static int rootdse_search(struct ldb_module *module, struct ldb_request *req)
 {
@@ -680 +828 @@
         if (ac == NULL) {
                 return ldb_operr(ldb);
+        }
+
+        if (do_attribute_explicit(req->op.search.attrs, "netlogon")) {
+                ret = rootdse_handle_netlogon(ac);
+                /* We have to return an empty result, so don't forward `ret' */
+                if (ret != LDB_SUCCESS) {
+                        return ldb_module_done(ac->req, NULL, NULL, LDB_SUCCESS);
+                }
         }
 
@@ -701 +857 @@
 static int rootdse_register_control(struct ldb_module *module, struct ldb_request *req)
 {
-        struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
+        struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(module), struct rootdse_private_data);
         char **list;
 
@@ -722 +878 @@
 static int rootdse_register_partition(struct ldb_module *module, struct ldb_request *req)
 {
-        struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
+        struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(module), struct rootdse_private_data);
         struct ldb_dn **list;
 
@@ -762 +918 @@
         struct ldb_context *ldb;
         struct ldb_result *res;
-        struct private_data *data;
+        struct rootdse_private_data *data;
         const char *attrs[] = { "msDS-Behavior-Version", NULL };
         const char *ds_attrs[] = { "dsServiceName", NULL };
@@ -769 +925 @@
         ldb = ldb_module_get_ctx(module);
 
-        data = talloc_zero(module, struct private_data);
+        data = talloc_zero(module, struct rootdse_private_data);
         if (data == NULL) {
                 return ldb_oom(ldb);
@@ -804 +960 @@
         ret = dsdb_module_search(module, mem_ctx, &res,
                                  ldb_get_default_basedn(ldb),
-                                 LDB_SCOPE_BASE, attrs, DSDB_FLAG_NEXT_MODULE, NULL, NULL);
+                                 LDB_SCOPE_BASE, attrs,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
+                                 NULL, NULL);
         if (ret == LDB_SUCCESS && res->count == 1) {
                 int domain_behaviour_version
@@ -826 +985 @@
         ret = dsdb_module_search(module, mem_ctx, &res,
                                  samdb_partitions_dn(ldb, mem_ctx),
-                                 LDB_SCOPE_BASE, attrs, DSDB_FLAG_NEXT_MODULE, NULL, NULL);
+                                 LDB_SCOPE_BASE, attrs,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
+                                 NULL, NULL);
         if (ret == LDB_SUCCESS && res->count == 1) {
                 int forest_behaviour_version
@@ -850 +1012 @@
         ret = dsdb_module_search(module, mem_ctx, &res,
                                  ldb_dn_new(mem_ctx, ldb, "@ROOTDSE"),
-                                 LDB_SCOPE_BASE, ds_attrs, DSDB_FLAG_NEXT_MODULE, NULL, NULL);
+                                 LDB_SCOPE_BASE, ds_attrs,
+                                 DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM,
+                                 NULL, NULL);
         if (ret == LDB_SUCCESS && res->count == 1) {
                 struct ldb_dn *ds_dn
@@ -857 +1022 @@
                 if (ds_dn) {
                         ret = dsdb_module_search(module, mem_ctx, &res, ds_dn,
-                                                 LDB_SCOPE_BASE, attrs, DSDB_FLAG_NEXT_MODULE, NULL, NULL);
+                                                 LDB_SCOPE_BASE, attrs,
+                                                 DSDB_FLAG_NEXT_MODULE |
+                                                 DSDB_FLAG_AS_SYSTEM,
+                                                 NULL, NULL);
                         if (ret == LDB_SUCCESS && res->count == 1) {
                                 int domain_controller_behaviour_version
@@ -950 +1118 @@
                                  NULL,
                                  DSDB_FLAG_NEXT_MODULE |
+                                 DSDB_FLAG_AS_SYSTEM |
                                  DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
                                  parent,
@@ -997 +1166 @@
 
         tmp_ctx = talloc_new(mem_ctx);
-        ntds_settings_dn = samdb_ntds_settings_dn(ldb);
+        ntds_settings_dn = samdb_ntds_settings_dn(ldb, tmp_ctx);
         if (!ntds_settings_dn) {
-                DEBUG(0, (__location__ ": Failed to find NTDS settings DN\n"));
-                ret = LDB_ERR_OPERATIONS_ERROR;
                 talloc_free(tmp_ctx);
-                return ret;
+                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "Failed to find NTDS settings DN");
         }
 
         ntds_settings_dn = ldb_dn_copy(tmp_ctx, ntds_settings_dn);
         if (!ntds_settings_dn) {
-                DEBUG(0, (__location__ ": Failed to copy NTDS settings DN\n"));
-                ret = LDB_ERR_OPERATIONS_ERROR;
                 talloc_free(tmp_ctx);
-                return ret;
+                return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "Failed to copy NTDS settings DN");
         }
 
         msg = ldb_msg_new(tmp_ctx);
+        if (msg == NULL) {
+                talloc_free(tmp_ctx);
+                return ldb_module_oom(module);
+        }
         msg->dn = ntds_settings_dn;
 
@@ -1138 +1307 @@
 }
 
+static int rootdse_schemaupgradeinprogress(struct ldb_module *module, struct ldb_request *req)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        int ret = LDB_SUCCESS;
+        struct ldb_dn *schema_dn;
+
+        schema_dn = ldb_get_schema_basedn(ldb);
+        if (!schema_dn) {
+                ldb_reset_err_string(ldb);
+                ldb_debug(ldb, LDB_DEBUG_WARNING,
+                          "rootdse_modify: no schema dn present: (skip ldb_extended call)\n");
+                return ldb_next_request(module, req);
+        }
+
+        /* FIXME we have to do something in order to relax constraints for DRS
+         * setting schemaUpgradeInProgress cause the fschemaUpgradeInProgress
+         * in all LDAP connection (2K3/2K3R2) or in the current connection (2K8 and +)
+         * to be set to true.
+         */
+
+        /* from 5.113 LDAPConnections in DRSR.pdf
+         * fschemaUpgradeInProgress: A Boolean that specifies certain constraint
+         * validations are skipped when adding, updating, or removing directory
+         * objects on the opened connection. The skipped constraint validations
+         * are documented in the applicable constraint sections in [MS-ADTS].
+         */
+        return ldb_module_done(req, NULL, NULL, ret);
+}
+
 static int rootdse_add(struct ldb_module *module, struct ldb_request *req)
 {
@@ -1164 +1362 @@
 }
 
+static int rootdse_start_trans(struct ldb_module *module)
+{
+        int ret;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct rootdse_private_data *data = talloc_get_type_abort(ldb_module_get_private(module),
+                                                                  struct rootdse_private_data);
+        ret = ldb_next_start_trans(module);
+        if (ret == LDB_SUCCESS) {
+                if (data->private_ev != NULL) {
+                        return ldb_operr(ldb);
+                }
+                data->private_ev = s4_event_context_init(data);
+                if (data->private_ev == NULL) {
+                        return ldb_operr(ldb);
+                }
+                data->saved_ev = ldb_get_event_context(ldb);
+                ldb_set_event_context(ldb, data->private_ev);
+        }
+        return ret;
+}
+
+static int rootdse_end_trans(struct ldb_module *module)
+{
+        int ret;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct rootdse_private_data *data = talloc_get_type_abort(ldb_module_get_private(module),
+                                                                  struct rootdse_private_data);
+        ret = ldb_next_end_trans(module);
+        if (data->saved_ev == NULL) {
+                return ldb_operr(ldb);
+        }
+
+        if (data->private_ev != ldb_get_event_context(ldb)) {
+                return ldb_operr(ldb);
+        }
+        ldb_set_event_context(ldb, data->saved_ev);
+        data->saved_ev = NULL;
+        TALLOC_FREE(data->private_ev);
+        return ret;
+}
+
+static int rootdse_del_trans(struct ldb_module *module)
+{
+        int ret;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct rootdse_private_data *data = talloc_get_type_abort(ldb_module_get_private(module),
+                                                                  struct rootdse_private_data);
+        ret = ldb_next_del_trans(module);
+        if (data->saved_ev == NULL) {
+                return ldb_operr(ldb);
+        }
+
+        if (data->private_ev != ldb_get_event_context(ldb)) {
+                return ldb_operr(ldb);
+        }
+        ldb_set_event_context(ldb, data->saved_ev);
+        data->saved_ev = NULL;
+        TALLOC_FREE(data->private_ev);
+        return ret;
+}
+
+struct fsmo_transfer_state {
+        struct ldb_context *ldb;
+        struct ldb_request *req;
+        struct ldb_module *module;
+};
+
+/*
+  called when a FSMO transfer operation has completed
+ */
+static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
+{
+        struct fsmo_transfer_state *fsmo = tevent_req_callback_data(treq, struct fsmo_transfer_state);
+        NTSTATUS status;
+        WERROR werr;
+        int ret;
+        struct ldb_request *req = fsmo->req;
+        struct ldb_context *ldb = fsmo->ldb;
+        struct ldb_module *module = fsmo->module;
+
+        status = dcerpc_drepl_takeFSMORole_recv(treq, fsmo, &werr);
+        talloc_free(fsmo);
+        if (!NT_STATUS_IS_OK(status)) {
+                ldb_asprintf_errstring(ldb, "Failed FSMO transfer: %s", nt_errstr(status));
+                /*
+                 * Now that it is failed, start the transaction up
+                 * again so the wrappers can close it without additional error
+                 */
+                rootdse_start_trans(module);
+                ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
+                return;
+        }
+        if (!W_ERROR_IS_OK(werr)) {
+                ldb_asprintf_errstring(ldb, "Failed FSMO transfer: %s", win_errstr(werr));
+                /*
+                 * Now that it is failed, start the transaction up
+                 * again so the wrappers can close it without additional error
+                 */
+                rootdse_start_trans(module);
+                ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
+                return;
+        }
+
+        /*
+         * Now that it is done, start the transaction up again so the
+         * wrappers can close it without error
+         */
+        ret = rootdse_start_trans(module);
+        ldb_module_done(req, NULL, NULL, ret);
+}
+
 static int rootdse_become_master(struct ldb_module *module,
                                  struct ldb_request *req,
                                  enum drepl_role_master role)
 {
-        struct drepl_takeFSMORole r;
-        struct messaging_context *msg;
+        struct imessaging_context *msg;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
         TALLOC_CTX *tmp_ctx = talloc_new(req);
         struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
-        NTSTATUS status_call;
-        WERROR status_fn;
         bool am_rodc;
         struct dcerpc_binding_handle *irpc_handle;
         int ret;
+        struct auth_session_info *session_info;
+        enum security_user_level level;
+        struct fsmo_transfer_state *fsmo;
+        struct tevent_req *treq;
+
+        session_info = (struct auth_session_info *)ldb_get_opaque(ldb_module_get_ctx(module), "sessionInfo");
+        level = security_session_user_level(session_info, NULL);
+        if (level < SECURITY_ADMINISTRATOR) {
+                return ldb_error(ldb, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS, "Denied rootDSE modify for non-administrator");
+        }
 
         ret = samdb_rodc(ldb, &am_rodc);
@@ -1189 +1505 @@
         }
 
-        msg = messaging_client_init(tmp_ctx, lpcfg_messaging_path(tmp_ctx, lp_ctx),
+        /*
+         * We always delete the transaction, not commit it, because
+         * this gives the least supprise to this supprising action (as
+         * we will never record anything done to this point
+         */
+        rootdse_del_trans(module);
+
+        msg = imessaging_client_init(tmp_ctx, lp_ctx,
                                     ldb_get_event_context(ldb));
         if (!msg) {
-                ldb_asprintf_errstring(ldb, "Failed to generate client messaging context in %s", lpcfg_messaging_path(tmp_ctx, lp_ctx));
+                ldb_asprintf_errstring(ldb, "Failed to generate client messaging context in %s", lpcfg_imessaging_path(tmp_ctx, lp_ctx));
                 return LDB_ERR_OPERATIONS_ERROR;
         }
@@ -1201 +1524 @@
                 return ldb_oom(ldb);
         }
-        r.in.role = role;
-
-        status_call = dcerpc_drepl_takeFSMORole_r(irpc_handle, tmp_ctx, &r);
-        if (!NT_STATUS_IS_OK(status_call)) {
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-        status_fn = r.out.result;
-        if (!W_ERROR_IS_OK(status_fn)) {
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+        fsmo = talloc_zero(req, struct fsmo_transfer_state);
+        if (fsmo == NULL) {
+                return ldb_oom(ldb);
+        }
+        fsmo->ldb = ldb;
+        fsmo->req = req;
+        fsmo->module = module;
+
+        /*
+         * we send the call asynchronously, as the ldap client is
+         * expecting to get an error back if the role transfer fails
+         *
+         * We need more than the default 10 seconds IRPC allows, so
+         * set a longer timeout (default ldb timeout is 300 seconds).
+         * We send an async reply when we are done.
+         *
+         * We are the first module, so don't bother working out how
+         * long we have spent so far.
+         */
+        dcerpc_binding_handle_set_timeout(irpc_handle, req->timeout);
+
+        treq = dcerpc_drepl_takeFSMORole_send(req, ldb_get_event_context(ldb), irpc_handle, role);
+        if (treq == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        tevent_req_set_callback(treq, rootdse_fsmo_transfer_callback, fsmo);
+        return LDB_SUCCESS;
 }
 
@@ -1261 +1601 @@
                 return rootdse_enableoptionalfeature(module, req);
         }
+        if (ldb_msg_find_element(req->op.mod.message, "schemaUpgradeInProgress")) {
+                return rootdse_schemaupgradeinprogress(module, req);
+        }
 
         ldb_set_errstring(ldb, "rootdse_modify: unknown attribute to change!");
@@ -1336 +1679 @@
 
 static const struct ldb_module_ops ldb_rootdse_module_ops = {
-        .name           = "rootdse",
-        .init_context   = rootdse_init,
-        .search         = rootdse_search,
-        .request        = rootdse_request,
-        .add            = rootdse_add,
-        .modify         = rootdse_modify,
-        .rename         = rootdse_rename,
-        .extended       = rootdse_extended,
-        .del            = rootdse_delete
+        .name              = "rootdse",
+        .init_context      = rootdse_init,
+        .search            = rootdse_search,
+        .request           = rootdse_request,
+        .add               = rootdse_add,
+        .modify            = rootdse_modify,
+        .rename            = rootdse_rename,
+        .extended          = rootdse_extended,
+        .del               = rootdse_delete,
+        .start_transaction = rootdse_start_trans,
+        .end_transaction   = rootdse_end_trans,
+        .del_transaction   = rootdse_del_trans
 };
 

vendor/current/source4/dsdb/samdb/ldb_modules/samba_dsdb.c

@@ -38 +38 @@
 #include "dsdb/samdb/samdb.h"
 #include "librpc/ndr/libndr.h"
+#include "auth/credentials/credentials.h"
+#include "param/secrets.h"
+#include "lib/ldb-samba/ldb_wrap.h"
 
 static int read_at_rootdse_record(struct ldb_context *ldb, struct ldb_module *module, TALLOC_CTX *mem_ctx,
@@ -103 +106 @@
 
         if (backend_mod) {
-                backend_full_list = (const char **)str_list_make_single(tmp_ctx, backend_mod);
+                char **b = str_list_make_single(tmp_ctx, backend_mod);
+                backend_full_list = discard_const_p(const char *, b);
         } else {
-                backend_full_list = (const char **)str_list_make_empty(tmp_ctx);
+                char **b = str_list_make_empty(tmp_ctx);
+                backend_full_list = discard_const_p(const char *, b);
         }
         if (!backend_full_list) {
@@ -130 +135 @@
 }
 
-
+/*
+ * Force overwrite of the credentials with those
+ * specified in secrets.ldb, to connect across the
+ * ldapi socket to an LDAP backend
+ */
+
+static int set_ldap_credentials(struct ldb_context *ldb, bool use_external)
+{
+        const char *secrets_ldb_path, *sam_ldb_path;
+        char *private_dir, *p, *error_string;
+        struct ldb_context *secrets_ldb;
+        struct cli_credentials *cred;
+        struct loadparm_context *lp_ctx = ldb_get_opaque(ldb, "loadparm");
+        TALLOC_CTX *tmp_ctx = talloc_new(ldb);
+
+        if (!tmp_ctx) {
+                return ldb_oom(ldb);
+        }
+
+        cred = cli_credentials_init(ldb);
+        if (!cred) {
+                talloc_free(tmp_ctx);
+                return ldb_oom(ldb);
+        }
+        cli_credentials_set_anonymous(cred);
+        if (use_external) {
+                cli_credentials_set_forced_sasl_mech(cred, "EXTERNAL");
+        } else {
+                cli_credentials_set_forced_sasl_mech(cred, "DIGEST-MD5");
+
+                /*
+                 * We don't want to use krb5 to talk to our samdb - recursion
+                 * here would be bad, and this account isn't in the KDC
+                 * anyway
+                 */
+                cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
+
+                /*
+                 * Work out where *our* secrets.ldb is.  It must be in
+                 * the same directory as sam.ldb
+                 */
+                sam_ldb_path = (const char *)ldb_get_opaque(ldb, "ldb_url");
+                if (!sam_ldb_path) {
+                        talloc_free(tmp_ctx);
+                        return ldb_operr(ldb);
+                }
+                if (strncmp("tdb://", sam_ldb_path, 6) == 0) {
+                        sam_ldb_path += 6;
+                }
+                private_dir = talloc_strdup(tmp_ctx, sam_ldb_path);
+                p = strrchr(private_dir, '/');
+                if (p) {
+                        *p = '\0';
+                } else {
+                        private_dir = talloc_strdup(tmp_ctx, ".");
+                }
+
+                secrets_ldb_path = talloc_asprintf(private_dir, "tdb://%s/secrets.ldb",
+                                                   private_dir);
+
+                if (!secrets_ldb_path) {
+                        talloc_free(tmp_ctx);
+                        return ldb_oom(ldb);
+                }
+
+                /*
+                 * Now that we have found the location, connect to
+                 * secrets.ldb so we can read the SamDB Credentials
+                 * record
+                 */
+                secrets_ldb = ldb_wrap_connect(tmp_ctx, NULL, lp_ctx, secrets_ldb_path,
+                                               NULL, NULL, 0);
+
+                if (!NT_STATUS_IS_OK(cli_credentials_set_secrets(cred, NULL, secrets_ldb, NULL,
+                                                                 SECRETS_LDAP_FILTER, &error_string))) {
+                        ldb_asprintf_errstring(ldb, "Failed to read LDAP backend password from %s", secrets_ldb_path);
+                        talloc_free(tmp_ctx);
+                        return LDB_ERR_STRONG_AUTH_REQUIRED;
+                }
+        }
+
+        /*
+         * Finally overwrite any supplied credentials with
+         * these ones, as only secrets.ldb contains the magic
+         * credentials to talk on the ldapi socket
+         */
+        if (ldb_set_opaque(ldb, "credentials", cred)) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+        talloc_free(tmp_ctx);
+        return LDB_SUCCESS;
+}
 
 static int samba_dsdb_init(struct ldb_module *module)
@@ -138 +235 @@
         TALLOC_CTX *tmp_ctx = talloc_new(module);
         struct ldb_result *res;
-        struct ldb_message *rootdse_msg, *partition_msg;
-        struct ldb_dn *samba_dsdb_dn;
+        struct ldb_message *rootdse_msg = NULL, *partition_msg;
+        struct ldb_dn *samba_dsdb_dn, *partition_dn;
         struct ldb_module *backend_module, *module_chain;
         const char **final_module_list, **reverse_module_list;
@@ -151 +248 @@
           - objectclass must be before password_hash and samldb since these LDB
             modules require the expanded "objectClass" list
+          - objectclass must be before descriptor and acl, as both assume that
+            objectClass values are sorted
           - objectclass_attrs must be behind operational in order to see all
             attributes (the operational module protects and therefore
@@ -161 +260 @@
           based on the parameters loaded from the database.
         */
-        static const char *modules_list[] = {"resolve_oids",
+        static const char *modules_list1[] = {"resolve_oids",
                                              "rootdse",
+                                             "schema_load",
                                              "lazy_commit",
+                                             "dirsync",
                                              "paged_results",
                                              "ranged_results",
@@ -170 +271 @@
                                              "asq",
                                              "extended_dn_store",
-                                             "extended_dn_in",
-                                             "objectclass",
+                                             NULL };
+        /* extended_dn_in or extended_dn_in_openldap goes here */
+        static const char *modules_list1a[] = {"objectclass",
                                              "descriptor",
                                              "acl",
@@ -178 +280 @@
                                              "password_hash",
                                              "operational",
-                                             "schema_load",
                                              "instancetype",
                                              "objectclass_attrs",
@@ -200 +301 @@
         const char *extended_dn_module_fds = "extended_dn_out_fds";
         const char *extended_dn_module_openldap = "extended_dn_out_openldap";
-
-        static const char *modules_list2[] = {"show_deleted",
+        const char *extended_dn_in_module = "extended_dn_in";
+
+        static const char *modules_list2[] = {"dns_notify",
+                                              "show_deleted",
                                               "new_partition",
                                               "partition",
@@ -210 +313 @@
                 "nsuniqueid", "paged_searches", "simple_dn", NULL };
         static const char *openldap_backend_modules[] = {
-                "entryuuid", "paged_searches", "simple_dn", NULL };
-
-        static const char *samba_dsdb_attrs[] = { "backendType", "serverRole", NULL };
-        const char *backendType, *serverRole;
+                "entryuuid", "simple_dn", NULL };
+
+        static const char *samba_dsdb_attrs[] = { "backendType", NULL };
+        static const char *partition_attrs[] = { "ldapBackend", NULL };
+        const char *backendType, *backendUrl;
+        bool use_sasl_external = false;
 
         if (!tmp_ctx) {
@@ -227 +332 @@
         samba_dsdb_dn = ldb_dn_new(tmp_ctx, ldb, "@SAMBA_DSDB");
         if (!samba_dsdb_dn) {
+                talloc_free(tmp_ctx);
+                return ldb_oom(ldb);
+        }
+
+        partition_dn = ldb_dn_new(tmp_ctx, ldb, DSDB_PARTITION_DN);
+        if (!partition_dn) {
                 talloc_free(tmp_ctx);
                 return ldb_oom(ldb);
@@ -243 +354 @@
         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                 backendType = "ldb";
-                serverRole = "domain controller";
         } else if (ret == LDB_SUCCESS) {
                 backendType = ldb_msg_find_attr_as_string(res->msgs[0], "backendType", "ldb");
-                serverRole = ldb_msg_find_attr_as_string(res->msgs[0], "serverRole", "domain controller");
         } else {
                 talloc_free(tmp_ctx);
@@ -257 +366 @@
                 link_modules = tdb_modules_list;
         } else {
+                struct cli_credentials *cred;
+                bool is_ldapi = false;
+
+                ret = dsdb_module_search_dn(module, tmp_ctx, &res, partition_dn,
+                                            partition_attrs, DSDB_FLAG_NEXT_MODULE, NULL);
+                if (ret == LDB_SUCCESS) {
+                        backendUrl = ldb_msg_find_attr_as_string(res->msgs[0], "ldapBackend", "ldapi://");
+                        if (!strncasecmp(backendUrl, "ldapi://", sizeof("ldapi://")-1)) {
+                                is_ldapi = true;
+                        }
+                } else if (ret != LDB_ERR_NO_SUCH_OBJECT) {
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
                 if (strcasecmp(backendType, "fedora-ds") == 0) {
                         link_modules = fedora_ds_modules;
@@ -265 +388 @@
                         backend_modules = openldap_backend_modules;
                         extended_dn_module = extended_dn_module_openldap;
+                        extended_dn_in_module = "extended_dn_in_openldap";
+                        if (is_ldapi) {
+                                use_sasl_external = true;
+                        }
                 } else {
                         return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "invalid backend type");
@@ -271 +398 @@
                 if (ret != LDB_SUCCESS) {
                         ldb_set_errstring(ldb, "Failed to set readOnlySchema opaque");
+                }
+
+                cred = ldb_get_opaque(ldb, "credentials");
+                if (!cred || !cli_credentials_authentication_requested(cred)) {
+                        ret = set_ldap_credentials(ldb, use_sasl_external);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
                 }
         }
@@ -282 +417 @@
         } while (0)
 
-        final_module_list = str_list_copy_const(tmp_ctx, modules_list);
+        final_module_list = str_list_copy_const(tmp_ctx, modules_list1);
+        CHECK_MODULE_LIST;
+
+        final_module_list = str_list_add_const(final_module_list, extended_dn_in_module);
+        CHECK_MODULE_LIST;
+
+        final_module_list = str_list_append_const(final_module_list, modules_list1a);
         CHECK_MODULE_LIST;
 
@@ -300 +441 @@
         partition_msg = ldb_msg_new(tmp_ctx);
         partition_msg->dn = ldb_dn_new(partition_msg, ldb, "@" DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME);
-
-        ret = prepare_modules_line(ldb, tmp_ctx,
-                                   rootdse_msg,
-                                   partition_msg, "defaultNamingContext",
-                                   "pdc_fsmo", backend_modules);
-        CHECK_LDB_RET(ret);
-
-        ret = prepare_modules_line(ldb, tmp_ctx,
-                                   rootdse_msg,
-                                   partition_msg, "configurationNamingContext",
-                                   "naming_fsmo", backend_modules);
-        CHECK_LDB_RET(ret);
 
         ret = prepare_modules_line(ldb, tmp_ctx,

vendor/current/source4/dsdb/samdb/ldb_modules/samba_secrets.c

@@ -53 +53 @@
         */
         static const char *modules_list[] = {"update_keytab",
+                                             "secrets_tdb_sync",
                                              "objectguid",
                                              "rdn_name",

vendor/current/source4/dsdb/samdb/ldb_modules/samldb.c

@@ -2 +2 @@
    SAM ldb module
 
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2014
    Copyright (C) Simo Sorce  2004-2008
-   Copyright (C) Matthias Dieter Wallnöfer 2009-2010
+   Copyright (C) Matthias Dieter Wallnöfer 2009-2011
+   Copyright (C) Matthieu Patou 2012
 
