/src/samba/source4/dsdb/common/util_trusts.c

Source
/*
   Unix SMB/CIFS implementation.

   Copyright (C) Stefan Metzmacher 2015

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "ldb.h"
#include "../lib/util/util_ldb.h"
#include "../lib/util/dns_cmp.h"
#include "../libcli/lsarpc/util_lsarpc.h"
#include "dsdb/samdb/samdb.h"
#include "libcli/security/security.h"
#include "librpc/gen_ndr/ndr_security.h"
#include "librpc/gen_ndr/ndr_misc.h"
#include "../libds/common/flags.h"
#include "dsdb/common/proto.h"
#include "param/param.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
#include "lib/util/tsort.h"
#include "dsdb/common/util.h"
#include "libds/common/flag_mapping.h"
#include "../lib/util/dlinklist.h"
#include "lib/crypto/md4.h"
#include "libcli/ldap/ldap_ndr.h"
#include "libcli/security/claims_transformation.h"

#undef strcasecmp

static NTSTATUS dsdb_trust_forest_info_add_record(struct lsa_ForestTrustInformation2 *fti,
              const struct lsa_ForestTrustRecord2 *ftr)
{
  struct lsa_ForestTrustRecord2 **es = NULL;
  struct lsa_ForestTrustRecord2 *e = NULL;
  const struct lsa_StringLarge *dns1 = NULL;
  struct lsa_StringLarge *dns2 = NULL;
  const struct lsa_ForestTrustDomainInfo *d1 = NULL;
  struct lsa_ForestTrustDomainInfo *d2 = NULL;
  DATA_BLOB blob = { .length = 0, };
  size_t len = 0;
  bool scanner = false;

  es = talloc_realloc(fti, fti->entries,
          struct lsa_ForestTrustRecord2 *,
          fti->count + 1);
  if (!es) {
    return NT_STATUS_NO_MEMORY;
  }
  fti->entries = es;

  e = talloc_zero(es, struct lsa_ForestTrustRecord2);
  if (e == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  e->type = ftr->type;
  e->flags = ftr->flags;
  e->time = ftr->time;

  switch (ftr->type) {
  case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
    dns1 = &ftr->forest_trust_data.top_level_name;
    dns2 = &e->forest_trust_data.top_level_name;
    break;

  case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
    dns1 = &ftr->forest_trust_data.top_level_name_ex;
    dns2 = &e->forest_trust_data.top_level_name_ex;
    break;

  case LSA_FOREST_TRUST_DOMAIN_INFO:
    dns1 = &ftr->forest_trust_data.domain_info.dns_domain_name;
    dns2 = &e->forest_trust_data.domain_info.dns_domain_name;
    d1 = &ftr->forest_trust_data.domain_info;
    d2 = &e->forest_trust_data.domain_info;
    break;

  case LSA_FOREST_TRUST_BINARY_DATA:
    blob = data_blob_talloc_named(e,
                ftr->forest_trust_data.data.data,
                ftr->forest_trust_data.data.length,
                "BINARY_DATA");
    if (blob.length != ftr->forest_trust_data.data.length) {
      return NT_STATUS_NO_MEMORY;
    }
    e->forest_trust_data.data.data = blob.data;
    e->forest_trust_data.data.length = blob.length;
    goto done;

  case LSA_FOREST_TRUST_SCANNER_INFO:
    dns1 = &ftr->forest_trust_data.scanner_info.dns_domain_name;
    dns2 = &e->forest_trust_data.scanner_info.dns_domain_name;
    d1 = &ftr->forest_trust_data.scanner_info;
    d2 = &e->forest_trust_data.scanner_info;
    scanner = true;
    break;

  default:
    return NT_STATUS_INVALID_PARAMETER;
  }

  if (dns1->string == NULL) {
    TALLOC_FREE(e);
    return NT_STATUS_INVALID_PARAMETER;
  }

  len = strlen(dns1->string);
  if (len == 0) {
    TALLOC_FREE(e);
    return NT_STATUS_INVALID_PARAMETER;
  }

  dns2->string = talloc_strdup(e, dns1->string);
  if (dns2->string == NULL) {
    TALLOC_FREE(e);
    return NT_STATUS_NO_MEMORY;
  }

  if (d1 != NULL) {
    const struct lsa_StringLarge *nb1 = &d1->netbios_domain_name;
    struct lsa_StringLarge *nb2 = &d2->netbios_domain_name;

    if (nb1->string == NULL) {
      TALLOC_FREE(e);
      return NT_STATUS_INVALID_PARAMETER;
    }

    len = strlen(nb1->string);
    if (len == 0) {
      TALLOC_FREE(e);
      return NT_STATUS_INVALID_PARAMETER;
    }
    if (len > 15) {
      TALLOC_FREE(e);
      return NT_STATUS_INVALID_PARAMETER;
    }

    nb2->string = talloc_strdup(e, nb1->string);
    if (nb2->string == NULL) {
      TALLOC_FREE(e);
      return NT_STATUS_NO_MEMORY;
    }

    if (d1->domain_sid == NULL) {
      /*
       * scanner records typically don't have
       * a sid, but it's just ignored if present.
       */
      if (!scanner) {
        TALLOC_FREE(e);
        return NT_STATUS_INVALID_PARAMETER;
      }

    } else {
      d2->domain_sid = dom_sid_dup(e, d1->domain_sid);
      if (d2->domain_sid == NULL) {
        TALLOC_FREE(e);
        return NT_STATUS_NO_MEMORY;
      }
    }
  }

done:
  fti->entries[fti->count++] = e;
  return NT_STATUS_OK;
}

static NTSTATUS dsdb_trust_parse_crossref_info(TALLOC_CTX *mem_ctx,
          struct ldb_context *sam_ctx,
          const struct ldb_message *msg,
          struct lsa_TrustDomainInfoInfoEx **_tdo)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
  const char *dns = NULL;
  const char *netbios = NULL;
  struct ldb_dn *nc_dn = NULL;
  struct dom_sid sid = {
    .num_auths = 0,
  };
  NTSTATUS status;

  *_tdo = NULL;
  tdo = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoInfoEx);
  if (tdo == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, tdo);

  dns = ldb_msg_find_attr_as_string(msg, "dnsRoot", NULL);
  if (dns == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }
  tdo->domain_name.string = talloc_strdup(tdo, dns);
  if (tdo->domain_name.string == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  netbios = ldb_msg_find_attr_as_string(msg, "nETBIOSName", NULL);
  if (netbios == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }
  tdo->netbios_name.string = talloc_strdup(tdo, netbios);
  if (tdo->netbios_name.string == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  nc_dn = samdb_result_dn(sam_ctx, frame, msg, "ncName", NULL);
  if (nc_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }

  status = dsdb_get_extended_dn_sid(nc_dn, &sid, "SID");
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }
  tdo->sid = dom_sid_dup(tdo, &sid);
  if (tdo->sid == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  tdo->trust_type = LSA_TRUST_TYPE_UPLEVEL;
  tdo->trust_direction = LSA_TRUST_DIRECTION_INBOUND |
             LSA_TRUST_DIRECTION_OUTBOUND;
  tdo->trust_attributes = LSA_TRUST_ATTRIBUTE_WITHIN_FOREST;

  *_tdo = talloc_move(mem_ctx, &tdo);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

static NTSTATUS dsdb_trust_crossref_tdo_info(TALLOC_CTX *mem_ctx,
      struct ldb_context *sam_ctx,
      struct ldb_dn *domain_dn,
      const char *extra_filter,
      struct lsa_TrustDomainInfoInfoEx **_tdo,
      struct lsa_TrustDomainInfoInfoEx **_root_trust_tdo,
      struct lsa_TrustDomainInfoInfoEx **_trust_parent_tdo)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
  struct lsa_TrustDomainInfoInfoEx *root_trust_tdo = NULL;
  struct lsa_TrustDomainInfoInfoEx *trust_parent_tdo = NULL;
  struct ldb_dn *partitions_dn = NULL;
  const char * const cross_attrs[] = {
    "dnsRoot",
    "nETBIOSName",
    "nCName",
    "rootTrust",
    "trustParent",
    NULL,
  };
  struct ldb_result *cross_res = NULL;
  struct ldb_message *msg = NULL;
  struct ldb_dn *root_trust_dn = NULL;
  struct ldb_dn *trust_parent_dn = NULL;
  NTSTATUS status;
  int ret;

  if (extra_filter == NULL) {
    extra_filter = "";
  }

  *_tdo = NULL;
  if (_root_trust_tdo != NULL) {
    *_root_trust_tdo = NULL;
  }
  if (_trust_parent_tdo != NULL) {
    *_trust_parent_tdo = NULL;
  }

  partitions_dn = samdb_partitions_dn(sam_ctx, frame);
  if (partitions_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  ret = dsdb_search(sam_ctx, partitions_dn, &cross_res,
        partitions_dn, LDB_SCOPE_ONELEVEL,
        cross_attrs,
        DSDB_SEARCH_ONE_ONLY |
        DSDB_SEARCH_SHOW_EXTENDED_DN,
        "(&"
          "(ncName=%s)"
          "(objectClass=crossRef)"
          "(systemFlags:%s:=%u)"
          "%s"
        ")",
        ldb_dn_get_linearized(domain_dn),
        LDB_OID_COMPARATOR_AND,
        SYSTEM_FLAG_CR_NTDS_DOMAIN,
        extra_filter);
  if (ret != LDB_SUCCESS) {
    TALLOC_FREE(frame);
    return dsdb_ldb_err_to_ntstatus(ret);
  }
  msg = cross_res->msgs[0];

  status = dsdb_trust_parse_crossref_info(mem_ctx, sam_ctx, msg, &tdo);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }
  talloc_steal(frame, tdo);

  if (_root_trust_tdo != NULL) {
    root_trust_dn = samdb_result_dn(sam_ctx, frame, msg,
            "rootTrust", NULL);
  }
  if (_trust_parent_tdo != NULL) {
    trust_parent_dn = samdb_result_dn(sam_ctx, frame, msg,
               "trustParent", NULL);
  }

  if (root_trust_dn != NULL) {
    struct ldb_message *root_trust_msg = NULL;

    ret = dsdb_search_one(sam_ctx, frame,
              &root_trust_msg,
              root_trust_dn,
              LDB_SCOPE_BASE,
              cross_attrs,
              DSDB_SEARCH_NO_GLOBAL_CATALOG,
              "(objectClass=crossRef)");
    if (ret != LDB_SUCCESS) {
      status = dsdb_ldb_err_to_ntstatus(ret);
      DEBUG(3, ("Failed to search for %s: %s - %s\n",
          ldb_dn_get_linearized(root_trust_dn),
          nt_errstr(status), ldb_errstring(sam_ctx)));
      TALLOC_FREE(frame);
      return status;
    }

    status = dsdb_trust_parse_crossref_info(mem_ctx, sam_ctx,
              root_trust_msg,
              &root_trust_tdo);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
    talloc_steal(frame, root_trust_tdo);
  }

  if (trust_parent_dn != NULL) {
    struct ldb_message *trust_parent_msg = NULL;

    ret = dsdb_search_one(sam_ctx, frame,
              &trust_parent_msg,
              trust_parent_dn,
              LDB_SCOPE_BASE,
              cross_attrs,
              DSDB_SEARCH_NO_GLOBAL_CATALOG,
              "(objectClass=crossRef)");
    if (ret != LDB_SUCCESS) {
      status = dsdb_ldb_err_to_ntstatus(ret);
      DEBUG(3, ("Failed to search for %s: %s - %s\n",
          ldb_dn_get_linearized(trust_parent_dn),
          nt_errstr(status), ldb_errstring(sam_ctx)));
      TALLOC_FREE(frame);
      return status;
    }

    status = dsdb_trust_parse_crossref_info(mem_ctx, sam_ctx,
              trust_parent_msg,
              &trust_parent_tdo);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
    talloc_steal(frame, trust_parent_tdo);
  }

