4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/session.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl, NULL);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = ldb_controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 ldb_controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent, parent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
516 if (ldb_msg_find_element(msg, attr) != NULL) {
520 s = ldb_timestring(msg, t);
522 return LDB_ERR_OPERATIONS_ERROR;
525 ret = ldb_msg_add_string(msg, attr, s);
526 if (ret != LDB_SUCCESS) {
530 el = ldb_msg_find_element(msg, attr);
531 /* always set as replace. This works because on add ops, the flag
533 el->flags = LDB_FLAG_MOD_REPLACE;
539 add a uint64_t element to a record
541 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
542 const char *attr, uint64_t v)
544 struct ldb_message_element *el;
547 if (ldb_msg_find_element(msg, attr) != NULL) {
551 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
552 if (ret != LDB_SUCCESS) {
556 el = ldb_msg_find_element(msg, attr);
557 /* always set as replace. This works because on add ops, the flag
559 el->flags = LDB_FLAG_MOD_REPLACE;
564 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
565 const struct replPropertyMetaData1 *m2,
566 const uint32_t *rdn_attid)
568 if (m1->attid == m2->attid) {
573 * the rdn attribute should be at the end!
574 * so we need to return a value greater than zero
575 * which means m1 is greater than m2
577 if (m1->attid == *rdn_attid) {
582 * the rdn attribute should be at the end!
583 * so we need to return a value less than zero
584 * which means m2 is greater than m1
586 if (m2->attid == *rdn_attid) {
590 return m1->attid > m2->attid ? 1 : -1;
593 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
594 const struct dsdb_schema *schema,
597 const char *rdn_name;
598 const struct dsdb_attribute *rdn_sa;
600 rdn_name = ldb_dn_get_rdn_name(dn);
602 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
603 return LDB_ERR_OPERATIONS_ERROR;
606 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
607 if (rdn_sa == NULL) {
608 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
609 return LDB_ERR_OPERATIONS_ERROR;
612 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
613 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
615 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
620 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
621 const struct ldb_message_element *e2,
622 const struct dsdb_schema *schema)
624 const struct dsdb_attribute *a1;
625 const struct dsdb_attribute *a2;
628 * TODO: make this faster by caching the dsdb_attribute pointer
629 * on the ldb_messag_element
632 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
633 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
636 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
640 return strcasecmp(e1->name, e2->name);
642 if (a1->attributeID_id == a2->attributeID_id) {
645 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
648 static void replmd_ldb_message_sort(struct ldb_message *msg,
649 const struct dsdb_schema *schema)
651 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
654 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
655 const struct GUID *invocation_id, uint64_t seq_num,
656 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
660 fix up linked attributes in replmd_add.
661 This involves setting up the right meta-data in extended DN
662 components, and creating backlinks to the object
664 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
665 uint64_t seq_num, const struct GUID *invocationId, time_t t,
666 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
669 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
670 struct ldb_context *ldb = ldb_module_get_ctx(module);
672 /* We will take a reference to the schema in replmd_add_backlink */
673 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
676 unix_to_nt_time(&now, t);
678 for (i=0; i<el->num_values; i++) {
679 struct ldb_val *v = &el->values[i];
680 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
681 struct GUID target_guid;
685 /* note that the DN already has the extended
686 components from the extended_dn_store module */
687 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
688 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
689 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
694 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
695 if (ret != LDB_SUCCESS) {
696 talloc_free(tmp_ctx);
701 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
702 seq_num, seq_num, now, 0, false);
703 if (ret != LDB_SUCCESS) {
704 talloc_free(tmp_ctx);
708 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
709 if (ret != LDB_SUCCESS) {
710 talloc_free(tmp_ctx);
715 talloc_free(tmp_ctx);
721 intercept add requests
723 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
725 struct ldb_context *ldb;
726 struct ldb_control *control;
727 struct replmd_replicated_request *ac;
728 enum ndr_err_code ndr_err;
729 struct ldb_request *down_req;
730 struct ldb_message *msg;
731 const DATA_BLOB *guid_blob;
733 struct replPropertyMetaDataBlob nmd;
734 struct ldb_val nmd_value;
735 const struct GUID *our_invocation_id;
736 time_t t = time(NULL);
741 unsigned int functional_level;
743 bool allow_add_guid = false;
744 bool remove_current_guid = false;
745 bool is_urgent = false;
746 struct ldb_message_element *objectclass_el;
748 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
749 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
751 allow_add_guid = true;
754 /* do not manipulate our control entries */
755 if (ldb_dn_is_special(req->op.add.message->dn)) {
756 return ldb_next_request(module, req);
759 ldb = ldb_module_get_ctx(module);
761 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
763 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
764 if (guid_blob != NULL) {
765 if (!allow_add_guid) {
766 ldb_set_errstring(ldb,
767 "replmd_add: it's not allowed to add an object with objectGUID!");