    This program is free software; you can redistribute it and/or modify
@@ -33 +34 @@
 #include "libcli/ldap/ldap_ndr.h"
 #include "ldb_module.h"
+#include "auth/auth.h"
 #include "dsdb/samdb/samdb.h"
 #include "dsdb/samdb/ldb_modules/util.h"
@@ -41 +43 @@
 #include "param/param.h"
 #include "libds/common/flag_mapping.h"
+#include "system/network.h"
 
 struct samldb_ctx;
+enum samldb_add_type {
+        SAMLDB_TYPE_USER,
+        SAMLDB_TYPE_GROUP,
+        SAMLDB_TYPE_CLASS,
+        SAMLDB_TYPE_ATTRIBUTE
+};
 
 typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
@@ -56 +65 @@
 
         /* used for add operations */
-        const char *type;
+        enum samldb_add_type type;
 
         /* the resulting message */
@@ -170 +179 @@
         int ret;
         struct ldb_result *res;
-        const char *noattrs[] = { NULL };
+        const char * const noattrs[] = { NULL };
 
         if (ldb_msg_find_element(ac->msg, "sAMAccountName") == NULL) {
@@ -188 +197 @@
 
         ret = dsdb_module_search(ac->module, ac, &res,
-                                 NULL, LDB_SCOPE_SUBTREE, noattrs,
+                                 ldb_get_default_basedn(ldb), LDB_SCOPE_SUBTREE, noattrs,
                                  DSDB_FLAG_NEXT_MODULE,
                                  ac->req,
@@ -258 +267 @@
         TALLOC_CTX *tmp_ctx = talloc_new(ac);
         struct ldb_result *res;
-        const char *no_attrs[] = { NULL };
+        const char * const no_attrs[] = { NULL };
         int ret;
 
-        ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL,
+        ret = dsdb_module_search(ac->module, tmp_ctx, &res,
+                                 ldb_get_default_basedn(ldb_module_get_ctx(ac->module)),
                                  LDB_SCOPE_SUBTREE, no_attrs,
                                  DSDB_FLAG_NEXT_MODULE,
@@ -336 +346 @@
                                    newpass, strlen(newpass),
                                    (void *)&newpass_utf16.data,
-                                   &newpass_utf16.length, false)) {
+                                   &newpass_utf16.length)) {
                 ldb_asprintf_errstring(ldb,
                                        "samldb_rodc_add: "
@@ -354 +364 @@
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
         struct ldb_result *res;
-        const char *no_attrs[] = { NULL };
+        const char * const no_attrs[] = { NULL };
         int ret;
 
@@ -380 +390 @@
         }
 
+        if (ret == LDB_SUCCESS) {
+                /* ensure the defaultObjectCategory has a full GUID */
+                struct ldb_message *m;
+                m = ldb_msg_new(ac->msg);
+                if (m == NULL) {
+                        return ldb_oom(ldb);
+                }
+                m->dn = ac->msg->dn;
+                if (ldb_msg_add_string(m, "defaultObjectCategory",
+                                       ldb_dn_get_extended_linearized(m, res->msgs[0]->dn, 1)) !=
+                    LDB_SUCCESS) {
+                        return ldb_oom(ldb);
+                }
+                m->elements[0].flags = LDB_FLAG_MOD_REPLACE;
+
+                ret = dsdb_module_modify(ac->module, m,
+                                         DSDB_FLAG_NEXT_MODULE,
+                                         ac->req);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+
         ac->res_dn = ac->dn;
 
@@ -398 +432 @@
         struct ldb_result *ldb_res;
         struct ldb_dn *schema_dn;
+        struct samldb_msds_intid_persistant *msds_intid_struct;
+        struct dsdb_schema *schema;
 
         ldb = ldb_module_get_ctx(ac->module);
@@ -429 +465 @@
                 return LDB_SUCCESS;
         }
-
-        /* Generate new value for msDs-IntId
-         * Value should be in 0x80000000..0xBFFFFFFF range */
-        msds_intid = generate_random() % 0X3FFFFFFF;
-        msds_intid += 0x80000000;
+        schema = dsdb_get_schema(ldb, NULL);
+        if (!schema) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "samldb_schema_info_update: no dsdb_schema loaded");
+                DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
+                return ldb_operr(ldb);
+        }
+
+        msds_intid_struct = (struct samldb_msds_intid_persistant*) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
+        if (!msds_intid_struct) {
+                msds_intid_struct = talloc(ldb, struct samldb_msds_intid_persistant);
+                /* Generate new value for msDs-IntId
+                * Value should be in 0x80000000..0xBFFFFFFF range */
+                msds_intid = generate_random() % 0X3FFFFFFF;
+                msds_intid += 0x80000000;
+                msds_intid_struct->msds_intid = msds_intid;
+                msds_intid_struct->usn = schema->loaded_usn;
+                DEBUG(2, ("No samldb_msds_intid_persistant struct, allocating a new one\n"));
+        } else {
+                msds_intid = msds_intid_struct->msds_intid;
+        }
 
         /* probe id values until unique one is found */
         do {
+                uint64_t current_usn;
                 msds_intid++;
                 if (msds_intid > 0xBFFFFFFF) {
                         msds_intid = 0x80000001;
                 }
-
-                ret = dsdb_module_search(ac->module, ac,
-                                         &ldb_res,
-                                         schema_dn, LDB_SCOPE_ONELEVEL, NULL,
-                                         DSDB_FLAG_NEXT_MODULE,
-                                         ac->req,
-                                         "(msDS-IntId=%d)", msds_intid);
+                /*
+                 * Alternative strategy to a costly (even indexed search) to the
+                 * database.
+                 * We search in the schema if we have already this intid (using dsdb_attribute_by_attributeID_id because
+                 * in the range 0x80000000 0xBFFFFFFFF, attributeID is a DSDB_ATTID_TYPE_INTID).
+                 * If so generate another random value.
+                 * If not check if the highest USN in the database for the schema partition is the
+                 * one that we know.
+                 * If so it means that's only this ldb context that is touching the schema in the database.
+                 * If not it means that's someone else has modified the database while we are doing our changes too
+                 * (this case should be very bery rare) in order to be sure do the search in the database.
+                 */
+                if (dsdb_attribute_by_attributeID_id(schema, msds_intid)) {
+                        msds_intid = generate_random() % 0X3FFFFFFF;
+                        msds_intid += 0x80000000;
+                        continue;
+                }
+
+                ret = dsdb_module_load_partition_usn(ac->module, schema_dn,
+                                                     &current_usn, NULL, NULL);
                 if (ret != LDB_SUCCESS) {
                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
-                                      __location__": Searching for msDS-IntId=%d failed - %s\n",
-                                      msds_intid,
+                                      __location__": Searching for schema USN failed: %s\n",
                                       ldb_errstring(ldb));
                         return ldb_operr(ldb);
                 }
-                id_exists = (ldb_res->count > 0);
-
-                talloc_free(ldb_res);
+
+                /* current_usn can be lesser than msds_intid_struct-> if there is
+                 * uncommited changes.
+                 */
+                if (current_usn > msds_intid_struct->usn) {
+                        /* oups something has changed, someone/something
+                         * else is modifying or has modified the schema
+                         * we'd better check this intid is the database directly
+                         */
+
+                        DEBUG(2, ("Schema has changed, searching the database for the unicity of %d\n",
+                                        msds_intid));
+
+                        ret = dsdb_module_search(ac->module, ac,
+                                                &ldb_res,
+                                                schema_dn, LDB_SCOPE_ONELEVEL, NULL,
+                                                DSDB_FLAG_NEXT_MODULE,
+                                                ac->req,
+                                                "(msDS-IntId=%d)", msds_intid);
+                        if (ret != LDB_SUCCESS) {
+                                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                                        __location__": Searching for msDS-IntId=%d failed - %s\n",
+                                        msds_intid,
+                                        ldb_errstring(ldb));
+                                return ldb_operr(ldb);
+                        }
+                        id_exists = (ldb_res->count > 0);
+                        talloc_free(ldb_res);
+                } else {
+                        id_exists = 0;
+                }
+
         } while(id_exists);
+        msds_intid_struct->msds_intid = msds_intid;
+        ldb_set_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE, msds_intid_struct);
 
         return samdb_msg_add_int(ldb, ac->msg, ac->msg, "msDS-IntId",
@@ -493 +589 @@
         }
         if (ares->type != LDB_REPLY_DONE) {
-                ldb_set_errstring(ldb,
-                        "Invalid reply type!\n");
+                ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
                 return ldb_module_done(ac->req, NULL, NULL,
                                         LDB_ERR_OPERATIONS_ERROR);
@@ -558 +653 @@
 
         /* Add information for the different account types */
-        if (strcmp(ac->type, "user") == 0) {
+        switch(ac->type) {
+        case SAMLDB_TYPE_USER: {
                 struct ldb_control *rodc_control = ldb_request_get_control(ac->req,
                                                                            LDB_CONTROL_RODC_DCPROMO_OID);
@@ -574 +670 @@
                 ret = samldb_add_step(ac, samldb_add_entry);
                 if (ret != LDB_SUCCESS) return ret;
-
-        } else if (strcmp(ac->type, "group") == 0) {
+                break;
+        }
+
+        case SAMLDB_TYPE_GROUP: {
                 /* check if we have a valid sAMAccountName */
                 ret = samldb_add_step(ac, samldb_check_sAMAccountName);
@@ -582 +680 @@
                 ret = samldb_add_step(ac, samldb_add_entry);
                 if (ret != LDB_SUCCESS) return ret;
-
-        } else if (strcmp(ac->type, "classSchema") == 0) {
+                break;
+        }
+
+        case SAMLDB_TYPE_CLASS: {
                 const struct ldb_val *rdn_value, *def_obj_cat_val;
+                unsigned int v = ldb_msg_find_attr_as_uint(ac->msg, "objectClassCategory", -2);
+
+                /* As discussed with Microsoft through dochelp in April 2012 this is the behavior of windows*/
+                if (!ldb_msg_find_element(ac->msg, "subClassOf")) {
+                        ret = ldb_msg_add_string(ac->msg, "subClassOf", "top");
+                        if (ret != LDB_SUCCESS) return ret;
+                }
 
                 ret = samdb_find_or_add_attribute(ldb, ac->msg,
@@ -590 +697 @@
                 if (ret != LDB_SUCCESS) return ret;
 
-                /* do not allow to mark an attributeSchema as RODC filtered if it
+                /* do not allow one to mark an attributeSchema as RODC filtered if it
                  * is system-critical */
                 if (check_rodc_critical_attribute(ac->msg)) {
@@ -662 +769 @@
                 if (ret != LDB_SUCCESS) return ret;
 
-        } else if (strcmp(ac->type, "attributeSchema") == 0) {
+                /* -2 is not a valid objectClassCategory so it means the attribute wasn't present */
+                if (v == -2) {
+                        /* Windows 2003 does this*/
+                        ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "objectClassCategory", 0);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+                }
+                break;
+        }
+
+        case SAMLDB_TYPE_ATTRIBUTE: {
                 const struct ldb_val *rdn_value;
+                struct ldb_message_element *el;
                 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
                 if (rdn_value == NULL) {
@@ -679 +798 @@
                 }
 
-                /* do not allow to mark an attributeSchema as RODC filtered if it
+                /* do not allow one to mark an attributeSchema as RODC filtered if it
                  * is system-critical */
                 if (check_rodc_critical_attribute(ac->msg)) {
@@ -703 +822 @@
                 }
 
+                el = ldb_msg_find_element(ac->msg, "attributeSyntax");
+                if (el) {
+                        /*
+                         * No need to scream if there isn't as we have code later on
+                         * that will take care of it.
+                         */
+                        const struct dsdb_syntax *syntax = find_syntax_map_by_ad_oid((const char *)el->values[0].data);
+                        if (!syntax) {
+                                DEBUG(9, ("Can't find dsdb_syntax object for attributeSyntax %s\n",
+                                                (const char *)el->values[0].data));
+                        } else {
+                                unsigned int v = ldb_msg_find_attr_as_uint(ac->msg, "oMSyntax", 0);
+                                const struct ldb_val *val = ldb_msg_find_ldb_val(ac->msg, "oMObjectClass");
+
+                                if (v == 0) {
+                                        ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "oMSyntax", syntax->oMSyntax);
+                                        if (ret != LDB_SUCCESS) {
+                                                return ret;
+                                        }
+                                }
+                                if (!val) {
+                                        struct ldb_val val2 = ldb_val_dup(ldb, &syntax->oMObjectClass);
+                                        if (val2.length > 0) {
+                                                ret = ldb_msg_add_value(ac->msg, "oMObjectClass", &val2, NULL);
+                                                if (ret != LDB_SUCCESS) {
+                                                        return ret;
+                                                }
+                                        }
+                                }
+                        }
+                }
+
                 /* handle msDS-IntID attribute */
                 ret = samldb_add_handle_msDS_IntId(ac);
@@ -709 +860 @@
                 ret = samldb_add_step(ac, samldb_add_entry);
                 if (ret != LDB_SUCCESS) return ret;
-
-        } else {
-                ldb_asprintf_errstring(ldb,
-                        "Invalid entry type!");
+                break;
+        }
+
+        default:
+                ldb_asprintf_errstring(ldb, "Invalid entry type!");
                 return LDB_ERR_OPERATIONS_ERROR;
+                break;
         }
 
@@ -780 +933 @@
 
         ret = dsdb_module_schema_info_update(ac->module, schema,
-                                             DSDB_FLAG_NEXT_MODULE, ac->req);
+                                             DSDB_FLAG_NEXT_MODULE|
+                                             DSDB_FLAG_AS_SYSTEM,
+                                             ac->req);
         if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb,
@@ -790 +945 @@
         return LDB_SUCCESS;
 }
+
+static int samldb_prim_group_tester(struct samldb_ctx *ac, uint32_t rid);
+static int samldb_check_user_account_control_rules(struct samldb_ctx *ac,
+                                                   struct dom_sid *sid,
+                                                   uint32_t user_account_control,
+                                                   uint32_t user_account_control_old);
 
 /*
@@ -802 +963 @@
 {
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb,
-                                         "loadparm"), struct loadparm_context);
+        void *skip_allocate_sids = ldb_get_opaque(ldb,
+                                                  "skip_allocate_sids");
         struct ldb_message_element *el, *el2;
-        enum sid_generator sid_generator;
         struct dom_sid *sid;
         int ret;
@@ -831 +991 @@
 
         /* but generate a new SID when we do have an add operations */
-        if ((sid == NULL) && (ac->req->operation == LDB_ADD)) {
-                sid_generator = lpcfg_sid_generator(lp_ctx);
-                if (sid_generator == SID_GENERATOR_INTERNAL) {
-                        ret = samldb_add_step(ac, samldb_allocate_sid);
-                        if (ret != LDB_SUCCESS) return ret;
-                }
-        }
-
-        if (strcmp(ac->type, "user") == 0) {
-                bool uac_generated = false;
+        if ((sid == NULL) && (ac->req->operation == LDB_ADD) && !skip_allocate_sids) {
+                ret = samldb_add_step(ac, samldb_allocate_sid);
+                if (ret != LDB_SUCCESS) return ret;
+        }
+
+        switch(ac->type) {
+        case SAMLDB_TYPE_USER: {
+                bool uac_generated = false, uac_add_flags = false;
 
                 /* Step 1.2: Default values */
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "accountExpires", "9223372036854775807");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "badPasswordTime", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "badPwdCount", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "codePage", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "countryCode", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "lastLogoff", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "lastLogon", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "logonCount", "0");
-                if (ret != LDB_SUCCESS) return ret;
-                ret = samdb_find_or_add_attribute(ldb, ac->msg,
-                        "pwdLastSet", "0");
+                ret = dsdb_user_obj_set_defaults(ldb, ac->msg);
                 if (ret != LDB_SUCCESS) return ret;
 
@@ -882 +1015 @@
                         }
                         uac_generated = true;
+                        uac_add_flags = true;
                 }
 
                 el = ldb_msg_find_element(ac->msg, "userAccountControl");
                 if (el != NULL) {
-                        uint32_t user_account_control, account_type;
-
+                        uint32_t user_account_control;
                         /* Step 1.3: "userAccountControl" -> "sAMAccountType" mapping */
                         user_account_control = ldb_msg_find_attr_as_uint(ac->msg,
                                                                          "userAccountControl",
                                                                          0);
-
-                        /* Temporary duplicate accounts aren't allowed */
-                        if ((user_account_control & UF_TEMP_DUPLICATE_ACCOUNT) != 0) {
-                                return LDB_ERR_OTHER;
-                        }
-
-                        account_type = ds_uf2atype(user_account_control);
-                        if (account_type == 0) {
-                                ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
-                                return LDB_ERR_UNWILLING_TO_PERFORM;
-                        }
-                        ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
-                                                 "sAMAccountType",
-                                                 account_type);
+                        /*
+                         * "userAccountControl" = 0 or missing one of
+                         * the types means "UF_NORMAL_ACCOUNT".  See
+                         * MS-SAMR 3.1.1.8.10 point 8
+                         */
+                        if ((user_account_control & UF_ACCOUNT_TYPE_MASK) == 0) {
+                                user_account_control = UF_NORMAL_ACCOUNT | user_account_control;
+                                uac_generated = true;
+                        }
+
+                        /*
+                         * As per MS-SAMR 3.1.1.8.10 these flags have not to be set
+                         */
+                        if ((user_account_control & UF_LOCKOUT) != 0) {
+                                user_account_control &= ~UF_LOCKOUT;
+                                uac_generated = true;
+                        }
+                        if ((user_account_control & UF_PASSWORD_EXPIRED) != 0) {
+                                user_account_control &= ~UF_PASSWORD_EXPIRED;
+                                uac_generated = true;
+                        }
+
+                        ret = samldb_check_user_account_control_rules(ac, NULL,
+                                                                      user_account_control, 0);
                         if (ret != LDB_SUCCESS) {
                                 return ret;
                         }
-                        el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
-                        el2->flags = LDB_FLAG_MOD_REPLACE;
-
+
+                        /* Workstation and (read-only) DC objects do need objectclass "computer" */
+                        if ((samdb_find_attribute(ldb, ac->msg,
+                                                  "objectclass", "computer") == NULL) &&
+                            (user_account_control &
+                             (UF_SERVER_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT))) {
+                                ldb_set_errstring(ldb,
+                                                  "samldb: Requested account type does need objectclass 'computer'!");
+                                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+                        }
+
+                        /* add "sAMAccountType" attribute */
+                        ret = dsdb_user_obj_set_account_type(ldb, ac->msg, user_account_control, NULL);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+
+                        /* "isCriticalSystemObject" might be set */
                         if (user_account_control &
                             (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
-                                ret = samdb_msg_set_string(ldb, ac->msg, ac->msg,
-                                                           "isCriticalSystemObject",
-                                                           "TRUE");
+                                ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+                                                         "TRUE");
                                 if (ret != LDB_SUCCESS) {
                                         return ret;
@@ -923 +1080 @@
                                                            "isCriticalSystemObject");
                                 el2->flags = LDB_FLAG_MOD_REPLACE;
-                        }
-
-                        /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
-                        if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
-                                uint32_t rid = ds_uf2prim_group_rid(user_account_control);
-                                ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
-                                                         "primaryGroupID", rid);
+                        } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
+                                ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+                                                         "FALSE");
                                 if (ret != LDB_SUCCESS) {
                                         return ret;
                                 }
                                 el2 = ldb_msg_find_element(ac->msg,
-                                                           "primaryGroupID");
+                                                           "isCriticalSystemObject");
                                 el2->flags = LDB_FLAG_MOD_REPLACE;
+                        }
+
+                        /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
+                        if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
+                                uint32_t rid;
+
+                                ret = dsdb_user_obj_set_primary_group_id(ldb, ac->msg, user_account_control, &rid);
+                                if (ret != LDB_SUCCESS) {
+                                        return ret;
+                                }
+                                /*
+                                 * Older AD deployments don't know about the
+                                 * RODC group
+                                 */
+                                if (rid == DOMAIN_RID_READONLY_DCS) {
+                                        ret = samldb_prim_group_tester(ac, rid);
+                                        if (ret != LDB_SUCCESS) {
+                                                return ret;
+                                        }
+                                }
                         }
 
@@ -943 +1116 @@
                          * Server) */
                         if (uac_generated) {
-                                user_account_control |= UF_ACCOUNTDISABLE;
-                                user_account_control |= UF_PASSWD_NOTREQD;
+                                if (uac_add_flags) {
+                                        user_account_control |= UF_ACCOUNTDISABLE;
+                                        user_account_control |= UF_PASSWD_NOTREQD;
+                                }
 
                                 ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
@@ -953 +1128 @@
                                 }
                         }
-                }
-
-        } else if (strcmp(ac->type, "group") == 0) {
+
+                }
+                break;
+        }
+
+        case SAMLDB_TYPE_GROUP: {
                 const char *tempstr;
 
@@ -997 +1175 @@
                         el2->flags = LDB_FLAG_MOD_REPLACE;
                 }
+                break;
+        }
+
+        default:
+                ldb_asprintf_errstring(ldb,
+                                "Invalid entry type!");
+                return LDB_ERR_OPERATIONS_ERROR;
+                break;
         }
 
@@ -1010 +1196 @@
  */
 
-static int samldb_prim_group_set(struct samldb_ctx *ac)
+static int samldb_prim_group_tester(struct samldb_ctx *ac, uint32_t rid)
 {
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        uint32_t rid;
         struct dom_sid *sid;
         struct ldb_result *res;
         int ret;
-        const char *noattrs[] = { NULL };
-
-        rid = ldb_msg_find_attr_as_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
-        if (rid == (uint32_t) -1) {
-                /* we aren't affected of any primary group set */
-                return LDB_SUCCESS;
-
-        } else if (!ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
-                ldb_set_errstring(ldb,
-                                  "The primary group isn't settable on add operations!");
-                return LDB_ERR_UNWILLING_TO_PERFORM;
-        }
+        const char * const noattrs[] = { NULL };
 
         sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
@@ -1035 +1209 @@
         }
 
-        ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE,
+        ret = dsdb_module_search(ac->module, ac, &res,
+                                 ldb_get_default_basedn(ldb),
+                                 LDB_SCOPE_SUBTREE,
                                  noattrs, DSDB_FLAG_NEXT_MODULE,
                                  ac->req,
@@ -1055 +1231 @@
 }
 
+static int samldb_prim_group_set(struct samldb_ctx *ac)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        uint32_t rid;
+
+        rid = ldb_msg_find_attr_as_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
+        if (rid == (uint32_t) -1) {
+                /* we aren't affected of any primary group set */
+                return LDB_SUCCESS;
+
+        } else if (!ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+                ldb_set_errstring(ldb,
+                                  "The primary group isn't settable on add operations!");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        return samldb_prim_group_tester(ac, rid);
+}
+
 static int samldb_prim_group_change(struct samldb_ctx *ac)
 {
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        const char * attrs[] = { "primaryGroupID", "memberOf", NULL };
+        const char * const attrs[] = {
+                "primaryGroupID",
+                "memberOf",
+                "userAccountControl",
+                NULL };
         struct ldb_result *res, *group_res;
         struct ldb_message_element *el;
         struct ldb_message *msg;
-        uint32_t prev_rid, new_rid;
+        uint32_t prev_rid, new_rid, uac;
         struct dom_sid *prev_sid, *new_sid;
         struct ldb_dn *prev_prim_group_dn, *new_prim_group_dn;
         int ret;
-        const char *noattrs[] = { NULL };
+        const char * const noattrs[] = { NULL };
 
         el = dsdb_get_single_valued_attr(ac->msg, "primaryGroupID",
@@ -1077 +1276 @@
         /* Fetch information from the existing object */
 
-        ret = dsdb_module_search(ac->module, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
-                                 DSDB_FLAG_NEXT_MODULE, ac->req, NULL);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-        if (res->count != 1) {
-                return ldb_operr(ldb);
-        }
+        ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
+                                    DSDB_FLAG_NEXT_MODULE, ac->req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        uac = ldb_msg_find_attr_as_uint(res->msgs[0], "userAccountControl", 0);
 
         /* Finds out the DN of the old primary group */
@@ -1125 +1323 @@
         }
 
-        ret = dsdb_module_search(ac->module, ac, &group_res, NULL, LDB_SCOPE_SUBTREE,
+        if ((uac & UF_SERVER_TRUST_ACCOUNT) && new_rid != DOMAIN_RID_DCS) {
+                ldb_asprintf_errstring(ldb,
+                        "%08X: samldb: UF_SERVER_TRUST_ACCOUNT requires "
+                        "primaryGroupID=%u!",
+                        W_ERROR_V(WERR_DS_CANT_MOD_PRIMARYGROUPID),
+                        DOMAIN_RID_DCS);
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        if ((uac & UF_PARTIAL_SECRETS_ACCOUNT) && new_rid != DOMAIN_RID_READONLY_DCS) {
+                ldb_asprintf_errstring(ldb,
+                        "%08X: samldb: UF_PARTIAL_SECRETS_ACCOUNT requires "
+                        "primaryGroupID=%u!",
+                        W_ERROR_V(WERR_DS_CANT_MOD_PRIMARYGROUPID),
+                        DOMAIN_RID_READONLY_DCS);
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        ret = dsdb_module_search(ac->module, ac, &group_res,
+                                 ldb_get_default_basedn(ldb),
+                                 LDB_SCOPE_SUBTREE,
                                  noattrs, DSDB_FLAG_NEXT_MODULE,
                                  ac->req,
@@ -1143 +1361 @@
         }
 
-        ret = dsdb_module_search(ac->module, ac, &group_res, NULL, LDB_SCOPE_SUBTREE,
+        ret = dsdb_module_search(ac->module, ac, &group_res,
+                                 ldb_get_default_basedn(ldb),
+                                 LDB_SCOPE_SUBTREE,
                                  noattrs, DSDB_FLAG_NEXT_MODULE,
                                  ac->req,
@@ -1220 +1440 @@
 }
 