  *_tdo = talloc_move(mem_ctx, &tdo);
  if (_root_trust_tdo != NULL) {
    *_root_trust_tdo = talloc_move(mem_ctx, &root_trust_tdo);
  }
  if (_trust_parent_tdo != NULL) {
    *_trust_parent_tdo = talloc_move(mem_ctx, &trust_parent_tdo);
  }
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_local_tdo_info(TALLOC_CTX *mem_ctx,
           struct ldb_context *sam_ctx,
           struct lsa_TrustDomainInfoInfoEx **_tdo)
{
  struct ldb_dn *domain_dn = NULL;

  domain_dn = ldb_get_default_basedn(sam_ctx);
  if (domain_dn == NULL) {
    return NT_STATUS_INTERNAL_ERROR;
  }

  return dsdb_trust_crossref_tdo_info(mem_ctx, sam_ctx,
              domain_dn, NULL,
              _tdo, NULL, NULL);
}

NTSTATUS dsdb_trust_xref_tdo_info(TALLOC_CTX *mem_ctx,
          struct ldb_context *sam_ctx,
          struct lsa_TrustDomainInfoInfoEx **_tdo)
{
  /*
   * The extra filter makes sure we only find the forest root domain
   */
  const char *extra_filter = "(!(|(rootTrust=*)(trustParent=*)))";
  struct ldb_dn *domain_dn = NULL;

  domain_dn = ldb_get_default_basedn(sam_ctx);
  if (domain_dn == NULL) {
    return NT_STATUS_INTERNAL_ERROR;
  }

  return dsdb_trust_crossref_tdo_info(mem_ctx, sam_ctx,
              domain_dn, extra_filter,
              _tdo, NULL, NULL);
}

static int dsdb_trust_xref_sort_msgs(struct ldb_message **_m1,
             struct ldb_message **_m2)
{
  struct ldb_message *m1 = *_m1;
  struct ldb_message *m2 = *_m2;
  const char *dns1 = NULL;
  const char *dns2 = NULL;
  int cmp;
  struct ldb_message_element *rootTrust1 = NULL;
  struct ldb_message_element *trustParent1 = NULL;
  struct ldb_message_element *rootTrust2 = NULL;
  struct ldb_message_element *trustParent2 = NULL;

  dns1 = ldb_msg_find_attr_as_string(m1, "dnsRoot", NULL);
  dns2 = ldb_msg_find_attr_as_string(m2, "dnsRoot", NULL);

  cmp = dns_cmp(dns1, dns2);
  switch (cmp) {
  case DNS_CMP_FIRST_IS_CHILD:
    return -1;
  case DNS_CMP_SECOND_IS_CHILD:
    return 1;
  }

  rootTrust1 = ldb_msg_find_element(m1, "rootTrust");
  trustParent1 = ldb_msg_find_element(m1, "trustParent");
  rootTrust2 = ldb_msg_find_element(m2, "rootTrust");
  trustParent2 = ldb_msg_find_element(m2, "trustParent");

  if (rootTrust1 == NULL && trustParent1 == NULL) {
    /* m1 is the forest root */
    return -1;
  }
  if (rootTrust2 == NULL && trustParent2 == NULL) {
    /* m2 is the forest root */
    return 1;
  }

  return cmp;
}

static int dsdb_trust_xref_sort_vals(struct ldb_val *v1,
             struct ldb_val *v2)
{
  const char *dns1 = (const char *)v1->data;
  const char *dns2 = (const char *)v2->data;

  return dns_cmp(dns1, dns2);
}

NTSTATUS dsdb_trust_xref_forest_info(TALLOC_CTX *mem_ctx,
             struct ldb_context *sam_ctx,
             struct lsa_ForestTrustInformation2 **_info)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct lsa_ForestTrustInformation2 *info = NULL;
  struct ldb_dn *partitions_dn = NULL;
  const char * const cross_attrs1[] = {
    "uPNSuffixes",
    "msDS-SPNSuffixes",
    NULL,
  };
  struct ldb_result *cross_res1 = NULL;
  struct ldb_message_element *upn_el = NULL;
  struct ldb_message_element *spn_el = NULL;
  struct ldb_message *tln_msg = NULL;
  struct ldb_message_element *tln_el = NULL;
  const char * const cross_attrs2[] = {
    "dnsRoot",
    "nETBIOSName",
    "nCName",
    "rootTrust",
    "trustParent",
    NULL,
  };
  struct ldb_result *cross_res2 = NULL;
  int ret;
  unsigned int i;
  bool restart = false;

  *_info = NULL;
  info = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation2);
  if (info == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, info);

  partitions_dn = samdb_partitions_dn(sam_ctx, frame);
  if (partitions_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  ret = dsdb_search_dn(sam_ctx, partitions_dn, &cross_res1,
           partitions_dn, cross_attrs1, 0);
  if (ret != LDB_SUCCESS) {
    TALLOC_FREE(frame);
    return dsdb_ldb_err_to_ntstatus(ret);
  }

  ret = dsdb_search(sam_ctx, partitions_dn, &cross_res2,
        partitions_dn, LDB_SCOPE_ONELEVEL,
        cross_attrs2,
        DSDB_SEARCH_SHOW_EXTENDED_DN,
        "(&(objectClass=crossRef)"
         "(systemFlags:%s:=%u))",
        LDB_OID_COMPARATOR_AND,
        SYSTEM_FLAG_CR_NTDS_DOMAIN);
  if (ret != LDB_SUCCESS) {
    TALLOC_FREE(frame);
    return dsdb_ldb_err_to_ntstatus(ret);
  }

  /*
   * Sort the domains as trees, starting with the forest root
   */
  TYPESAFE_QSORT(cross_res2->msgs, cross_res2->count,
           dsdb_trust_xref_sort_msgs);

  upn_el = ldb_msg_find_element(cross_res1->msgs[0], "uPNSuffixes");
  if (upn_el != NULL) {
    upn_el->name = "__tln__";
  }
  spn_el = ldb_msg_find_element(cross_res1->msgs[0], "msDS-SPNSuffixes");
  if (spn_el != NULL) {
    spn_el->name = "__tln__";
  }
  ret = ldb_msg_normalize(sam_ctx, frame, cross_res1->msgs[0], &tln_msg);
  if (ret != LDB_SUCCESS) {
    TALLOC_FREE(frame);
    return dsdb_ldb_err_to_ntstatus(ret);
  }
  tln_el = ldb_msg_find_element(tln_msg, "__tln__");
  if (tln_el != NULL) {
    /*
     * Sort the domains as trees
     */
    TYPESAFE_QSORT(tln_el->values, tln_el->num_values,
             dsdb_trust_xref_sort_vals);
  }

  for (i=0; i < cross_res2->count; i++) {
    struct ldb_message *m = cross_res2->msgs[i];
    const char *dns = NULL;
    const char *netbios = NULL;
    struct ldb_dn *nc_dn = NULL;
    struct dom_sid sid = {
      .num_auths = 0,
    };
    struct lsa_ForestTrustRecord2 e = {
      .flags = 0,
    };
    struct lsa_ForestTrustDomainInfo *d = NULL;
    struct lsa_StringLarge *t = NULL;
    bool match = false;
    NTSTATUS status;

    dns = ldb_msg_find_attr_as_string(m, "dnsRoot", NULL);
    if (dns == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INTERNAL_DB_CORRUPTION;
    }

    netbios = ldb_msg_find_attr_as_string(m, "nETBIOSName", NULL);
    if (netbios == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INTERNAL_DB_CORRUPTION;
    }

    nc_dn = samdb_result_dn(sam_ctx, m, m, "ncName", NULL);
    if (nc_dn == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INTERNAL_DB_CORRUPTION;
    }

    status = dsdb_get_extended_dn_sid(nc_dn, &sid, "SID");
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }

    match = trust_forest_info_tln_match(info, dns);
    if (!match) {
      /*
       * First the TOP_LEVEL_NAME, if required
       */
      e = (struct lsa_ForestTrustRecord2) {
        .flags = 0,
        .type = LSA_FOREST_TRUST_TOP_LEVEL_NAME,
        .time = 0, /* so far always 0 in traces. */
      };

      t = &e.forest_trust_data.top_level_name;
      t->string = dns;

      status = dsdb_trust_forest_info_add_record(info, &e);
      if (!NT_STATUS_IS_OK(status)) {
        TALLOC_FREE(frame);
        return status;
      }
    }

    /*
     * Then the DOMAIN_INFO
     */
    e = (struct lsa_ForestTrustRecord2) {
      .flags = 0,
      .type = LSA_FOREST_TRUST_DOMAIN_INFO,
      .time = 0, /* so far always 0 in traces. */
    };
    d = &e.forest_trust_data.domain_info;
    d->domain_sid = &sid;
    d->dns_domain_name.string = dns;
    d->netbios_domain_name.string = netbios;

    status = dsdb_trust_forest_info_add_record(info, &e);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  for (i=0; (tln_el != NULL) && i < tln_el->num_values; i++) {
    const struct ldb_val *v = &tln_el->values[i];
    const char *dns = (const char *)v->data;
    struct lsa_ForestTrustRecord2 e = {
      .flags = 0,
    };
    struct lsa_StringLarge *t = NULL;
    bool match = false;
    NTSTATUS status;

    if (dns == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INTERNAL_DB_CORRUPTION;
    }

    match = trust_forest_info_tln_match(info, dns);
    if (match) {
      continue;
    }