768 return LDB_ERR_UNWILLING_TO_PERFORM;
770 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
771 if (!NT_STATUS_IS_OK(status)) {
772 ldb_set_errstring(ldb,
773 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
774 return LDB_ERR_UNWILLING_TO_PERFORM;
776 /* we remove this attribute as it can be a string and
777 * will not be treated correctly and then we will re-add
778 * it later on in the good format */
779 remove_current_guid = true;
783 guid = GUID_random();
786 ac = replmd_ctx_init(module, req);
788 return ldb_module_oom(module);
791 functional_level = dsdb_functional_level(ldb);
793 /* Get a sequence number from the backend */
794 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
795 if (ret != LDB_SUCCESS) {
800 /* get our invocationId */
801 our_invocation_id = samdb_ntds_invocation_id(ldb);
802 if (!our_invocation_id) {
803 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
804 "replmd_add: unable to find invocationId\n");
806 return LDB_ERR_OPERATIONS_ERROR;
809 /* we have to copy the message as the caller might have it as a const */
810 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
814 return LDB_ERR_OPERATIONS_ERROR;
817 /* generated times */
818 unix_to_nt_time(&now, t);
819 time_str = ldb_timestring(msg, t);
823 return LDB_ERR_OPERATIONS_ERROR;
825 if (remove_current_guid) {
826 ldb_msg_remove_attr(msg,"objectGUID");
830 * remove autogenerated attributes
832 ldb_msg_remove_attr(msg, "whenCreated");
833 ldb_msg_remove_attr(msg, "whenChanged");
834 ldb_msg_remove_attr(msg, "uSNCreated");
835 ldb_msg_remove_attr(msg, "uSNChanged");
836 ldb_msg_remove_attr(msg, "replPropertyMetaData");
839 * readd replicated attributes
841 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
842 if (ret != LDB_SUCCESS) {
848 /* build the replication meta_data */
851 nmd.ctr.ctr1.count = msg->num_elements;
852 nmd.ctr.ctr1.array = talloc_array(msg,
853 struct replPropertyMetaData1,
855 if (!nmd.ctr.ctr1.array) {
858 return LDB_ERR_OPERATIONS_ERROR;
861 for (i=0; i < msg->num_elements; i++) {
862 struct ldb_message_element *e = &msg->elements[i];
863 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
864 const struct dsdb_attribute *sa;
866 if (e->name[0] == '@') continue;
868 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
870 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
871 "replmd_add: attribute '%s' not defined in schema\n",
874 return LDB_ERR_NO_SUCH_ATTRIBUTE;
877 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
878 /* if the attribute is not replicated (0x00000001)
879 * or constructed (0x00000004) it has no metadata
884 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
885 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
886 if (ret != LDB_SUCCESS) {
890 /* linked attributes are not stored in
891 replPropertyMetaData in FL above w2k */
895 m->attid = sa->attributeID_id;
897 m->originating_change_time = now;
898 m->originating_invocation_id = *our_invocation_id;
899 m->originating_usn = ac->seq_num;
900 m->local_usn = ac->seq_num;
904 /* fix meta data count */
905 nmd.ctr.ctr1.count = ni;
908 * sort meta data array, and move the rdn attribute entry to the end
910 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
911 if (ret != LDB_SUCCESS) {
916 /* generated NDR encoded values */
917 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
919 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
920 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
923 return LDB_ERR_OPERATIONS_ERROR;
927 * add the autogenerated values
929 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
930 if (ret != LDB_SUCCESS) {
935 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
936 if (ret != LDB_SUCCESS) {
941 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
942 if (ret != LDB_SUCCESS) {
947 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
948 if (ret != LDB_SUCCESS) {
953 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
954 if (ret != LDB_SUCCESS) {
961 * sort the attributes by attid before storing the object
963 replmd_ldb_message_sort(msg, ac->schema);
965 objectclass_el = ldb_msg_find_element(msg, "objectClass");
966 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
967 REPL_URGENT_ON_CREATE);
969 ac->is_urgent = is_urgent;
970 ret = ldb_build_add_req(&down_req, ldb, ac,
973 ac, replmd_op_callback,
976 LDB_REQ_SET_LOCATION(down_req);
977 if (ret != LDB_SUCCESS) {
982 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
983 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
984 if (ret != LDB_SUCCESS) {
990 /* mark the control done */
992 control->critical = 0;
995 /* go on with the call chain */
996 return ldb_next_request(module, down_req);
1001 * update the replPropertyMetaData for one element
1003 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1004 struct ldb_message *msg,
1005 struct ldb_message_element *el,
1006 struct ldb_message_element *old_el,
1007 struct replPropertyMetaDataBlob *omd,
1008 const struct dsdb_schema *schema,
1010 const struct GUID *our_invocation_id,
1014 const struct dsdb_attribute *a;
1015 struct replPropertyMetaData1 *md1;
1017 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1019 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1021 return LDB_ERR_OPERATIONS_ERROR;
1024 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1028 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1029 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1033 for (i=0; i<omd->ctr.ctr1.count; i++) {
1034 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1037 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1038 /* linked attributes are not stored in
1039 replPropertyMetaData in FL above w2k, but we do
1040 raise the seqnum for the object */
1041 if (*seq_num == 0 &&
1042 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1043 return LDB_ERR_OPERATIONS_ERROR;
1048 if (i == omd->ctr.ctr1.count) {
1049 /* we need to add a new one */
1050 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1051 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1052 if (omd->ctr.ctr1.array == NULL) {