+static int samldb_check_user_account_control_invariants(struct samldb_ctx *ac,
+                                                    uint32_t user_account_control)
+{
+        int i, ret = 0;
+        bool need_check = false;
+        const struct uac_to_guid {
+                uint32_t uac;
+                bool never;
+                uint32_t needs;
+                uint32_t not_with;
+                const char *error_string;
+        } map[] = {
+                {
+                        .uac = UF_TEMP_DUPLICATE_ACCOUNT,
+                        .never = true,
+                        .error_string = "Updating the UF_TEMP_DUPLICATE_ACCOUNT flag is never allowed"
+                },
+                {
+                        .uac = UF_PARTIAL_SECRETS_ACCOUNT,
+                        .needs = UF_WORKSTATION_TRUST_ACCOUNT,
+                        .error_string = "Setting UF_PARTIAL_SECRETS_ACCOUNT only permitted with UF_WORKSTATION_TRUST_ACCOUNT"
+                },
+                {
+                        .uac = UF_TRUSTED_FOR_DELEGATION,
+                        .not_with = UF_PARTIAL_SECRETS_ACCOUNT,
+                        .error_string = "Setting UF_TRUSTED_FOR_DELEGATION not allowed with UF_PARTIAL_SECRETS_ACCOUNT"
+                },
+                {
+                        .uac = UF_NORMAL_ACCOUNT,
+                        .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_NORMAL_ACCOUNT,
+                        .error_string = "Setting more than one account type not permitted"
+                },
+                {
+                        .uac = UF_WORKSTATION_TRUST_ACCOUNT,
+                        .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_WORKSTATION_TRUST_ACCOUNT,
+                        .error_string = "Setting more than one account type not permitted"
+                },
+                {
+                        .uac = UF_INTERDOMAIN_TRUST_ACCOUNT,
+                        .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_INTERDOMAIN_TRUST_ACCOUNT,
+                        .error_string = "Setting more than one account type not permitted"
+                },
+                {
+                        .uac = UF_SERVER_TRUST_ACCOUNT,
+                        .not_with = UF_ACCOUNT_TYPE_MASK & ~UF_SERVER_TRUST_ACCOUNT,
+                        .error_string = "Setting more than one account type not permitted"
+                },
+                {
+                        .uac = UF_TRUSTED_FOR_DELEGATION,
+                        .not_with = UF_PARTIAL_SECRETS_ACCOUNT,
+                        .error_string = "Setting UF_TRUSTED_FOR_DELEGATION not allowed with UF_PARTIAL_SECRETS_ACCOUNT"
+                }
+        };
+
+        for (i = 0; i < ARRAY_SIZE(map); i++) {
+                if (user_account_control & map[i].uac) {
+                        need_check = true;
+                        break;
+                }
+        }
+        if (need_check == false) {
+                return LDB_SUCCESS;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(map); i++) {
+                uint32_t this_uac = user_account_control & map[i].uac;
+                if (this_uac != 0) {
+                        if (map[i].never) {
+                                ret = LDB_ERR_OTHER;
+                                break;
+                        } else if (map[i].needs != 0) {
+                                if ((map[i].needs & user_account_control) == 0) {
+                                        ret = LDB_ERR_OTHER;
+                                        break;
+                                }
+                        } else if (map[i].not_with != 0) {
+                                if ((map[i].not_with & user_account_control) != 0) {
+                                        ret = LDB_ERR_OTHER;
+                                        break;
+                                }
+                        }
+                }
+        }
+        if (ret != LDB_SUCCESS) {
+                switch (ac->req->operation) {
+                case LDB_ADD:
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
+                                               "Failed to add %s: %s",
+                                               ldb_dn_get_linearized(ac->msg->dn),
+                                               map[i].error_string);
+                        break;
+                case LDB_MODIFY:
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
+                                               "Failed to modify %s: %s",
+                                               ldb_dn_get_linearized(ac->msg->dn),
+                                               map[i].error_string);
+                        break;
+                default:
+                        return ldb_module_operr(ac->module);
+                }
+        }
+        return ret;
+}
+
+/**
+ * Validate that the restriction in point 5 of MS-SAMR 3.1.1.8.10 userAccountControl is honoured
+ *
+ */
+static int samldb_check_user_account_control_acl(struct samldb_ctx *ac,
+                                                 struct dom_sid *sid,
+                                                 uint32_t user_account_control,
+                                                 uint32_t user_account_control_old)
+{
+        int i, ret = 0;
+        bool need_acl_check = false;
+        struct ldb_result *res;
+        const char * const sd_attrs[] = {"ntSecurityDescriptor", NULL};
+        struct security_token *user_token;
+        struct security_descriptor *domain_sd;
+        struct ldb_dn *domain_dn = ldb_get_default_basedn(ldb_module_get_ctx(ac->module));
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        const struct uac_to_guid {
+                uint32_t uac;
+                uint32_t priv_to_change_from;
+                const char *oid;
+                const char *guid;
+                enum sec_privilege privilege;
+                bool delete_is_privileged;
+                bool admin_required;
+                const char *error_string;
+        } map[] = {
+                {
+                        .uac = UF_PASSWD_NOTREQD,
+                        .guid = GUID_DRS_UPDATE_PASSWORD_NOT_REQUIRED_BIT,
+                        .error_string = "Adding the UF_PASSWD_NOTREQD bit in userAccountControl requires the Update-Password-Not-Required-Bit right that was not given on the Domain object"
+                },
+                {
+                        .uac = UF_DONT_EXPIRE_PASSWD,
+                        .guid = GUID_DRS_UNEXPIRE_PASSWORD,
+                        .error_string = "Adding the UF_DONT_EXPIRE_PASSWD bit in userAccountControl requires the Unexpire-Password right that was not given on the Domain object"
+                },
+                {
+                        .uac = UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED,
+                        .guid = GUID_DRS_ENABLE_PER_USER_REVERSIBLY_ENCRYPTED_PASSWORD,
+                        .error_string = "Adding the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED bit in userAccountControl requires the Enable-Per-User-Reversibly-Encrypted-Password right that was not given on the Domain object"
+                },
+                {
+                        .uac = UF_SERVER_TRUST_ACCOUNT,
+                        .guid = GUID_DRS_DS_INSTALL_REPLICA,
+                        .error_string = "Adding the UF_SERVER_TRUST_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
+                },
+                {
+                        .uac = UF_PARTIAL_SECRETS_ACCOUNT,
+                        .guid = GUID_DRS_DS_INSTALL_REPLICA,
+                        .error_string = "Adding the UF_PARTIAL_SECRETS_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
+                },
+                {
+                        .uac = UF_WORKSTATION_TRUST_ACCOUNT,
+                        .priv_to_change_from = UF_NORMAL_ACCOUNT,
+                        .error_string = "Swapping UF_NORMAL_ACCOUNT to UF_WORKSTATION_TRUST_ACCOUNT requires the user to be a member of the domain admins group"
+                },
+                {
+                        .uac = UF_NORMAL_ACCOUNT,
+                        .priv_to_change_from = UF_WORKSTATION_TRUST_ACCOUNT,
+                        .error_string = "Swapping UF_WORKSTATION_TRUST_ACCOUNT to UF_NORMAL_ACCOUNT requires the user to be a member of the domain admins group"
+                },
+                {
+                        .uac = UF_INTERDOMAIN_TRUST_ACCOUNT,
+                        .oid = DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID,
+                        .error_string = "Updating the UF_INTERDOMAIN_TRUST_ACCOUNT bit in userAccountControl is not permitted over LDAP.  This bit is restricted to the LSA CreateTrustedDomain interface",
+                        .delete_is_privileged = true
+                },
+                {
+                        .uac = UF_TRUSTED_FOR_DELEGATION,
+                        .privilege = SEC_PRIV_ENABLE_DELEGATION,
+                        .delete_is_privileged = true,
+                        .error_string = "Updating the UF_TRUSTED_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
+                },
+                {
+                        .uac = UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION,
+                        .privilege = SEC_PRIV_ENABLE_DELEGATION,
+                        .delete_is_privileged = true,
+                        .error_string = "Updating the UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
+                }
+
+        };
+
+        if (dsdb_module_am_system(ac->module)) {
+                return LDB_SUCCESS;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(map); i++) {
+                if (user_account_control & map[i].uac) {
+                        need_acl_check = true;
+                        break;
+                }
+        }
+        if (need_acl_check == false) {
+                return LDB_SUCCESS;
+        }
+
+        user_token = acl_user_token(ac->module);
+        if (user_token == NULL) {
+                return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+        }
+
+        ret = dsdb_module_search_dn(ac->module, ac, &res,
+                                    domain_dn,
+                                    sd_attrs,
+                                    DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
+                                    ac->req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        if (res->count != 1) {
+                return ldb_module_operr(ac->module);
+        }
+
+        ret = dsdb_get_sd_from_ldb_message(ldb,
+                                           ac, res->msgs[0], &domain_sd);
+
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(map); i++) {
+                uint32_t this_uac_new = user_account_control & map[i].uac;
+                uint32_t this_uac_old = user_account_control_old & map[i].uac;
+                if (this_uac_new != this_uac_old) {
+                        if (this_uac_old != 0) {
+                                if (map[i].delete_is_privileged == false) {
+                                        continue;
+                                }
+                        }
+                        if (map[i].oid) {
+                                struct ldb_control *control = ldb_request_get_control(ac->req, map[i].oid);
+                                if (control == NULL) {
+                                        ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+                                }
+                        } else if (map[i].privilege != SEC_PRIV_INVALID) {
+                                bool have_priv = security_token_has_privilege(user_token,
+                                                                              map[i].privilege);
+                                if (have_priv == false) {
+                                        ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+                                }
+                        } else if (map[i].priv_to_change_from & user_account_control_old) {
+                                bool is_admin = security_token_has_builtin_administrators(user_token);
+                                if (is_admin == false) {
+                                        ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+                                }
+                        } else if (map[i].guid) {
+                                ret = acl_check_extended_right(ac, domain_sd,
+                                                               user_token,
+                                                               map[i].guid,
+                                                               SEC_ADS_CONTROL_ACCESS,
+                                                               sid);
+                        } else {
+                                ret = LDB_SUCCESS;
+                        }
+                        if (ret != LDB_SUCCESS) {
+                                break;
+                        }
+                }
+        }
+        if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
+                switch (ac->req->operation) {
+                case LDB_ADD:
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
+                                               "Failed to add %s: %s",
+                                               ldb_dn_get_linearized(ac->msg->dn),
+                                               map[i].error_string);
+                        break;
+                case LDB_MODIFY:
+                        ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
+                                               "Failed to modify %s: %s",
+                                               ldb_dn_get_linearized(ac->msg->dn),
+                                               map[i].error_string);
+                        break;
+                default:
+                        return ldb_module_operr(ac->module);
+                }
+                if (map[i].guid) {
+                        dsdb_acl_debug(domain_sd, acl_user_token(ac->module),
+                                       domain_dn,
+                                       true,
+                                       10);
+                }
+        }
+        return ret;
+}
+
+static int samldb_check_user_account_control_rules(struct samldb_ctx *ac,
+                                                   struct dom_sid *sid,
+                                                   uint32_t user_account_control,
+                                                   uint32_t user_account_control_old)
+{
+        int ret;
+        ret = samldb_check_user_account_control_invariants(ac, user_account_control);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        ret = samldb_check_user_account_control_acl(ac, sid, user_account_control, user_account_control_old);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        return ret;
+}
+
+
+/**
+ * This function is called on LDB modify operations. It performs some additions/
+ * replaces on the current LDB message when "userAccountControl" changes.
+ */
 static int samldb_user_account_control_change(struct samldb_ctx *ac)
 {
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        uint32_t user_account_control, account_type;
+        uint32_t old_uac;
+        uint32_t new_uac;
+        uint32_t raw_uac;
+        uint32_t old_ufa;
+        uint32_t new_ufa;
+        uint32_t old_uac_computed;
+        uint32_t clear_uac;
+        uint32_t old_atype;
+        uint32_t new_atype;
+        uint32_t old_pgrid;
+        uint32_t new_pgrid;
+        NTTIME old_lockoutTime;
         struct ldb_message_element *el;
+        struct ldb_val *val;
+        struct ldb_val computer_val;
         struct ldb_message *tmp_msg;
+        struct dom_sid *sid;
         int ret;
+        struct ldb_result *res;
+        const char * const attrs[] = {
+                "objectClass",
+                "isCriticalSystemObject",
+                "userAccountControl",
+                "msDS-User-Account-Control-Computed",
+                "lockoutTime",
+                "objectSid",
+                NULL
+        };
+        bool is_computer = false;
+        bool old_is_critical = false;
+        bool new_is_critical = false;
 
         el = dsdb_get_single_valued_attr(ac->msg, "userAccountControl",
                                          ac->req->operation);
-        if (el == NULL) {
-                /* we are not affected */
-                return LDB_SUCCESS;
+        if (el == NULL || el->num_values == 0) {
+                ldb_asprintf_errstring(ldb,
+                        "%08X: samldb: 'userAccountControl' can't be deleted!",
+                        W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
         }
 
@@ -1244 +1806 @@
                 return ret;
         }
-        user_account_control = ldb_msg_find_attr_as_uint(tmp_msg,
-                                                         "userAccountControl",
-                                                         0);
+        raw_uac = ldb_msg_find_attr_as_uint(tmp_msg,
+                                            "userAccountControl",
+                                            0);
         talloc_free(tmp_msg);
-
-        /* Temporary duplicate accounts aren't allowed */
-        if ((user_account_control & UF_TEMP_DUPLICATE_ACCOUNT) != 0) {
+        /*
+         * UF_LOCKOUT, UF_PASSWD_CANT_CHANGE and UF_PASSWORD_EXPIRED
+         * are only generated and not stored. We ignore them almost
+         * completely, along with unknown bits and UF_SCRIPT.
+         *
+         * The only exception is ACB_AUTOLOCK, which features in
+         * clear_acb when the bit is cleared in this modify operation.
+         *
+         * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are
+         * ignored by clients and servers
+         */
+        new_uac = raw_uac & UF_SETTABLE_BITS;
+
+        /* Fetch the old "userAccountControl" and "objectClass" */
+        ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
+                                    DSDB_FLAG_NEXT_MODULE, ac->req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        old_uac = ldb_msg_find_attr_as_uint(res->msgs[0], "userAccountControl", 0);
+        if (old_uac == 0) {
+                return ldb_operr(ldb);
+        }
+        old_uac_computed = ldb_msg_find_attr_as_uint(res->msgs[0],
+                                                     "msDS-User-Account-Control-Computed", 0);
+        old_lockoutTime = ldb_msg_find_attr_as_int64(res->msgs[0],
+                                                     "lockoutTime", 0);
+        old_is_critical = ldb_msg_find_attr_as_bool(res->msgs[0],
+                                                    "isCriticalSystemObject", 0);
+        /* When we do not have objectclass "computer" we cannot switch to a (read-only) DC */
+        el = ldb_msg_find_element(res->msgs[0], "objectClass");
+        if (el == NULL) {
+                return ldb_operr(ldb);
+        }
+        computer_val = data_blob_string_const("computer");
+        val = ldb_msg_find_val(el, &computer_val);
+        if (val != NULL) {
+                is_computer = true;
+        }
+
+        old_ufa = old_uac & UF_ACCOUNT_TYPE_MASK;
+        old_atype = ds_uf2atype(old_ufa);
+        old_pgrid = ds_uf2prim_group_rid(old_uac);
+
+        new_ufa = new_uac & UF_ACCOUNT_TYPE_MASK;
+        if (new_ufa == 0) {
+                /*
+                 * "userAccountControl" = 0 or missing one of the
+                 * types means "UF_NORMAL_ACCOUNT".  See MS-SAMR
+                 * 3.1.1.8.10 point 8
+                 */
+                new_ufa = UF_NORMAL_ACCOUNT;
+                new_uac |= new_ufa;
+        }
+        sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
+        if (sid == NULL) {
+                return ldb_module_operr(ac->module);
+        }
+
+        ret = samldb_check_user_account_control_rules(ac, sid, new_uac, old_uac);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        new_atype = ds_uf2atype(new_ufa);
+        new_pgrid = ds_uf2prim_group_rid(new_uac);
+
+        clear_uac = (old_uac | old_uac_computed) & ~raw_uac;
+
+        switch (new_ufa) {
+        case UF_NORMAL_ACCOUNT:
+                new_is_critical = old_is_critical;
+                break;
+
+        case UF_INTERDOMAIN_TRUST_ACCOUNT:
+                new_is_critical = true;
+                break;
+
+        case UF_WORKSTATION_TRUST_ACCOUNT:
+                new_is_critical = false;
+                if (new_uac & UF_PARTIAL_SECRETS_ACCOUNT) {
+                        if (!is_computer) {
+                                ldb_asprintf_errstring(ldb,
+                                                       "%08X: samldb: UF_PARTIAL_SECRETS_ACCOUNT "
+                                                       "requires objectclass 'computer'!",
+                                                       W_ERROR_V(WERR_DS_MACHINE_ACCOUNT_CREATED_PRENT4));
+                                return LDB_ERR_UNWILLING_TO_PERFORM;
+                        }
+                        new_is_critical = true;
+                }
+                break;
+
+        case UF_SERVER_TRUST_ACCOUNT:
+                if (!is_computer) {
+                        ldb_asprintf_errstring(ldb,
+                                "%08X: samldb: UF_SERVER_TRUST_ACCOUNT "
+                                "requires objectclass 'computer'!",
+                                W_ERROR_V(WERR_DS_MACHINE_ACCOUNT_CREATED_PRENT4));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+                new_is_critical = true;
+                break;
+
+        default:
+                ldb_asprintf_errstring(ldb,
+                        "%08X: samldb: invalid userAccountControl[0x%08X]",
+                        W_ERROR_V(WERR_INVALID_PARAMETER), raw_uac);
                 return LDB_ERR_OTHER;
         }
 
-        account_type = ds_uf2atype(user_account_control);
-        if (account_type == 0) {
-                ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
-                return LDB_ERR_UNWILLING_TO_PERFORM;
-        }
-        ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "sAMAccountType",
-                                 account_type);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-        el = ldb_msg_find_element(ac->msg, "sAMAccountType");
-        el->flags = LDB_FLAG_MOD_REPLACE;
-
-        if (user_account_control
-            & (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
+        if (old_atype != new_atype) {
+                ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+                                         "sAMAccountType", new_atype);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+                el = ldb_msg_find_element(ac->msg, "sAMAccountType");
+                el->flags = LDB_FLAG_MOD_REPLACE;
+        }
+
+        /* As per MS-SAMR 3.1.1.8.10 these flags have not to be set */
+        if ((clear_uac & UF_LOCKOUT) && (old_lockoutTime != 0)) {
+                /* "pwdLastSet" reset as password expiration has been forced  */
+                ldb_msg_remove_attr(ac->msg, "lockoutTime");
+                ret = samdb_msg_add_uint64(ldb, ac->msg, ac->msg, "lockoutTime",
+                                           (NTTIME)0);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+                el = ldb_msg_find_element(ac->msg, "lockoutTime");
+                el->flags = LDB_FLAG_MOD_REPLACE;
+        }
+
+        /* "isCriticalSystemObject" might be set/changed */
+        if (old_is_critical != new_is_critical) {
                 ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
-                                         "TRUE");
+                                         new_is_critical ? "TRUE": "FALSE");
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -1279 +1955 @@
         }
 
-        if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
-                uint32_t rid = ds_uf2prim_group_rid(user_account_control);
+        if (!ldb_msg_find_element(ac->msg, "primaryGroupID") &&
+            (old_pgrid != new_pgrid)) {
+                /* Older AD deployments don't know about the RODC group */
+                if (new_pgrid == DOMAIN_RID_READONLY_DCS) {
+                        ret = samldb_prim_group_tester(ac, new_pgrid);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
+                }
+
                 ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
-                                         "primaryGroupID", rid);
+                                         "primaryGroupID", new_pgrid);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -1290 +1974 @@
                 el->flags = LDB_FLAG_MOD_REPLACE;
         }
+
+        /* Propagate eventual "userAccountControl" attribute changes */
+        if (old_uac != new_uac) {
+                char *tempstr = talloc_asprintf(ac->msg, "%d",
+                                                new_uac);
+                if (tempstr == NULL) {
+                        return ldb_module_oom(ac->module);
+                }
+
+                /* Overwrite "userAccountControl" correctly */
+                el = dsdb_get_single_valued_attr(ac->msg, "userAccountControl",
+                                                 ac->req->operation);
+                el->values[0].data = (uint8_t *) tempstr;
+                el->values[0].length = strlen(tempstr);
+        } else {
+                ldb_msg_remove_attr(ac->msg, "userAccountControl");
+        }
+
+        return LDB_SUCCESS;
+}
+
+static int samldb_lockout_time(struct samldb_ctx *ac)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        NTTIME lockoutTime;
+        struct ldb_message_element *el;
+        struct ldb_message *tmp_msg;
+        int ret;
+
+        el = dsdb_get_single_valued_attr(ac->msg, "lockoutTime",
+                                         ac->req->operation);
+        if (el == NULL || el->num_values == 0) {
+                ldb_asprintf_errstring(ldb,
+                        "%08X: samldb: 'lockoutTime' can't be deleted!",
+                        W_ERROR_V(WERR_DS_ILLEGAL_MOD_OPERATION));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        /* Create a temporary message for fetching the "lockoutTime" */
+        tmp_msg = ldb_msg_new(ac->msg);
+        if (tmp_msg == NULL) {
+                return ldb_module_oom(ac->module);
+        }
+        ret = ldb_msg_add(tmp_msg, el, 0);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        lockoutTime = ldb_msg_find_attr_as_int64(tmp_msg,
+                                                 "lockoutTime",
+                                                 0);
+        talloc_free(tmp_msg);
+
+        if (lockoutTime != 0) {
+                return LDB_SUCCESS;
+        }
+
+        /* lockoutTime == 0 resets badPwdCount */
+        ldb_msg_remove_attr(ac->msg, "badPwdCount");
+        ret = samdb_msg_add_int(ldb, ac->msg, ac->msg,
+                                "badPwdCount", 0);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        el = ldb_msg_find_element(ac->msg, "badPwdCount");
+        el->flags = LDB_FLAG_MOD_REPLACE;
 
         return LDB_SUCCESS;
@@ -1302 +2051 @@
         int ret;
         struct ldb_result *res;
-        const char *attrs[] = { "groupType", NULL };
+        const char * const attrs[] = { "groupType", NULL };
 
         el = dsdb_get_single_valued_attr(ac->msg, "groupType",
@@ -1324 +2073 @@
 
         ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
-                                    DSDB_FLAG_NEXT_MODULE, ac->req);
+                                    DSDB_FLAG_NEXT_MODULE |
+                                    DSDB_SEARCH_SHOW_DELETED, ac->req);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -1393 +2143 @@
 {
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        const char *no_attrs[] = { NULL };
+        const char * const no_attrs[] = { NULL };
         struct ldb_result *res;
         const char *sam_accountname, *enc_str;
@@ -1416 +2166 @@
                 return ret;
         }
-        sam_accountname = talloc_steal(ac,
-                                       ldb_msg_find_attr_as_string(tmp_msg, "sAMAccountName", NULL));
+
+        /* We must not steal the original string, it belongs to the caller! */
+        sam_accountname = talloc_strdup(ac, 
+                                        ldb_msg_find_attr_as_string(tmp_msg, "sAMAccountName", NULL));
         talloc_free(tmp_msg);
 
@@ -1434 +2186 @@
         /* Make sure that a "sAMAccountName" is only used once */
 
-        ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE, no_attrs,
+        ret = dsdb_module_search(ac->module, ac, &res,
+                                 ldb_get_default_basedn(ldb),
+                                 LDB_SCOPE_SUBTREE, no_attrs,
                                  DSDB_FLAG_NEXT_MODULE, ac->req,
                                  "(sAMAccountName=%s)", enc_str);
@@ -1457 +2211 @@
 static int samldb_member_check(struct samldb_ctx *ac)
 {
-        static const char * const attrs[] = { "objectSid", "member", NULL };
+        const char * const attrs[] = { "objectSid", NULL };
         struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
         struct ldb_message_element *el;
@@ -1465 +2219 @@
         struct dom_sid *group_sid;
         unsigned int i, j;
-        int cnt;
         int ret;
 
@@ -1471 +2224 @@
 
         ret = dsdb_module_search(ac->module, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
-                                 DSDB_FLAG_NEXT_MODULE, ac->req, NULL);
+                                 DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED, ac->req, NULL);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -1493 +2246 @@
                 el = &ac->msg->elements[i];
                 for (j = 0; j < el->num_values; j++) {
-                        struct ldb_message_element *mo;
                         struct ldb_result *group_res;
                         const char *group_attrs[] = { "primaryGroupID" , NULL };
                         uint32_t prim_group_rid;
+
+                        if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
+                                /* Deletes will be handled in
+                                 * repl_meta_data, and deletes not
+                                 * matching a member will return
+                                 * LDB_ERR_UNWILLING_TO_PERFORM
+                                 * there */
+                                continue;
+                        }
 
                         member_dn = ldb_dn_from_ldb_val(ac, ldb,
@@ -1502 +2263 @@
                         if (!ldb_dn_validate(member_dn)) {
                                 return ldb_operr(ldb);
-                        }
-
-                        /* The "member" attribute can be modified with the
-                         * following restrictions (beside a valid DN):
-                         *
-                         * - "add" operations can only be performed when the
-                         *   member still doesn't exist - if not then return
-                         *   ERR_ENTRY_ALREADY_EXISTS (not
-                         *   ERR_ATTRIBUTE_OR_VALUE_EXISTS!)
-                         * - "delete" operations can only be performed when the
-                         *   member does exist - if not then return
-                         *   ERR_UNWILLING_TO_PERFORM (not
-                         *   ERR_NO_SUCH_ATTRIBUTE!)
-                         * - primary group check
-                         */
-                        mo = samdb_find_attribute(ldb, res->msgs[0], "member",
-                                                  ldb_dn_get_linearized(member_dn));
-                        if (mo == NULL) {
-                                cnt = 0;
-                        } else {
-                                cnt = 1;
-                        }
-
-                        if ((cnt > 0) && (LDB_FLAG_MOD_TYPE(el->flags)
-                            == LDB_FLAG_MOD_ADD)) {
-                                return LDB_ERR_ENTRY_ALREADY_EXISTS;
-                        }
-                        if ((cnt == 0) && LDB_FLAG_MOD_TYPE(el->flags)
-                            == LDB_FLAG_MOD_DELETE) {
-                                return LDB_ERR_UNWILLING_TO_PERFORM;
                         }
 