    /*
     * an additional the TOP_LEVEL_NAME
     */
    e = (struct lsa_ForestTrustRecord2) {
      .flags = 0,
      .type = LSA_FOREST_TRUST_TOP_LEVEL_NAME,
      .time = 0, /* so far always 0 in traces. */
    };
    t = &e.forest_trust_data.top_level_name;
    t->string = dns;

    status = dsdb_trust_forest_info_add_record(info, &e);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  for (i=0; i < info->count; restart ? i=0 : i++) {
    struct lsa_ForestTrustRecord2 *tr = info->entries[i];
    const struct lsa_StringLarge *ts = NULL;
    uint32_t c;

    restart = false;

    if (tr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
      continue;
    }

    ts = &tr->forest_trust_data.top_level_name;

    for (c = i + 1; c < info->count; c++) {
      struct lsa_ForestTrustRecord2 *cr = info->entries[c];
      const struct lsa_StringLarge *cs = NULL;
      uint32_t j;
      int cmp;

      if (cr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      cs = &cr->forest_trust_data.top_level_name;

      cmp = dns_cmp(ts->string, cs->string);
      if (DNS_CMP_IS_NO_MATCH(cmp)) {
        continue;
      }
      if (cmp != DNS_CMP_FIRST_IS_CHILD) {
        /* can't happen ... */
        continue;
      }

      ts = NULL;
      tr = NULL;
      TALLOC_FREE(info->entries[i]);
      info->entries[i] = info->entries[c];

      for (j = c + 1; j < info->count; j++) {
        info->entries[j-1] = info->entries[j];
      }
      info->count -= 1;
      restart = true;
      break;
    }
  }

  *_info = talloc_move(mem_ctx, &info);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_parse_tdo_info(TALLOC_CTX *mem_ctx,
           struct ldb_message *m,
           struct lsa_TrustDomainInfoInfoEx **_tdo)
{
  struct lsa_TrustDomainInfoInfoEx *tdo = NULL;
  const char *dns = NULL;
  const char *netbios = NULL;

  *_tdo = NULL;

  tdo = talloc_zero(mem_ctx, struct lsa_TrustDomainInfoInfoEx);
  if (tdo == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  dns = ldb_msg_find_attr_as_string(m, "trustPartner", NULL);
  if (dns == NULL) {
    TALLOC_FREE(tdo);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }
  tdo->domain_name.string = talloc_strdup(tdo, dns);
  if (tdo->domain_name.string == NULL) {
    TALLOC_FREE(tdo);
    return NT_STATUS_NO_MEMORY;
  }

  netbios = ldb_msg_find_attr_as_string(m, "flatName", NULL);
  if (netbios == NULL) {
    TALLOC_FREE(tdo);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }
  tdo->netbios_name.string = talloc_strdup(tdo, netbios);
  if (tdo->netbios_name.string == NULL) {
    TALLOC_FREE(tdo);
    return NT_STATUS_NO_MEMORY;
  }

  tdo->sid = samdb_result_dom_sid(tdo, m, "securityIdentifier");
  if (tdo->sid == NULL) {
    TALLOC_FREE(tdo);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }

  tdo->trust_type = ldb_msg_find_attr_as_uint(m, "trustType", 0);
  tdo->trust_direction = ldb_msg_find_attr_as_uint(m, "trustDirection", 0);
  tdo->trust_attributes = ldb_msg_find_attr_as_uint(m, "trustAttributes", 0);

  *_tdo = tdo;
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_parse_forest_info(TALLOC_CTX *mem_ctx,
              struct ldb_message *m,
              struct ForestTrustInfo **_fti)
{
  const struct ldb_val *ft_blob = NULL;
  struct ForestTrustInfo *fti = NULL;
  enum ndr_err_code ndr_err;

  *_fti = NULL;

  ft_blob = ldb_msg_find_ldb_val(m, "msDS-TrustForestTrustInfo");
  if (ft_blob == NULL) {
    return NT_STATUS_NOT_FOUND;
  }

  fti = talloc_zero(mem_ctx, struct ForestTrustInfo);
  if (fti == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  /* ldb_val is equivalent to DATA_BLOB */
  ndr_err = ndr_pull_struct_blob_all(ft_blob, fti, fti,
        (ndr_pull_flags_fn_t)ndr_pull_ForestTrustInfo);
  if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
    TALLOC_FREE(fti);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }

  *_fti = fti;
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_default_forest_info(TALLOC_CTX *mem_ctx,
          const struct dom_sid *sid,
          const char *dns_name,
          const char *nbt_name,
          NTTIME now,
          struct ForestTrustInfo **_fti)
{
  struct ForestTrustInfo *trust_fti = NULL;
  struct ForestTrustInfoRecordArmor *ra = NULL;
  struct ForestTrustInfoRecord *r = NULL;

  trust_fti = talloc_zero(mem_ctx, struct ForestTrustInfo);
  if (trust_fti == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  ra = talloc_zero_array(trust_fti,
             struct ForestTrustInfoRecordArmor,
             2);
  if (ra == NULL) {
    TALLOC_FREE(trust_fti);
    return NT_STATUS_NO_MEMORY;
  }

  r = &ra[0].record;
  r->type = FOREST_TRUST_TOP_LEVEL_NAME;
  r->timestamp = now;
  r->flags = 0;
  r->data.name.string = talloc_strdup(ra, dns_name);
  if (r->data.name.string == NULL) {
    TALLOC_FREE(trust_fti);
    return NT_STATUS_NO_MEMORY;
  }

  r = &ra[1].record;
  r->type = FOREST_TRUST_DOMAIN_INFO;
  r->timestamp = now;
  r->flags = 0;
  r->data.info.sid = *sid;
  r->data.info.dns_name.string = talloc_strdup(ra, dns_name);
  if (r->data.info.dns_name.string == NULL) {
    TALLOC_FREE(trust_fti);
    return NT_STATUS_NO_MEMORY;
  }
  r->data.info.netbios_name.string = talloc_strdup(ra, nbt_name);
  if (r->data.info.netbios_name.string == NULL) {
    TALLOC_FREE(trust_fti);
    return NT_STATUS_NO_MEMORY;
  }

  trust_fti->version = 1;
  trust_fti->records = ra;
  trust_fti->count = 2;

  *_fti = trust_fti;
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_normalize_forest_info_step1(TALLOC_CTX *mem_ctx,
        const struct lsa_ForestTrustInformation2 *gfti,
        struct lsa_ForestTrustInformation2 **_nfti)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct lsa_ForestTrustInformation2 *nfti;
  uint32_t n;

  *_nfti = NULL;

  nfti = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation2);
  if (nfti == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, nfti);

  /*
   * First we copy every record and remove possible trailing dots
   * from dns names.
   *
   * We also NULL out duplicates. The first one wins and
   * we keep 'count' as is. This is required in order to
   * provide the correct index for collision records.
   */
  for (n = 0; n < gfti->count; n++) {
    const struct lsa_ForestTrustRecord2 *gftr = gfti->entries[n];
    struct lsa_ForestTrustRecord2 *nftr = NULL;
    struct lsa_ForestTrustDomainInfo *ninfo = NULL;
    struct lsa_StringLarge *ntln = NULL;
    struct lsa_StringLarge *nnb = NULL;
    struct dom_sid *nsid = NULL;
    NTSTATUS status;
    size_t len = 0;
    char *p = NULL;
    uint32_t c;

    if (gftr == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    status = dsdb_trust_forest_info_add_record(nfti, gftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }

    nftr = nfti->entries[n];

    switch (nftr->type) {
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
      ntln = &nftr->forest_trust_data.top_level_name;
      break;

    case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
      ntln = &nftr->forest_trust_data.top_level_name_ex;
      break;

    case LSA_FOREST_TRUST_DOMAIN_INFO:
      ninfo = &nftr->forest_trust_data.domain_info;
      ntln = &ninfo->dns_domain_name;
      nnb = &ninfo->netbios_domain_name;
      nsid = ninfo->domain_sid;
      break;

    case LSA_FOREST_TRUST_BINARY_DATA:
      continue;

    case LSA_FOREST_TRUST_SCANNER_INFO:
      if (nftr->flags & ~LSA_TLN_DISABLED_NEW) {
        return NT_STATUS_INVALID_PARAMETER;
      }
      ninfo = &nftr->forest_trust_data.scanner_info;
      ntln = &ninfo->dns_domain_name;
      nnb = &ninfo->netbios_domain_name;
      nsid = ninfo->domain_sid;
      break;

    default:
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    /*
     * We remove one trailing '.' before checking
     * for invalid dots.
     *
     * domain.com.  becomes domain.com
     * domain.com.. becomes domain.com.
     *
     * Then the following is invalid:
     *
     * domain..com
     * .domain.com
     * domain.com.
     */
    len = strlen(ntln->string);
    if (len > 1 && ntln->string[len - 1] == '.') {
      const char *cp = &ntln->string[len - 1];
      p = discard_const_p(char, cp);
      *p= '\0';
    }
    if (ntln->string[0] == '.') {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }
    {
      const char *dots = NULL;

      dots = strstr_m(ntln->string, "..");
      if (dots != NULL) {
        TALLOC_FREE(frame);
        return NT_STATUS_INVALID_PARAMETER;
      }
    }

    if (nnb != NULL &&
       (nnb->string == NULL ||
        strlen(nnb->string) > 15))
    {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    for (c = 0; c < n; c++) {
      const struct lsa_ForestTrustRecord2 *cftr = nfti->entries[c];
      const struct lsa_ForestTrustDomainInfo *cinfo = NULL;
      const struct lsa_StringLarge *ctln = NULL;
      const struct lsa_StringLarge *cnb = NULL;
      const struct dom_sid *csid = NULL;
      int cmp;

      if (cftr == NULL) {
        continue;
      }

      if (cftr->type != nftr->type) {
        continue;
      }

      switch (cftr->type) {
      case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
        ctln = &cftr->forest_trust_data.top_level_name;
        break;

      case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
        ctln = &cftr->forest_trust_data.top_level_name_ex;
        break;

      case LSA_FOREST_TRUST_DOMAIN_INFO:
        cinfo = &cftr->forest_trust_data.domain_info;
        ctln = &cinfo->dns_domain_name;
        cnb = &cinfo->netbios_domain_name;
        csid = cinfo->domain_sid;
        break;

      case LSA_FOREST_TRUST_SCANNER_INFO:
        cinfo = &cftr->forest_trust_data.scanner_info;
        ctln = &cinfo->dns_domain_name;
        cnb = &cinfo->netbios_domain_name;
        csid = cinfo->domain_sid;
        break;

      default:
        TALLOC_FREE(frame);
        return NT_STATUS_INVALID_PARAMETER;
      }

      cmp = dns_cmp(ntln->string, ctln->string);
      if (cmp == DNS_CMP_MATCH) {
        nftr = NULL;
        TALLOC_FREE(nfti->entries[n]);
        break;
      }

      if (cinfo == NULL) {
        continue;
      }

      cmp = strcasecmp_m(nnb->string, cnb->string);
      if (cmp == 0) {
        nftr = NULL;
        TALLOC_FREE(nfti->entries[n]);
        break;
      }

      if (cftr->type == LSA_FOREST_TRUST_SCANNER_INFO) {
        /*
         * ignore the sid
         */
        continue;
      }

      cmp = dom_sid_compare(nsid, csid);
      if (cmp == 0) {
        nftr = NULL;
        TALLOC_FREE(nfti->entries[n]);
        break;
      }
    }
  }

