#include "auth/auth.h"
#include "param/param.h"
#include "dsdb/samdb/ldb_modules/util.h"
-#include "lib/util/binsearch.h"
+#include "lib/util/util_tdb.h"
+#include "lib/dbwrap/dbwrap.h"
+#include "lib/dbwrap/dbwrap_rbt.h"
struct descriptor_changes {
struct descriptor_changes *prev, *next;
- struct descriptor_changes *children;
struct ldb_dn *nc_root;
- struct ldb_dn *dn;
+ struct GUID guid;
bool force_self;
bool force_children;
struct ldb_dn *stopped_dn;
+ size_t ref_count;
+};
+
+struct descriptor_transaction {
+ TALLOC_CTX *mem;
+ struct {
+ /*
+ * We used to have a list of changes, appended with each
+ * DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID operation.
+ *
+ * But the main problem was that a replication
+ * cycle (mainly the initial replication) calls
+ * DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID for the
+ * same object[GUID] more than once. With
+ * DRSUAPI_DRS_GET_TGT we'll get the naming
+ * context head object and other top level
+ * containers, every often.
+ *
+ * It means we'll process objects more
+ * than once and waste a lot of time
+ * doing the same work again and again.
+ *
+ * We use an objectGUID based map in order to
+ * avoid registering objects more than once.
+ * In an domain with 22000 object it can
+ * reduce the work from 4 hours down to ~ 3.5 minutes.
+ */
+ struct descriptor_changes *list;
+ struct db_context *map;
+ size_t num_registrations;
+ size_t num_registered;
+ size_t num_processed;
+ } changes;
+ struct {
+ size_t num_processed;
+ } objects;
};
struct descriptor_data {
- TALLOC_CTX *trans_mem;
- struct descriptor_changes *changes;
+ struct descriptor_transaction transaction;
};
struct descriptor_context {
struct auth_session_info *session_info
= ldb_get_opaque(ldb, DSDB_SESSION_INFO);
const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
- char *sddl_sd;
struct dom_sid *default_owner;
struct dom_sid *default_group;
struct security_descriptor *default_descriptor = NULL;
final_sd->sacl->revision = SECURITY_ACL_REVISION_ADS;
}
- sddl_sd = sddl_encode(mem_ctx, final_sd, domain_sid);
- DEBUG(10, ("Object %s created with descriptor %s\n\n", ldb_dn_get_linearized(dn), sddl_sd));
+ {
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ DBG_DEBUG("Object %s created with descriptor %s\n\n",
+ ldb_dn_get_linearized(dn),
+ sddl_encode(tmp_ctx, final_sd, domain_sid));
+ TALLOC_FREE(tmp_ctx);
+ }
linear_sd = talloc(mem_ctx, DATA_BLOB);
if (!linear_sd) {
current_attrs,
DSDB_FLAG_NEXT_MODULE |
DSDB_FLAG_AS_SYSTEM |
- DSDB_SEARCH_SHOW_RECYCLED,
+ DSDB_SEARCH_SHOW_RECYCLED |
+ DSDB_SEARCH_SHOW_EXTENDED_DN,
req);
if (ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_ERROR,"descriptor_modify: Could not find %s\n",
user_sd = old_sd;
}
- sd = get_new_descriptor(module, dn, req,
+ sd = get_new_descriptor(module, current_res->msgs[0]->dn, req,
objectclass, parent_sd,
user_sd, old_sd, sd_flags);
if (sd == NULL) {
return ldb_oom(ldb);
}
} else if (cmp_ret != 0) {
+ struct GUID guid;
struct ldb_dn *nc_root;
+ NTSTATUS status;
- ret = dsdb_find_nc_root(ldb, msg, dn, &nc_root);
+ ret = dsdb_find_nc_root(ldb,
+ msg,
+ current_res->msgs[0]->dn,
+ &nc_root);
if (ret != LDB_SUCCESS) {
return ldb_oom(ldb);
}
- ret = dsdb_module_schedule_sd_propagation(module, nc_root,
- dn, false);
+ status = dsdb_get_extended_dn_guid(current_res->msgs[0]->dn,
+ &guid,
+ "GUID");
+ if (!NT_STATUS_IS_OK(status)) {
+ return ldb_operr(ldb);
+ }
+
+ /*
+ * Force SD propagation on children of this record
+ */
+ ret = dsdb_module_schedule_sd_propagation(module,
+ nc_root,
+ guid,
+ false);
if (ret != LDB_SUCCESS) {
return ldb_operr(ldb);
}
if (ldb_dn_compare(olddn, newdn) != 0) {
struct ldb_dn *nc_root;
+ struct GUID guid;