@@ -1562 +2293 @@
 
                         if (dom_sid_equal(group_sid, sid)) {
+                                ldb_asprintf_errstring(ldb,
+                                                       "samldb: member %s already set via primaryGroupID %u",
+                                                       ldb_dn_get_linearized(member_dn), prim_group_rid);
                                 return LDB_ERR_ENTRY_ALREADY_EXISTS;
                         }
@@ -1619 +2353 @@
         struct ldb_message_element *el = NULL, *el2 = NULL;
         struct ldb_message *msg;
-        const char *attrs[] = { "servicePrincipalName", NULL };
+        const char * const attrs[] = { "servicePrincipalName", NULL };
         struct ldb_result *res;
         const char *dns_hostname = NULL, *old_dns_hostname = NULL,
                    *sam_accountname = NULL, *old_sam_accountname = NULL;
-        unsigned int i;
+        unsigned int i, j;
         int ret;
 
@@ -1646 +2380 @@
                         return ret;
                 }
-                dns_hostname = talloc_steal(ac,
-                                            ldb_msg_find_attr_as_string(msg, "dNSHostName", NULL));
+                dns_hostname = talloc_strdup(ac, 
+                                             ldb_msg_find_attr_as_string(msg, "dNSHostName", NULL));
+                if (dns_hostname == NULL) {
+                        return ldb_module_oom(ac->module);
+                }
+                        
                 talloc_free(msg);
 
@@ -1659 +2397 @@
         /* Create a temporary message for fetching the "sAMAccountName" */
         if (el2 != NULL) {
-                char *tempstr, *tempstr2;
+                char *tempstr, *tempstr2 = NULL;
                 const char *acct_attrs[] = { "sAMAccountName", NULL };
 
@@ -1702 +2440 @@
         }
         if ((old_dns_hostname != NULL) && (dns_hostname != NULL) &&
-            (strcasecmp(old_dns_hostname, dns_hostname) == 0)) {
+            (strcasecmp_m(old_dns_hostname, dns_hostname) == 0)) {
                 /* The "dNSHostName" didn't change */
                 dns_hostname = NULL;
@@ -1712 +2450 @@
         }
         if ((old_sam_accountname != NULL) && (sam_accountname != NULL) &&
-            (strcasecmp(old_sam_accountname, sam_accountname) == 0)) {
+            (strcasecmp_m(old_sam_accountname, sam_accountname) == 0)) {
                 /* The "sAMAccountName" didn't change */
                 sam_accountname = NULL;
@@ -1764 +2502 @@
 
         if (res->msgs[0]->num_elements == 1) {
-                /* Yes, we do have "servicePrincipalName"s. First we update them
+                /*
+                 * Yes, we do have "servicePrincipalName"s. First we update them
                  * locally, that means we do always substitute the current
                  * "dNSHostName" with the new one and/or "sAMAccountName"
-                 * without "$" with the new one and then we append this to the
-                 * modification request (Windows behaviour). */
+                 * without "$" with the new one and then we append the
+                 * modified "servicePrincipalName"s as a message element
+                 * replace to the modification request (Windows behaviour). We
+                 * need also to make sure that the values remain case-
+                 * insensitively unique.
+                 */
+
+                ret = ldb_msg_add_empty(ac->msg, "servicePrincipalName",
+                                        LDB_FLAG_MOD_REPLACE, &el);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
 
                 for (i = 0; i < res->msgs[0]->elements[0].num_values; i++) {
-                        char *old_str, *new_str, *pos;
+                        char *old_str, *new_str;
+                        char *pos = NULL;
                         const char *tok;
+                        struct ldb_val *vals;
+                        bool found = false;
 
                         old_str = (char *)
@@ -1785 +2537 @@
                         while ((tok = strtok_r(NULL, "/", &pos)) != NULL) {
                                 if ((dns_hostname != NULL) &&
-                                    (strcasecmp(tok, old_dns_hostname) == 0)) {
+                                    (strcasecmp_m(tok, old_dns_hostname) == 0)) {
                                         tok = dns_hostname;
                                 }
                                 if ((sam_accountname != NULL) &&
-                                    (strcasecmp(tok, old_sam_accountname) == 0)) {
+                                    (strcasecmp_m(tok, old_sam_accountname) == 0)) {
                                         tok = sam_accountname;
                                 }
@@ -1800 +2552 @@
                         }
 
-                        ret = ldb_msg_add_string(ac->msg,
-                                                 "servicePrincipalName",
-                                                 new_str);
-                        if (ret != LDB_SUCCESS) {
-                                return ret;
-                        }
-                }
-
-                el = ldb_msg_find_element(ac->msg, "servicePrincipalName");
-                el->flags = LDB_FLAG_MOD_REPLACE;
+                        /* Uniqueness check */
+                        for (j = 0; (!found) && (j < el->num_values); j++) {
+                                if (strcasecmp_m((char *)el->values[j].data,
+                                               new_str) == 0) {
+                                        found = true;
+                                }
+                        }
+                        if (found) {
+                                continue;
+                        }
+
+                        /*
+                         * append the new "servicePrincipalName" -
+                         * code derived from ldb_msg_add_value().
+                         *
+                         * Open coded to make it clear that we must
+                         * append to the MOD_REPLACE el created above.
+                         */
+                        vals = talloc_realloc(ac->msg, el->values,
+                                              struct ldb_val,
+                                              el->num_values + 1);
+                        if (vals == NULL) {
+                                return ldb_module_oom(ac->module);
+                        }
+                        el->values = vals;
+                        el->values[el->num_values] = data_blob_string_const(new_str);
+                        ++(el->num_values);
+                }
         }
 
         talloc_free(res);
+
+        return LDB_SUCCESS;
+}
+
+/* This checks the "fSMORoleOwner" attributes */
+static int samldb_fsmo_role_owner_check(struct samldb_ctx *ac)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        const char * const no_attrs[] = { NULL };
+        struct ldb_message_element *el;
+        struct ldb_message *tmp_msg;
+        struct ldb_dn *res_dn;
+        struct ldb_result *res;
+        int ret;
+
+        el = dsdb_get_single_valued_attr(ac->msg, "fSMORoleOwner",
+                                         ac->req->operation);
+        if (el == NULL) {
+                /* we are not affected */
+                return LDB_SUCCESS;
+        }
+
+        /* Create a temporary message for fetching the "fSMORoleOwner" */
+        tmp_msg = ldb_msg_new(ac->msg);
+        if (tmp_msg == NULL) {
+                return ldb_module_oom(ac->module);
+        }
+        ret = ldb_msg_add(tmp_msg, el, 0);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        res_dn = ldb_msg_find_attr_as_dn(ldb, ac, tmp_msg, "fSMORoleOwner");
+        talloc_free(tmp_msg);
+
+        if (res_dn == NULL) {
+                ldb_set_errstring(ldb,
+                                  "samldb: 'fSMORoleOwner' attributes have to reference 'nTDSDSA' entries!");
+                if (ac->req->operation == LDB_ADD) {
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                } else {
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        }
+
+        /* Fetched DN has to reference a "nTDSDSA" entry */
+        ret = dsdb_module_search(ac->module, ac, &res, res_dn, LDB_SCOPE_BASE,
+                                 no_attrs,
+                                 DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
+                                 ac->req, "(objectClass=nTDSDSA)");
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        if (res->count != 1) {
+                ldb_set_errstring(ldb,
+                                  "samldb: 'fSMORoleOwner' attributes have to reference 'nTDSDSA' entries!");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        talloc_free(res);
+
+        return LDB_SUCCESS;
+}
+
+/*
+ * Return zero if the number of zero bits in the address (looking from low to
+ * high) is equal to or greater than the length minus the mask. Otherwise it
+ * returns -1.
+ */
+static int check_cidr_zero_bits(uint8_t *address, unsigned int len,
+                                unsigned int mask)
+{
+        /* <address> is an integer in big-endian form, <len> bits long. All
+           bits between <mask> and <len> must be zero. */
+        int i;
+        unsigned int byte_len;
+        unsigned int byte_mask;
+        unsigned int bit_mask;
+        if (len == 32) {
+                DBG_INFO("Looking at address %02x%02x%02x%02x, mask %u\n",
+                         address[0], address[1], address[2], address[3],
+                          mask);
+        } else if (len == 128){
+                DBG_INFO("Looking at address "
+                         "%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
+                         "%02x%02x-%02x%02x-%02x%02x-%02x%02x, mask %u\n",
+                         address[0], address[1], address[2], address[3],
+                         address[4], address[5], address[6], address[7],
+                         address[8], address[9], address[10], address[11],
+                         address[12], address[13], address[14], address[15],
+                         mask);
+        }
+
+        if (mask > len){
+                DBG_INFO("mask %u is too big (> %u)\n", mask, len);
+                return -1;
+        }
+        if (mask == len){
+                /* single address subnet.
+                 * In IPv4 all 255s is invalid by the bitmask != address rule
+                 * in MS-ADTS. IPv6 does not suffer.
+                 */
+                if (len == 32){
+                        if (address[0] == 255 &&
+                            address[1] == 255 &&
+                            address[2] == 255 &&
+                            address[3] == 255){
+                                return -1;
+                        }
+                }
+                return 0;
+        }
+
+        byte_len = len / 8;
+        byte_mask = mask / 8;
+
+        for (i = byte_len - 1; i > byte_mask; i--){
+                DBG_DEBUG("checking byte %d %02x\n", i, address[i]);
+                if (address[i] != 0){
+                        return -1;
+                }
+        }
+        bit_mask = (1 << (8 - (mask & 7))) - 1;
+        DBG_DEBUG("checking bitmask %02x & %02x overlap %02x\n", bit_mask, address[byte_mask],
+                  bit_mask & address[byte_mask]);
+        if (address[byte_mask] & bit_mask){
+                return -1;
+        }
+
+        /* According to MS-ADTS, the mask can't exactly equal the bitmask for
+         * IPv4 (but this is fine for v6). That is 255.255.80.0/17 is bad,
+         * because the bitmask implied by "/17" is 255.255.80.0.
+         *
+         * The bit_mask used in the previous check is the complement of what
+         * we want here.
+         */
+        if (len == 32 && address[byte_mask] == (uint8_t)~bit_mask){
+                bool ok = false;
+                for (i = 0; i < byte_mask; i++){
+                        if (address[i] != 255){
+                                ok = true;
+                                break;
+                        }
+                }
+                if (ok == false){
+                        return -1;
+                }
+        }
+        return 0;
+}
+
+
+
+static int check_address_roundtrip(const char *address, int family,
+                                   const uint8_t *address_bytes,
+                                   char *buffer, int buffer_len)
+{
+        /*
+         * Check that the address is in the canonical RFC5952 format for IPv6,
+         * and lacks extra leading zeros for each dotted decimal for IPv4.
+         * Handily this is what inet_ntop() gives you.
+         */
+        const char *address_redux = inet_ntop(family, address_bytes,
+                                              buffer, buffer_len);
+        if (address_redux == NULL){
+                DBG_INFO("Address round trip %s failed unexpectedly"
+                         " with errno %d\n", address, errno);
+                return -1;
+        }
+        if (strcasecmp(address, address_redux) != 0){
+                DBG_INFO("Address %s round trips to %s; fail!\n",
+                         address, address_redux);
+                /* If the address family is IPv6, and the address is in a
+                   certain range
+
+                 */
+                if (strchr(address_redux, '.') != NULL){
+                        DEBUG(0, ("The IPv6 address '%s' has the misfortune of "
+                                  "lying in a range that was once used for "
+                                  "IPv4 embedding (that is, it might also be "
+                                  "represented as '%s').\n", address,
+                                  address_redux));
+                }
+                return -1;
+        }
+        return 0;
+}
+
+
+
+/*
+ * MS-ADTS v20150630 6.1.1.2.2.2.1 Subnet Object, refers to RFC1166 and
+ * RFC2373. It specifies something seemingly indistinguishable from an RFC4632
+ * CIDR address range without saying so explicitly. Here we follow the CIDR
+ * spec.
+ *
+ * Return 0 on success, -1 on error.
+ */
+static int verify_cidr(const char *cidr)
+{
+        char *address = NULL, *slash = NULL, *endptr = NULL;
+        bool has_colon, has_dot;
+        int res, ret;
+        unsigned long mask;
+        uint8_t *address_bytes = NULL;
+        char *address_redux = NULL;
+        unsigned int address_len;
+        TALLOC_CTX *frame = NULL;
+
+        DBG_DEBUG("CIDR is %s\n", cidr);
+        frame = talloc_stackframe();
+        address = talloc_strdup(frame, cidr);
+        if (address == NULL){
+                goto error;
+        }
+
+        /* there must be a '/' */
+        slash = strchr(address, '/');
+        if (slash == NULL){
+                goto error;
+        }
+        /* terminate the address for strchr, inet_pton */
+        *slash = '\0';
+
+        mask = strtoul(slash + 1, &endptr, 10);
+        if (mask == 0){
+                DBG_INFO("Windows does not like the zero mask, "
+                         "so nor do we: %s\n", cidr);
+                goto error;
+        }
+
+        if (*endptr != '\0' || endptr == slash + 1){
+                DBG_INFO("CIDR mask is not a proper integer: %s\n", cidr);
+                goto error;
+        }
+
+        address_bytes = talloc_size(frame, sizeof(struct in6_addr));
+        if (address_bytes == NULL){
+                goto error;
+        }
+
+        address_redux = talloc_size(frame, INET6_ADDRSTRLEN);
+        if (address_redux == NULL){
+                goto error;
+        }
+
+        DBG_INFO("found address %s, mask %lu\n", address, mask);
+        has_colon = (strchr(address, ':') == NULL) ? false : true;
+        has_dot = (strchr(address, '.') == NULL) ? false : true;
+        if (has_dot && has_colon){
+                /* This seems to be an IPv4 address embedded in IPv6, which is
+                   icky. We don't support it. */
+                DBG_INFO("Refusing to consider cidr '%s' with dots and colons\n",
+                          cidr);
+                goto error;
+        } else if (has_colon){  /* looks like IPv6 */
+                res = inet_pton(AF_INET6, address, address_bytes);
+                if (res != 1) {
+                        DBG_INFO("Address in %s fails to parse as IPv6\n", cidr);
+                        goto error;
+                }
+                address_len = 128;
+                if (check_address_roundtrip(address, AF_INET6, address_bytes,
+                                            address_redux, INET6_ADDRSTRLEN)){
+                        goto error;
+                }
+        } else if (has_dot) {
+                /* looks like IPv4 */
+                if (strcmp(address, "0.0.0.0") == 0){
+                        DBG_INFO("Windows does not like the zero IPv4 address, "
+                                 "so nor do we.\n");
+                        goto error;
+                }
+                res = inet_pton(AF_INET, address, address_bytes);
+                if (res != 1) {
+                        DBG_INFO("Address in %s fails to parse as IPv4\n", cidr);
+                        goto error;
+                }
+                address_len = 32;
+
+                if (check_address_roundtrip(address, AF_INET, address_bytes,
+                                            address_redux, INET_ADDRSTRLEN)){
+                        goto error;
+                }
+        } else {
+                /* This doesn't look like an IP address at all. */
+                goto error;
+        }
+
+        ret = check_cidr_zero_bits(address_bytes, address_len, mask);
+        talloc_free(frame);
+        return ret;
+  error:
+        talloc_free(frame);
+        return -1;
+}
+
+
+static int samldb_verify_subnet(struct samldb_ctx *ac)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        const char *cidr = NULL;
+        const struct ldb_val *rdn_value = NULL;
+
+        rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+        if (rdn_value == NULL) {
+                ldb_set_errstring(ldb, "samldb: ldb_dn_get_rdn_val "
+                                  "failed");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        cidr = ldb_dn_escape_value(ac, *rdn_value);
+        DBG_INFO("looking at cidr '%s'\n", cidr);
+        if (cidr == NULL) {
+                ldb_set_errstring(ldb,
+                                  "samldb: adding an empty subnet cidr seems wrong");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        if (verify_cidr(cidr)){
+                ldb_set_errstring(ldb,
+                                  "samldb: subnet value is invalid");
+                return LDB_ERR_INVALID_DN_SYNTAX;
+        }
 
         return LDB_SUCCESS;
@@ -1823 +2916 @@
         struct ldb_context *ldb;
         struct samldb_ctx *ac;
+        struct ldb_message_element *el;
         int ret;
 
@@ -1831 +2925 @@
         if (ldb_dn_is_special(req->op.add.message->dn)) {
                 return ldb_next_request(module, req);
+        }
+
+        el = ldb_msg_find_element(req->op.add.message, "userParameters");
+        if (el != NULL && ldb_req_is_untrusted(req)) {
+                const char *reason = "samldb_add: "
+                        "setting userParameters is not supported over LDAP, "
+                        "see https://bugzilla.samba.org/show_bug.cgi?id=8077";
+                ldb_debug(ldb, LDB_DEBUG_WARNING, "%s", reason);
+                return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, reason);
         }
 
@@ -1847 +2950 @@
         }
 
+        el = ldb_msg_find_element(ac->msg, "fSMORoleOwner");
+        if (el != NULL) {
+                ret = samldb_fsmo_role_owner_check(ac);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
         if (samdb_find_attribute(ldb, ac->msg,
                                  "objectclass", "user") != NULL) {
-                ac->type = "user";
+                ac->type = SAMLDB_TYPE_USER;
 
                 ret = samldb_prim_group_trigger(ac);
@@ -1866 +2977 @@
         if (samdb_find_attribute(ldb, ac->msg,
                                  "objectclass", "group") != NULL) {
-                ac->type = "group";
+                ac->type = SAMLDB_TYPE_GROUP;
 
                 ret = samldb_objectclass_trigger(ac);
@@ -1891 +3002 @@
                 }
 
-                ac->type = "classSchema";
+                ac->type = SAMLDB_TYPE_CLASS;
                 return samldb_fill_object(ac);
         }
@@ -1903 +3014 @@
                 }
 
-                ac->type = "attributeSchema";
+                ac->type = SAMLDB_TYPE_ATTRIBUTE;
                 return samldb_fill_object(ac);
+        }
+
+        if (samdb_find_attribute(ldb, ac->msg,
+                                 "objectclass", "subnet") != NULL) {
+                ret = samldb_verify_subnet(ac);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(ac);
+                        return ret;
+                }
+                /* We are just checking the value is valid, and there are no
+                   values to fill in. */
         }
 
@@ -1919 +3041 @@
         struct samldb_ctx *ac;
         struct ldb_message_element *el, *el2;
+        struct ldb_control *is_undelete;
         bool modified = false;
         int ret;
@@ -1929 +3052 @@
         ldb = ldb_module_get_ctx(module);
 
+        /*
+         * we are going to need some special handling if in Undelete call.
+         * Since tombstone_reanimate module will restore certain attributes,
+         * we need to relax checks for: sAMAccountType, primaryGroupID
+         */
+        is_undelete = ldb_request_get_control(req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID);
+
         /* make sure that "objectSid" is not specified */
         el = ldb_msg_find_element(req->op.mod.message, "objectSid");
         if (el != NULL) {
-                ldb_set_errstring(ldb,
-                                  "samldb: objectSid must not be specified!");
-                return LDB_ERR_UNWILLING_TO_PERFORM;
-        }
-        /* make sure that "sAMAccountType" is not specified */
-        el = ldb_msg_find_element(req->op.mod.message, "sAMAccountType");
-        if (el != NULL) {
-                ldb_set_errstring(ldb,
-                                  "samldb: sAMAccountType must not be specified!");
-                return LDB_ERR_UNWILLING_TO_PERFORM;
+                if (ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID) == NULL) {
+                        ldb_set_errstring(ldb,
+                                          "samldb: objectSid must not be specified!");
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        }
+        if (is_undelete == NULL) {
+                /* make sure that "sAMAccountType" is not specified */
+                el = ldb_msg_find_element(req->op.mod.message, "sAMAccountType");
+                if (el != NULL) {
+                        ldb_set_errstring(ldb,
+                                          "samldb: sAMAccountType must not be specified!");
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
         }
         /* make sure that "isCriticalSystemObject" is not specified */
@@ -1962 +3096 @@
         }
 
+        el = ldb_msg_find_element(req->op.mod.message, "userParameters");
+        if (el != NULL && ldb_req_is_untrusted(req)) {
+                const char *reason = "samldb: "
+                        "setting userParameters is not supported over LDAP, "
+                        "see https://bugzilla.samba.org/show_bug.cgi?id=8077";
+                ldb_debug(ldb, LDB_DEBUG_WARNING, "%s", reason);
+                return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, reason);
+        }
+
         ac = samldb_ctx_init(module, req);
         if (ac == NULL) {
@@ -1976 +3119 @@
         }
 
-        el = ldb_msg_find_element(ac->msg, "primaryGroupID");
-        if (el != NULL) {
-                ret = samldb_prim_group_change(ac);
-                if (ret != LDB_SUCCESS) {
-                        return ret;
+        if (is_undelete == NULL) {
+                el = ldb_msg_find_element(ac->msg, "primaryGroupID");
+                if (el != NULL) {
+                        ret = samldb_prim_group_trigger(ac);
+                        if (ret != LDB_SUCCESS) {
+                                return ret;
+                        }
                 }
         }
@@ -1993 +3138 @@
         }
 
+        el = ldb_msg_find_element(ac->msg, "lockoutTime");
+        if (el != NULL) {
+                modified = true;
+                ret = samldb_lockout_time(ac);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
         el = ldb_msg_find_element(ac->msg, "groupType");
         if (el != NULL) {
@@ -2031 +3185 @@
                 modified = true;
                 ret = samldb_service_principal_names_change(ac);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+        el = ldb_msg_find_element(ac->msg, "fSMORoleOwner");
+        if (el != NULL) {
+                ret = samldb_fsmo_role_owner_check(ac);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -2069 +3231 @@
         int ret;
         struct ldb_result *res;
-        const char *attrs[] = { "objectSid", NULL };
-        const char *noattrs[] = { NULL };
+        const char * const attrs[] = { "objectSid", "isDeleted", NULL };
+        const char * const noattrs[] = { NULL };
 
         ldb = ldb_module_get_ctx(ac->module);
 
         /* Finds out the SID/RID of the SAM object */
-        ret = dsdb_module_search_dn(ac->module, ac, &res, ac->req->op.del.dn, attrs, DSDB_FLAG_NEXT_MODULE, ac->req);
-        if (ret != LDB_SUCCESS) {
-                return ret;
+        ret = dsdb_module_search_dn(ac->module, ac, &res, ac->req->op.del.dn,
+                                        attrs,
+                                        DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
+                                        ac->req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (ldb_msg_check_string_attribute(res->msgs[0], "isDeleted", "TRUE")) {
+                return LDB_SUCCESS;
         }
 
@@ -2093 +3262 @@
                 return LDB_SUCCESS;
         }
+        /* do not allow deletion of well-known sids */
+        if (rid < DSDB_SAMDB_MINIMUM_ALLOWED_RID &&
+            (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) == NULL)) {
+                return LDB_ERR_OTHER;
+        }
 