  /*
   * Now we check that only true top level names are provided
   */
  for (n = 0; n < nfti->count; n++) {
    const struct lsa_ForestTrustRecord2 *nftr = nfti->entries[n];
    const struct lsa_StringLarge *ntln = NULL;
    uint32_t c;

    if (nftr == NULL) {
      continue;
    }

    if (nftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
      continue;
    }

    ntln = &nftr->forest_trust_data.top_level_name;

    for (c = 0; c < nfti->count; c++) {
      const struct lsa_ForestTrustRecord2 *cftr = nfti->entries[c];
      const struct lsa_StringLarge *ctln = NULL;
      int cmp;

      if (cftr == NULL) {
        continue;
      }

      if (cftr == nftr) {
        continue;
      }

      if (cftr->type != nftr->type) {
        continue;
      }

      ctln = &cftr->forest_trust_data.top_level_name;

      cmp = dns_cmp(ntln->string, ctln->string);
      if (DNS_CMP_IS_NO_MATCH(cmp)) {
        continue;
      }

      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }
  }

  /*
   * Now we check that only true sub level excludes are provided
   */
  for (n = 0; n < nfti->count; n++) {
    const struct lsa_ForestTrustRecord2 *nftr = nfti->entries[n];
    const struct lsa_StringLarge *ntln = NULL;
    uint32_t c;
    bool found_tln = false;

    if (nftr == NULL) {
      continue;
    }

    if (nftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX) {
      continue;
    }

    ntln = &nftr->forest_trust_data.top_level_name;

    for (c = 0; c < nfti->count; c++) {
      const struct lsa_ForestTrustRecord2 *cftr = nfti->entries[c];
      const struct lsa_StringLarge *ctln = NULL;
      int cmp;

      if (cftr == NULL) {
        continue;
      }

      if (cftr == nftr) {
        continue;
      }

      if (cftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      ctln = &cftr->forest_trust_data.top_level_name;

      cmp = dns_cmp(ntln->string, ctln->string);
      if (cmp == DNS_CMP_FIRST_IS_CHILD) {
        found_tln = true;
        break;
      }
    }

    if (found_tln) {
      continue;
    }

    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_PARAMETER;
  }

  /*
   * Now we check that there's a top level name for each domain
   */
  for (n = 0; n < nfti->count; n++) {
    const struct lsa_ForestTrustRecord2 *nftr = nfti->entries[n];
    const struct lsa_ForestTrustDomainInfo *ninfo = NULL;
    const struct lsa_StringLarge *ntln = NULL;
    uint32_t c;
    bool found_tln = false;

    if (nftr == NULL) {
      continue;
    }

    if (nftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
      continue;
    }

    ninfo = &nftr->forest_trust_data.domain_info;
    ntln = &ninfo->dns_domain_name;

    for (c = 0; c < nfti->count; c++) {
      const struct lsa_ForestTrustRecord2 *cftr = nfti->entries[c];
      const struct lsa_StringLarge *ctln = NULL;
      int cmp;

      if (cftr == NULL) {
        continue;
      }

      if (cftr == nftr) {
        continue;
      }

      if (cftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      ctln = &cftr->forest_trust_data.top_level_name;

      cmp = dns_cmp(ntln->string, ctln->string);
      if (cmp == DNS_CMP_MATCH) {
        found_tln = true;
        break;
      }
      if (cmp == DNS_CMP_FIRST_IS_CHILD) {
        found_tln = true;
        break;
      }
    }

    if (found_tln) {
      continue;
    }

    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_PARAMETER;
  }

  *_nfti = talloc_move(mem_ctx, &nfti);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_normalize_forest_info_step2(TALLOC_CTX *mem_ctx,
        const struct lsa_ForestTrustInformation2 *gfti,
        struct lsa_ForestTrustInformation2 **_nfti)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct timeval tv = timeval_current();
  NTTIME now = timeval_to_nttime(&tv);
  struct lsa_ForestTrustInformation2 *nfti;
  uint32_t g;

  *_nfti = NULL;

  nfti = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation2);
  if (nfti == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, nfti);

  /*
   * Now we add TOP_LEVEL_NAME[_EX] in reverse order
   * followed by LSA_FOREST_TRUST_DOMAIN_INFO in reverse order.
   *
   * LSA_FOREST_TRUST_SCANNER_INFO and LSA_FOREST_TRUST_BINARY_DATA
   * are added last.
   *
   * This also removes the possible NULL entries generated in step1.
   */

  for (g = 0; g < gfti->count; g++) {
    const struct lsa_ForestTrustRecord2 *gftr = gfti->entries[gfti->count - (g+1)];
    struct lsa_ForestTrustRecord2 tftr;
    bool skip = false;
    NTSTATUS status;

    if (gftr == NULL) {
      continue;
    }

    switch (gftr->type) {
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
      break;

    case LSA_FOREST_TRUST_DOMAIN_INFO:
    case LSA_FOREST_TRUST_BINARY_DATA:
    case LSA_FOREST_TRUST_SCANNER_INFO:
      skip = true;
      break;

    default:
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (skip) {
      continue;
    }

    /* make a copy in order to update the time. */
    tftr = *gftr;
    if (tftr.time == 0) {
      tftr.time = now;
    }

    status = dsdb_trust_forest_info_add_record(nfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  for (g = 0; g < gfti->count; g++) {
    const struct lsa_ForestTrustRecord2 *gftr = gfti->entries[gfti->count - (g+1)];
    struct lsa_ForestTrustRecord2 tftr;
    bool skip = false;
    NTSTATUS status;

    if (gftr == NULL) {
      continue;
    }

    switch (gftr->type) {
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
    case LSA_FOREST_TRUST_BINARY_DATA:
    case LSA_FOREST_TRUST_SCANNER_INFO:
      skip = true;
      break;

    case LSA_FOREST_TRUST_DOMAIN_INFO:
      break;

    default:
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (skip) {
      continue;
    }

    /* make a copy in order to update the time. */
    tftr = *gftr;
    if (tftr.time == 0) {
      tftr.time = now;
    }

    status = dsdb_trust_forest_info_add_record(nfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  for (g = 0; g < gfti->count; g++) {
    const struct lsa_ForestTrustRecord2 *gftr = gfti->entries[gfti->count - (g+1)];
    struct lsa_ForestTrustRecord2 tftr;
    bool skip = false;
    NTSTATUS status;

    if (gftr == NULL) {
      continue;
    }

    switch (gftr->type) {
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
    case LSA_FOREST_TRUST_DOMAIN_INFO:
    case LSA_FOREST_TRUST_BINARY_DATA:
      skip = true;
      break;

    case LSA_FOREST_TRUST_SCANNER_INFO:
      break;

    default:
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (skip) {
      continue;
    }

    /* make a copy in order to update the time. */
    tftr = *gftr;
    if (tftr.time == 0) {
      tftr.time = now;
    }

    status = dsdb_trust_forest_info_add_record(nfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  for (g = 0; g < gfti->count; g++) {
    const struct lsa_ForestTrustRecord2 *gftr = gfti->entries[gfti->count - (g+1)];
    struct lsa_ForestTrustRecord2 tftr;
    bool skip = false;
    NTSTATUS status;

    if (gftr == NULL) {
      continue;
    }

    switch (gftr->type) {
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
    case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
    case LSA_FOREST_TRUST_DOMAIN_INFO:
    case LSA_FOREST_TRUST_SCANNER_INFO:
      skip = true;
      break;

    case LSA_FOREST_TRUST_BINARY_DATA:
      break;

    default:
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (skip) {
      continue;
    }

    /* make a copy in order to update the time. */
    tftr = *gftr;
    if (tftr.time == 0) {
      tftr.time = now;
    }

    status = dsdb_trust_forest_info_add_record(nfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  *_nfti = talloc_move(mem_ctx, &nfti);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

static NTSTATUS dsdb_trust_add_collision(
      struct lsa_ForestTrustCollisionInfo *c_info,
      enum lsa_ForestTrustCollisionRecordType type,
      uint32_t idx, uint32_t flags,
      const char *tdo_name)
{
  struct lsa_ForestTrustCollisionRecord **es;
  uint32_t i = c_info->count;

  es = talloc_realloc(c_info, c_info->entries,
          struct lsa_ForestTrustCollisionRecord *, i + 1);
  if (es == NULL) {
    return NT_STATUS_NO_MEMORY;
  }
  c_info->entries = es;
  c_info->count = i + 1;

  es[i] = talloc_zero(es, struct lsa_ForestTrustCollisionRecord);
  if (es[i] == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  es[i]->index = idx;
  es[i]->type = type;
  es[i]->flags = flags;
  es[i]->name.string = talloc_strdup(es[i], tdo_name);
  if (es[i]->name.string == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_verify_forest_info(const struct lsa_TrustDomainInfoInfoEx *ref_tdo,
        const struct lsa_ForestTrustInformation2 *ref_fti,
        enum lsa_ForestTrustCollisionRecordType collision_type,
        struct lsa_ForestTrustCollisionInfo *c_info,
        struct lsa_ForestTrustInformation2 *new_fti)
{
  uint32_t n;

  for (n = 0; n < new_fti->count; n++) {
    struct lsa_ForestTrustRecord2 *nftr = new_fti->entries[n];
    struct lsa_StringLarge *ntln = NULL;
    bool ntln_excluded = false;
    uint32_t flags = 0;
    uint32_t r;
    NTSTATUS status;

    if (nftr == NULL) {
      continue;
    }

    if (nftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
      continue;
    }

    ntln = &nftr->forest_trust_data.top_level_name;
    if (ntln->string == NULL) {
      return NT_STATUS_INVALID_PARAMETER;
    }

    ntln_excluded = trust_forest_info_tln_ex_match(ref_fti,
                     ntln->string);