1054 return LDB_ERR_OPERATIONS_ERROR;
1056 omd->ctr.ctr1.count++;
1057 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1060 /* Get a new sequence number from the backend. We only do this
1061 * if we have a change that requires a new
1062 * replPropertyMetaData element
1064 if (*seq_num == 0) {
1065 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1066 if (ret != LDB_SUCCESS) {
1067 return LDB_ERR_OPERATIONS_ERROR;
1071 md1 = &omd->ctr.ctr1.array[i];
1073 md1->attid = a->attributeID_id;
1074 md1->originating_change_time = now;
1075 md1->originating_invocation_id = *our_invocation_id;
1076 md1->originating_usn = *seq_num;
1077 md1->local_usn = *seq_num;
1082 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1084 uint32_t count = omd.ctr.ctr1.count;
1087 for (i=0; i < count; i++) {
1088 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1089 if (max < m.local_usn) {
1097 * update the replPropertyMetaData object each time we modify an
1098 * object. This is needed for DRS replication, as the merge on the
1099 * client is based on this object
1101 static int replmd_update_rpmd(struct ldb_module *module,
1102 const struct dsdb_schema *schema,
1103 struct ldb_request *req,
1104 struct ldb_message *msg, uint64_t *seq_num,
1108 const struct ldb_val *omd_value;
1109 enum ndr_err_code ndr_err;
1110 struct replPropertyMetaDataBlob omd;
1113 const struct GUID *our_invocation_id;
1115 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1116 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1117 struct ldb_result *res;
1118 struct ldb_context *ldb;
1119 struct ldb_message_element *objectclass_el;
1120 enum urgent_situation situation;
1121 bool rodc, rmd_is_provided;
1123 ldb = ldb_module_get_ctx(module);
1125 our_invocation_id = samdb_ntds_invocation_id(ldb);
1126 if (!our_invocation_id) {
1127 /* this happens during an initial vampire while
1128 updating the schema */
1129 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1133 unix_to_nt_time(&now, t);
1135 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1136 rmd_is_provided = true;
1138 rmd_is_provided = false;
1141 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1142 * otherwise we consider we are updating */
1143 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1144 situation = REPL_URGENT_ON_DELETE;
1146 situation = REPL_URGENT_ON_UPDATE;
1149 if (rmd_is_provided) {
1150 /* In this case the change_replmetadata control was supplied */
1151 /* We check that it's the only attribute that is provided
1152 * (it's a rare case so it's better to keep the code simplier)
1153 * We also check that the highest local_usn is bigger than
1156 if( msg->num_elements != 1 ||
1157 strncmp(msg->elements[0].name,
1158 "replPropertyMetaData", 20) ) {
1159 DEBUG(0,(__location__ ": changereplmetada control called without "\
1160 "a specified replPropertyMetaData attribute or with others\n"));
1161 return LDB_ERR_OPERATIONS_ERROR;
1163 if (situation == REPL_URGENT_ON_DELETE) {
1164 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1165 return LDB_ERR_OPERATIONS_ERROR;
1167 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1169 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1170 ldb_dn_get_linearized(msg->dn)));
1171 return LDB_ERR_OPERATIONS_ERROR;
1173 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1174 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1175 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1176 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1177 ldb_dn_get_linearized(msg->dn)));
1178 return LDB_ERR_OPERATIONS_ERROR;
1180 *seq_num = find_max_local_usn(omd);
1182 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1183 DSDB_FLAG_NEXT_MODULE |
1184 DSDB_SEARCH_SHOW_RECYCLED |
1185 DSDB_SEARCH_SHOW_EXTENDED_DN |
1186 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1187 DSDB_SEARCH_REVEAL_INTERNALS, req);
1189 if (ret != LDB_SUCCESS || res->count != 1) {
1190 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1191 ldb_dn_get_linearized(msg->dn)));
1192 return LDB_ERR_OPERATIONS_ERROR;
1195 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1196 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1201 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1202 if (*seq_num <= db_seq) {
1203 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1204 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1205 (long long)*seq_num, (long long)db_seq));
1206 return LDB_ERR_OPERATIONS_ERROR;
1210 /* search for the existing replPropertyMetaDataBlob. We need
1211 * to use REVEAL and ask for DNs in storage format to support
1212 * the check for values being the same in
1213 * replmd_update_rpmd_element()
1215 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1216 DSDB_FLAG_NEXT_MODULE |
1217 DSDB_SEARCH_SHOW_RECYCLED |
1218 DSDB_SEARCH_SHOW_EXTENDED_DN |
1219 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1220 DSDB_SEARCH_REVEAL_INTERNALS, req);
1221 if (ret != LDB_SUCCESS || res->count != 1) {
1222 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1223 ldb_dn_get_linearized(msg->dn)));
1224 return LDB_ERR_OPERATIONS_ERROR;
1227 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1228 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1233 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1235 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1236 ldb_dn_get_linearized(msg->dn)));
1237 return LDB_ERR_OPERATIONS_ERROR;
1240 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1241 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1242 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1243 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1244 ldb_dn_get_linearized(msg->dn)));
1245 return LDB_ERR_OPERATIONS_ERROR;
1248 if (omd.version != 1) {
1249 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1250 omd.version, ldb_dn_get_linearized(msg->dn)));
1251 return LDB_ERR_OPERATIONS_ERROR;
1254 for (i=0; i<msg->num_elements; i++) {
1255 struct ldb_message_element *old_el;