         /* Deny delete requests from groups which are primary ones */
-        ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE, noattrs,
+        ret = dsdb_module_search(ac->module, ac, &res,
+                                 ldb_get_default_basedn(ldb),
+                                 LDB_SCOPE_SUBTREE, noattrs,
                                  DSDB_FLAG_NEXT_MODULE,
                                  ac->req,
@@ -2132 +3308 @@
 
         return ldb_next_request(module, req);
+}
+
+/* rename */
+
+static int check_rename_constraints(struct ldb_message *msg,
+                                    struct samldb_ctx *ac,
+                                    struct ldb_dn *olddn, struct ldb_dn *newdn)
+{
+        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+        struct ldb_dn *dn1, *dn2, *nc_root;
+        int32_t systemFlags;
+        bool move_op = false;
+        bool rename_op = false;
+        int ret;
+
+        /* Skip the checks if old and new DN are the same, or if we have the
+         * relax control specified or if the returned objects is already
+         * deleted and needs only to be moved for consistency. */
+
+        if (ldb_dn_compare(olddn, newdn) == 0) {
+                return LDB_SUCCESS;
+        }
+        if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
+                return LDB_SUCCESS;
+        }
+
+        if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
+                /*
+                 * check originating request if we are supposed
+                 * to "see" this record in first place.
+                 */
+                if (ldb_request_get_control(ac->req, LDB_CONTROL_SHOW_DELETED_OID) == NULL) {
+                        return LDB_ERR_NO_SUCH_OBJECT;
+                }
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        /* Objects under CN=System */
+
+        dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
+        if (dn1 == NULL) return ldb_oom(ldb);
+
+        if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
+                talloc_free(dn1);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
+            (ldb_dn_compare_base(dn1, newdn) != 0)) {
+                talloc_free(dn1);
+                ldb_asprintf_errstring(ldb,
+                                       "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
+                                       ldb_dn_get_linearized(olddn));
+                return LDB_ERR_OTHER;
+        }
+
+        talloc_free(dn1);
+
+        /* LSA objects */
+
+        if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
+            (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
+                ldb_asprintf_errstring(ldb,
+                                       "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
+                                       ldb_dn_get_linearized(olddn));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        /* subnet objects */
+        if (samdb_find_attribute(ldb, msg, "objectclass", "subnet") != NULL) {
+                ret = samldb_verify_subnet(ac);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(ac);
+                        return ret;
+                }
+        }
+
+        /* systemFlags */
+
+        dn1 = ldb_dn_get_parent(ac, olddn);
+        if (dn1 == NULL) return ldb_oom(ldb);
+        dn2 = ldb_dn_get_parent(ac, newdn);
+        if (dn2 == NULL) return ldb_oom(ldb);
+
+        if (ldb_dn_compare(dn1, dn2) == 0) {
+                rename_op = true;
+        } else {
+                move_op = true;
+        }
+
+        talloc_free(dn1);
+        talloc_free(dn2);
+
+        systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
+
+        /* Fetch name context */
+
+        ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
+                if (move_op) {
+                        ldb_asprintf_errstring(ldb,
+                                               "subtree_rename: Cannot move %s within schema partition",
+                                               ldb_dn_get_linearized(olddn));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+                if (rename_op &&
+                    (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
+                        ldb_asprintf_errstring(ldb,
+                                               "subtree_rename: Cannot rename %s within schema partition",
+                                               ldb_dn_get_linearized(olddn));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
+                if (move_op &&
+                    (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
+                        /* Here we have to do more: control the
+                         * "ALLOW_LIMITED_MOVE" flag. This means that the
+                         * grand-grand-parents of two objects have to be equal
+                         * in order to perform the move (this is used for
+                         * moving "server" objects in the "sites" container). */
+                        bool limited_move =
+                                systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
+
+                        if (limited_move) {
+                                dn1 = ldb_dn_copy(ac, olddn);
+                                if (dn1 == NULL) return ldb_oom(ldb);
+                                dn2 = ldb_dn_copy(ac, newdn);
+                                if (dn2 == NULL) return ldb_oom(ldb);
+
+                                limited_move &= ldb_dn_remove_child_components(dn1, 3);
+                                limited_move &= ldb_dn_remove_child_components(dn2, 3);
+                                limited_move &= ldb_dn_compare(dn1, dn2) == 0;
+
+                                talloc_free(dn1);
+                                talloc_free(dn2);
+                        }
+
+                        if (!limited_move
+                            && ldb_request_get_control(ac->req, DSDB_CONTROL_RESTORE_TOMBSTONE_OID) == NULL) {
+                                ldb_asprintf_errstring(ldb,
+                                                       "subtree_rename: Cannot move %s to %s in config partition",
+                                                       ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
+                                return LDB_ERR_UNWILLING_TO_PERFORM;
+                        }
+                }
+                if (rename_op &&
+                    (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
+                        ldb_asprintf_errstring(ldb,
+                                               "subtree_rename: Cannot rename %s to %s within config partition",
+                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
+                if (move_op &&
+                    (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
+                        ldb_asprintf_errstring(ldb,
+                                               "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
+                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+                if (rename_op &&
+                    (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
+                        ldb_asprintf_errstring(ldb,
+                                                       "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
+                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
+                        return LDB_ERR_UNWILLING_TO_PERFORM;
+                }
+        }
+
+        talloc_free(nc_root);
+
+        return LDB_SUCCESS;
+}
+
+
+static int samldb_rename_search_base_callback(struct ldb_request *req,
+                                               struct ldb_reply *ares)
+{
+        struct samldb_ctx *ac;
+        int ret;
+
+        ac = talloc_get_type(req->context, struct samldb_ctx);
+
+        if (!ares) {
+                return ldb_module_done(ac->req, NULL, NULL,
+                                        LDB_ERR_OPERATIONS_ERROR);
+        }
+        if (ares->error != LDB_SUCCESS) {
+                return ldb_module_done(ac->req, ares->controls,
+                                        ares->response, ares->error);
+        }
+
+        switch (ares->type) {
+        case LDB_REPLY_ENTRY:
+                /*
+                 * This is the root entry of the originating move
+                 * respectively rename request. It has been already
+                 * stored in the list using "subtree_rename_search()".
+                 * Only this one is subject to constraint checking.
+                 */
+                ret = check_rename_constraints(ares->message, ac,
+                                               ac->req->op.rename.olddn,
+                                               ac->req->op.rename.newdn);
+                if (ret != LDB_SUCCESS) {
+                        return ldb_module_done(ac->req, NULL, NULL,
+                                               ret);
+                }
+                break;
+
+        case LDB_REPLY_REFERRAL:
+                /* ignore */
+                break;
+
+        case LDB_REPLY_DONE:
+
+                /*
+                 * Great, no problem with the rename, so go ahead as
+                 * if we never were here
+                 */
+                ret = ldb_next_request(ac->module, ac->req);
+                talloc_free(ares);
+                return ret;
+        }
+
+        talloc_free(ares);
+        return LDB_SUCCESS;
+}
+
+
+/* rename */
+static int samldb_rename(struct ldb_module *module, struct ldb_request *req)
+{
+        struct ldb_context *ldb;
+        static const char * const attrs[] = { "objectClass", "systemFlags",
+                                              "isDeleted", NULL };
+        struct ldb_request *search_req;
+        struct samldb_ctx *ac;
+        int ret;
+
+        if (ldb_dn_is_special(req->op.rename.olddn)) { /* do not manipulate our control entries */
+                return ldb_next_request(module, req);
+        }
+
+        ldb = ldb_module_get_ctx(module);
+
+        ac = samldb_ctx_init(module, req);
+        if (!ac) {
+                return ldb_oom(ldb);
+        }
+
+        ret = ldb_build_search_req(&search_req, ldb, ac,
+                                   req->op.rename.olddn,
+                                   LDB_SCOPE_BASE,
+                                   "(objectClass=*)",
+                                   attrs,
+                                   NULL,
+                                   ac,
+                                   samldb_rename_search_base_callback,
+                                   req);
+        LDB_REQ_SET_LOCATION(search_req);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
+                                      true, NULL);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        return ldb_next_request(ac->module, search_req);
 }
 
@@ -2173 +3624 @@
         .modify        = samldb_modify,
         .del           = samldb_delete,
+        .rename        = samldb_rename,
         .extended      = samldb_extended
 };

vendor/current/source4/dsdb/samdb/ldb_modules/schema_data.c

@@ -140 +140 @@
         const char *oid_attr = NULL;
         const char *oid = NULL;
+        struct ldb_dn *parent_dn = NULL;
+        int cmp;
         WERROR status;
-        bool rodc;
-        int ret;
+        bool rodc = false;
+        int ret;
+        struct schema_data_private_data *mc;
+        mc = talloc_get_type(ldb_module_get_private(module), struct schema_data_private_data);
 
         ldb = ldb_module_get_ctx(module);
@@ -169 +173 @@
                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
                           "schema_data_add: we are not master: reject request\n");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        if (!schema->fsmo.update_allowed && !rodc) {
+                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                          "schema_data_add: updates are not allowed: reject request\n");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
+                /*
+                 * the provision code needs to create
+                 * the schema root object.
+                 */
+                cmp = ldb_dn_compare(req->op.add.message->dn, mc->schema_dn);
+                if (cmp == 0) {
+                        return ldb_next_request(module, req);
+                }
+        }
+
+        parent_dn = ldb_dn_get_parent(req, req->op.add.message->dn);
+        if (!parent_dn) {
+                return ldb_oom(ldb);
+        }
+
+        cmp = ldb_dn_compare(parent_dn, mc->schema_dn);
+        if (cmp != 0) {
+                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                          "schema_data_add: no direct child :%s\n",
+                          ldb_dn_get_linearized(req->op.add.message->dn));
                 return LDB_ERR_UNWILLING_TO_PERFORM;
         }
@@ -212 +246 @@
 }
 
+static int schema_data_modify(struct ldb_module *module, struct ldb_request *req)
+{
+        struct ldb_context *ldb;
+        struct dsdb_schema *schema;
+        int cmp;
+        bool rodc = false;
+        int ret;
+        struct ldb_control *sd_propagation_control;
+        struct schema_data_private_data *mc;
+        mc = talloc_get_type(ldb_module_get_private(module), struct schema_data_private_data);
+
+        ldb = ldb_module_get_ctx(module);
+
+        /* special objects should always go through */
+        if (ldb_dn_is_special(req->op.mod.message->dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        /* replicated update should always go through */
+        if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+                return ldb_next_request(module, req);
+        }
+
+        /* dbcheck should be able to fix things */
+        if (ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                return ldb_next_request(module, req);
+        }
+
+        sd_propagation_control = ldb_request_get_control(req,
+                                        DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+        if (sd_propagation_control != NULL) {
+                if (req->op.mod.message->num_elements != 1) {
+                        return ldb_module_operr(module);
+                }
+                ret = strcmp(req->op.mod.message->elements[0].name,
+                             "nTSecurityDescriptor");
+                if (ret != 0) {
+                        return ldb_module_operr(module);
+                }
+
+                return ldb_next_request(module, req);
+        }
+
+        schema = dsdb_get_schema(ldb, req);
+        if (!schema) {
+                return ldb_next_request(module, req);
+        }
+
+        cmp = ldb_dn_compare(req->op.mod.message->dn, mc->schema_dn);
+        if (cmp == 0) {
+                static const char * const constrained_attrs[] = {
+                        "schemaInfo",
+                        "prefixMap",
+                        "msDs-Schema-Extensions",
+                        "msDS-IntId",
+                        NULL
+                };
+                size_t i;
+                struct ldb_message_element *el;
+
+                if (ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID)) {
+                        return ldb_next_request(module, req);
+                }
+
+                for (i=0; constrained_attrs[i]; i++) {
+                        el = ldb_msg_find_element(req->op.mod.message,
+                                                  constrained_attrs[i]);
+                        if (el == NULL) {
+                                continue;
+                        }
+
+                        ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                                      "schema_data_modify: reject update "
+                                      "of attribute[%s]\n",
+                                      constrained_attrs[i]);
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+
+                return ldb_next_request(module, req);
+        }
+
+        ret = samdb_rodc(ldb, &rodc);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(4, (__location__ ": unable to tell if we are an RODC \n"));
+        }
+
+        if (!schema->fsmo.we_are_master && !rodc) {
+                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                          "schema_data_modify: we are not master: reject request\n");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        if (!schema->fsmo.update_allowed && !rodc) {
+                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                          "schema_data_modify: updates are not allowed: reject request\n");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        return ldb_next_request(module, req);
+}
+
+static int schema_data_del(struct ldb_module *module, struct ldb_request *req)
+{
+        struct ldb_context *ldb;
+        struct dsdb_schema *schema;
+        bool rodc = false;
+        int ret;
+
+        ldb = ldb_module_get_ctx(module);
+
+        /* special objects should always go through */
+        if (ldb_dn_is_special(req->op.del.dn)) {
+                return ldb_next_request(module, req);
+        }
+
+        /* replicated update should always go through */
+        if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+                return ldb_next_request(module, req);
+        }
+
+        /* dbcheck should be able to fix things */
+        if (ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
+                return ldb_next_request(module, req);
+        }
+
+        schema = dsdb_get_schema(ldb, req);
+        if (!schema) {
+                return ldb_next_request(module, req);
+        }
+
+        ret = samdb_rodc(ldb, &rodc);
+        if (ret != LDB_SUCCESS) {
+                DEBUG(4, (__location__ ": unable to tell if we are an RODC \n"));
+        }
+
+        if (!schema->fsmo.we_are_master && !rodc) {
+                ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                          "schema_data_modify: we are not master: reject request\n");
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        /*
+         * normaly the DACL will prevent delete
+         * with LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
+         * above us.
+         */
+        ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+                      "schema_data_del: delete is not allowed in the schema\n");
+        return LDB_ERR_UNWILLING_TO_PERFORM;
+}
+
 static int generate_objectClasses(struct ldb_context *ldb, struct ldb_message *msg,
                                   const struct dsdb_schema *schema) 
@@ -219 +404 @@
 
         for (sclass = schema->classes; sclass; sclass = sclass->next) {
-                ret = ldb_msg_add_string(msg, "objectClasses", schema_class_to_description(msg, sclass));
+                char *v = schema_class_to_description(msg, sclass);
+                if (v == NULL) {
+                        return ldb_oom(ldb);
+                }
+                ret = ldb_msg_add_steal_string(msg, "objectClasses", v);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -231 +420 @@
         const struct dsdb_attribute *attribute;
         int ret;
-        
+
         for (attribute = schema->attributes; attribute; attribute = attribute->next) {
-                ret = ldb_msg_add_string(msg, "attributeTypes", schema_attribute_to_description(msg, attribute));
+                char *v = schema_attribute_to_description(msg, attribute);
+                if (v == NULL) {
+                        return ldb_oom(ldb);
+                }
+                ret = ldb_msg_add_steal_string(msg, "attributeTypes", v);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -275 +468 @@
                 }
 
-                ret = ldb_msg_add_string(msg, "extendedAttributeInfo", val);
+                ret = ldb_msg_add_steal_string(msg, "extendedAttributeInfo", val);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -297 +490 @@
                 }
 
-                ret = ldb_msg_add_string(msg, "extendedClassInfo", val);
+                ret = ldb_msg_add_steal_string(msg, "extendedClassInfo", val);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -335 +528 @@
 
         for (i=0;possibleInferiors[i];i++) {
-                ret = ldb_msg_add_string(msg, "possibleInferiors", possibleInferiors[i]);
+                char *v = talloc_strdup(msg, possibleInferiors[i]);
+                if (v == NULL) {
+                        return ldb_oom(ldb);
+                }
+                ret = ldb_msg_add_steal_string(msg, "possibleInferiors", v);
                 if (ret != LDB_SUCCESS) {
                         return ret;
@@ -481 +678 @@
         .init_context   = schema_data_init,
         .add            = schema_data_add,
+        .modify         = schema_data_modify,
+        .del            = schema_data_del,
         .search         = schema_data_search
 };

vendor/current/source4/dsdb/samdb/ldb_modules/schema_load.c

@@ -30 +30 @@
 #include "librpc/gen_ndr/ndr_drsblobs.h"
 #include "param/param.h"
+#include <tdb.h>
+#include "lib/tdb_wrap/tdb_wrap.h"
 #include "dsdb/samdb/ldb_modules/util.h"
 
+#include "system/filesys.h"
 struct schema_load_private_data {
         bool in_transaction;
+        struct tdb_wrap *metadata;
 };
 
-static int dsdb_schema_from_db(struct ldb_module *module, struct ldb_dn *schema_dn, uint64_t current_usn,
+static int dsdb_schema_from_db(struct ldb_module *module,
+                               TALLOC_CTX *mem_ctx,
+                               uint64_t current_usn,
+                               uint64_t schema_seq_num,
                                struct dsdb_schema **schema);
 
-struct dsdb_schema *dsdb_schema_refresh(struct ldb_module *module, struct dsdb_schema *schema, bool is_global_schema)
-{
-        uint64_t current_usn;
+/*
+ * Open sam.ldb.d/metadata.tdb.
+ */
+static int schema_metadata_open(struct ldb_module *module)
+{
+        struct schema_load_private_data *data = talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        TALLOC_CTX *tmp_ctx;
+        struct loadparm_context *lp_ctx;
+        const char *sam_name;
+        char *filename;
+        int open_flags;
+        struct stat statbuf;
+
+        if (!data) {
+                return ldb_module_error(module, LDB_ERR_OPERATIONS_ERROR,
+                                        "schema_load: metadata not initialized");
+        }
+        data->metadata = NULL;
+
+        tmp_ctx = talloc_new(NULL);
+        if (tmp_ctx == NULL) {
+                return ldb_module_oom(module);
+        }
+
+        sam_name = (const char *)ldb_get_opaque(ldb, "ldb_url");
+        if (!sam_name) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb);
+        }
+        if (strncmp("tdb://", sam_name, 6) == 0) {
+                sam_name += 6;
+        }
+        filename = talloc_asprintf(tmp_ctx, "%s.d/metadata.tdb", sam_name);
+        if (!filename) {
+                talloc_free(tmp_ctx);
+                return ldb_oom(ldb);
+        }
+
+        open_flags = O_RDWR;
+        if (stat(filename, &statbuf) != 0) {
+                talloc_free(tmp_ctx);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"),
+                                       struct loadparm_context);
+
+        data->metadata = tdb_wrap_open(data, filename, 10,
+                                       lpcfg_tdb_flags(lp_ctx, TDB_DEFAULT),
+                                       open_flags, 0660);
+        if (data->metadata == NULL) {
+                talloc_free(tmp_ctx);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        talloc_free(tmp_ctx);
+        return LDB_SUCCESS;
+}
+
+static int schema_metadata_get_uint64(struct ldb_module *module,
+                                         const char *key, uint64_t *value,
+                                         uint64_t default_value)
+{
+        struct schema_load_private_data *data = talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
+        struct tdb_context *tdb;
+        TDB_DATA tdb_key, tdb_data;
+        char *value_str;
+        TALLOC_CTX *tmp_ctx;
+
+        if (!data || !data->metadata) {
+                *value = default_value;
+                return LDB_SUCCESS;
+        }
+
+        tmp_ctx = talloc_new(NULL);
+        if (tmp_ctx == NULL) {
+                return ldb_module_oom(module);
+        }
+
+        tdb = data->metadata->tdb;
+
+        tdb_key.dptr = (uint8_t *)discard_const_p(char, key);
+        tdb_key.dsize = strlen(key);
+
+        tdb_data = tdb_fetch(tdb, tdb_key);
+        if (!tdb_data.dptr) {
+                if (tdb_error(tdb) == TDB_ERR_NOEXIST) {
+                        *value = default_value;
+                        talloc_free(tmp_ctx);
+                        return LDB_SUCCESS;
+                } else {
+                        talloc_free(tmp_ctx);
+                        return ldb_module_error(module, LDB_ERR_OPERATIONS_ERROR,
+                                                tdb_errorstr(tdb));
+                }
+        }
+
+        value_str = talloc_strndup(tmp_ctx, (char *)tdb_data.dptr, tdb_data.dsize);
+        if (value_str == NULL) {
+                SAFE_FREE(tdb_data.dptr);
+                talloc_free(tmp_ctx);
+                return ldb_module_oom(module);
+        }
+
+        *value = strtoull(value_str, NULL, 10);
+
+        SAFE_FREE(tdb_data.dptr);
+        talloc_free(tmp_ctx);
+
+        return LDB_SUCCESS;
+}
+
+static struct dsdb_schema *dsdb_schema_refresh(struct ldb_module *module, struct tevent_context *ev,
+                                               struct dsdb_schema *schema, bool is_global_schema)
+{
+        TALLOC_CTX *mem_ctx;
+        uint64_t current_usn, schema_seq_num = 0;
         int ret;
-        struct ldb_result *res;
-        struct ldb_request *treq;
-        struct ldb_seqnum_request *tseq;
-        struct ldb_seqnum_result *tseqr;
-        struct dsdb_control_current_partition *ctrl;
         struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct dsdb_schema *new_schema;
+        struct ldb_dn *schema_dn = ldb_get_schema_basedn(ldb);
+        time_t ts, lastts;      
         
         struct schema_load_private_data *private_data = talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
@@ -62 +181 @@
         }
 
-        res = talloc_zero(schema, struct ldb_result);
-        if (res == NULL) {
+        SMB_ASSERT(ev == ldb_get_event_context(ldb));
+
+        mem_ctx = talloc_new(module);
+        if (mem_ctx == NULL) {
                 return NULL;
         }
-        tseq = talloc_zero(res, struct ldb_seqnum_request);
-        if (tseq == NULL) {
-                talloc_free(res);
-                return NULL;
-        }
-        tseq->type = LDB_SEQ_HIGHEST_SEQ;
-        
-        ret = ldb_build_extended_req(&treq, ldb_module_get_ctx(module), res,
-                                     LDB_EXTENDED_SEQUENCE_NUMBER,
-                                     tseq,
-                                     NULL,
-                                     res,
-                                     ldb_extended_default_callback,
-                                     NULL);
-        LDB_REQ_SET_LOCATION(treq);
+
+        /*
+         * We update right now the last refresh timestamp so that if
+         * the schema partition hasn't change we don't keep on retrying.
+         * Otherwise if the timestamp was update only when the schema has
+         * actually changed (and therefor completely reloaded) we would
+         * continue to hit the database to get the highest USN.
+         */
+
+        ret = schema_metadata_get_uint64(module, DSDB_METADATA_SCHEMA_SEQ_NUM, &schema_seq_num, 0);
+
+        if (schema != NULL) {
+                lastts = schema->last_refresh;
+                ts = time(NULL);
+                if (lastts > (ts - schema->refresh_interval)) {
+                        DEBUG(11, ("Less than %d seconds since last reload, "
+                                   "returning cached version ts = %d\n",
+                                   (int)schema->refresh_interval,
+                                   (int)lastts));
+                        TALLOC_FREE(mem_ctx);
+                        return schema;
+                }
+
+                if (ret == LDB_SUCCESS) {
+                        schema->metadata_usn = schema_seq_num;
+                } else {
+                        /* From an old provision it can happen that the tdb didn't exists yet */
+                        DEBUG(0, ("Error while searching for the schema usn in the metadata ignoring: %d:%s:%s\n",
+                              ret, ldb_strerror(ret), ldb_errstring(ldb)));
+                        schema->metadata_usn = 0;
+                }
+                schema->last_refresh = ts;
+
+        }
+
+        ret = dsdb_module_load_partition_usn(module, schema_dn, &current_usn, NULL, NULL);
+        if (ret != LDB_SUCCESS || (schema && (current_usn == schema->loaded_usn))) {
+                TALLOC_FREE(mem_ctx);
+                return schema;
+        }
+
+        ret = dsdb_schema_from_db(module, mem_ctx, current_usn, schema_seq_num, &new_schema);
         if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return NULL;
-        }
-        
-        ctrl = talloc(treq, struct dsdb_control_current_partition);
-        if (!ctrl) {
-                talloc_free(res);
-                return NULL;
-        }
-        ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
-        ctrl->dn = schema->base_dn;
-        
-        ret = ldb_request_add_control(treq,
-                                      DSDB_CONTROL_CURRENT_PARTITION_OID,
-                                      false, ctrl);
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "dsdb_schema_from_db() failed: %d:%s: %s",
+                              ret, ldb_strerror(ret), ldb_errstring(ldb));
+                TALLOC_FREE(mem_ctx);
+                return schema;
+        }
+
+        ret = dsdb_set_schema(ldb, new_schema);
         if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return NULL;
-        }
-        
-        ret = ldb_next_request(module, treq);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return NULL;
-        }
-        ret = ldb_wait(treq->handle, LDB_WAIT_ALL);
-        if (ret != LDB_SUCCESS) {
-                talloc_free(res);
-                return NULL;
-        }
-        tseqr = talloc_get_type(res->extended->data,
-                                struct ldb_seqnum_result);
-        if (tseqr->seq_num == schema->reload_seq_number) {
-                talloc_free(res);
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "dsdb_set_schema() failed: %d:%s: %s",
+                              ret, ldb_strerror(ret), ldb_errstring(ldb));
+                TALLOC_FREE(mem_ctx);
                 return schema;
         }
-
-        schema->reload_seq_number = tseqr->seq_num;
-        talloc_free(res);
-                
-        ret = dsdb_module_load_partition_usn(module, schema->base_dn, &current_usn, NULL, NULL);
-        if (ret != LDB_SUCCESS || current_usn == schema->loaded_usn) {
-                return schema;
-        }
-
-        ret = dsdb_schema_from_db(module, schema->base_dn, current_usn, &new_schema);
-        if (ret != LDB_SUCCESS) {
-                return schema;
-        }
-        
         if (is_global_schema) {
                 dsdb_make_schema_global(ldb, new_schema);
         }
+        TALLOC_FREE(mem_ctx);
         return new_schema;
 }
@@ -143 +257 @@
 */
 
-static int dsdb_schema_from_db(struct ldb_module *module, struct ldb_dn *schema_dn, uint64_t current_usn,
+static int dsdb_schema_from_db(struct ldb_module *module,
+                               TALLOC_CTX *mem_ctx,
+                               uint64_t current_usn,
+                               uint64_t schema_seq_num,
                                struct dsdb_schema **schema)
 {
@@ -150 +267 @@
         char *error_string;
         int ret;
+        struct ldb_dn *schema_dn = ldb_get_schema_basedn(ldb);
         struct ldb_result *schema_res;
-        struct ldb_result *a_res;
-        struct ldb_result *c_res;
+        struct ldb_result *res;
         static const char *schema_attrs[] = {
                 "prefixMap",
@@ -191 +308 @@
          * load the attribute definitions
          */
-        ret = dsdb_module_search(module, tmp_ctx, &a_res,
-                                 schema_dn, LDB_SCOPE_ONELEVEL, NULL,
-                                 DSDB_FLAG_NEXT_MODULE,
-                                 NULL,
-                                 "(objectClass=attributeSchema)");
-        if (ret != LDB_SUCCESS) {
-                ldb_asprintf_errstring(ldb, 
-                                       "dsdb_schema: failed to search attributeSchema objects: %s",
-                                       ldb_errstring(ldb));
-                goto failed;
-        }
-
-        /*
-         * load the objectClass definitions
-         */
-        ret = dsdb_module_search(module, tmp_ctx, &c_res,
+        ret = dsdb_module_search(module, tmp_ctx, &res,
                                  schema_dn, LDB_SCOPE_ONELEVEL, NULL,
                                  DSDB_FLAG_NEXT_MODULE |
                                  DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
                                  NULL,
-                                 "(objectClass=classSchema)");
+                                 "(|(objectClass=attributeSchema)(objectClass=classSchema))");
         if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb, 
-                                       "dsdb_schema: failed to search classSchema objects: %s",
+                                       "dsdb_schema: failed to search attributeSchema and classSchema objects: %s",
                                        ldb_errstring(ldb));
                 goto failed;
@@ -220 +322 @@
 
         ret = dsdb_schema_from_ldb_results(tmp_ctx, ldb,
-                                           schema_res, a_res, c_res, schema, &error_string);
+                                           schema_res, res, schema, &error_string);
         if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb, 
@@ -228 +330 @@
         }
 