ret = dsdb_find_nc_root(ldb, req, newdn, &nc_root);
if (ret != LDB_SUCCESS) {
return ldb_oom(ldb);
}
- ret = dsdb_module_schedule_sd_propagation(module, nc_root,
- newdn, true);
- if (ret != LDB_SUCCESS) {
- return ldb_operr(ldb);
+ ret = dsdb_module_guid_by_dn(module,
+ olddn,
+ &guid,
+ req);
+ if (ret == LDB_SUCCESS) {
+ /*
+ * Without disturbing any errors if the olddn
+ * does not exit, force SD propagation on
+ * this record (get a new inherited SD from
+ * the potentially new parent
+ */
+ ret = dsdb_module_schedule_sd_propagation(module,
+ nc_root,
+ guid,
+ true);
+ if (ret != LDB_SUCCESS) {
+ return ldb_operr(ldb);
+ }
}
}
return ldb_next_request(module, req);
}
+static void descriptor_changes_parser(TDB_DATA key, TDB_DATA data, void *private_data)
+{
+ struct descriptor_changes **c_ptr = (struct descriptor_changes **)private_data;
+ uintptr_t ptr = 0;
+
+ SMB_ASSERT(data.dsize == sizeof(ptr));
+
+ memcpy(&ptr, data.dptr, data.dsize);
+
+ *c_ptr = talloc_get_type_abort((void *)ptr, struct descriptor_changes);
+}
+
static int descriptor_extended_sec_desc_propagation(struct ldb_module *module,
struct ldb_request *req)
{
struct descriptor_data *descriptor_private =
talloc_get_type_abort(ldb_module_get_private(module),
struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
struct ldb_context *ldb = ldb_module_get_ctx(module);
struct dsdb_extended_sec_desc_propagation_op *op;
- TALLOC_CTX *parent_mem = NULL;
- struct descriptor_changes *parent_change = NULL;
- struct descriptor_changes *c;
- int ret;
+ struct descriptor_changes *c = NULL;
+ TDB_DATA key;
+ NTSTATUS status;
op = talloc_get_type(req->op.extended.data,
struct dsdb_extended_sec_desc_propagation_op);
return LDB_ERR_PROTOCOL_ERROR;
}
- if (descriptor_private->trans_mem == NULL) {
+ if (t->mem == NULL) {
return ldb_module_operr(module);
}
- parent_mem = descriptor_private->trans_mem;
+ /*
+ * First we check if we already have an registration
+ * for the given object.
+ */
- for (c = descriptor_private->changes; c; c = c->next) {
- ret = ldb_dn_compare(c->nc_root, op->nc_root);
- if (ret != 0) {
- continue;
- }
+ key = make_tdb_data((const void*)&op->guid, sizeof(op->guid));
+ status = dbwrap_parse_record(t->changes.map, key,
+ descriptor_changes_parser, &c);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+ c = NULL;
+ status = NT_STATUS_OK;
+ }
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_debug(ldb, LDB_DEBUG_FATAL,
+ "dbwrap_parse_record() - %s\n",
+ nt_errstr(status));
+ return ldb_module_operr(module);
+ }
- ret = ldb_dn_compare(c->dn, op->dn);
- if (ret == 0) {
- if (op->include_self) {
- c->force_self = true;
- } else {
- c->force_children = true;
- }
- return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
- }
+ if (c == NULL) {
+ /*
+ * Create a new structure if we
+ * don't know about the object yet.
+ */
- ret = ldb_dn_compare_base(c->dn, op->dn);
- if (ret != 0) {
- continue;
+ c = talloc_zero(t->mem, struct descriptor_changes);
+ if (c == NULL) {
+ return ldb_module_oom(module);
}
-
- parent_mem = c;
- parent_change = c;
- break;
+ c->nc_root = ldb_dn_copy(c, op->nc_root);
+ if (c->nc_root == NULL) {
+ return ldb_module_oom(module);
+ }
+ c->guid = op->guid;
}
- c = talloc_zero(parent_mem, struct descriptor_changes);
- if (c == NULL) {
- return ldb_module_oom(module);
- }
- c->nc_root = ldb_dn_copy(c, op->nc_root);
- if (c->nc_root == NULL) {
- return ldb_module_oom(module);
- }
- c->dn = ldb_dn_copy(c, op->dn);
- if (c->dn == NULL) {
- return ldb_module_oom(module);
+ if (ldb_dn_compare(c->nc_root, op->nc_root) != 0) {
+ /*
+ * This is an unexpected situation,
+ * we don't expect the nc root to change
+ * during a replication cycle.