1256 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1257 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1258 our_invocation_id, now);
1259 if (ret != LDB_SUCCESS) {
1263 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1264 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1270 * replmd_update_rpmd_element has done an update if the
1273 if (*seq_num != 0) {
1274 struct ldb_val *md_value;
1275 struct ldb_message_element *el;
1277 /*if we are RODC and this is a DRSR update then its ok*/
1278 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1279 ret = samdb_rodc(ldb, &rodc);
1280 if (ret != LDB_SUCCESS) {
1281 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1283 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1284 return LDB_ERR_REFERRAL;
1288 md_value = talloc(msg, struct ldb_val);
1289 if (md_value == NULL) {
1291 return LDB_ERR_OPERATIONS_ERROR;
1294 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1295 if (ret != LDB_SUCCESS) {
1299 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1300 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1301 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1302 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1303 ldb_dn_get_linearized(msg->dn)));
1304 return LDB_ERR_OPERATIONS_ERROR;
1307 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1308 if (ret != LDB_SUCCESS) {
1309 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1310 ldb_dn_get_linearized(msg->dn)));
1315 el->values = md_value;
1322 struct dsdb_dn *dsdb_dn;
1327 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1329 return GUID_compare(pdn1->guid, pdn2->guid);
1332 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1333 unsigned int count, struct GUID *guid,
1336 struct parsed_dn *ret;
1338 if (dn && GUID_all_zero(guid)) {
1339 /* when updating a link using DRS, we sometimes get a
1340 NULL GUID. We then need to try and match by DN */
1341 for (i=0; i<count; i++) {
1342 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1343 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1349 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1354 get a series of message element values as an array of DNs and GUIDs
1355 the result is sorted by GUID
1357 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1358 struct ldb_message_element *el, struct parsed_dn **pdn,
1359 const char *ldap_oid, struct ldb_request *parent)
1362 struct ldb_context *ldb = ldb_module_get_ctx(module);
1369 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1371 ldb_module_oom(module);
1372 return LDB_ERR_OPERATIONS_ERROR;
1375 for (i=0; i<el->num_values; i++) {
1376 struct ldb_val *v = &el->values[i];
1379 struct parsed_dn *p;
1383 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1384 if (p->dsdb_dn == NULL) {
1385 return LDB_ERR_INVALID_DN_SYNTAX;
1388 dn = p->dsdb_dn->dn;
1390 p->guid = talloc(*pdn, struct GUID);
1391 if (p->guid == NULL) {
1392 ldb_module_oom(module);
1393 return LDB_ERR_OPERATIONS_ERROR;
1396 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1397 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1398 /* we got a DN without a GUID - go find the GUID */
1399 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1400 if (ret != LDB_SUCCESS) {
1401 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1402 ldb_dn_get_linearized(dn));
1405 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1406 if (ret != LDB_SUCCESS) {
1409 } else if (!NT_STATUS_IS_OK(status)) {
1410 return LDB_ERR_OPERATIONS_ERROR;
1413 /* keep a pointer to the original ldb_val */
1417 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1423 build a new extended DN, including all meta data fields
1425 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1426 RMD_ADDTIME = originating_add_time
1427 RMD_INVOCID = originating_invocation_id
1428 RMD_CHANGETIME = originating_change_time
1429 RMD_ORIGINATING_USN = originating_usn
1430 RMD_LOCAL_USN = local_usn
1431 RMD_VERSION = version
1433 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1434 const struct GUID *invocation_id, uint64_t seq_num,
1435 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1437 struct ldb_dn *dn = dsdb_dn->dn;
1438 const char *tstring, *usn_string, *flags_string;
1439 struct ldb_val tval;
1441 struct ldb_val usnv, local_usnv;
1442 struct ldb_val vers, flagsv;
1445 const char *dnstring;
1447 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1449 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1451 return LDB_ERR_OPERATIONS_ERROR;
1453 tval = data_blob_string_const(tstring);
1455 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1457 return LDB_ERR_OPERATIONS_ERROR;
1459 usnv = data_blob_string_const(usn_string);
1461 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1463 return LDB_ERR_OPERATIONS_ERROR;
1465 local_usnv = data_blob_string_const(usn_string);
1467 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1469 return LDB_ERR_OPERATIONS_ERROR;
1471 vers = data_blob_string_const(vstring);
1473 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1474 if (!NT_STATUS_IS_OK(status)) {
1475 return LDB_ERR_OPERATIONS_ERROR;
1478 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1479 if (!flags_string) {
1480 return LDB_ERR_OPERATIONS_ERROR;
1482 flagsv = data_blob_string_const(flags_string);
1484 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1485 if (ret != LDB_SUCCESS) return ret;
1486 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1487 if (ret != LDB_SUCCESS) return ret;
1488 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1489 if (ret != LDB_SUCCESS) return ret;
1490 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1491 if (ret != LDB_SUCCESS) return ret;
1492 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1493 if (ret != LDB_SUCCESS) return ret;
1494 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1495 if (ret != LDB_SUCCESS) return ret;
1496 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1497 if (ret != LDB_SUCCESS) return ret;
1499 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1500 if (dnstring == NULL) {
1501 return LDB_ERR_OPERATIONS_ERROR;