-        (*schema)->refresh_in_progress = true;
-
-        /* If we have the readOnlySchema opaque, then don't check for
-         * runtime schema updates, as they are not permitted (we would
-         * have to update the backend server schema too */
-        if (!ldb_get_opaque(ldb, "readOnlySchema")) {
-                (*schema)->refresh_fn = dsdb_schema_refresh;
-                (*schema)->loaded_from_module = module;
-                (*schema)->loaded_usn = current_usn;
-        }
-
-        /* "dsdb_set_schema()" steals schema into the ldb_context */
-        ret = dsdb_set_schema(ldb, (*schema));
-
-        (*schema)->refresh_in_progress = false;
-
-        if (ret != LDB_SUCCESS) {
-                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
-                              "schema_load_init: dsdb_set_schema() failed: %d:%s: %s",
-                              ret, ldb_strerror(ret), ldb_errstring(ldb));
-                goto failed;
-        }
-
-        /* Ensure this module won't go away before the callback */
-        if (talloc_reference(*schema, ldb) == NULL) {
-                ldb_oom(ldb);
-                ret = LDB_ERR_OPERATIONS_ERROR;
-        }
+        (*schema)->loaded_usn = current_usn;
+        (*schema)->metadata_usn = schema_seq_num;
+        (*schema)->last_refresh = time(NULL);
+
+        talloc_steal(mem_ctx, *schema);
 
 failed:
@@ -270 +349 @@
 {
         struct schema_load_private_data *private_data;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
         struct dsdb_schema *schema;
-        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        void *readOnlySchema;
         int ret;
-        uint64_t current_usn;
-        struct ldb_dn *schema_dn;
 
         private_data = talloc_zero(module, struct schema_load_private_data);
@@ -288 +366 @@
         }
 
-        if (dsdb_get_schema(ldb, NULL)) {
+        schema = dsdb_get_schema(ldb, NULL);
+
+        /* We might already have a schema */
+        if (schema != NULL) {
+                /* Hook up the refresh function */
+                if (dsdb_uses_global_schema(ldb)) {
+                        ret = dsdb_set_schema_refresh_function(ldb, dsdb_schema_refresh, module);
+
+                        if (ret != LDB_SUCCESS) {
+                                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                              "schema_load_init: dsdb_set_schema_refresh_fns() failed: %d:%s: %s",
+                                              ret, ldb_strerror(ret), ldb_errstring(ldb));
+                                return ret;
+                        }
+                }
+
                 return LDB_SUCCESS;
         }
 
-        schema_dn = ldb_get_schema_basedn(ldb);
-        if (!schema_dn) {
-                ldb_reset_err_string(ldb);
-                ldb_debug(ldb, LDB_DEBUG_WARNING,
-                          "schema_load_init: no schema dn present: (skip schema loading)\n");
-                return LDB_SUCCESS;
-        }
-
-        ret = dsdb_module_load_partition_usn(module, schema_dn, &current_usn, NULL, NULL);
-        if (ret != LDB_SUCCESS) {
-                /* Ignore the error and just reload the DB more often */
-                current_usn = 0;
-        }
-
-        return dsdb_schema_from_db(module, schema_dn, current_usn, &schema);
-}
-
-static int schema_load_start_transaction(struct ldb_module *module)
-{
+        readOnlySchema = ldb_get_opaque(ldb, "readOnlySchema");
+
+        /* If we have the readOnlySchema opaque, then don't check for
+         * runtime schema updates, as they are not permitted (we would
+         * have to update the backend server schema too */
+        if (readOnlySchema != NULL) {
+                struct dsdb_schema *new_schema;
+                ret = dsdb_schema_from_db(module, private_data, 0, 0, &new_schema);
+                if (ret != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "schema_load_init: dsdb_schema_from_db() failed: %d:%s: %s",
+                                      ret, ldb_strerror(ret), ldb_errstring(ldb));
+                        return ret;
+                }
+
+                /* "dsdb_set_schema()" steals schema into the ldb_context */
+                ret = dsdb_set_schema(ldb, new_schema);
+                if (ret != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "schema_load_init: dsdb_set_schema() failed: %d:%s: %s",
+                                      ret, ldb_strerror(ret), ldb_errstring(ldb));
+                        return ret;
+                }
+
+        } else {
+                ret = dsdb_set_schema_refresh_function(ldb, dsdb_schema_refresh, module);
+
+                if (ret != LDB_SUCCESS) {
+                        ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                                      "schema_load_init: dsdb_set_schema_refresh_fns() failed: %d:%s: %s",
+                                      ret, ldb_strerror(ret), ldb_errstring(ldb));
+                        return ret;
+                }
+        }
+
+        schema = dsdb_get_schema(ldb, NULL);
+
+        /* We do this, invoking the refresh handler, so we know that it works */
+        if (schema == NULL) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "schema_load_init: dsdb_get_schema failed");
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        return ret;
+}
+
+static int schema_search(struct ldb_module *module, struct ldb_request *req)
+{
+        struct dsdb_schema *schema;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        uint64_t value;
+        int ret;
         struct schema_load_private_data *private_data =
                 talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
 
-        private_data->in_transaction = true;
-
-        return ldb_next_start_trans(module);
-}
-
-static int schema_load_end_transaction(struct ldb_module *module)
+        schema = dsdb_get_schema(ldb, NULL);
+        if (schema && private_data && !private_data->in_transaction) {
+                ret = schema_metadata_get_uint64(module, DSDB_METADATA_SCHEMA_SEQ_NUM, &value, 0);
+                if (ret == LDB_SUCCESS && schema->metadata_usn < value) {
+                        /* The usn of the schema was changed in the metadata,
+                        * this indicate that another process has modified the schema and
+                        * that a reload is needed.
+                        */
+                        schema->last_refresh = 0;
+                        schema = dsdb_get_schema(ldb, NULL);
+                }
+        }
+
+        return ldb_next_request(module, req);
+}
+
+static int schema_load_start_transaction(struct ldb_module *module)
 {
         struct schema_load_private_data *private_data =
                 talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
-
-        private_data->in_transaction = false;
-
-        return ldb_next_end_trans(module);
-}
-
-static int schema_load_del_transaction(struct ldb_module *module)
+        struct dsdb_schema *schema;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        uint64_t value;
+        int ret;
+
+        schema = dsdb_get_schema(ldb, NULL);
+        if (!private_data->metadata) {
+                schema_metadata_open(module);
+        }
+        ret = schema_metadata_get_uint64(module, DSDB_METADATA_SCHEMA_SEQ_NUM, &value, 0);
+        if (ret == LDB_SUCCESS && schema->metadata_usn < value) {
+                /* The usn of the schema was changed in the metadata,
+                 * this indicate that another process has modified the schema and
+                 * that a reload is needed.
+                 */
+                schema->last_refresh = 0;
+                schema = dsdb_get_schema(ldb, NULL);
+        }
+        private_data->in_transaction = true;
+
+        return ldb_next_start_trans(module);
+}
+
+static int schema_load_end_transaction(struct ldb_module *module)
 {
         struct schema_load_private_data *private_data =
@@ -336 +491 @@
         private_data->in_transaction = false;
 
+        return ldb_next_end_trans(module);
+}
+
+static int schema_load_del_transaction(struct ldb_module *module)
+{
+        struct schema_load_private_data *private_data =
+                talloc_get_type(ldb_module_get_private(module), struct schema_load_private_data);
+
+        private_data->in_transaction = false;
+
         return ldb_next_del_trans(module);
 }
@@ -341 +506 @@
 static int schema_load_extended(struct ldb_module *module, struct ldb_request *req)
 {
-        struct ldb_context *ldb;
-
-        ldb = ldb_module_get_ctx(module);
+        time_t *lastts;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        struct dsdb_schema *schema;
 
         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID) != 0) {
                 return ldb_next_request(module, req);
         }
-
-        /* This is a no-op.  We reload as soon as we can */
-        return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+        lastts = (time_t *)ldb_get_opaque(ldb, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME);
+        if (!lastts) {
+                lastts = talloc(ldb, time_t);
+        }
+        schema = dsdb_get_schema(ldb, NULL);
+        /* Force a refresh */
+        schema->last_refresh = 0;
+        *lastts = 0;
+        ldb_set_opaque(ldb, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME, lastts);
+
+        /* Pass to next module, the partition one should finish the chain */
+        return ldb_next_request(module, req);
 }
 
@@ -358 +532 @@
         .init_context   = schema_load_init,
         .extended       = schema_load_extended,
+        .search         = schema_search,
         .start_transaction = schema_load_start_transaction,
         .end_transaction   = schema_load_end_transaction,

vendor/current/source4/dsdb/samdb/ldb_modules/schema_util.c

@@ -144 +144 @@
 {
         int ldb_err;
-        struct ldb_message *msg;
+        struct ldb_message *msg = NULL;
         TALLOC_CTX *temp_ctx;
 
@@ -241 +241 @@
         temp_ctx = talloc_new(ldb_module);
         if (temp_ctx == NULL) {
-                return ldb_module_oom(temp_ctx);
+                return ldb_module_oom(ldb_module);
         }
 

vendor/current/source4/dsdb/samdb/ldb_modules/show_deleted.c

@@ -37 +37 @@
 #include "dsdb/samdb/ldb_modules/util.h"
 
+struct show_deleted_state {
+        bool need_refresh;
+        bool recycle_bin_enabled;
+};
+
 static int show_deleted_search(struct ldb_module *module, struct ldb_request *req)
 {
@@ -43 +48 @@
         struct ldb_request *down_req;
         struct ldb_parse_tree *new_tree = req->op.search.tree;
+        struct show_deleted_state *state;
         int ret;
+        const char *attr_filter = NULL;
 
         ldb = ldb_module_get_ctx(module);
+
+        state = talloc_get_type(ldb_module_get_private(module), struct show_deleted_state);
+
+        /* note that state may be NULL during initialisation */
+        if (state != NULL && state->need_refresh) {
+                state->need_refresh = false;
+                ret = dsdb_recyclebin_enabled(module, &state->recycle_bin_enabled);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+
+        /* This is the logic from MS-ADTS 3.1.1.3.4.1.14 that
+           determines if objects are visible
+
+           Extended control name                     Deleted-objects      Tombstones        Recycled-objects
+           LDAP_SERVER_SHOW_DELETED_OID              Visible              Visible           Not Visible
+           LDAP_SERVER_SHOW_RECYCLED_OID             Visible              Visible           Visible
+
+           Note that if the recycle bin is disabled, then the
+           isRecycled attribute is ignored, and objects are either
+           "normal" or "tombstone".
+
+           When the recycle bin is enabled, then objects are in one of
+           3 states, "normal", "deleted" or "recycled"
+        */
 
         /* check if there's a show deleted control */
@@ -52 +85 @@
         show_rec = ldb_request_get_control(req, LDB_CONTROL_SHOW_RECYCLED_OID);
 
-        if ((show_del == NULL) && (show_rec == NULL)) {
-                /* Here we have to suppress all deleted objects:
-                 * MS-ADTS 3.1.1.3.4.1
-                 *
-                 * Filter: (&(!(isDeleted=TRUE))(...))
+
+        if (state == NULL || !state->recycle_bin_enabled) {
+                /* when recycle bin is not enabled, then all we look
+                   at is the isDeleted attribute. We hide objects with this
+                   attribute set to TRUE when the client has not specified either
+                   SHOW_DELETED or SHOW_RECYCLED
+                */
+                if (show_del != NULL || show_rec != NULL) {
+                        attr_filter = NULL;
+                } else {
+                        attr_filter = "isDeleted";
+                }
+        } else {
+                /* the recycle bin is enabled
                  */
-                /* FIXME: we could use a constant tree here once we are sure
-                 * that no ldb modules modify trees in-site */
+                if (show_rec != NULL) {
+                        attr_filter = NULL;
+                } else if (show_del != NULL) {
+                        /* we want deleted but not recycled objects */
+                        attr_filter = "isRecycled";
+                } else {
+                        /* we don't want deleted or recycled objects,
+                         * which we get by filtering on isDeleted */
+                        attr_filter = "isDeleted";
+                }
+        }
+
+
+        if (attr_filter != NULL) {
                 new_tree = talloc(req, struct ldb_parse_tree);
                 if (!new_tree) {
@@ -79 +133 @@
                 }
                 new_tree->u.list.elements[0]->u.isnot.child->operation = LDB_OP_EQUALITY;
-                new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr = "isDeleted";
+                new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr = attr_filter;
                 new_tree->u.list.elements[0]->u.isnot.child->u.equality.value = data_blob_string_const("TRUE");
-
-                new_tree->u.list.elements[1] = req->op.search.tree;
-        } else if ((show_del != NULL) && (show_rec == NULL)) {
-                /* Here we need to suppress all recycled objects:
-                 * MS-ADTS 3.1.1.3.4.1
-                 *
-                 * Filter: (&(!(isRecycled=TRUE))(...))
-                 */
-                /* FIXME: we could use a constant tree here once we are sure
-                 * that no ldb modules modify trees in-site */
-                new_tree = talloc(req, struct ldb_parse_tree);
-                if (!new_tree) {
-                        return ldb_oom(ldb);
-                }
-                new_tree->operation = LDB_OP_AND;
-                new_tree->u.list.num_elements = 2;
-                new_tree->u.list.elements = talloc_array(new_tree, struct ldb_parse_tree *, 2);
-                if (!new_tree->u.list.elements) {
-                        return ldb_oom(ldb);
-                }
-
-                new_tree->u.list.elements[0] = talloc(new_tree->u.list.elements, struct ldb_parse_tree);
-                new_tree->u.list.elements[0]->operation = LDB_OP_NOT;
-                new_tree->u.list.elements[0]->u.isnot.child =
-                        talloc(new_tree->u.list.elements, struct ldb_parse_tree);
-                if (!new_tree->u.list.elements[0]->u.isnot.child) {
-                        return ldb_oom(ldb);
-                }
-                new_tree->u.list.elements[0]->u.isnot.child->operation = LDB_OP_EQUALITY;
-                new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr = "isRecycled";
-                new_tree->u.list.elements[0]->u.isnot.child->u.equality.value = data_blob_string_const("TRUE");
-
                 new_tree->u.list.elements[1] = req->op.search.tree;
         }
@@ -145 +167 @@
         struct ldb_context *ldb;
         int ret;
+        struct show_deleted_state *state;
+
+        state = talloc_zero(module, struct show_deleted_state);
+        if (state == NULL) {
+                return ldb_module_oom(module);
+        }
+        state->need_refresh = true;
 
         ldb = ldb_module_get_ctx(module);
@@ -162 +191 @@
         }
 
-        return ldb_next_init(module);
+        ret = ldb_next_init(module);
+
+        ldb_module_set_private(module, state);
+
+        return ret;
 }
 

vendor/current/source4/dsdb/samdb/ldb_modules/simple_dn.c

@@ -45 +45 @@
         new_base = ldb_dn_copy(req, req->op.search.base);
         if (!new_base) {
-                ldb_module_oom(module);
+                return ldb_module_oom(module);
         }
 

vendor/current/source4/dsdb/samdb/ldb_modules/simple_ldap_map.c

@@ -34 +34 @@
 #include "librpc/ndr/libndr.h"
 #include "dsdb/samdb/samdb.h"
+#include "dsdb/common/util.h"
 #include <ldb_handlers.h>
 
@@ -176 +177 @@
         unsigned long long usn = strtoull((const char *)val->data, NULL, 10);
         time_t t = (usn >> 24);
-        out = data_blob_string_const(talloc_asprintf(ctx, "%s#%06x#00#000000", ldb_timestring(ctx, t), (unsigned int)(usn & 0xFFFFFF)));
+        struct tm *tm = gmtime(&t);
+        /* CSN timestamp is YYYYMMDDhhmmss.ssssssZ */
+        out = data_blob_string_const(talloc_asprintf(ctx,
+                "%04u%02u%02u%02u%02u%02u.000000Z#%06x#000#000000",
+                tm->tm_year+1900, tm->tm_mon+1, tm->tm_mday,
+                tm->tm_hour, tm->tm_min, tm->tm_sec,
+                (unsigned int)(usn & 0xFFFFFF)));
         return out;
 }
@@ -362 +369 @@
         {
                 .local_name = "distinguishedName",
-                .type = LDB_MAP_RENAME,
+                .type = LDB_MAP_RENDROP,
                 .u = {
                         .rename = {
@@ -476 +483 @@
         "usnChanged",
         "memberOf",
+        "name",
+        "distinguishedName",
         NULL
 };
@@ -822 +831 @@
         int ret;
         struct map_private *map_private;
-        struct entryuuid_private *entryuuid_private;
         unsigned long long seq_num = 0;
         struct ldb_request *search_req;
@@ -842 +850 @@
 
         map_private = talloc_get_type(ldb_module_get_private(module), struct map_private);
-
-        entryuuid_private = talloc_get_type(map_private->caller_private, struct entryuuid_private);
+        if (!map_private) {
+                ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+                              "private data is not of type struct map_private");
+                return LDB_ERR_PROTOCOL_ERROR;
+        }
 
         /* All this to get the DN of the parition, so we can search the right thing */
@@ -903 +914 @@
                 break;
         case LDB_SEQ_HIGHEST_TIMESTAMP:
-        {
-                seqr->seq_num = (seq_num >> 24);
-                break;
-        }
-        }
+                return ldb_module_error(module, LDB_ERR_OPERATIONS_ERROR, "LDB_SEQ_HIGHEST_TIMESTAMP not supported");
+        }
+
         seqr->flags = 0;
-        seqr->flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
         seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
 

vendor/current/source4/dsdb/samdb/ldb_modules/subtree_delete.c

@@ -39 +39 @@
 
 
+static int subtree_delete_sort(struct ldb_message **m1,
+                               struct ldb_message **m2,
+                               void *private_data)
+{
+        struct ldb_dn *dn1 = (*m1)->dn;
+        struct ldb_dn *dn2 = (*m2)->dn;
+
+        /*
+         * This sorts in tree order, children first
+         */
+        return ldb_dn_compare(dn1, dn2);
+}
+
 static int subtree_delete(struct ldb_module *module, struct ldb_request *req)
 {
@@ -62 +75 @@
                 return ret;
         }
-        if (res->count > 0) {
-                if (ldb_request_get_control(req, LDB_CONTROL_TREE_DELETE_OID) == NULL) {
-                        /* Do not add any DN outputs to this error string!
-                         * Some MMC consoles (eg release 2000) have a strange
-                         * bug and prevent subtree deletes afterwards. */
-                        ldb_asprintf_errstring(ldb_module_get_ctx(module),
-                                               "subtree_delete: Unable to "
-                                               "delete a non-leaf node "
-                                               "(it has %u children)!",
-                                               res->count);
-                        talloc_free(res);
-                        return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
-                }
+        if (res->count == 0) {
+                talloc_free(res);
+                return ldb_next_request(module, req);
+        }
 
-                /* we need to start from the top since other LDB modules could
-                 * enforce constraints (eg "objectclass" and "samldb" do so). */
-                flags = DSDB_FLAG_TOP_MODULE | DSDB_TREE_DELETE;
-                if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
-                        flags |= DSDB_MODIFY_RELAX;
-                }
+        if (ldb_request_get_control(req, LDB_CONTROL_TREE_DELETE_OID) == NULL) {
+                /* Do not add any DN outputs to this error string!
+                 * Some MMC consoles (eg release 2000) have a strange
+                 * bug and prevent subtree deletes afterwards. */
+                ldb_asprintf_errstring(ldb_module_get_ctx(module),
+                                       "subtree_delete: Unable to "
+                                       "delete a non-leaf node "
+                                       "(it has %u children)!",
+                                       res->count);
+                talloc_free(res);
+                return LDB_ERR_NOT_ALLOWED_ON_NON_LEAF;
+        }
 
-                for (i = 0; i < res->count; i++) {
-                        ret = dsdb_module_del(module, res->msgs[i]->dn, flags, req);
-                        if (ret != LDB_SUCCESS) {
-                                return ret;
-                        }
+        /*
+         * First we sort the results from the leaf to the root
+         */
+        LDB_TYPESAFE_QSORT(res->msgs, res->count, NULL,
+                           subtree_delete_sort);
+
+        /*
+         * we need to start from the top since other LDB modules could
+         * enforce constraints (eg "objectclass" and "samldb" do so).
+         *
+         * We pass DSDB_FLAG_AS_SYSTEM as the acl module above us
+         * has already checked for SEC_ADS_DELETE_TREE.
+         */
+        flags = DSDB_FLAG_TOP_MODULE |
+                DSDB_FLAG_AS_SYSTEM |
+                DSDB_FLAG_TRUSTED |
+                DSDB_TREE_DELETE;
+        if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID) != NULL) {
+                flags |= DSDB_MODIFY_RELAX;
+        }
+
+        for (i = 0; i < res->count; i++) {
+                ret = dsdb_module_del(module, res->msgs[i]->dn, flags, req);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
                 }
         }
+
         talloc_free(res);
 

vendor/current/source4/dsdb/samdb/ldb_modules/subtree_rename.c

@@ -4 +4 @@
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2007
    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
+   Copyright (C) Matthias Dieter Wallnöfer <mdw@samba.org> 2010-2011
 
    This program is free software; you can redistribute it and/or modify
@@ -34 +35 @@
 #include "libds/common/flags.h"
 #include "dsdb/samdb/samdb.h"
-
-struct subren_msg_store {
-        struct subren_msg_store *next;
-        struct ldb_dn *olddn;
-        struct ldb_dn *newdn;
-};
+#include "dsdb/samdb/ldb_modules/util.h"
 
 struct subtree_rename_context {
         struct ldb_module *module;
         struct ldb_request *req;
-
-        struct subren_msg_store *list;
-        struct subren_msg_store *current;
 };
 
@@ -52 +45 @@
                                                       struct ldb_request *req)
 {
-        struct ldb_context *ldb;
-        struct subtree_rename_context *ac;
-
-        ldb = ldb_module_get_ctx(module);
+        struct subtree_rename_context *ac;
+
 
         ac = talloc_zero(req, struct subtree_rename_context);
@@ -68 +59 @@
 }
 
-static int subtree_rename_next_request(struct subtree_rename_context *ac);
-
 static int subtree_rename_callback(struct ldb_request *req,
                                    struct ldb_reply *ares)
@@ -75 +64 @@
         struct ldb_context *ldb;
         struct subtree_rename_context *ac;
-        int ret;
 
         ac = talloc_get_type(req->context, struct subtree_rename_context);
@@ -95 +83 @@
 
         if (ares->type != LDB_REPLY_DONE) {
-                ldb_set_errstring(ldb, "Invalid reply type!\n");
+                ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
                 return ldb_module_done(ac->req, NULL, NULL,
                                         LDB_ERR_OPERATIONS_ERROR);
         }
 
-        if (ac->current == NULL) {
-                /* this was the last one */
-                return ldb_module_done(ac->req, ares->controls,
-                                        ares->response, LDB_SUCCESS);
-        }
-
-        ret = subtree_rename_next_request(ac);
-        if (ret != LDB_SUCCESS) {
-                return ldb_module_done(ac->req, NULL, NULL, ret);
-        }
-
         talloc_free(ares);
-        return LDB_SUCCESS;
-}
-
-static int subtree_rename_next_request(struct subtree_rename_context *ac)
-{
-        struct ldb_context *ldb;
-        struct ldb_request *req;
+        return ldb_module_done(ac->req, NULL, NULL, LDB_SUCCESS);
+}
+
+static int subtree_rename_search_onelevel_callback(struct ldb_request *req,
+                                                   struct ldb_reply *ares)
+{
+        struct subtree_rename_context *ac;
+        struct ldb_request *rename_req;
         int ret;
 