+ */
+ DBG_ERR("ERROR: Object %s nc_root changed %s => %s\n",
+ GUID_string(c, &c->guid),
+ ldb_dn_get_extended_linearized(c, c->nc_root, 1),
+ ldb_dn_get_extended_linearized(c, op->nc_root, 1));
+ return ldb_module_operr(module);
}
+
+ c->ref_count += 1;
+
+ /*
+ * Note that we only set, but don't clear values here,
+ * it means c->force_self and c->force_children can
+ * both be true in the end.
+ */
if (op->include_self) {
c->force_self = true;
} else {
c->force_children = true;
}
- if (parent_change != NULL) {
- DLIST_ADD_END(parent_change->children, c);
- } else {
- DLIST_ADD_END(descriptor_private->changes, c);
+ if (c->ref_count == 1) {
+ struct TDB_DATA val = make_tdb_data((const void*)&c, sizeof(c));
+
+ /*
+ * Remember the change by objectGUID in order
+ * to avoid processing it more than once.
+ */
+
+ status = dbwrap_store(t->changes.map, key, val, TDB_INSERT);
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_debug(ldb, LDB_DEBUG_FATAL,
+ "dbwrap_parse_record() - %s\n",
+ nt_errstr(status));
+ return ldb_module_operr(module);
+ }
+
+ DLIST_ADD_END(t->changes.list, c);
+ t->changes.num_registered += 1;
}
+ t->changes.num_registrations += 1;
return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
}
struct ldb_message *msg,
bool *stop)
{
+ struct descriptor_data *descriptor_private =
+ talloc_get_type_abort(ldb_module_get_private(module),
+ struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
struct ldb_context *ldb = ldb_module_get_ctx(module);
struct ldb_request *sub_req;
struct ldb_result *mod_res;
*stop = false;
+ t->objects.num_processed += 1;
+
mod_res = talloc_zero(msg, struct ldb_result);
if (mod_res == NULL) {
return ldb_module_oom(module);
return ldb_dn_compare(dn2, dn1);
}
-static int descriptor_sd_propagation_dn_sort(struct ldb_dn *dn1,
- struct ldb_dn *dn2)
-{
- /*
- * This sorts in tree order, parents first
- */
- return ldb_dn_compare(dn2, dn1);
-}
-
static int descriptor_sd_propagation_recursive(struct ldb_module *module,
struct descriptor_changes *change)
{
- struct ldb_context *ldb = ldb_module_get_ctx(module);
+ struct descriptor_data *descriptor_private =
+ talloc_get_type_abort(ldb_module_get_private(module),
+ struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
+ struct ldb_result *guid_res = NULL;
struct ldb_result *res = NULL;
unsigned int i;
const char * const no_attrs[] = { "@__NONE__", NULL };
- struct descriptor_changes *c;
- struct descriptor_changes *stopped_stack = NULL;
- enum ldb_scope scope;
+ struct ldb_dn *stopped_dn = NULL;
+ struct GUID_txt_buf guid_buf;
int ret;
+ bool stop = false;
+
+ t->changes.num_processed += 1;
/*
- * First confirm this object has children, or exists (depending on change->force_self)
+ * First confirm this object has children, or exists
+ * (depending on change->force_self)
*
* LDB_SCOPE_SUBTREE searches are expensive.
*
- * Note: that we do not search for deleted/recycled objects
- *
* We know this is safe against a rename race as we are in the
* prepare_commit(), so must be in a transaction.