1503 *v = data_blob_string_const(dnstring);
1508 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1509 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1510 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1511 uint32_t version, bool deleted);
1514 check if any links need upgrading from w2k format
1516 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1518 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1521 for (i=0; i<count; i++) {
1526 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1527 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1531 /* it's an old one that needs upgrading */
1532 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1534 if (ret != LDB_SUCCESS) {
1542 update an extended DN, including all meta data fields
1544 see replmd_build_la_val for value names
1546 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1547 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1548 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1549 uint32_t version, bool deleted)
1551 struct ldb_dn *dn = dsdb_dn->dn;
1552 const char *tstring, *usn_string, *flags_string;
1553 struct ldb_val tval;
1555 struct ldb_val usnv, local_usnv;
1556 struct ldb_val vers, flagsv;
1557 const struct ldb_val *old_addtime;
1558 uint32_t old_version;
1561 const char *dnstring;
1563 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1565 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1567 return LDB_ERR_OPERATIONS_ERROR;
1569 tval = data_blob_string_const(tstring);
1571 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1573 return LDB_ERR_OPERATIONS_ERROR;
1575 usnv = data_blob_string_const(usn_string);
1577 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1579 return LDB_ERR_OPERATIONS_ERROR;
1581 local_usnv = data_blob_string_const(usn_string);
1583 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1584 if (!NT_STATUS_IS_OK(status)) {
1585 return LDB_ERR_OPERATIONS_ERROR;
1588 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1589 if (!flags_string) {
1590 return LDB_ERR_OPERATIONS_ERROR;
1592 flagsv = data_blob_string_const(flags_string);
1594 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1595 if (ret != LDB_SUCCESS) return ret;
1597 /* get the ADDTIME from the original */
1598 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1599 if (old_addtime == NULL) {
1600 old_addtime = &tval;
1602 if (dsdb_dn != old_dsdb_dn) {
1603 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1604 if (ret != LDB_SUCCESS) return ret;
1607 /* use our invocation id */
1608 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1609 if (ret != LDB_SUCCESS) return ret;
1611 /* changetime is the current time */
1612 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1613 if (ret != LDB_SUCCESS) return ret;
1615 /* update the USN */
1616 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1617 if (ret != LDB_SUCCESS) return ret;
1619 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1620 if (ret != LDB_SUCCESS) return ret;
1622 /* increase the version by 1 */
1623 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1624 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1625 version = old_version+1;
1627 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1628 vers = data_blob_string_const(vstring);
1629 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1630 if (ret != LDB_SUCCESS) return ret;
1632 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1633 if (dnstring == NULL) {
1634 return LDB_ERR_OPERATIONS_ERROR;
1636 *v = data_blob_string_const(dnstring);
1642 handle adding a linked attribute
1644 static int replmd_modify_la_add(struct ldb_module *module,
1645 const struct dsdb_schema *schema,
1646 struct ldb_message *msg,
1647 struct ldb_message_element *el,
1648 struct ldb_message_element *old_el,
1649 const struct dsdb_attribute *schema_attr,
1652 struct GUID *msg_guid,
1653 struct ldb_request *parent)
1656 struct parsed_dn *dns, *old_dns;
1657 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1659 struct ldb_val *new_values = NULL;
1660 unsigned int num_new_values = 0;
1661 unsigned old_num_values = old_el?old_el->num_values:0;
1662 const struct GUID *invocation_id;
1663 struct ldb_context *ldb = ldb_module_get_ctx(module);
1666 unix_to_nt_time(&now, t);
1668 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1669 if (ret != LDB_SUCCESS) {
1670 talloc_free(tmp_ctx);
1674 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1675 if (ret != LDB_SUCCESS) {
1676 talloc_free(tmp_ctx);
1680 invocation_id = samdb_ntds_invocation_id(ldb);
1681 if (!invocation_id) {
1682 talloc_free(tmp_ctx);
1683 return LDB_ERR_OPERATIONS_ERROR;
1686 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1687 if (ret != LDB_SUCCESS) {
1688 talloc_free(tmp_ctx);
1692 /* for each new value, see if it exists already with the same GUID */
1693 for (i=0; i<el->num_values; i++) {
1694 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1696 /* this is a new linked attribute value */
1697 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1698 if (new_values == NULL) {
1699 ldb_module_oom(module);
1700 talloc_free(tmp_ctx);
1701 return LDB_ERR_OPERATIONS_ERROR;
1703 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1704 invocation_id, seq_num, seq_num, now, 0, false);
1705 if (ret != LDB_SUCCESS) {
1706 talloc_free(tmp_ctx);
1711 /* this is only allowed if the GUID was
1712 previously deleted. */
1713 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1715 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1716 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1717 el->name, GUID_string(tmp_ctx, p->guid));
1718 talloc_free(tmp_ctx);
1719 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1721 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1722 invocation_id, seq_num, seq_num, now, 0, false);
1723 if (ret != LDB_SUCCESS) {
1724 talloc_free(tmp_ctx);
1729 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1730 if (ret != LDB_SUCCESS) {
1731 talloc_free(tmp_ctx);
1736 /* add the new ones on to the end of the old values, constructing a new el->values */