-        ldb = ldb_module_get_ctx(ac->module);
-
-        if (ac->current == NULL) {
-                return ldb_operr(ldb);
-        }
-
-        ret = ldb_build_rename_req(&req, ldb, ac->current,
-                                   ac->current->olddn,
-                                   ac->current->newdn,
-                                   ac->req->controls,
-                                   ac, subtree_rename_callback,
-                                   ac->req);
-        LDB_REQ_SET_LOCATION(req);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
-        ac->current = ac->current->next;
-
-        return ldb_next_request(ac->module, req);
-}
-
-static int check_constraints(struct ldb_message *msg,
-                             struct subtree_rename_context *ac,
-                             struct ldb_dn *olddn, struct ldb_dn *newdn)
-{
-        struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
-        struct ldb_dn *dn1, *dn2, *nc_root;
-        int32_t systemFlags;
-        bool move_op = false;
-        bool rename_op = false;
-        int ret;
-
-        /* Skip the checks if old and new DN are the same, or if we have the
-         * relax control specified or if the returned objects is already
-         * deleted and needs only to be moved for consistency. */
-
-        if (ldb_dn_compare(olddn, newdn) == 0) {
-                return LDB_SUCCESS;
-        }
-        if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) != NULL) {
-                return LDB_SUCCESS;
-        }
-        if (ldb_msg_find_attr_as_bool(msg, "isDeleted", false)) {
-                return LDB_SUCCESS;
-        }
-
-        /* Objects under CN=System */
-
-        dn1 = ldb_dn_copy(ac, ldb_get_default_basedn(ldb));
-        if (dn1 == NULL) return ldb_oom(ldb);
-
-        if ( ! ldb_dn_add_child_fmt(dn1, "CN=System")) {
-                talloc_free(dn1);
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-
-        if ((ldb_dn_compare_base(dn1, olddn) == 0) &&
-            (ldb_dn_compare_base(dn1, newdn) != 0)) {
-                talloc_free(dn1);
-                ldb_asprintf_errstring(ldb,
-                                       "subtree_rename: Cannot move/rename %s. Objects under CN=System have to stay under it!",
-                                       ldb_dn_get_linearized(olddn));
-                return LDB_ERR_OTHER;
-        }
-
-        talloc_free(dn1);
-
-        /* LSA objects */
-
-        if ((samdb_find_attribute(ldb, msg, "objectClass", "secret") != NULL) ||
-            (samdb_find_attribute(ldb, msg, "objectClass", "trustedDomain") != NULL)) {
-                ldb_asprintf_errstring(ldb,
-                                       "subtree_rename: Cannot move/rename %s. It's an LSA-specific object!",
-                                       ldb_dn_get_linearized(olddn));
-                return LDB_ERR_UNWILLING_TO_PERFORM;
-        }
-
-        /* systemFlags */
-
-        dn1 = ldb_dn_get_parent(ac, olddn);
-        if (dn1 == NULL) return ldb_oom(ldb);
-        dn2 = ldb_dn_get_parent(ac, newdn);
-        if (dn2 == NULL) return ldb_oom(ldb);
-
-        if (ldb_dn_compare(dn1, dn2) == 0) {
-                rename_op = true;
-        } else {
-                move_op = true;
-        }
-
-        talloc_free(dn1);
-        talloc_free(dn2);
-
-        systemFlags = ldb_msg_find_attr_as_int(msg, "systemFlags", 0);
-
-        /* Fetch name context */
-
-        ret = dsdb_find_nc_root(ldb, ac, olddn, &nc_root);
-        if (ret != LDB_SUCCESS) {
-                return ret;
-        }
-
-        if (ldb_dn_compare(nc_root, ldb_get_schema_basedn(ldb)) == 0) {
-                if (move_op) {
-                        ldb_asprintf_errstring(ldb,
-                                               "subtree_rename: Cannot move %s within schema partition",
-                                               ldb_dn_get_linearized(olddn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-                if (rename_op &&
-                    (systemFlags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) != 0) {
-                        ldb_asprintf_errstring(ldb,
-                                               "subtree_rename: Cannot rename %s within schema partition",
-                                               ldb_dn_get_linearized(olddn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-        } else if (ldb_dn_compare(nc_root, ldb_get_config_basedn(ldb)) == 0) {
-                if (move_op &&
-                    (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_MOVE) == 0) {
-                        /* Here we have to do more: control the
-                         * "ALLOW_LIMITED_MOVE" flag. This means that the
-                         * grand-grand-parents of two objects have to be equal
-                         * in order to perform the move (this is used for
-                         * moving "server" objects in the "sites" container). */
-                        bool limited_move =
-                                systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE;
-
-                        if (limited_move) {
-                                dn1 = ldb_dn_copy(ac, olddn);
-                                if (dn1 == NULL) return ldb_oom(ldb);
-                                dn2 = ldb_dn_copy(ac, newdn);
-                                if (dn2 == NULL) return ldb_oom(ldb);
-
-                                limited_move &= ldb_dn_remove_child_components(dn1, 3);
-                                limited_move &= ldb_dn_remove_child_components(dn2, 3);
-                                limited_move &= ldb_dn_compare(dn1, dn2) == 0;
-
-                                talloc_free(dn1);
-                                talloc_free(dn2);
-                        }
-
-                        if (!limited_move) {
-                                ldb_asprintf_errstring(ldb,
-                                                       "subtree_rename: Cannot move %s to %s in config partition",
-                                                       ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
-                                return LDB_ERR_UNWILLING_TO_PERFORM;
-                        }
-                }
-                if (rename_op &&
-                    (systemFlags & SYSTEM_FLAG_CONFIG_ALLOW_RENAME) == 0) {
-                        ldb_asprintf_errstring(ldb,
-                                               "subtree_rename: Cannot rename %s to %s within config partition",
-                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-        } else if (ldb_dn_compare(nc_root, ldb_get_default_basedn(ldb)) == 0) {
-                if (move_op &&
-                    (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE) != 0) {
-                        ldb_asprintf_errstring(ldb,
-                                               "subtree_rename: Cannot move %s to %s - DISALLOW_MOVE set",
-                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-                if (rename_op &&
-                    (systemFlags & SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME) != 0) {
-                        ldb_asprintf_errstring(ldb,
-                                                       "subtree_rename: Cannot rename %s to %s - DISALLOW_RENAME set",
-                                               ldb_dn_get_linearized(olddn), ldb_dn_get_linearized(newdn));
-                        return LDB_ERR_UNWILLING_TO_PERFORM;
-                }
-        }
-
-        talloc_free(nc_root);
-
-        return LDB_SUCCESS;
-}
-
-static int subtree_rename_search_callback(struct ldb_request *req,
-                                          struct ldb_reply *ares)
-{
-        struct subren_msg_store *store;
-        struct subtree_rename_context *ac;
-        int ret;
-
         ac = talloc_get_type(req->context, struct subtree_rename_context);
 
-        if (!ares || !ac->current) {
+        if (!ares) {
                 return ldb_module_done(ac->req, NULL, NULL,
                                         LDB_ERR_OPERATIONS_ERROR);
@@ -319 +112 @@
         switch (ares->type) {
         case LDB_REPLY_ENTRY:
-                if (ldb_dn_compare(ares->message->dn, ac->list->olddn) == 0) {
-                        /* this was already stored by the
-                         * subtree_rename_search() */
-
-                        ret = check_constraints(ares->message, ac,
-                                                ac->list->olddn,
-                                                ac->list->newdn);
-                        if (ret != LDB_SUCCESS) {
-                                return ldb_module_done(ac->req, NULL, NULL,
-                                                       ret);
-                        }
-
-                        talloc_free(ares);
-                        return LDB_SUCCESS;
-                }
-
-                store = talloc_zero(ac, struct subren_msg_store);
-                if (store == NULL) {
+        {
+                struct ldb_dn *old_dn = ares->message->dn;
+                struct ldb_dn *new_dn = ldb_dn_copy(ares, old_dn);
+                if (!new_dn) {
+                        return ldb_module_oom(ac->module);
+                }
+
+                if ( ! ldb_dn_remove_base_components(new_dn,
+                                ldb_dn_get_comp_num(ac->req->op.rename.olddn))) {
                         return ldb_module_done(ac->req, NULL, NULL,
                                                 LDB_ERR_OPERATIONS_ERROR);
                 }
-                ac->current->next = store;
-                ac->current = store;
-
-                /* the first list element contains the base for the rename */
-                store->olddn = talloc_steal(store, ares->message->dn);
-                store->newdn = ldb_dn_copy(store, store->olddn);
-
-                if ( ! ldb_dn_remove_base_components(store->newdn,
-                                ldb_dn_get_comp_num(ac->list->olddn))) {
+
+                if ( ! ldb_dn_add_base(new_dn, ac->req->op.rename.newdn)) {
                         return ldb_module_done(ac->req, NULL, NULL,
                                                 LDB_ERR_OPERATIONS_ERROR);
                 }
-
-                if ( ! ldb_dn_add_base(store->newdn, ac->list->newdn)) {
-                        return ldb_module_done(ac->req, NULL, NULL,
-                                                LDB_ERR_OPERATIONS_ERROR);
-                }
-
-                ret = check_constraints(ares->message, ac,
-                                        store->olddn, store->newdn);
+                ret = dsdb_module_rename(ac->module, old_dn, new_dn, DSDB_FLAG_OWN_MODULE, req);
                 if (ret != LDB_SUCCESS) {
-                        return ldb_module_done(ac->req, NULL, NULL, ret);
-                }
-
-                break;
-
+                        return ret;
+                }
+
+                talloc_free(ares);
+
+                return LDB_SUCCESS;
+        }
         case LDB_REPLY_REFERRAL:
                 /* ignore */
@@ -372 +144 @@
         case LDB_REPLY_DONE:
 
-                /* rewind ac->current */
-                ac->current = ac->list;
-
-                /* All dns set up, start with the first one */
-                ret = subtree_rename_next_request(ac);
-
+                ret = ldb_build_rename_req(&rename_req, ldb_module_get_ctx(ac->module), ac,
+                                           ac->req->op.rename.olddn,
+                                           ac->req->op.rename.newdn,
+                                           ac->req->controls,
+                                           ac, subtree_rename_callback,
+                                           ac->req);
+                LDB_REQ_SET_LOCATION(req);
                 if (ret != LDB_SUCCESS) {
-                        return ldb_module_done(ac->req, NULL, NULL, ret);
-                }
-                break;
-        }
-
-        talloc_free(ares);
+                        return ret;
+                }
+
+                talloc_free(ares);
+                return ldb_next_request(ac->module, rename_req);
+        }
+
         return LDB_SUCCESS;
 }
@@ -392 +166 @@
 {
         struct ldb_context *ldb;
-        static const char * const attrs[] = { "objectClass", "systemFlags",
-                                              "isDeleted", NULL };
+        static const char * const no_attrs[] = {NULL};
         struct ldb_request *search_req;
         struct subtree_rename_context *ac;
@@ -418 +191 @@
         }
 
-        /* add this entry as the first to do */
-        ac->current = talloc_zero(ac, struct subren_msg_store);
-        if (ac->current == NULL) {
-                return ldb_oom(ldb);
-        }
-        ac->current->olddn = req->op.rename.olddn;
-        ac->current->newdn = req->op.rename.newdn;
-        ac->list = ac->current;
-
-        ret = ldb_build_search_req(&search_req, ldb, ac,
-                                   req->op.rename.olddn, 
-                                   LDB_SCOPE_SUBTREE,
+        ret = ldb_build_search_req(&search_req, ldb_module_get_ctx(ac->module), ac,
+                                   ac->req->op.rename.olddn,
+                                   LDB_SCOPE_ONELEVEL,
                                    "(objectClass=*)",
-                                   attrs,
+                                   no_attrs,
                                    NULL,
-                                   ac, 
-                                   subtree_rename_search_callback,
+                                   ac,
+                                   subtree_rename_search_onelevel_callback,
                                    req);
         LDB_REQ_SET_LOCATION(search_req);
@@ -447 +211 @@
         }
 
-        return ldb_next_request(module, search_req);
+        return ldb_next_request(ac->module, search_req);
 }
 

vendor/current/source4/dsdb/samdb/ldb_modules/update_keytab.c

@@ -35 +35 @@
 #include "system/kerberos.h"
 #include "auth/kerberos/kerberos.h"
-#include "util.h"
+#include "auth/kerberos/kerberos_srv_keytab.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "param/secrets.h"
 
 struct dn_list {
@@ -90 +92 @@
         int ret;
 
-        filter = talloc_asprintf(data, "(&(dn=%s)(&(objectClass=kerberosSecret)(privateKeytab=*)))",
-                                 ldb_dn_get_linearized(dn));
+        filter = talloc_asprintf(data,
+                                 "(&(objectClass=kerberosSecret)(privateKeytab=*))");
         if (!filter) {
                 return ldb_oom(ldb);
@@ -108 +110 @@
                 /* if it's not a kerberosSecret then we don't have anything to update */
                 talloc_free(res);
-                talloc_free(filter);
                 return LDB_SUCCESS;
         }
@@ -115 +116 @@
         if (!item) {
                 talloc_free(res);
-                talloc_free(filter);
                 return ldb_oom(ldb);
         }
@@ -123 +123 @@
         talloc_free(res);
 
-        DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
+        DLIST_ADD_END(data->changed_dns, item);
         return LDB_SUCCESS;
 }
@@ -378 +378 @@
         struct dn_list *p;
         struct smb_krb5_context *smb_krb5_context;
-        int krb5_ret = smb_krb5_init_context(data, ldb_get_event_context(ldb), ldb_get_opaque(ldb, "loadparm"),
+        int krb5_ret = smb_krb5_init_context(data,
+                                             ldb_get_opaque(ldb, "loadparm"),
                                              &smb_krb5_context);
+        TALLOC_CTX *tmp_ctx = NULL;
+
         if (krb5_ret != 0) {
-                talloc_free(data->changed_dns);
-                data->changed_dns = NULL;
                 ldb_asprintf_errstring(ldb, "Failed to setup krb5_context: %s", error_message(krb5_ret));
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-
-        ldb = ldb_module_get_ctx(module);
+                goto fail;
+        }
+
+        tmp_ctx = talloc_new(data);
+        if (!tmp_ctx) {
+                ldb_oom(ldb);
+                goto fail;
+        }
 
         for (p=data->changed_dns; p; p = p->next) {
                 const char *error_string;
-                krb5_ret = smb_krb5_update_keytab(data, smb_krb5_context, ldb, p->msg, p->do_delete, &error_string);
+                const char *realm;
+                char *upper_realm;
+                struct ldb_message_element *spn_el = ldb_msg_find_element(p->msg, "servicePrincipalName");
+                const char **SPNs = NULL;
+                int num_SPNs = 0;
+                int i;
+
+                realm = ldb_msg_find_attr_as_string(p->msg, "realm", NULL);
+
+                if (spn_el) {
+                        upper_realm = strupper_talloc(tmp_ctx, realm);
+                        if (!upper_realm) {
+                                ldb_oom(ldb);
+                                goto fail;
+                        }
+
+                        num_SPNs = spn_el->num_values;
+                        SPNs = talloc_array(tmp_ctx, const char *, num_SPNs);
+                        if (!SPNs) {
+                                ldb_oom(ldb);
+                                goto fail;
+                        }
+                        for (i = 0; i < num_SPNs; i++) {
+                                SPNs[i] = talloc_asprintf(SPNs, "%*.*s@%s",
+                                                          (int)spn_el->values[i].length,
+                                                          (int)spn_el->values[i].length,
+                                                          (const char *)spn_el->values[i].data,
+                                                          upper_realm);
+                                if (!SPNs[i]) {
+                                        ldb_oom(ldb);
+                                        goto fail;
+                                }
+                        }
+                }
+
+                krb5_ret = smb_krb5_update_keytab(tmp_ctx, smb_krb5_context->krb5_context,
+                                                  keytab_name_from_msg(tmp_ctx, ldb, p->msg),
+                                                  ldb_msg_find_attr_as_string(p->msg, "samAccountName", NULL),
+                                                  realm, SPNs, num_SPNs,
+                                                  ldb_msg_find_attr_as_string(p->msg, "saltPrincipal", NULL),
+                                                  ldb_msg_find_attr_as_string(p->msg, "secret", NULL),
+                                                  ldb_msg_find_attr_as_string(p->msg, "priorSecret", NULL),
+                                                  ldb_msg_find_attr_as_int(p->msg, "msDS-KeyVersionNumber", 0),
+                                                  (uint32_t)ldb_msg_find_attr_as_int(p->msg, "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES),
+                                                  p->do_delete, NULL, &error_string);
                 if (krb5_ret != 0) {
-                        talloc_free(data->changed_dns);
-                        data->changed_dns = NULL;
                         ldb_asprintf_errstring(ldb, "Failed to update keytab from entry %s in %s: %s",
                                                ldb_dn_get_linearized(p->msg->dn),
                                                (const char *)ldb_get_opaque(ldb, "ldb_url"),
                                                error_string);
-                        return LDB_ERR_OPERATIONS_ERROR;
+                        goto fail;
                 }
         }
@@ -405 +452 @@
         talloc_free(data->changed_dns);
         data->changed_dns = NULL;
+        talloc_free(tmp_ctx);
 
         return ldb_next_prepare_commit(module);
+
+fail:
+        talloc_free(data->changed_dns);
+        data->changed_dns = NULL;
+        talloc_free(tmp_ctx);
+        return LDB_ERR_OPERATIONS_ERROR;
 }
 

vendor/current/source4/dsdb/samdb/ldb_modules/util.c

@@ -5 +5 @@
    Copyright (C) Andrew Tridgell 2009
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
+   Copyright (C) Matthieu Patou <mat@matws.net> 2011
 
    This program is free software; you can redistribute it and/or modify
@@ -26 +27 @@
 #include "dsdb/samdb/ldb_modules/util.h"
 #include "dsdb/samdb/samdb.h"
-#include "util.h"
+#include "dsdb/common/util.h"
 #include "libcli/security/security.h"
 
@@ -110 +111 @@
 }
 
-/*
-  search for attrs in the modules below
- */
-int dsdb_module_search(struct ldb_module *module,
+int dsdb_module_search_tree(struct ldb_module *module,
                        TALLOC_CTX *mem_ctx,
                        struct ldb_result **_res,
-                       struct ldb_dn *basedn, enum ldb_scope scope, 
+                       struct ldb_dn *basedn,
+                       enum ldb_scope scope,
+                       struct ldb_parse_tree *tree,
                        const char * const *attrs,
-                       int dsdb_flags, 
-                       struct ldb_request *parent,
-                       const char *format, ...) _PRINTF_ATTRIBUTE(9, 10)
+                       int dsdb_flags,
+                       struct ldb_request *parent)
 {
         int ret;
@@ -126 +125 @@
         TALLOC_CTX *tmp_ctx;
         struct ldb_result *res;
-        va_list ap;
-        char *expression;
 
         tmp_ctx = talloc_new(mem_ctx);
 
-        if (format) {
-                va_start(ap, format);
-                expression = talloc_vasprintf(tmp_ctx, format, ap);
-                va_end(ap);
-
-                if (!expression) {
-                        talloc_free(tmp_ctx);
-                        return ldb_oom(ldb_module_get_ctx(module));
-                }
-        } else {
-                expression = NULL;
-        }
+        /* cross-partitions searches with a basedn break multi-domain support */
+        SMB_ASSERT(basedn == NULL || (dsdb_flags & DSDB_SEARCH_SEARCH_ALL_PARTITIONS) == 0);
 
         res = talloc_zero(tmp_ctx, struct ldb_result);
@@ -150 +137 @@
         }
 
-        ret = ldb_build_search_req(&req, ldb_module_get_ctx(module), tmp_ctx,
+        ret = ldb_build_search_req_ex(&req, ldb_module_get_ctx(module), tmp_ctx,
                                    basedn,
                                    scope,
-                                   expression,
+                                   tree,
                                    attrs,
                                    NULL,
@@ -188 +175 @@
         }
 
+        if (dsdb_flags & DSDB_SEARCH_ONE_ONLY) {
+                if (res->count == 0) {
+                        talloc_free(tmp_ctx);
+                        ldb_reset_err_string(ldb_module_get_ctx(module));
+                        return LDB_ERR_NO_SUCH_OBJECT;
+                }
+                if (res->count != 1) {
+                        talloc_free(tmp_ctx);
+                        ldb_reset_err_string(ldb_module_get_ctx(module));
+                        return LDB_ERR_CONSTRAINT_VIOLATION;
+                }
+        }
+
         talloc_free(req);
         if (ret == LDB_SUCCESS) {
                 *_res = talloc_steal(mem_ctx, res);
         }
+        talloc_free(tmp_ctx);
+        return ret;
+}
+
+/*
+  search for attrs in the modules below
+ */
+int dsdb_module_search(struct ldb_module *module,
+                       TALLOC_CTX *mem_ctx,
+                       struct ldb_result **_res,
+                       struct ldb_dn *basedn, enum ldb_scope scope,
+                       const char * const *attrs,
+                       int dsdb_flags,
+                       struct ldb_request *parent,
+                       const char *format, ...) _PRINTF_ATTRIBUTE(9, 10)
+{
+        int ret;
+        TALLOC_CTX *tmp_ctx;
+        va_list ap;
+        char *expression;
+        struct ldb_parse_tree *tree;
+
+        /* cross-partitions searches with a basedn break multi-domain support */
+        SMB_ASSERT(basedn == NULL || (dsdb_flags & DSDB_SEARCH_SEARCH_ALL_PARTITIONS) == 0);
+
+        tmp_ctx = talloc_new(mem_ctx);
+
+        if (format) {
+                va_start(ap, format);
+                expression = talloc_vasprintf(tmp_ctx, format, ap);
+                va_end(ap);
+
+                if (!expression) {
+                        talloc_free(tmp_ctx);
+                        return ldb_oom(ldb_module_get_ctx(module));
+                }
+        } else {
+                expression = NULL;
+        }
+
+        tree = ldb_parse_tree(tmp_ctx, expression);
+        if (tree == NULL) {
+                talloc_free(tmp_ctx);
+                ldb_set_errstring(ldb_module_get_ctx(module),
+                                "Unable to parse search expression");
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        ret = dsdb_module_search_tree(module,
+                       mem_ctx,
+                       _res,
+                       basedn,
+                       scope,
+                       tree,
+                       attrs,
+                       dsdb_flags,
+                       parent);
+
         talloc_free(tmp_ctx);
         return ret;
@@ -270 +328 @@
         return LDB_SUCCESS;
 }
+
+
+/*
+  a ldb_extended request operating on modules below the
+  current module
+
+  Note that this does not automatically start a transaction. If you
+  need a transaction the caller needs to start it as needed.
+ */
+int dsdb_module_extended(struct ldb_module *module,
+                         TALLOC_CTX *mem_ctx,
+                         struct ldb_result **_res,
+                         const char* oid, void* data,
+                         uint32_t dsdb_flags,
+                         struct ldb_request *parent)
+{
+        struct ldb_request *req;
+        int ret;
+        struct ldb_context *ldb = ldb_module_get_ctx(module);
+        TALLOC_CTX *tmp_ctx = talloc_new(module);
+        struct ldb_result *res;
+
+        if (_res != NULL) {
+                (*_res) = NULL;
+        }
+
+        res = talloc_zero(tmp_ctx, struct ldb_result);
+        if (!res) {
+                talloc_free(tmp_ctx);
+                return ldb_oom(ldb_module_get_ctx(module));
+        }
+
+        ret = ldb_build_extended_req(&req, ldb,
+                        tmp_ctx,
+                        oid,
+                        data,
+                        NULL,
+                        res, ldb_extended_default_callback,
+                        parent);
+
+        LDB_REQ_SET_LOCATION(req);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        ret = dsdb_request_add_controls(req, dsdb_flags);
+        if (ret != LDB_SUCCESS) {
+                talloc_free(tmp_ctx);
+                return ret;
+        }
+
+        if (dsdb_flags & DSDB_FLAG_TRUSTED) {
+                ldb_req_mark_trusted(req);
+        }
+
+        /* Run the new request */
+        if (dsdb_flags & DSDB_FLAG_NEXT_MODULE) {
+                ret = ldb_next_request(module, req);
+        } else if (dsdb_flags & DSDB_FLAG_TOP_MODULE) {
+                ret = ldb_request(ldb_module_get_ctx(module), req);
+        } else {
+                const struct ldb_module_ops *ops = ldb_module_get_ops(module);
+                SMB_ASSERT(dsdb_flags & DSDB_FLAG_OWN_MODULE);
+                ret = ops->extended(module, req);
+        }
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        if (_res != NULL && ret == LDB_SUCCESS) {
+                (*_res) = talloc_steal(mem_ctx, res);
+        }
+
+        talloc_free(tmp_ctx);
+        return ret;
+}
+
 
 /*
@@ -547 +683 @@
 }
 
-int dsdb_check_optional_feature(struct ldb_module *module, struct ldb_dn *scope,
-                                        struct GUID op_feature_guid, bool *feature_enabled)
+/*
+  check if an optional feature is enabled on our own NTDS DN
+
+  Note that features can be marked as enabled in more than one
+  place. For example, the recyclebin feature is marked as enabled both
+  on the CN=Partitions,CN=Configurration object and on the NTDS DN of
+  each DC in the forest. It seems likely that it is the job of the KCC
+  to propogate between the two
+ */
+int dsdb_check_optional_feature(struct ldb_module *module, struct GUID op_feature_guid, bool *feature_enabled)
 {
         TALLOC_CTX *tmp_ctx;
@@ -559 +703 @@
         unsigned int i;
         struct ldb_message_element *el;
+        struct ldb_dn *feature_dn;
+
+        tmp_ctx = talloc_new(ldb);
+
+        feature_dn = samdb_ntds_settings_dn(ldb_module_get_ctx(module), tmp_ctx);
+        if (feature_dn == NULL) {
+                talloc_free(tmp_ctx);
+                return ldb_operr(ldb_module_get_ctx(module));
+        }
 
         *feature_enabled = false;
 
-        tmp_ctx = talloc_new(ldb);
-
-        ret = ldb_search(ldb, tmp_ctx, &res,
-                                        scope, LDB_SCOPE_BASE, attrs,
-                                        NULL);
+        ret = dsdb_module_search_dn(module, tmp_ctx, &res, feature_dn, attrs, DSDB_FLAG_NEXT_MODULE, NULL);
         if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb,
-                                "Could no find the scope object - dn: %s\n",
-                                ldb_dn_get_linearized(scope));
+                                "Could not find the feature object - dn: %s\n",
+                                ldb_dn_get_linearized(feature_dn));
                 talloc_free(tmp_ctx);
                 return LDB_ERR_OPERATIONS_ERROR;
         }
         if (res->msgs[0]->num_elements > 0) {
+                const char *attrs2[] = {"msDS-OptionalFeatureGUID", NULL};
 
                 el = ldb_msg_find_element(res->msgs[0],"msDS-EnabledFeature");
-
-                attrs[0] = "msDS-OptionalFeatureGUID";
 
                 for (i=0; i<el->num_values; i++) {
                         search_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb, &el->values[i]);
 
-                        ret = ldb_search(ldb, tmp_ctx, &res,
-                                                        search_dn, LDB_SCOPE_BASE, attrs,
-                                                        NULL);
+                        ret = dsdb_module_search_dn(module, tmp_ctx, &res,
+                                                    search_dn, attrs2, DSDB_FLAG_NEXT_MODULE, NULL);
                         if (ret != LDB_SUCCESS) {
                                 ldb_asprintf_errstring(ldb,
@@ -596 +743 @@
                         search_guid = samdb_result_guid(res->msgs[0], "msDS-OptionalFeatureGUID");
 
-                        if (GUID_compare(&search_guid, &op_feature_guid) == 0){
+                        if (GUID_equal(&search_guid, &op_feature_guid)) {
                                 *feature_enabled = true;
                                 break;
@@ -651 +798 @@
 
         ret = dsdb_module_search_dn(module, mem_ctx, &res, base, attrs,
-                                    DSDB_FLAG_NEXT_MODULE, parent);
+                                    DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_EXTENDED_DN, parent);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -902 +1049 @@
 {
         struct ldb_context *ldb = ldb_module_get_ctx(module);
-        struct ldb_dn *partitions_dn;
         struct GUID recyclebin_guid;
         int ret;
 
-        partitions_dn = samdb_partitions_dn(ldb, module);
-
         GUID_from_string(DS_GUID_FEATURE_RECYCLE_BIN, &recyclebin_guid);
 
-        ret = dsdb_check_optional_feature(module, partitions_dn, recyclebin_guid, enabled);
+        ret = dsdb_check_optional_feature(module, recyclebin_guid, enabled);
         if (ret != LDB_SUCCESS) {
                 ldb_asprintf_errstring(ldb, "Could not verify if Recycle Bin is enabled \n");
-                talloc_free(partitions_dn);
                 return LDB_ERR_UNWILLING_TO_PERFORM;
         }
 