*/
+
+ /* Find the DN by GUID, as this is stable under rename */
+ ret = dsdb_module_search(module,
+ change,
+ &guid_res,
+ change->nc_root,
+ LDB_SCOPE_SUBTREE,
+ no_attrs,
+ DSDB_FLAG_NEXT_MODULE |
+ DSDB_FLAG_AS_SYSTEM |
+ DSDB_SEARCH_SHOW_DELETED |
+ DSDB_SEARCH_SHOW_RECYCLED,
+ NULL, /* parent_req */
+ "(objectGUID=%s)",
+ GUID_buf_string(&change->guid,
+ &guid_buf));
+
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+
+ if (guid_res->count != 1) {
+ /*
+ * We were just given this GUID during the same
+ * transaction, if it is missing this is a big
+ * problem.
+ *
+ * Cleanup of tombstones does not trigger this module
+ * as it just does a delete.
+ */
+ ldb_asprintf_errstring(ldb_module_get_ctx(module),
+ "failed to find GUID %s under %s "
+ "for transaction-end SD inheritance: %d results",
+ GUID_buf_string(&change->guid,
+ &guid_buf),
+ ldb_dn_get_linearized(change->nc_root),
+ guid_res->count);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ /*
+ * OK, so there was a parent, are there children? Note: that
+ * this time we do not search for deleted/recycled objects
+ */
ret = dsdb_module_search(module,
change,
&res,
- change->dn,
+ guid_res->msgs[0]->dn,
LDB_SCOPE_ONELEVEL,
no_attrs,
DSDB_FLAG_NEXT_MODULE |
NULL, /* parent_req */
"(objectClass=*)");
if (ret != LDB_SUCCESS) {
+ /*
+ * LDB_ERR_NO_SUCH_OBJECT, say if the DN was a deleted
+ * object, is ignored by the caller
+ */
return ret;
}
if (res->count == 0 && !change->force_self) {
+ /* All done, no children */
TALLOC_FREE(res);
return LDB_SUCCESS;
- } else if (res->count == 0 && change->force_self) {
- scope = LDB_SCOPE_BASE;
- } else {
- scope = LDB_SCOPE_SUBTREE;
}
/*
+ * First, if we are in force_self mode (eg renamed under new
+ * parent) then apply the SD to the top object
+ */
+ if (change->force_self) {
+ ret = descriptor_sd_propagation_object(module,
+ guid_res->msgs[0],
+ &stop);
+ if (ret != LDB_SUCCESS) {
+ TALLOC_FREE(guid_res);
+ return ret;
+ }
+
+ if (stop == true && !change->force_children) {
+ /* There was no change, nothing more to do */
+ TALLOC_FREE(guid_res);
+ return LDB_SUCCESS;
+ }
+
+ if (res->count == 0) {
+ /* All done! */
+ TALLOC_FREE(guid_res);
+ return LDB_SUCCESS;
+ }
+ }
+
+ /*
+ * Look for children
+ *
* Note: that we do not search for deleted/recycled objects
*/
ret = dsdb_module_search(module,
change,
&res,
- change->dn,
- scope,
+ guid_res->msgs[0]->dn,
+ LDB_SCOPE_SUBTREE,
no_attrs,
DSDB_FLAG_NEXT_MODULE |
DSDB_FLAG_AS_SYSTEM,
TYPESAFE_QSORT(res->msgs, res->count,
descriptor_sd_propagation_msg_sort);
- for (c = change->children; c; c = c->next) {
- struct ldb_message *msg = NULL;
-
- BINARY_ARRAY_SEARCH_P(res->msgs, res->count, dn, c->dn,
- descriptor_sd_propagation_dn_sort,
- msg);
-
- if (msg == NULL) {
- ldb_debug(ldb, LDB_DEBUG_WARNING,
- "descriptor_sd_propagation_recursive: "
- "%s not found under %s",
- ldb_dn_get_linearized(c->dn),
- ldb_dn_get_linearized(change->dn));
- continue;
- }
-
- msg->elements = (struct ldb_message_element *)c;
- }
-
- DLIST_ADD(stopped_stack, change);
-
- if (change->force_self) {
- i = 0;
- } else {
- i = 1;
- }
-
- for (; i < res->count; i++) {
- struct descriptor_changes *cur;
- bool stop = false;
-
- cur = talloc_get_type(res->msgs[i]->elements,
- struct descriptor_changes);
- res->msgs[i]->elements = NULL;
- res->msgs[i]->num_elements = 0;
-
- if (cur != NULL) {
- DLIST_REMOVE(change->children, cur);
- }
-
- for (c = stopped_stack; c; c = stopped_stack) {
- ret = ldb_dn_compare_base(c->dn,
- res->msgs[i]->dn);
- if (ret == 0) {
- break;
- }