1737 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1739 old_num_values+num_new_values);
1740 if (el->values == NULL) {
1741 ldb_module_oom(module);
1742 return LDB_ERR_OPERATIONS_ERROR;
1745 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1746 el->num_values = old_num_values + num_new_values;
1748 talloc_steal(msg->elements, el->values);
1749 talloc_steal(el->values, new_values);
1751 talloc_free(tmp_ctx);
1753 /* we now tell the backend to replace all existing values
1754 with the one we have constructed */
1755 el->flags = LDB_FLAG_MOD_REPLACE;
1762 handle deleting all active linked attributes
1764 static int replmd_modify_la_delete(struct ldb_module *module,
1765 const struct dsdb_schema *schema,
1766 struct ldb_message *msg,
1767 struct ldb_message_element *el,
1768 struct ldb_message_element *old_el,
1769 const struct dsdb_attribute *schema_attr,
1772 struct GUID *msg_guid,
1773 struct ldb_request *parent)
1776 struct parsed_dn *dns, *old_dns;
1777 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1779 const struct GUID *invocation_id;
1780 struct ldb_context *ldb = ldb_module_get_ctx(module);
1783 unix_to_nt_time(&now, t);
1785 /* check if there is nothing to delete */
1786 if ((!old_el || old_el->num_values == 0) &&
1787 el->num_values == 0) {
1791 if (!old_el || old_el->num_values == 0) {
1792 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1795 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1796 if (ret != LDB_SUCCESS) {
1797 talloc_free(tmp_ctx);
1801 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1802 if (ret != LDB_SUCCESS) {
1803 talloc_free(tmp_ctx);
1807 invocation_id = samdb_ntds_invocation_id(ldb);
1808 if (!invocation_id) {
1809 return LDB_ERR_OPERATIONS_ERROR;
1812 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1813 if (ret != LDB_SUCCESS) {
1814 talloc_free(tmp_ctx);
1820 /* see if we are being asked to delete any links that
1821 don't exist or are already deleted */
1822 for (i=0; i<el->num_values; i++) {
1823 struct parsed_dn *p = &dns[i];
1824 struct parsed_dn *p2;
1827 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1829 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1830 el->name, GUID_string(tmp_ctx, p->guid));
1831 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1833 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1834 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1835 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1836 el->name, GUID_string(tmp_ctx, p->guid));
1837 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1841 /* for each new value, see if it exists already with the same GUID
1842 if it is not already deleted and matches the delete list then delete it
1844 for (i=0; i<old_el->num_values; i++) {
1845 struct parsed_dn *p = &old_dns[i];
1848 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1852 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1853 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1855 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1856 invocation_id, seq_num, seq_num, now, 0, true);
1857 if (ret != LDB_SUCCESS) {
1858 talloc_free(tmp_ctx);
1862 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1863 if (ret != LDB_SUCCESS) {
1864 talloc_free(tmp_ctx);
1869 el->values = talloc_steal(msg->elements, old_el->values);
1870 el->num_values = old_el->num_values;
1872 talloc_free(tmp_ctx);
1874 /* we now tell the backend to replace all existing values
1875 with the one we have constructed */
1876 el->flags = LDB_FLAG_MOD_REPLACE;
1882 handle replacing a linked attribute
1884 static int replmd_modify_la_replace(struct ldb_module *module,
1885 const struct dsdb_schema *schema,
1886 struct ldb_message *msg,
1887 struct ldb_message_element *el,
1888 struct ldb_message_element *old_el,
1889 const struct dsdb_attribute *schema_attr,
1892 struct GUID *msg_guid,
1893 struct ldb_request *parent)
1896 struct parsed_dn *dns, *old_dns;
1897 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1899 const struct GUID *invocation_id;
1900 struct ldb_context *ldb = ldb_module_get_ctx(module);
1901 struct ldb_val *new_values = NULL;
1902 unsigned int num_new_values = 0;
1903 unsigned int old_num_values = old_el?old_el->num_values:0;
1906 unix_to_nt_time(&now, t);
1908 /* check if there is nothing to replace */
1909 if ((!old_el || old_el->num_values == 0) &&
1910 el->num_values == 0) {
1914 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1915 if (ret != LDB_SUCCESS) {
1916 talloc_free(tmp_ctx);
1920 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1921 if (ret != LDB_SUCCESS) {
1922 talloc_free(tmp_ctx);
1926 invocation_id = samdb_ntds_invocation_id(ldb);
1927 if (!invocation_id) {
1928 return LDB_ERR_OPERATIONS_ERROR;
1931 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1932 if (ret != LDB_SUCCESS) {
1933 talloc_free(tmp_ctx);
1937 /* mark all the old ones as deleted */
1938 for (i=0; i<old_num_values; i++) {
1939 struct parsed_dn *old_p = &old_dns[i];
1940 struct parsed_dn *p;
1941 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1943 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1945 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1946 if (ret != LDB_SUCCESS) {
1947 talloc_free(tmp_ctx);
1951 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1953 /* we don't delete it if we are re-adding it */
1957 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1958 invocation_id, seq_num, seq_num, now, 0, true);
1959 if (ret != LDB_SUCCESS) {
1960 talloc_free(tmp_ctx);
1965 /* for each new value, either update its meta-data, or add it
1968 for (i=0; i<el->num_values; i++) {
1969 struct parsed_dn *p = &dns[i], *old_p;
1972 (old_p = parsed_dn_find(old_dns,
1973 old_num_values, p->guid, NULL)) != NULL) {
1974 /* update in place */
1975 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1976 old_p->dsdb_dn, invocation_id,
1977 seq_num, seq_num, now, 0, false);
1978 if (ret != LDB_SUCCESS) {
1979 talloc_free(tmp_ctx);
1984 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1986 if (new_values == NULL) {