    /* check if this is already taken and not excluded */
    for (r = 0; r < ref_fti->count; r++) {
      const struct lsa_ForestTrustRecord2 *rftr =
        ref_fti->entries[r];
      const struct lsa_StringLarge *rtln = NULL;
      int cmp;

      if (rftr == NULL) {
        continue;
      }

      if (rftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      rtln = &rftr->forest_trust_data.top_level_name;
      if (rtln->string == NULL) {
        continue;
      }

      cmp = dns_cmp(ntln->string, rtln->string);
      if (DNS_CMP_IS_NO_MATCH(cmp)) {
        continue;
      }
      if (cmp == DNS_CMP_MATCH) {
        /* We need to normalize the string */
        ntln->string = talloc_strdup(nftr,
                   rtln->string);
        if (ntln->string == NULL) {
          return NT_STATUS_NO_MEMORY;
        }
      }

      if (ntln_excluded) {
        continue;
      }

      if (rftr->flags & LSA_TLN_DISABLED_MASK) {
        continue;
      }

      if (nftr->flags & LSA_TLN_DISABLED_MASK) {
        continue;
      }

      if (cmp == DNS_CMP_SECOND_IS_CHILD) {
        bool m;

        /*
         * If the conflicting tln is a child, check if
         * we have an exclusion record for it.
         */
        m = trust_forest_info_tln_ex_match(new_fti,
                   rtln->string);
        if (m) {
          continue;
        }
      }

      flags |= LSA_TLN_DISABLED_CONFLICT;
    }

    if (flags == 0) {
      continue;
    }

    nftr->flags |= flags;

    status = dsdb_trust_add_collision(c_info,
              collision_type,
              n, nftr->flags,
              ref_tdo->domain_name.string);
    if (!NT_STATUS_IS_OK(status)) {
      return status;
    }
  }

  for (n = 0; n < new_fti->count; n++) {
    struct lsa_ForestTrustRecord2 *nftr = new_fti->entries[n];
    struct lsa_ForestTrustDomainInfo *ninfo = NULL;
    struct lsa_StringLarge *ntln = NULL;
    struct lsa_StringLarge *nnb = NULL;
    struct dom_sid *nsid = NULL;
    bool ntln_found = false;
    uint32_t flags = 0;
    uint32_t r;
    NTSTATUS status;

    if (nftr == NULL) {
      continue;
    }

    if (nftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
      continue;
    }

    ninfo = &nftr->forest_trust_data.domain_info;
    ntln = &ninfo->dns_domain_name;
    if (ntln->string == NULL) {
      return NT_STATUS_INVALID_PARAMETER;
    }
    nnb = &ninfo->netbios_domain_name;
    if (nnb->string == NULL) {
      return NT_STATUS_INVALID_PARAMETER;
    }
    nsid = ninfo->domain_sid;
    if (nsid == NULL) {
      return NT_STATUS_INVALID_PARAMETER;
    }

    ntln_found = trust_forest_info_tln_match(ref_fti, ntln->string);

    /* check if this is already taken and not excluded */
    for (r = 0; r < ref_fti->count; r++) {
      const struct lsa_ForestTrustRecord2 *rftr =
        ref_fti->entries[r];
      const struct lsa_ForestTrustDomainInfo *rinfo = NULL;
      const struct lsa_StringLarge *rtln = NULL;
      const struct lsa_StringLarge *rnb = NULL;
      const struct dom_sid *rsid = NULL;
      bool nb_possible = true;
      bool sid_possible = true;
      int cmp;

      if (rftr == NULL) {
        continue;
      }

      if (!ntln_found) {
        /*
         * If the dns name doesn't match any existing
         * tln any conflict is ignored, but name
         * normalization still happens.
         *
         * I guess that's a bug in Windows
         * (tested with Windows 2012r2).
         */
        nb_possible = false;
        sid_possible = false;
      }

      if (nftr->flags & LSA_SID_DISABLED_MASK) {
        sid_possible = false;
      }

      if (nftr->flags & LSA_NB_DISABLED_MASK) {
        nb_possible = false;
      }

      switch (rftr->type) {
      case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
        rtln = &rftr->forest_trust_data.top_level_name;
        nb_possible = false;
        sid_possible = false;
        break;

      case LSA_FOREST_TRUST_DOMAIN_INFO:
        rinfo = &rftr->forest_trust_data.domain_info;
        rtln = &rinfo->dns_domain_name;
        rnb = &rinfo->netbios_domain_name;
        rsid = rinfo->domain_sid;

        if (rftr->flags & LSA_SID_DISABLED_MASK) {
          sid_possible = false;
        }

        if (rftr->flags & LSA_NB_DISABLED_MASK) {
          nb_possible = false;
        }
        break;

      default:
        break;
      }

      if (rtln == NULL) {
        continue;
      }

      if (rtln->string == NULL) {
        continue;
      }

      cmp = dns_cmp(ntln->string, rtln->string);
      if (DNS_CMP_IS_NO_MATCH(cmp)) {
        nb_possible = false;
        sid_possible = false;
      }
      if (cmp == DNS_CMP_MATCH) {
        /* We need to normalize the string */
        ntln->string = talloc_strdup(nftr,
                   rtln->string);
        if (ntln->string == NULL) {
          return NT_STATUS_NO_MEMORY;
        }
      }

      if (rinfo == NULL) {
        continue;
      }

      if (rsid != NULL) {
        cmp = dom_sid_compare(nsid, rsid);
      } else {
        cmp = -1;
      }
      if (cmp == 0) {
        if (sid_possible) {
          flags |= LSA_SID_DISABLED_CONFLICT;
        }
      }

      if (rnb->string != NULL) {
        cmp = strcasecmp_m(nnb->string, rnb->string);
      } else {
        cmp = -1;
      }
      if (cmp == 0) {
        nnb->string = talloc_strdup(nftr, rnb->string);
        if (nnb->string == NULL) {
          return NT_STATUS_NO_MEMORY;
        }
        if (nb_possible) {
          flags |= LSA_NB_DISABLED_CONFLICT;
        }
      }
    }

    if (flags == 0) {
      continue;
    }

    nftr->flags |= flags;

    status = dsdb_trust_add_collision(c_info,
              collision_type,
              n, nftr->flags,
              ref_tdo->domain_name.string);
    if (!NT_STATUS_IS_OK(status)) {
      return status;
    }
  }

  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_merge_forest_info(TALLOC_CTX *mem_ctx,
        const struct lsa_TrustDomainInfoInfoEx *tdo,
        const struct lsa_ForestTrustInformation2 *ofti,
        const struct lsa_ForestTrustInformation2 *nfti,
        struct lsa_ForestTrustInformation2 **_mfti)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct lsa_ForestTrustInformation2 *mfti = NULL;
  uint32_t ni;
  uint32_t oi;
  NTSTATUS status;
  int cmp;

  *_mfti = NULL;
  mfti = talloc_zero(mem_ctx, struct lsa_ForestTrustInformation2);
  if (mfti == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, mfti);

  /*
   * First we add all top unique level names.
   *
   * The one matching the tdo dns name, will be
   * added without further checking. All others
   * may keep the flags and time values.
   */
  for (ni = 0; ni < nfti->count; ni++) {
    const struct lsa_ForestTrustRecord2 *nftr = nfti->entries[ni];
    struct lsa_ForestTrustRecord2 tftr = {
      .flags = 0,
    };
    const char *ndns = NULL;
    bool ignore_new = false;
    bool found_old = false;
    uint32_t mi;

    if (nftr == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (nftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
      continue;
    }

    ndns = nftr->forest_trust_data.top_level_name.string;
    if (ndns == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    cmp = dns_cmp(tdo->domain_name.string, ndns);
    if (cmp == DNS_CMP_MATCH) {
      status = dsdb_trust_forest_info_add_record(mfti, nftr);
      if (!NT_STATUS_IS_OK(status)) {
        TALLOC_FREE(frame);
        return status;
      }
    }

    for (mi = 0; mi < mfti->count; mi++) {
      const struct lsa_ForestTrustRecord2 *mftr =
        mfti->entries[mi];
      const char *mdns = NULL;

      /*
       * we just added this above, so we're sure to have a
       * valid LSA_FOREST_TRUST_TOP_LEVEL_NAME record
       */
      mdns = mftr->forest_trust_data.top_level_name.string;

      cmp = dns_cmp(mdns, ndns);
      switch (cmp) {
      case DNS_CMP_MATCH:
      case DNS_CMP_SECOND_IS_CHILD:
        ignore_new = true;
        break;
      }

      if (ignore_new) {
        break;
      }
    }

    if (ignore_new) {
      continue;
    }

    /*
     * make a temporary copy where we can change time and flags
     */
    tftr = *nftr;

    for (oi = 0; oi < ofti->count; oi++) {
      const struct lsa_ForestTrustRecord2 *oftr =
        ofti->entries[oi];
      const char *odns = NULL;

      if (oftr == NULL) {
        /*
         * broken record => ignore...
         */
        continue;
      }

      if (oftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      odns = oftr->forest_trust_data.top_level_name.string;
      if (odns == NULL) {
        /*
         * broken record => ignore...
         */
        continue;
      }

      cmp = dns_cmp(odns, ndns);
      if (cmp != DNS_CMP_MATCH) {
        continue;
      }

      found_old = true;
      tftr.flags = oftr->flags;
      tftr.time = oftr->time;
    }

    if (!found_old) {
      tftr.flags = LSA_TLN_DISABLED_NEW;
      tftr.time = 0;
    }

    status = dsdb_trust_forest_info_add_record(mfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * Now we add all unique (based on their SID) domains
   * and may keep the flags and time values.
   */
  for (ni = 0; ni < nfti->count; ni++) {
    const struct lsa_ForestTrustRecord2 *nftr = nfti->entries[ni];
    struct lsa_ForestTrustRecord2 tftr = {
      .flags = 0,
    };
    const struct lsa_ForestTrustDomainInfo *nd = NULL;
    const char *ndns = NULL;
    const char *nnbt = NULL;
    bool ignore_new = false;
    bool found_old = false;
    uint32_t mi;

    if (nftr == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    if (nftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
      continue;
    }

    nd = &nftr->forest_trust_data.domain_info;
    if (nd->domain_sid == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }
    ndns = nd->dns_domain_name.string;
    if (ndns == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }
    nnbt = nd->netbios_domain_name.string;
    if (nnbt == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_PARAMETER;
    }