-        talloc_free(partitions_dn);
         return LDB_SUCCESS;
 }
@@ -1051 +1193 @@
 
         msg = ldb_msg_new(module);
+        if (msg == NULL) {
+                return ldb_module_oom(module);
+        }
         msg->dn = dn;
 
@@ -1093 +1238 @@
 
         msg = ldb_msg_new(module);
+        if (msg == NULL) {
+                return ldb_module_oom(module);
+        }
         msg->dn = dn;
 
@@ -1235 +1383 @@
         return el;
 }
+
+/*
+ * This function determines the (last) structural or 88 object class of a passed
+ * "objectClass" attribute - per MS-ADTS 3.1.1.1.4 this is the last value.
+ * Without schema this does not work and hence NULL is returned.
+ */
+const struct dsdb_class *dsdb_get_last_structural_class(const struct dsdb_schema *schema,
+                                                        const struct ldb_message_element *element)
+{
+        const struct dsdb_class *last_class;
+
+        if (schema == NULL) {
+                return NULL;
+        }
+
+        if (element->num_values == 0) {
+                return NULL;
+        }
+
+        last_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema,
+                                                           &element->values[element->num_values-1]);
+        if (last_class == NULL) {
+                return NULL;
+        }
+        if (last_class->objectClassCategory > 1) {
+                return NULL;
+        }
+
+        return last_class;
+}
+
+const struct dsdb_class *dsdb_get_structural_oc_from_msg(const struct dsdb_schema *schema,
+                                                         const struct ldb_message *msg)
+{
+        struct ldb_message_element *oc_el;
+
+        oc_el = ldb_msg_find_element(msg, "objectClass");
+        if (!oc_el) {
+                return NULL;
+        }
+
+        return dsdb_get_last_structural_class(schema, oc_el);
+}
+
+/* Fix the DN so that the relative attribute names are in upper case so that the DN:
+   cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
+   CN=Adminstrator,CN=users,DC=samba,DC=example,DC=com
+*/
+int dsdb_fix_dn_rdncase(struct ldb_context *ldb, struct ldb_dn *dn)
+{
+        int i, ret;
+        char *upper_rdn_attr;
+
+        for (i=0; i < ldb_dn_get_comp_num(dn); i++) {
+                /* We need the attribute name in upper case */
+                upper_rdn_attr = strupper_talloc(dn,
+                                                 ldb_dn_get_component_name(dn, i));
+                if (!upper_rdn_attr) {
+                        return ldb_oom(ldb);
+                }
+                ret = ldb_dn_set_component(dn, i, upper_rdn_attr,
+                                           *ldb_dn_get_component_val(dn, i));
+                talloc_free(upper_rdn_attr);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+        return LDB_SUCCESS;
+}
+
+/**
+ * Make most specific objectCategory for the objectClass of passed object
+ * NOTE: In this implementation we count that it is called on already
+ * verified objectClass attribute value. See objectclass.c thorough
+ * implementation for all the magic that involves
+ *
+ * @param ldb   ldb context
+ * @param schema cached schema for ldb. We may get it, but it is very time consuming.
+ *                      Hence leave the responsibility to the caller.
+ * @param obj   AD object to determint objectCategory for
+ * @param mem_ctx Memory context - usually it is obj actually
+ * @param pobjectcategory location to store found objectCategory
+ *
+ * @return LDB_SUCCESS or error including out of memory error
+ */
+int dsdb_make_object_category(struct ldb_context *ldb, const struct dsdb_schema *schema,
+                              struct ldb_message *obj,
+                              TALLOC_CTX *mem_ctx, const char **pobjectcategory)
+{
+        const struct dsdb_class                 *objectclass;
+        struct ldb_message_element              *objectclass_element;
+        struct dsdb_extended_dn_store_format    *dn_format;
+
+        objectclass_element = ldb_msg_find_element(obj, "objectClass");
+        if (!objectclass_element) {
+                ldb_asprintf_errstring(ldb, "dsdb: Cannot add %s, no objectclass specified!",
+                                       ldb_dn_get_linearized(obj->dn));
+                return LDB_ERR_OBJECT_CLASS_VIOLATION;
+        }
+        if (objectclass_element->num_values == 0) {
+                ldb_asprintf_errstring(ldb, "dsdb: Cannot add %s, at least one (structural) objectclass has to be specified!",
+                                       ldb_dn_get_linearized(obj->dn));
+                return LDB_ERR_CONSTRAINT_VIOLATION;
+        }
+
+        /*
+         * Get the new top-most structural object class and check for
+         * unrelated structural classes
+         */
+        objectclass = dsdb_get_last_structural_class(schema,
+                                                     objectclass_element);
+        if (objectclass == NULL) {
+                ldb_asprintf_errstring(ldb,
+                                       "Failed to find a structural class for %s",
+                                       ldb_dn_get_linearized(obj->dn));
+                return LDB_ERR_UNWILLING_TO_PERFORM;
+        }
+
+        dn_format = talloc_get_type(ldb_get_opaque(ldb, DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME),
+                                    struct dsdb_extended_dn_store_format);
+        if (dn_format && dn_format->store_extended_dn_in_ldb == false) {
+                /* Strip off extended components */
+                struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb,
+                                               objectclass->defaultObjectCategory);
+                *pobjectcategory = ldb_dn_alloc_linearized(mem_ctx, dn);
+                talloc_free(dn);
+        } else {
+                *pobjectcategory = talloc_strdup(mem_ctx, objectclass->defaultObjectCategory);
+        }
+
+        if (*pobjectcategory == NULL) {
+                return ldb_oom(ldb);
+        }
+
+        return LDB_SUCCESS;
+}

vendor/current/source4/dsdb/samdb/ldb_modules/util.h

@@ -26 +26 @@
 struct security_descriptor;
 struct dom_sid;
+struct netlogon_samlogon_response;
 
 #include "librpc/gen_ndr/misc.h"
 #include "dsdb/samdb/ldb_modules/util_proto.h"
 #include "dsdb/common/util.h"
+#include "../libcli/netlogon/netlogon.h"
 
 /* extend the dsdb_request_add_controls() flags for module

vendor/current/source4/dsdb/samdb/ldb_modules/wscript_build

@@ -3 +3 @@
 bld.SAMBA_LIBRARY('dsdb-module',
         source=[],
-        deps='DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA DSDB_MODULE_HELPER_RIDALLOC',
+        deps='DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_RIDALLOC',
         private_library=True,
         grouping_library=True)
 
 bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPERS',
-        source='util.c acl_util.c schema_util.c',
+        source='util.c acl_util.c schema_util.c netlogon.c',
         autoproto='util_proto.h',
-        deps='ldb ndr samdb-common security'
+        deps='ldb ndr samdb-common samba-security'
         )
 
@@ -19 +19 @@
         )
 
-bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_SCHEMA',
-        source='schema.c',
-        autoproto='schema.h',
-        deps='SAMDB_SCHEMA'
-        )
-
-bld.SAMBA_MODULE('ldb_samba_dsdb',
-        source='samba_dsdb.c',
-        subsystem='ldb',
-        init_function='ldb_samba_dsdb_module_init',
-        module_init_name='ldb_init_module',
-        deps='samdb talloc events ndr DSDB_MODULE_HELPERS',
-        internal_module=False,
-        )
-
-
-bld.SAMBA_MODULE('ldb_samba_secrets',
-        source='samba_secrets.c',
-        subsystem='ldb',
-        init_function='ldb_samba_secrets_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events ndr'
-        )
-
-
-bld.SAMBA_MODULE('ldb_objectguid',
-        source='objectguid.c',
-        subsystem='ldb',
-        init_function='ldb_objectguid_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events ndr DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_repl_meta_data',
-        source='repl_meta_data.c',
-        subsystem='ldb',
-        init_function='ldb_repl_meta_data_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events ndr NDR_DRSUAPI NDR_DRSBLOBS ndr DSDB_MODULE_HELPERS security'
-        )
-
-
-bld.SAMBA_MODULE('ldb_schema_load',
-        source='schema_load.c',
-        subsystem='ldb',
-        init_function='ldb_schema_load_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_schema_data',
-        source='schema_data.c',
-        subsystem='ldb',
-        init_function='ldb_schema_data_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_naming_fsmo',
-        source='naming_fsmo.c',
-        subsystem='ldb',
-        init_function='ldb_naming_fsmo_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_pdc_fsmo',
-        source='pdc_fsmo.c',
-        subsystem='ldb',
-        init_function='ldb_pdc_fsmo_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_samldb',
-        source='samldb.c',
-        subsystem='ldb',
-        init_function='ldb_samldb_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_RIDALLOC'
-        )
-
-
-bld.SAMBA_MODULE('ldb_samba3sam',
-        source='samba3sam.c',
-        subsystem='ldb',
-        init_function='ldb_samba3sam_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events ldb smbpasswdparser security NDR_SECURITY'
-        )
-
-
-bld.SAMBA_MODULE('ldb_samba3sid',
-        source='samba3sid.c',
-        subsystem='ldb',
-        init_function='ldb_samba3sid_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events ldb security NDR_SECURITY ldbsamba DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_simple_ldap_map',
-        source='simple_ldap_map.c',
-        subsystem='ldb',
-        init_function='ldb_simple_ldap_map_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events ldb ndr ldbsamba'
-        )
-
-
-bld.SAMBA_MODULE('ldb_rootdse',
-        source='rootdse.c',
-        subsystem='ldb',
-        init_function='ldb_rootdse_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb MESSAGING security DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_password_hash',
-        source='password_hash.c',
-        subsystem='ldb',
-        init_function='ldb_password_hash_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_local_password',
-        source='local_password.c',
-        subsystem='ldb',
-        init_function='ldb_local_password_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events ndr samdb'
-        )
-
-bld.SAMBA_MODULE('ldb_extended_dn_in',
-        source='extended_dn_in.c',
-        subsystem='ldb',
-        init_function='ldb_extended_dn_in_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='ldb talloc events samba-util'
-        )
-
-
-bld.SAMBA_MODULE('ldb_extended_dn_out',
-        source='extended_dn_out.c',
-        init_function='ldb_extended_dn_out_module_init',
-        module_init_name='ldb_init_module',
-        subsystem='ldb',
-        deps='talloc events ndr samba-util samdb',
-        internal_module=False,
-        )
-
-
-bld.SAMBA_MODULE('ldb_extended_dn_store',
-        source='extended_dn_store.c',
-        subsystem='ldb',
-        init_function='ldb_extended_dn_store_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util samdb DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_show_deleted',
-        source='show_deleted.c',
-        subsystem='ldb',
-        init_function='ldb_show_deleted_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_partition',
-        source='partition.c partition_init.c',
-        autoproto='partition_proto.h',
-        subsystem='ldb',
-        init_function='ldb_partition_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_new_partition',
-        source='new_partition.c',
-        subsystem='ldb',
-        init_function='ldb_new_partition_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_update_keytab',
-        source='update_keytab.c',
-        subsystem='ldb',
-        init_function='ldb_update_keytab_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events credentials ldb com_err KERBEROS_UTIL DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_objectclass',
-        source='objectclass.c',
-        subsystem='ldb',
-        init_function='ldb_objectclass_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events security NDR_SECURITY samdb DSDB_MODULE_HELPERS samba-util DSDB_MODULE_HELPER_SCHEMA'
-        )
-
-
-bld.SAMBA_MODULE('ldb_objectclass_attrs',
-        source='objectclass_attrs.c',
-        subsystem='ldb',
-        init_function='ldb_objectclass_attrs_module_init',
-        module_init_name='ldb_init_module',
-        deps='talloc samdb samba-util',
-        internal_module=False,
-        )
-
-
-bld.SAMBA_MODULE('ldb_subtree_rename',
-        source='subtree_rename.c',
-        subsystem='ldb',
-        init_function='ldb_subtree_rename_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util ldb samdb-common'
-        )
-
-
-bld.SAMBA_MODULE('ldb_subtree_delete',
-        source='subtree_delete.c',
-        subsystem='ldb',
-        init_function='ldb_subtree_delete_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_linked_attributes',
-        source='linked_attributes.c',
-        subsystem='ldb',
-        init_function='ldb_linked_attributes_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samdb DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_ranged_results',
-        source='ranged_results.c',
-        subsystem='ldb',
-        init_function='ldb_ranged_results_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util ldb'
-        )
-
-
-bld.SAMBA_MODULE('ldb_anr',
-        source='anr.c',
-        subsystem='ldb',
-        init_function='ldb_anr_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util samdb'
-        )
-
-
-bld.SAMBA_MODULE('ldb_instancetype',
-        source='instancetype.c',
-        subsystem='ldb',
-        init_function='ldb_instancetype_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events samba-util samdb DSDB_MODULE_HELPERS'
-        )
-
-
-bld.SAMBA_MODULE('ldb_operational',
-        source='operational.c',
-        subsystem='ldb',
-        init_function='ldb_operational_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc tevent samba-util samdb-common DSDB_MODULE_HELPERS samdb'
-        )
-
-
-bld.SAMBA_MODULE('ldb_descriptor',
-        source='descriptor.c',
-        subsystem='ldb',
-        init_function='ldb_descriptor_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events security NDR_SECURITY samdb DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
-        )
-
-
-bld.SAMBA_MODULE('ldb_resolve_oids',
-        source='resolve_oids.c',
-        subsystem='ldb',
-        init_function='ldb_resolve_oids_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='samdb talloc events ndr'
-        )
-
-
-bld.SAMBA_MODULE('ldb_acl',
-        source='acl.c',
-        subsystem='ldb',
-        init_function='ldb_acl_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events security samdb DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
-        )
-
-
-bld.SAMBA_MODULE('ldb_lazy_commit',
-        source='lazy_commit.c',
-        subsystem='ldb',
-        internal_module=False,
-        module_init_name='ldb_init_module',
-        init_function='ldb_lazy_commit_module_init',
-        deps='samdb DSDB_MODULE_HELPERS'
-        )
-
-bld.SAMBA_MODULE('ldb_aclread',
-        source='acl_read.c',
-        subsystem='ldb',
-        init_function='ldb_aclread_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc events security samdb DSDB_MODULE_HELPERS',
-        )
-
-bld.SAMBA_MODULE('ldb_simple_dn',
-        source='simple_dn.c',
-        subsystem='ldb',
-        init_function='ldb_simple_dn_module_init',
-        module_init_name='ldb_init_module',
-        internal_module=False,
-        deps='talloc DSDB_MODULE_HELPERS'
-        )
+if bld.AD_DC_BUILD_IS_ENABLED():
+    bld.PROCESS_SEPARATE_RULE("server")

vendor/current/source4/dsdb/samdb/samdb.c

@@ -45 +45 @@
 
 /*
-  make sure the static credentials are not freed
- */
-static int samdb_credentials_destructor(struct cli_credentials *creds)
-{
-        return -1;
-}
-
-/*
-  this returns a static set of system credentials. It is static so
-  that we always get the same pointer in ldb_wrap_connect()
- */
-struct cli_credentials *samdb_credentials(struct loadparm_context *lp_ctx)
-{
-        static struct cli_credentials *static_credentials;
-        struct cli_credentials *cred;
-        char *error_string;
-
-        if (static_credentials) {
-                return static_credentials;
-        }
-
-        cred = cli_credentials_init(talloc_autofree_context());
-        if (!cred) {
-                return NULL;
-        }
-        cli_credentials_set_conf(cred, lp_ctx);
-
-        /* We don't want to use krb5 to talk to our samdb - recursion
-         * here would be bad, and this account isn't in the KDC
-         * anyway */
-        cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
-
-        if (!NT_STATUS_IS_OK(cli_credentials_set_secrets(cred, lp_ctx, NULL, NULL,
-                                                         SECRETS_LDAP_FILTER, &error_string))) {
-                DEBUG(5, ("(normal if no LDAP backend) %s", error_string));
-                /* Perfectly OK - if not against an LDAP backend */
-                talloc_free(cred);
-                return NULL;
-        }
-        static_credentials = cred;
-        talloc_set_destructor(cred, samdb_credentials_destructor);
-        return cred;
-}
-
-/*
-  connect to the SAM database
+  connect to the SAM database specified by URL
   return an opaque context pointer on success, or NULL on failure
  */
-struct ldb_context *samdb_connect(TALLOC_CTX *mem_ctx, 
+struct ldb_context *samdb_connect_url(TALLOC_CTX *mem_ctx,
                                   struct tevent_context *ev_ctx,
                                   struct loadparm_context *lp_ctx,
                                   struct auth_session_info *session_info,
-                                  int flags)
+                                  unsigned int flags, const char *url)
 {
         struct ldb_context *ldb;
-        struct dsdb_schema *schema;
-        const char *url;
-        struct cli_credentials *credentials;
         int ret;
 
-        url  = lpcfg_sam_url(lp_ctx);
-        credentials = samdb_credentials(lp_ctx);
-
-        ldb = ldb_wrap_find(url, ev_ctx, lp_ctx, session_info, credentials, flags);
+        ldb = ldb_wrap_find(url, ev_ctx, lp_ctx, session_info, NULL, flags);
         if (ldb != NULL)
                 return talloc_reference(mem_ctx, ldb);
 
-        ldb = samba_ldb_init(mem_ctx, ev_ctx, lp_ctx, session_info, credentials);
+        ldb = samba_ldb_init(mem_ctx, ev_ctx, lp_ctx, session_info, NULL);
 
         if (ldb == NULL)
@@ -125 +74 @@
         }
 
-        schema = dsdb_get_schema(ldb, NULL);
-        /* make the resulting schema global */
-        if (schema) {
-                dsdb_make_schema_global(ldb, schema);
-        }
-
-        if (!ldb_wrap_add(url, ev_ctx, lp_ctx, session_info, credentials, flags, ldb)) {
+        if (!ldb_wrap_add(url, ev_ctx, lp_ctx, session_info, NULL, flags, ldb)) {
                 talloc_free(ldb);
                 return NULL;
@@ -139 +82 @@
 }
 
+
+/*
+  connect to the SAM database
+  return an opaque context pointer on success, or NULL on failure
+ */
+struct ldb_context *samdb_connect(TALLOC_CTX *mem_ctx,
+                                  struct tevent_context *ev_ctx,
+                                  struct loadparm_context *lp_ctx,
+                                  struct auth_session_info *session_info,
+                                  unsigned int flags)
+{
+        return samdb_connect_url(mem_ctx, ev_ctx, lp_ctx, session_info, flags, "sam.ldb");
+}
 
 /****************************************************************************
@@ -181 +137 @@
         }
 
-        /*
-         * Finally add the "standard" sids.
-         * The only difference between guest and "anonymous"
-         * is the addition of Authenticated_Users.
-         */
-
-        if (session_info_flags & AUTH_SESSION_INFO_DEFAULT_GROUPS) {
-                ptoken->sids = talloc_realloc(ptoken, ptoken->sids, struct dom_sid, ptoken->num_sids + 2);
-                NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
-
-                if (!dom_sid_parse(SID_WORLD, &ptoken->sids[ptoken->num_sids])) {
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-                ptoken->num_sids++;
-
-                if (!dom_sid_parse(SID_NT_NETWORK, &ptoken->sids[ptoken->num_sids])) {
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-                ptoken->num_sids++;
-        }
-
-        if (session_info_flags & AUTH_SESSION_INFO_AUTHENTICATED) {
-                ptoken->sids = talloc_realloc(ptoken, ptoken->sids, struct dom_sid, ptoken->num_sids + 1);
-                NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
-
-                if (!dom_sid_parse(SID_NT_AUTHENTICATED_USERS, &ptoken->sids[ptoken->num_sids])) {
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-                ptoken->num_sids++;
-        }
-
         /* The caller may have requested simple privilages, for example if there isn't a local DB */
         if (session_info_flags & AUTH_SESSION_INFO_SIMPLE_PRIVILEGES) {

vendor/current/source4/dsdb/samdb/samdb.h

@@ -30 +30 @@
 struct tevent_context;
 
+struct dsdb_trust_routing_table;
+
 #include "librpc/gen_ndr/security.h"
 #include <ldb.h>
@@ -54 +56 @@
 };
 
+
+/*
+  flags in dsdb_repl_flags to control replication logic
+ */
+#define DSDB_REPL_FLAG_PRIORITISE_INCOMING 1
+#define DSDB_REPL_FLAG_PARTIAL_REPLICA     2
+#define DSDB_REPL_FLAG_ADD_NCNAME          4
+#define DSDB_REPL_FLAG_EXPECT_NO_SECRETS   8
+
+
 #define DSDB_CONTROL_REPLICATED_UPDATE_OID "1.3.6.1.4.1.7165.4.3.3"
-/* DSDB_CONTROL_REPLICATED_UPDATE_OID has NULL data */
+struct dsdb_control_replicated_update {
+        uint32_t dsdb_repl_flags;
+};
 
 #define DSDB_CONTROL_DN_STORAGE_FORMAT_OID "1.3.6.1.4.1.7165.4.3.4"
@@ -82 +96 @@
 
 #define DSDB_CONTROL_PASSWORD_CHANGE_OID "1.3.6.1.4.1.7165.4.3.10"
-
 struct dsdb_control_password_change {
         const struct samr_Password *old_nt_pwd_hash;
@@ -103 +116 @@
 */
 #define DSDB_CONTROL_CHANGEREPLMETADATA_OID "1.3.6.1.4.1.7165.4.3.14"
+
+/* passed when we want to get the behaviour of the non-global catalog port */
+#define DSDB_CONTROL_NO_GLOBAL_CATALOG "1.3.6.1.4.1.7165.4.3.17"
+
+/* passed when we want special behaviour for partial replicas */
+#define DSDB_CONTROL_PARTIAL_REPLICA "1.3.6.1.4.1.7165.4.3.18"
+
+/* passed when we want special behaviour for dbcheck */
+#define DSDB_CONTROL_DBCHECK "1.3.6.1.4.1.7165.4.3.19"
+
+/* passed when dbcheck wants to modify a read only replica (very special case) */
+#define DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA "1.3.6.1.4.1.7165.4.3.19.1"
+
+/* passed when importing plain text password on upgrades */
+#define DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.20"
+
+/*
+ * passed from the descriptor module in order to
+ * store the recalucated nTSecurityDescriptor without
+ * modifying the replPropertyMetaData.
+ */
+#define DSDB_CONTROL_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.3.21"
+
+/*
+ * passed when creating a interdomain trust account through LSA
+ * to relax constraints in the samldb ldb module.
+ */
+#define DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID "1.3.6.1.4.1.7165.4.3.23"
+
+/*
+ * Internal control to mark requests as being part of Tombstone restoring
+ * procedure - it requires slightly special behavior like:
+ *  - a bit different security checks
+ *  - restoring certain attributes to their default values, etc
+ */
+#define DSDB_CONTROL_RESTORE_TOMBSTONE_OID "1.3.6.1.4.1.7165.4.3.24"
+
+/**
+  OID used to allow the replacement of replPropertyMetaData.
+  It is used when the current replmetadata needs only to be re-sorted, but not edited.
+*/
+#define DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID "1.3.6.1.4.1.7165.4.3.25"
 
 #define DSDB_EXTENDED_REPLICATED_OBJECTS_OID "1.3.6.1.4.1.7165.4.4.1"
@@ -108 +163 @@
         struct ldb_message *msg;
         struct ldb_val guid_value;
+        struct ldb_val parent_guid_value;
         const char *when_changed;
         struct replPropertyMetaDataBlob *meta_data;
+
+        /* Only used for internal processing in repl_meta_data */
+        struct ldb_dn *last_known_parent;
 };
 
@@ -117 +176 @@
          * version 0: initial implementation
          */
-#define DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION 1
+#define DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION 2
         uint32_t version;
+
+        /* DSDB_REPL_FLAG_* flags */
+        uint32_t dsdb_repl_flags;
 
         struct ldb_dn *partition_dn;
@@ -130 +192 @@
         uint32_t linked_attributes_count;
         const struct drsuapi_DsReplicaLinkedAttribute *linked_attributes;
-};
-
-struct dsdb_naming_fsmo {
-        bool we_are_master;
-        struct ldb_dn *master_dn;
-};
-
-struct dsdb_pdc_fsmo {
-        bool we_are_master;
-        struct ldb_dn *master_dn;
 };
 
@@ -152 +204 @@
  */
 #define DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID "1.3.6.1.4.1.7165.4.4.2"
+
+#define DSDB_EXTENDED_SCHEMA_UPGRADE_IN_PROGRESS_OID "1.3.6.1.4.1.7165.4.4.6"
 
 #define DSDB_OPENLDAP_DEREFERENCE_CONTROL "1.3.6.1.4.1.4203.666.5.16"
@@ -175 +229 @@
 };
 
+struct samldb_msds_intid_persistant {
+        uint32_t msds_intid;
+        uint64_t usn;
+};
+
+#define SAMLDB_MSDS_INTID_OPAQUE "SAMLDB_MSDS_INTID_OPAQUE"
+
 #define DSDB_PARTITION_DN "@PARTITION"
 #define DSDB_PARTITION_ATTR "partition"
@@ -183 +244 @@
 };
 
+#define DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME "DSDB_OPAQUE_LAST_SCHEMA_UPDATE"
 #define DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME "DSDB_OPAQUE_PARTITION_MODULE_MSG"
 
@@ -193 +255 @@
 };
 
+/*
+ * passed from the descriptor module in order to
+ * store the recalucated nTSecurityDescriptor without
+ * modifying the replPropertyMetaData.
+ */
+#define DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.4.7"
+struct dsdb_extended_sec_desc_propagation_op {
+        struct ldb_dn *nc_root;
+        struct ldb_dn *dn;
+        bool include_self;
+};
+
+#define DSDB_ACL_CHECKS_DIRSYNC_FLAG 0x1
+#define DSDB_SAMDB_MINIMUM_ALLOWED_RID   1000
+
+#define DSDB_METADATA_SCHEMA_SEQ_NUM    "SCHEMA_SEQ_NUM"
 #endif /* __SAMDB_H__ */