1987 ldb_module_oom(module);
1988 talloc_free(tmp_ctx);
1989 return LDB_ERR_OPERATIONS_ERROR;
1991 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1992 invocation_id, seq_num, seq_num, now, 0, false);
1993 if (ret != LDB_SUCCESS) {
1994 talloc_free(tmp_ctx);
2000 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2001 if (ret != LDB_SUCCESS) {
2002 talloc_free(tmp_ctx);
2007 /* add the new values to the end of old_el */
2008 if (num_new_values != 0) {
2009 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2010 struct ldb_val, old_num_values+num_new_values);
2011 if (el->values == NULL) {
2012 ldb_module_oom(module);
2013 return LDB_ERR_OPERATIONS_ERROR;
2015 memcpy(&el->values[old_num_values], &new_values[0],
2016 sizeof(struct ldb_val)*num_new_values);
2017 el->num_values = old_num_values + num_new_values;
2018 talloc_steal(msg->elements, new_values);
2020 el->values = old_el->values;
2021 el->num_values = old_el->num_values;
2022 talloc_steal(msg->elements, el->values);
2025 talloc_free(tmp_ctx);
2027 /* we now tell the backend to replace all existing values
2028 with the one we have constructed */
2029 el->flags = LDB_FLAG_MOD_REPLACE;
2036 handle linked attributes in modify requests
2038 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2039 struct ldb_message *msg,
2040 uint64_t seq_num, time_t t,
2041 struct ldb_request *parent)
2043 struct ldb_result *res;
2046 struct ldb_context *ldb = ldb_module_get_ctx(module);
2047 struct ldb_message *old_msg;
2049 const struct dsdb_schema *schema;
2050 struct GUID old_guid;
2053 /* there the replmd_update_rpmd code has already
2054 * checked and saw that there are no linked
2059 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2060 /* don't do anything special for linked attributes */
2064 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2065 DSDB_FLAG_NEXT_MODULE |
2066 DSDB_SEARCH_SHOW_RECYCLED |
2067 DSDB_SEARCH_REVEAL_INTERNALS |
2068 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2070 if (ret != LDB_SUCCESS) {
2073 schema = dsdb_get_schema(ldb, res);
2075 return LDB_ERR_OPERATIONS_ERROR;
2078 old_msg = res->msgs[0];
2080 old_guid = samdb_result_guid(old_msg, "objectGUID");
2082 for (i=0; i<msg->num_elements; i++) {
2083 struct ldb_message_element *el = &msg->elements[i];
2084 struct ldb_message_element *old_el, *new_el;
2085 const struct dsdb_attribute *schema_attr
2086 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2088 ldb_asprintf_errstring(ldb,
2089 "%s: attribute %s is not a valid attribute in schema",
2090 __FUNCTION__, el->name);
2091 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2093 if (schema_attr->linkID == 0) {
2096 if ((schema_attr->linkID & 1) == 1) {
2097 /* Odd is for the target. Illegal to modify */
2098 ldb_asprintf_errstring(ldb,
2099 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2100 return LDB_ERR_UNWILLING_TO_PERFORM;
2102 old_el = ldb_msg_find_element(old_msg, el->name);
2103 switch (el->flags & LDB_FLAG_MOD_MASK) {
2104 case LDB_FLAG_MOD_REPLACE:
2105 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2107 case LDB_FLAG_MOD_DELETE:
2108 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2110 case LDB_FLAG_MOD_ADD:
2111 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2114 ldb_asprintf_errstring(ldb,
2115 "invalid flags 0x%x for %s linked attribute",
2116 el->flags, el->name);
2117 return LDB_ERR_UNWILLING_TO_PERFORM;
2119 if (ret != LDB_SUCCESS) {
2123 ldb_msg_remove_attr(old_msg, el->name);
2125 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2126 new_el->num_values = el->num_values;
2127 new_el->values = talloc_steal(msg->elements, el->values);
2129 /* TODO: this relises a bit too heavily on the exact
2130 behaviour of ldb_msg_find_element and
2131 ldb_msg_remove_element */
2132 old_el = ldb_msg_find_element(msg, el->name);
2134 ldb_msg_remove_element(msg, old_el);
2145 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2147 struct ldb_context *ldb;
2148 struct replmd_replicated_request *ac;
2149 struct ldb_request *down_req;
2150 struct ldb_message *msg;
2151 time_t t = time(NULL);
2153 bool is_urgent = false;
2154 struct loadparm_context *lp_ctx;
2156 unsigned int functional_level;
2157 const DATA_BLOB *guid_blob;
2159 /* do not manipulate our control entries */
2160 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2161 return ldb_next_request(module, req);
2164 ldb = ldb_module_get_ctx(module);
2166 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2168 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2169 if ( guid_blob != NULL ) {
2170 ldb_set_errstring(ldb,
2171 "replmd_modify: it's not allowed to change the objectGUID!");
2172 return LDB_ERR_CONSTRAINT_VIOLATION;
2175 ac = replmd_ctx_init(module, req);
2177 return ldb_module_oom(module);
2180 functional_level = dsdb_functional_level(ldb);
2182 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2183 struct loadparm_context);
2185 /* we have to copy the message as the caller might have it as a const */
2186 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2190 return LDB_ERR_OPERATIONS_ERROR;
2193 ldb_msg_remove_attr(msg, "whenChanged");
2194 ldb_msg_remove_attr(msg, "uSNChanged");
2196 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2197 if (ret == LDB_ERR_REFERRAL) {
2198 referral = talloc_asprintf(req,
2200 lpcfg_dnsdomain(lp_ctx),
2201 ldb_dn_get_linearized(msg->dn));
2202 ret = ldb_module_send_referral(req, referral);
2204 return ldb_module_done(req, NULL, NULL, ret);
2207 if (ret != LDB_SUCCESS) {
2212 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2213 if (ret != LDB_SUCCESS) {
2219 * - replace the old object with the newly constructed one
2222 ac->is_urgent = is_urgent;
2224 ret = ldb_build_mod_req(&down_req, ldb, ac,
2227 ac, replmd_op_callback,
2229 LDB_REQ_SET_LOCATION(down_req);
2230 if (ret != LDB_SUCCESS) {
2235 /* If we are in functional level 2000, then
2236 * replmd_modify_handle_linked_attribs will have done
2238 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2239 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2240 if (ret != LDB_SUCCESS) {