-
- c->stopped_dn = NULL;
- DLIST_REMOVE(stopped_stack, c);
- }
-
- if (cur != NULL) {
- DLIST_ADD(stopped_stack, cur);
- }
-
- if (stopped_stack->stopped_dn != NULL) {
- ret = ldb_dn_compare_base(stopped_stack->stopped_dn,
+ /* We start from 1, the top object has been done */
+ for (i = 1; i < res->count; i++) {
+ /*
+ * ldb_dn_compare_base() does not match for NULL but
+ * this is clearer
+ */
+ if (stopped_dn != NULL) {
+ ret = ldb_dn_compare_base(stopped_dn,
res->msgs[i]->dn);
+ /*
+ * Skip further processing of this
+ * sub-subtree
+ */
if (ret == 0) {
continue;
}
- stopped_stack->stopped_dn = NULL;
}
-
- ret = descriptor_sd_propagation_object(module, res->msgs[i],
+ ret = descriptor_sd_propagation_object(module,
+ res->msgs[i],
&stop);
if (ret != LDB_SUCCESS) {
return ret;
}
- if (cur != NULL && cur->force_children) {
- continue;
- }
-
if (stop) {
- stopped_stack->stopped_dn = res->msgs[i]->dn;
- continue;
+ /*
+ * If this child didn't change, then nothing
+ * under it needs to change
+ *
+ * res has been sorted into tree order so the
+ * next few entries can be skipped
+ */
+ stopped_dn = res->msgs[i]->dn;
}
}
struct descriptor_data *descriptor_private =
talloc_get_type_abort(ldb_module_get_private(module),
struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
- if (descriptor_private->trans_mem != NULL) {
+ if (t->mem != NULL) {
return ldb_module_operr(module);
}
- descriptor_private->trans_mem = talloc_new(descriptor_private);
- if (descriptor_private->trans_mem == NULL) {
+ *t = (struct descriptor_transaction) { .mem = NULL, };
+ t->mem = talloc_new(descriptor_private);
+ if (t->mem == NULL) {
+ return ldb_module_oom(module);
+ }
+ t->changes.map = db_open_rbt(t->mem);
+ if (t->changes.map == NULL) {
+ TALLOC_FREE(t->mem);
+ *t = (struct descriptor_transaction) { .mem = NULL, };
return ldb_module_oom(module);
}
- descriptor_private->changes = NULL;
return ldb_next_start_trans(module);
}
struct descriptor_data *descriptor_private =
talloc_get_type_abort(ldb_module_get_private(module),
struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
struct descriptor_changes *c, *n;
int ret;
- for (c = descriptor_private->changes; c; c = n) {
+ DBG_NOTICE("changes: num_registrations=%zu\n",
+ t->changes.num_registrations);
+ DBG_NOTICE("changes: num_registered=%zu\n",
+ t->changes.num_registered);
+
+ for (c = t->changes.list; c; c = n) {
n = c->next;
- DLIST_REMOVE(descriptor_private->changes, c);
+
+ DLIST_REMOVE(t->changes.list, c);
ret = descriptor_sd_propagation_recursive(module, c);
if (ret == LDB_ERR_NO_SUCH_OBJECT) {
}
}
+ DBG_NOTICE("changes: num_processed=%zu\n", t->changes.num_processed);
+ DBG_NOTICE("objects: num_processed=%zu\n", t->objects.num_processed);
+
return ldb_next_prepare_commit(module);
}
struct descriptor_data *descriptor_private =
talloc_get_type_abort(ldb_module_get_private(module),
struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
- TALLOC_FREE(descriptor_private->trans_mem);
- descriptor_private->changes = NULL;
+ TALLOC_FREE(t->mem);
+ *t = (struct descriptor_transaction) { .mem = NULL, };
return ldb_next_end_trans(module);
}
struct descriptor_data *descriptor_private =
talloc_get_type_abort(ldb_module_get_private(module),
struct descriptor_data);
+ struct descriptor_transaction *t = &descriptor_private->transaction;
- TALLOC_FREE(descriptor_private->trans_mem);
- descriptor_private->changes = NULL;
+ TALLOC_FREE(t->mem);
+ *t = (struct descriptor_transaction) { .mem = NULL, };
return ldb_next_del_trans(module);
}
git.samba.org / samba.git / blobdiff