    for (mi = 0; mi < mfti->count; mi++) {
      const struct lsa_ForestTrustRecord2 *mftr =
        mfti->entries[mi];
      const struct lsa_ForestTrustDomainInfo *md = NULL;

      if (mftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }

      /*
       * we just added this above, so we're sure to have a
       * valid LSA_FOREST_TRUST_DOMAIN_INFO record
       */
      md = &mftr->forest_trust_data.domain_info;

      cmp = dom_sid_compare(nd->domain_sid, md->domain_sid);
      if (cmp == 0) {
        ignore_new = true;
        break;
      }
    }

    if (ignore_new) {
      continue;
    }

    /*
     * make a temporary copy where we can change time and flags
     */
    tftr = *nftr;

    for (oi = 0; oi < ofti->count; oi++) {
      const struct lsa_ForestTrustRecord2 *oftr =
        ofti->entries[oi];
      const struct lsa_ForestTrustDomainInfo *od = NULL;
      const char *onbt = NULL;

      if (oftr == NULL) {
        /*
         * broken record => ignore...
         */
        continue;
      }

      if (oftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }

      od = &oftr->forest_trust_data.domain_info;
      onbt = od->netbios_domain_name.string;
      if (onbt == NULL) {
        /*
         * broken record => ignore...
         */
        continue;
      }

      cmp = strcasecmp(onbt, nnbt);
      if (cmp != 0) {
        continue;
      }

      found_old = true;
      tftr.flags = oftr->flags;
      tftr.time = oftr->time;
    }

    if (!found_old) {
      tftr.flags = 0;
      tftr.time = 0;
    }

    status = dsdb_trust_forest_info_add_record(mfti, &tftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * We keep old domain records disabled by the admin
   * if not already in the list.
   */
  for (oi = 0; oi < ofti->count; oi++) {
    const struct lsa_ForestTrustRecord2 *oftr =
      ofti->entries[oi];
    const struct lsa_ForestTrustDomainInfo *od = NULL;
    const char *odns = NULL;
    const char *onbt = NULL;
    bool ignore_old = true;
    uint32_t mi;

    if (oftr == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    if (oftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
      continue;
    }

    od = &oftr->forest_trust_data.domain_info;
    odns = od->dns_domain_name.string;
    if (odns == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }
    onbt = od->netbios_domain_name.string;
    if (onbt == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }
    if (od->domain_sid == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    if (oftr->flags & LSA_NB_DISABLED_ADMIN) {
      ignore_old = false;
    } else if (oftr->flags & LSA_SID_DISABLED_ADMIN) {
      ignore_old = false;
    }

    for (mi = 0; mi < mfti->count; mi++) {
      const struct lsa_ForestTrustRecord2 *mftr =
        mfti->entries[mi];
      const struct lsa_ForestTrustDomainInfo *md = NULL;

      if (mftr->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }

      /*
       * we just added this above, so we're sure to have a
       * valid LSA_FOREST_TRUST_DOMAIN_INFO record
       */
      md = &mftr->forest_trust_data.domain_info;

      cmp = dom_sid_compare(od->domain_sid, md->domain_sid);
      if (cmp == 0) {
        ignore_old = true;
        break;
      }
    }

    if (ignore_old) {
      continue;
    }

    status = dsdb_trust_forest_info_add_record(mfti, oftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * Finally we readd top level exclusions,
   * if they still match a top level name.
   */
  for (oi = 0; oi < ofti->count; oi++) {
    const struct lsa_ForestTrustRecord2 *oftr =
      ofti->entries[oi];
    const char *odns = NULL;
    bool ignore_old = false;
    uint32_t mi;

    if (oftr == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    if (oftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX) {
      continue;
    }

    odns = oftr->forest_trust_data.top_level_name_ex.string;
    if (odns == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    for (mi = 0; mi < mfti->count; mi++) {
      const struct lsa_ForestTrustRecord2 *mftr =
        mfti->entries[mi];
      const char *mdns = NULL;

      if (mftr->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      /*
       * we just added this above, so we're sure to have a
       * valid LSA_FOREST_TRUST_TOP_LEVEL_NAME.
       */
      mdns = mftr->forest_trust_data.top_level_name.string;

      cmp = dns_cmp(mdns, odns);
      switch (cmp) {
      case DNS_CMP_MATCH:
      case DNS_CMP_SECOND_IS_CHILD:
        break;
      default:
        ignore_old = true;
        break;
      }

      if (ignore_old) {
        break;
      }
    }

    if (ignore_old) {
      continue;
    }

    status = dsdb_trust_forest_info_add_record(mfti, oftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * Finally we readd scanner info records
   */
  for (oi = 0; oi < ofti->count; oi++) {
    const struct lsa_ForestTrustRecord2 *oftr =
      ofti->entries[oi];

    if (oftr == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    if (oftr->type != LSA_FOREST_TRUST_SCANNER_INFO) {
      continue;
    }

    status = dsdb_trust_forest_info_add_record(mfti, oftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * Finally we readd binary info records
   */
  for (oi = 0; oi < ofti->count; oi++) {
    const struct lsa_ForestTrustRecord2 *oftr =
      ofti->entries[oi];

    if (oftr == NULL) {
      /*
       * broken record => ignore...
       */
      continue;
    }

    if (oftr->type != LSA_FOREST_TRUST_BINARY_DATA) {
      continue;
    }

    status = dsdb_trust_forest_info_add_record(mfti, oftr);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  *_mfti = talloc_move(mem_ctx, &mfti);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_search_tdo(struct ldb_context *sam_ctx,
             const char *netbios, const char *dns,
             const char * const *attrs,
             TALLOC_CTX *mem_ctx,
             struct ldb_message **msg)
{
  TALLOC_CTX *frame = talloc_stackframe();
  int ret;
  struct ldb_dn *system_dn = NULL;
  char *netbios_encoded = NULL;
  char *dns_encoded = NULL;
  char *filter = NULL;

  *msg = NULL;

  if (netbios == NULL && dns == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_PARAMETER_MIX;
  }

  system_dn = samdb_system_container_dn(sam_ctx, frame);
  if (system_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  if (netbios != NULL) {
    netbios_encoded = ldb_binary_encode_string(frame, netbios);
    if (netbios_encoded == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }

  if (dns != NULL) {
    dns_encoded = ldb_binary_encode_string(frame, dns);
    if (dns_encoded == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }

  if (netbios != NULL && dns != NULL) {
    filter = talloc_asprintf(frame,
        "(&(objectClass=trustedDomain)"
          "(|(trustPartner=%s)(flatName=%s))"
        ")",
        dns_encoded, netbios_encoded);
    if (filter == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else if (netbios != NULL) {
    filter = talloc_asprintf(frame,
        "(&(objectClass=trustedDomain)(flatName=%s))",
        netbios_encoded);
    if (filter == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else if (dns != NULL) {
    filter = talloc_asprintf(frame,
        "(&(objectClass=trustedDomain)(trustPartner=%s))",
        dns_encoded);
    if (filter == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }

  ret = dsdb_search_one(sam_ctx, mem_ctx, msg,
            system_dn,
            LDB_SCOPE_ONELEVEL, attrs,
            DSDB_SEARCH_NO_GLOBAL_CATALOG,
            "%s", filter);
  if (ret != LDB_SUCCESS) {
    NTSTATUS status = dsdb_ldb_err_to_ntstatus(ret);
    DEBUG(3, ("Failed to search for %s: %s - %s\n",
        filter, nt_errstr(status), ldb_errstring(sam_ctx)));
    TALLOC_FREE(frame);
    return status;
  }

  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_search_tdo_by_type(struct ldb_context *sam_ctx,
               enum netr_SchannelType type,
               const char *name,
               const char * const *attrs,
               TALLOC_CTX *mem_ctx,
               struct ldb_message **msg)
{
  TALLOC_CTX *frame = talloc_stackframe();
  NTSTATUS status;
  size_t len;
  char trailer = '$';
  bool require_trailer = true;
  char *encoded_name = NULL;
  const char *netbios = NULL;
  const char *dns = NULL;

  if (type != SEC_CHAN_DOMAIN && type != SEC_CHAN_DNS_DOMAIN) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_PARAMETER;
  }

  if (type == SEC_CHAN_DNS_DOMAIN) {
    trailer = '.';
    require_trailer = false;
  }

  encoded_name = ldb_binary_encode_string(frame, name);
  if (encoded_name == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  len = strlen(encoded_name);
  if (len < 2) {
    TALLOC_FREE(frame);
    return NT_STATUS_OBJECT_NAME_NOT_FOUND;
  }

  if (require_trailer && encoded_name[len - 1] != trailer) {
    TALLOC_FREE(frame);
    return NT_STATUS_OBJECT_NAME_NOT_FOUND;
  }
  encoded_name[len - 1] = '\0';

  if (type == SEC_CHAN_DNS_DOMAIN) {
    dns = encoded_name;
  } else {
    netbios = encoded_name;
  }

  status = dsdb_trust_search_tdo(sam_ctx, netbios, dns,
               attrs, mem_ctx, msg);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_search_tdo_by_sid(struct ldb_context *sam_ctx,
              const struct dom_sid *sid,
              const char * const *attrs,
              TALLOC_CTX *mem_ctx,
              struct ldb_message **msg)
{
  TALLOC_CTX *frame = talloc_stackframe();
  int ret;
  struct ldb_dn *system_dn = NULL;
  char *encoded_sid = NULL;
  char *filter = NULL;

  *msg = NULL;

  if (sid == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_PARAMETER_MIX;
  }

  encoded_sid = ldap_encode_ndr_dom_sid(frame, sid);
  if (encoded_sid == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  system_dn = samdb_system_container_dn(sam_ctx, frame);
  if (system_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  filter = talloc_asprintf(frame,
        "(&"
          "(objectClass=trustedDomain)"
          "(securityIdentifier=%s)"
        ")",
        encoded_sid);
  if (filter == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  ret = dsdb_search_one(sam_ctx, mem_ctx, msg,
            system_dn,
            LDB_SCOPE_ONELEVEL, attrs,
            DSDB_SEARCH_NO_GLOBAL_CATALOG,
            "%s", filter);
  if (ret != LDB_SUCCESS) {
    NTSTATUS status = dsdb_ldb_err_to_ntstatus(ret);
    DEBUG(3, ("Failed to search for %s: %s - %s\n",
        filter, nt_errstr(status), ldb_errstring(sam_ctx)));
    TALLOC_FREE(frame);
    return status;
  }

  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_get_incoming_passwords(const struct ldb_message *msg,
             TALLOC_CTX *mem_ctx,
             struct samr_Password **_current,
             struct samr_Password **_previous)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct samr_Password __current = {
    .hash = {0},
  };
  struct samr_Password __previous = {
    .hash = {0},
  };
  struct samr_Password *current = NULL;
  struct samr_Password *previous = NULL;
  const struct ldb_val *blob = NULL;
  enum ndr_err_code ndr_err;
  struct trustAuthInOutBlob incoming = {
    .count = 0,
  };
  uint32_t i;

  if (_current != NULL) {
    *_current = NULL;
  }
  if (_previous != NULL) {
    *_previous = NULL;
  }

  blob = ldb_msg_find_ldb_val(msg, "trustAuthIncoming");
  if (blob == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_ACCOUNT_DISABLED;
  }

  /* ldb_val is equivalent to DATA_BLOB */
  ndr_err = ndr_pull_struct_blob_all(blob, frame, &incoming,
        (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
  if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }

  for (i = 0; i < incoming.current.count; i++) {
    struct AuthenticationInformation *a =
      &incoming.current.array[i];

    if (current != NULL) {
      break;
    }

    switch (a->AuthType) {
    case TRUST_AUTH_TYPE_NONE:
    case TRUST_AUTH_TYPE_VERSION:
      break;
    case TRUST_AUTH_TYPE_NT4OWF:
      current = &a->AuthInfo.nt4owf.password;
      break;
    case TRUST_AUTH_TYPE_CLEAR:
      mdfour(__current.hash,
             a->AuthInfo.clear.password,
             a->AuthInfo.clear.size);
      current = &__current;
      break;
    }
  }

  if (current == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_DB_CORRUPTION;
  }

  for (i = 0; i < incoming.previous.count; i++) {
    struct AuthenticationInformation *a =
      &incoming.previous.array[i];

    if (previous != NULL) {
      break;
    }

    switch (a->AuthType) {
    case TRUST_AUTH_TYPE_NONE:
    case TRUST_AUTH_TYPE_VERSION:
      break;
    case TRUST_AUTH_TYPE_NT4OWF:
      previous = &a->AuthInfo.nt4owf.password;
      break;
    case TRUST_AUTH_TYPE_CLEAR:
      mdfour(__previous.hash,
             a->AuthInfo.clear.password,
             a->AuthInfo.clear.size);
      previous = &__previous;
      break;
    }
  }

  if (previous == NULL) {
    previous = current;
  }

  if (_current != NULL) {
    *_current = talloc_memdup(mem_ctx, current, sizeof(*current));
    if (*_current == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }
  if (_previous != NULL) {
    *_previous =
      talloc_memdup(mem_ctx, previous, sizeof(*previous));
    if (*_previous == NULL) {
      if (_current != NULL) {
        TALLOC_FREE(*_current);
      }
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }
  ZERO_STRUCTP(current);
  ZERO_STRUCTP(previous);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

NTSTATUS dsdb_trust_search_tdos(struct ldb_context *sam_ctx,
        const char *exclude,
        const char * const *attrs,
        TALLOC_CTX *mem_ctx,
        struct ldb_result **res)
{
  TALLOC_CTX *frame = talloc_stackframe();
  int ret;
  struct ldb_dn *system_dn = NULL;
  const char *filter = NULL;
  char *exclude_encoded = NULL;

  *res = NULL;

  system_dn = samdb_system_container_dn(sam_ctx, frame);
  if (system_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  if (exclude != NULL) {
    exclude_encoded = ldb_binary_encode_string(frame, exclude);
    if (exclude_encoded == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }

    filter = talloc_asprintf(frame,
        "(&(objectClass=trustedDomain)"
          "(!(|(trustPartner=%s)(flatName=%s)))"
        ")",
        exclude_encoded, exclude_encoded);
    if (filter == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else {
    filter = "(objectClass=trustedDomain)";
  }

  ret = dsdb_search(sam_ctx, mem_ctx, res,
        system_dn,
        LDB_SCOPE_ONELEVEL, attrs,
        DSDB_SEARCH_NO_GLOBAL_CATALOG,
        "%s", filter);
  if (ret != LDB_SUCCESS) {
    NTSTATUS status = dsdb_ldb_err_to_ntstatus(ret);
    DEBUG(3, ("Failed to search for %s: %s - %s\n",
        filter, nt_errstr(status), ldb_errstring(sam_ctx)));
    TALLOC_FREE(frame);
    return status;
  }

  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

struct dsdb_trust_routing_domain;

struct dsdb_trust_routing_table {
  struct dsdb_trust_routing_domain *domains;
};

struct dsdb_trust_routing_domain {
  struct dsdb_trust_routing_domain *prev, *next;

  struct lsa_TrustDomainInfoInfoEx *tdo;

  struct lsa_ForestTrustDomainInfo di;

  struct lsa_ForestTrustInformation2 *fti;
};

NTSTATUS dsdb_trust_routing_table_load(struct ldb_context *sam_ctx,
               TALLOC_CTX *mem_ctx,
               struct dsdb_trust_routing_table **_table)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct dsdb_trust_routing_table *table;
  struct dsdb_trust_routing_domain *d = NULL;
  struct ldb_dn *domain_dn = NULL;
  struct lsa_TrustDomainInfoInfoEx *root_trust_tdo = NULL;
  struct lsa_TrustDomainInfoInfoEx *trust_parent_tdo = NULL;
  struct lsa_TrustDomainInfoInfoEx *root_direction_tdo = NULL;
  const char * const trusts_attrs[] = {
    "securityIdentifier",
    "flatName",
    "trustPartner",
    "trustAttributes",
    "trustDirection",
    "trustType",
    "msDS-TrustForestTrustInfo",
    NULL
  };
  struct ldb_result *trusts_res = NULL;
  unsigned int i;
  NTSTATUS status;

  *_table = NULL;

  domain_dn = ldb_get_default_basedn(sam_ctx);
  if (domain_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INTERNAL_ERROR;
  }

  table = talloc_zero(mem_ctx, struct dsdb_trust_routing_table);
  if (table == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  talloc_steal(frame, table);

  d = talloc_zero(table, struct dsdb_trust_routing_domain);
  if (d == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  status = dsdb_trust_crossref_tdo_info(d, sam_ctx,
                domain_dn, NULL,
                &d->tdo,
                &root_trust_tdo,
                &trust_parent_tdo);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  /*
   * d->tdo should not be NULL of status above is 'NT_STATUS_OK'
   * check is needed to satisfy clang static checker
  */
  if (d->tdo == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  d->di.domain_sid = d->tdo->sid;
  d->di.netbios_domain_name.string = d->tdo->netbios_name.string;
  d->di.dns_domain_name.string = d->tdo->domain_name.string;

  if (root_trust_tdo != NULL) {
    root_direction_tdo = root_trust_tdo;
  } else if (trust_parent_tdo != NULL) {
    root_direction_tdo = trust_parent_tdo;
  }

  if (root_direction_tdo == NULL) {
    /* we're the forest root */
    status = dsdb_trust_xref_forest_info(d, sam_ctx, &d->fti);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  DLIST_ADD(table->domains, d);

  status = dsdb_trust_search_tdos(sam_ctx, NULL, trusts_attrs,
          frame, &trusts_res);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  for (i = 0; i < trusts_res->count; i++) {
    bool ok;
    int cmp;

    d = talloc_zero(table, struct dsdb_trust_routing_domain);
    if (d == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }

    status = dsdb_trust_parse_tdo_info(d,
               trusts_res->msgs[i],
               &d->tdo);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }

    d->di.domain_sid = d->tdo->sid;
    d->di.netbios_domain_name.string = d->tdo->netbios_name.string;
    d->di.dns_domain_name.string = d->tdo->domain_name.string;

    DLIST_ADD_END(table->domains, d);

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
      struct ForestTrustInfo *fti = NULL;

      status = dsdb_trust_parse_forest_info(frame,
                    trusts_res->msgs[i],
                    &fti);
      if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
        fti = NULL;
        status = NT_STATUS_OK;
      }
      if (!NT_STATUS_IS_OK(status)) {
        TALLOC_FREE(frame);
        return status;
      }

      if (fti == NULL) {
        continue;
      }

      status = trust_forest_info_to_lsa2(d, fti, &d->fti);
      if (!NT_STATUS_IS_OK(status)) {
        TALLOC_FREE(frame);
        return status;
      }

      continue;
    }

    if (!(d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)) {
      continue;
    }

    if (root_direction_tdo == NULL) {
      continue;
    }

    ok = dom_sid_equal(root_direction_tdo->sid, d->tdo->sid);
    if (!ok) {
      continue;
    }

    cmp = strcasecmp_m(root_direction_tdo->netbios_name.string,
           d->tdo->netbios_name.string);
    if (cmp != 0) {
      continue;
    }

    cmp = strcasecmp_m(root_direction_tdo->domain_name.string,
           d->tdo->domain_name.string);
    if (cmp != 0) {
      continue;
    }

    /* this our route to the forest root */
    status = dsdb_trust_xref_forest_info(d, sam_ctx, &d->fti);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  *_table = talloc_move(mem_ctx, &table);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

static void dsdb_trust_update_best_tln(
  const struct dsdb_trust_routing_domain **best_d,
  const char **best_tln,
  const struct dsdb_trust_routing_domain *d,
  const char *tln)
{
  int cmp;

  if (*best_tln == NULL) {
    *best_tln = tln;
    *best_d = d;
    return;
  }

  cmp = dns_cmp(tln, *best_tln);
  if (cmp != DNS_CMP_FIRST_IS_CHILD) {
    return;
  }

  *best_tln = tln;
  *best_d = d;
}

const struct lsa_TrustDomainInfoInfoEx *dsdb_trust_routing_by_name(
    const struct dsdb_trust_routing_table *table,
    const char *name)
{
  const struct dsdb_trust_routing_domain *best_d = NULL;
  const char *best_tln = NULL;
  const struct dsdb_trust_routing_domain *d = NULL;

  if (name == NULL) {
    return NULL;
  }

  for (d = table->domains; d != NULL; d = d->next) {
    bool transitive = false;
    bool allow_netbios = false;
    bool exclude = false;
    uint32_t i;

    if (d->tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) {
      /*
       * Only uplevel trusts have top level names
       */
      continue;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) {
      transitive = false;
    }

    if (d->tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) {
      transitive = false;
    }

    switch (d->tdo->trust_type) {
    case LSA_TRUST_TYPE_UPLEVEL:
      if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_UPLEVEL_ONLY) {
        break;
      }
      allow_netbios = true;
      break;
    case LSA_TRUST_TYPE_DOWNLEVEL:
      allow_netbios = true;
      break;
    default:
      allow_netbios = false;
      break;
    }

    if (!transitive || d->fti == NULL) {
      int cmp;

      if (allow_netbios) {
        cmp = dns_cmp(name, d->tdo->netbios_name.string);
        if (cmp == DNS_CMP_MATCH) {
          /*
           * exact match
           */
          return d->tdo;
        }
      }

      cmp = dns_cmp(name, d->tdo->domain_name.string);
      if (cmp == DNS_CMP_MATCH) {
        /*
         * exact match
         */
        return d->tdo;
      }
      if (cmp != DNS_CMP_FIRST_IS_CHILD) {
        continue;
      }

      dsdb_trust_update_best_tln(&best_d, &best_tln, d,
               d->tdo->domain_name.string);
      continue;
    }

    exclude = trust_forest_info_tln_ex_match(d->fti, name);
    if (exclude) {
      continue;
    }

    for (i = 0; i < d->fti->count; i++ ) {
      const struct lsa_ForestTrustRecord2 *f = d->fti->entries[i];
      const struct lsa_ForestTrustDomainInfo *di = NULL;
      const char *fti_nbt = NULL;
      int cmp;

      if (!allow_netbios) {
        break;
      }

      if (f == NULL) {
        /* broken record */
        continue;
      }

      if (f->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }

      if (f->flags & LSA_NB_DISABLED_MASK) {
        /*
         * any flag disables the entry.
         */
        continue;
      }

      di = &f->forest_trust_data.domain_info;
      fti_nbt = di->netbios_domain_name.string;
      if (fti_nbt == NULL) {
        /* broken record */
        continue;
      }

      cmp = dns_cmp(name, fti_nbt);
      if (cmp == DNS_CMP_MATCH) {
        /*
         * exact match
         */
        return d->tdo;
      }
    }

    for (i = 0; i < d->fti->count; i++ ) {
      const struct lsa_ForestTrustRecord2 *f = d->fti->entries[i];
      const union lsa_ForestTrustData2 *u = NULL;
      const char *fti_tln = NULL;
      int cmp;

      if (f == NULL) {
        /* broken record */
        continue;
      }

      if (f->type != LSA_FOREST_TRUST_TOP_LEVEL_NAME) {
        continue;
      }

      if (f->flags & LSA_TLN_DISABLED_MASK) {
        /*
         * any flag disables the entry.
         */
        continue;
      }

      u = &f->forest_trust_data;
      fti_tln = u->top_level_name.string;
      if (fti_tln == NULL) {
        continue;
      }

      cmp = dns_cmp(name, fti_tln);
      if (cmp == DNS_CMP_MATCH) {
        /*
         * exact match
         */
        return d->tdo;
      }
      if (cmp != DNS_CMP_FIRST_IS_CHILD) {
        continue;
      }

      dsdb_trust_update_best_tln(&best_d, &best_tln,
               d, fti_tln);
      continue;
    }
  }

  if (best_d != NULL) {
    return best_d->tdo;
  }

  return NULL;
}

const struct lsa_TrustDomainInfoInfoEx *dsdb_trust_domain_by_sid(
    const struct dsdb_trust_routing_table *table,
    const struct dom_sid *sid,
    const struct lsa_ForestTrustDomainInfo **pdi)
{
  const struct dsdb_trust_routing_domain *d = NULL;

  if (pdi != NULL) {
    *pdi = NULL;
  }

  if (sid == NULL) {
    return NULL;
  }

  for (d = table->domains; d != NULL; d = d->next) {
    bool transitive = false;
    uint32_t i;

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) {
      transitive = false;
    }

    if (d->tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) {
      transitive = false;
    }

    if (!transitive || d->fti == NULL) {
      bool match = false;

      match = dom_sid_equal(d->di.domain_sid, sid);
      if (match) {
        /*
         * exact match, it's the domain itself.
         */
        if (pdi != NULL) {
          *pdi = &d->di;
        }
        return d->tdo;
      }
      continue;
    }

    for (i = 0; i < d->fti->count; i++ ) {
      const struct lsa_ForestTrustRecord2 *f = d->fti->entries[i];
      const struct lsa_ForestTrustDomainInfo *di = NULL;
      const struct dom_sid *fti_sid = NULL;
      bool match = false;

      if (f == NULL) {
        /* broken record */
        continue;
      }

      if (f->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }

      if (f->flags & LSA_SID_DISABLED_MASK) {
        /*
         * any flag disables the entry.
         */
        continue;
      }

      di = &f->forest_trust_data.domain_info;
      fti_sid = di->domain_sid;
      if (fti_sid == NULL) {
        /* broken record */
        continue;
      }

      match = dom_sid_equal(fti_sid, sid);
      if (match) {
        /*
         * exact match, it's a domain in the forest.
         */
        if (pdi != NULL) {
          *pdi = di;
        }
        return d->tdo;
      }
    }
  }

  return NULL;
}

const struct lsa_TrustDomainInfoInfoEx *dsdb_trust_domain_by_name(
    const struct dsdb_trust_routing_table *table,
    const char *name,
    const struct lsa_ForestTrustDomainInfo **pdi)
{
  const struct dsdb_trust_routing_domain *d = NULL;

  if (pdi != NULL) {
    *pdi = NULL;
  }

  if (name == NULL) {
    return NULL;
  }

  for (d = table->domains; d != NULL; d = d->next) {
    bool transitive = false;
    uint32_t i;

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
      transitive = true;
    }

    if (d->tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) {
      transitive = false;
    }

    if (d->tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) {
      transitive = false;
    }

    if (!transitive || d->fti == NULL) {
      bool match = false;

      match = strequal_m(d->di.netbios_domain_name.string,
             name);
      if (match) {
        /*
         * exact match for netbios name,
         * it's the domain itself.
         */
        if (pdi != NULL) {
          *pdi = &d->di;
        }
        return d->tdo;
      }
      match = strequal_m(d->di.dns_domain_name.string,
             name);
      if (match) {
        /*
         * exact match for dns name,
         * it's the domain itself.
         */
        if (pdi != NULL) {
          *pdi = &d->di;
        }
        return d->tdo;
      }
      continue;
    }

    for (i = 0; i < d->fti->count; i++ ) {
      const struct lsa_ForestTrustRecord2 *f = d->fti->entries[i];
      const struct lsa_ForestTrustDomainInfo *di = NULL;
      bool match = false;

      if (f == NULL) {
        /* broken record */
        continue;
      }

      if (f->type != LSA_FOREST_TRUST_DOMAIN_INFO) {
        continue;
      }
      di = &f->forest_trust_data.domain_info;

      if (!(f->flags & LSA_NB_DISABLED_MASK)) {
        match = strequal_m(di->netbios_domain_name.string,
               name);
        if (match) {
          /*
           * exact match for netbios name,
           * it's a domain in the forest.
           */
          if (pdi != NULL) {
            *pdi = di;
          }
          return d->tdo;
        }
      }

      if (!(f->flags & LSA_TLN_DISABLED_MASK)) {
        match = strequal_m(di->dns_domain_name.string,
               name);
        if (match) {
          /*
           * exact match for dns name,
           * it's a domain in the forest.
           */
          if (pdi != NULL) {
            *pdi = di;
          }
          return d->tdo;
        }
      }
    }
  }

  return NULL;
}

NTSTATUS dsdb_trust_get_claims_tf_policy(struct ldb_context *samldb,
           const struct ldb_message *tdo_msg,
           const char *tdo_attr,
           TALLOC_CTX *mem_ctx,
           struct claims_tf_rule_set **_rule_set)
{
  TALLOC_CTX *frame = talloc_stackframe();
  const struct ldb_val *tdo_link_val = NULL;
  struct ldb_dn *config_dn = NULL;
  struct ldb_dn *claims_tf_dn = NULL;
  struct ldb_dn *policy_dn = NULL;
  struct ldb_message *policy_msg = NULL;
  static const char * const policy_attrs[] = {
    "msDS-TransformationRules",
    NULL
  };
  const struct ldb_val *xml_blob = NULL;
  DATA_BLOB rules_blob = { .length = 0, };
  struct claims_tf_rule_set *rule_set = NULL;
  int cmp;
  bool ok;
  int ret;

  *_rule_set = NULL;

  tdo_link_val = ldb_msg_find_ldb_val(tdo_msg, tdo_attr);
  if (tdo_link_val == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_NO_ATTRIBUTE_OR_VALUE;
  }

  config_dn = ldb_get_config_basedn(samldb);
  if (config_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_INIT_FAILURE;
  }

  claims_tf_dn = ldb_dn_copy(frame, config_dn);
  if (claims_tf_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  ok = ldb_dn_add_child_fmt(claims_tf_dn,
          "%s,%s,%s",
          "CN=Claims Transformation Policies",
          "CN=Claims Configuration",
          "CN=Services");
  if (!ok) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  policy_dn = ldb_msg_find_attr_as_dn(samldb, frame, tdo_msg, tdo_attr);
  if (policy_dn == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  /*
   * The policy dn needs to be a child of
   * the CN=Claims Transformation Policies container
   */
  cmp = ldb_dn_compare_base(claims_tf_dn, policy_dn);
  if (cmp != 0) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_OBJ_CLASS_VIOLATION;
  }

  ret = dsdb_search_one(samldb,
            frame,
            &policy_msg,
            policy_dn,
            LDB_SCOPE_BASE,
            policy_attrs,
            DSDB_SEARCH_ONE_ONLY,
            "(objectClass=msDS-ClaimsTransformationPolicyType)");
  if (ret != LDB_SUCCESS) {
    TALLOC_FREE(frame);
    return NT_STATUS_POLICY_OBJECT_NOT_FOUND;
  }

  xml_blob = ldb_msg_find_ldb_val(policy_msg, "msDS-TransformationRules");
  if (xml_blob == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_NO_ATTRIBUTE_OR_VALUE;
  }

  ok = claims_tf_policy_unwrap_xml(xml_blob,
           &rules_blob);
  if (!ok) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_INVALID_ATTRIBUTE_SYNTAX;
  }

  ok = claims_tf_rule_set_parse_blob(&rules_blob,
             frame,
             &rule_set,
             NULL); /* _error_string */
  if (!ok) {
    TALLOC_FREE(frame);
    return NT_STATUS_DS_INVALID_ATTRIBUTE_SYNTAX;
  }

  *_rule_set = talloc_move(mem_ctx, &rule_set);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

Coverage Report

Created: 2026-07-25 07:00