2246 talloc_steal(down_req, msg);
2248 /* we only change whenChanged and uSNChanged if the seq_num
2250 if (ac->seq_num != 0) {
2251 ret = add_time_element(msg, "whenChanged", t);
2252 if (ret != LDB_SUCCESS) {
2257 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2258 if (ret != LDB_SUCCESS) {
2264 /* go on with the call chain */
2265 return ldb_next_request(module, down_req);
2268 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2271 handle a rename request
2273 On a rename we need to do an extra ldb_modify which sets the
2274 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2276 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2278 struct ldb_context *ldb;
2279 struct replmd_replicated_request *ac;
2281 struct ldb_request *down_req;
2283 /* do not manipulate our control entries */
2284 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2285 return ldb_next_request(module, req);
2288 ldb = ldb_module_get_ctx(module);
2290 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2292 ac = replmd_ctx_init(module, req);
2294 return ldb_module_oom(module);
2297 ret = ldb_build_rename_req(&down_req, ldb, ac,
2298 ac->req->op.rename.olddn,
2299 ac->req->op.rename.newdn,
2301 ac, replmd_rename_callback,
2303 LDB_REQ_SET_LOCATION(down_req);
2304 if (ret != LDB_SUCCESS) {
2309 /* go on with the call chain */
2310 return ldb_next_request(module, down_req);
2313 /* After the rename is compleated, update the whenchanged etc */
2314 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2316 struct ldb_context *ldb;
2317 struct replmd_replicated_request *ac;
2318 struct ldb_request *down_req;
2319 struct ldb_message *msg;
2320 time_t t = time(NULL);
2323 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2324 ldb = ldb_module_get_ctx(ac->module);
2326 if (ares->error != LDB_SUCCESS) {
2327 return ldb_module_done(ac->req, ares->controls,
2328 ares->response, ares->error);
2331 if (ares->type != LDB_REPLY_DONE) {
2332 ldb_set_errstring(ldb,
2333 "invalid ldb_reply_type in callback");
2335 return ldb_module_done(ac->req, NULL, NULL,
2336 LDB_ERR_OPERATIONS_ERROR);
2339 /* Get a sequence number from the backend */
2340 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2341 if (ret != LDB_SUCCESS) {
2346 * - replace the old object with the newly constructed one
2349 msg = ldb_msg_new(ac);
2352 return LDB_ERR_OPERATIONS_ERROR;
2355 msg->dn = ac->req->op.rename.newdn;
2357 ret = ldb_build_mod_req(&down_req, ldb, ac,
2360 ac, replmd_op_callback,
2362 LDB_REQ_SET_LOCATION(down_req);
2363 if (ret != LDB_SUCCESS) {
2367 talloc_steal(down_req, msg);
2369 ret = add_time_element(msg, "whenChanged", t);
2370 if (ret != LDB_SUCCESS) {
2375 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2376 if (ret != LDB_SUCCESS) {
2381 /* go on with the call chain - do the modify after the rename */
2382 return ldb_next_request(ac->module, down_req);
2386 remove links from objects that point at this object when an object
2389 static int replmd_delete_remove_link(struct ldb_module *module,
2390 const struct dsdb_schema *schema,
2392 struct ldb_message_element *el,
2393 const struct dsdb_attribute *sa,
2394 struct ldb_request *parent)
2397 TALLOC_CTX *tmp_ctx = talloc_new(module);
2398 struct ldb_context *ldb = ldb_module_get_ctx(module);
2400 for (i=0; i<el->num_values; i++) {
2401 struct dsdb_dn *dsdb_dn;
2405 struct ldb_message *msg;
2406 const struct dsdb_attribute *target_attr;
2407 struct ldb_message_element *el2;
2408 struct ldb_val dn_val;
2410 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2414 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2416 talloc_free(tmp_ctx);
2417 return LDB_ERR_OPERATIONS_ERROR;
2420 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2421 if (!NT_STATUS_IS_OK(status)) {
2422 talloc_free(tmp_ctx);
2423 return LDB_ERR_OPERATIONS_ERROR;
2426 /* remove the link */
2427 msg = ldb_msg_new(tmp_ctx);
2429 ldb_module_oom(module);
2430 talloc_free(tmp_ctx);
2431 return LDB_ERR_OPERATIONS_ERROR;
2435 msg->dn = dsdb_dn->dn;
2437 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2438 if (target_attr == NULL) {
2442 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2443 if (ret != LDB_SUCCESS) {
2444 ldb_module_oom(module);
2445 talloc_free(tmp_ctx);
2446 return LDB_ERR_OPERATIONS_ERROR;
2448 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2449 el2->values = &dn_val;
2450 el2->num_values = 1;
2452 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2453 if (ret != LDB_SUCCESS) {
2454 talloc_free(tmp_ctx);
2458 talloc_free(tmp_ctx);
2464 handle update of replication meta data for deletion of objects
2466 This also handles the mapping of delete to a rename operation
2467 to allow deletes to be replicated.
2469 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2471 int ret = LDB_ERR_OTHER;
2472 bool retb, disallow_move_on_delete;
2473 struct ldb_dn *old_dn, *new_dn;
2474 const char *rdn_name;
2475 const struct ldb_val *rdn_value, *new_rdn_value;
2477 struct ldb_context *ldb = ldb_module_get_ctx(module);
2478 const struct dsdb_schema *schema;
2479 struct ldb_message *msg, *old_msg;
2480 struct ldb_message_element *el;
2481 TALLOC_CTX *tmp_ctx;
2482 struct ldb_result *res, *parent_res;
2483 const char *preserved_attrs[] = {
2484 /* yes, this really is a hard coded list. See MS-ADTS
2485 section 3.1.1.5.5.1.1 */
2486 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2487 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2488 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2489 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2490 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2491 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2492 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2493 "whenChanged", NULL};
2494 unsigned int i, el_count = 0;
2495 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2496 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2497 enum deletion_state deletion_state, next_deletion_state;
2500 if (ldb_dn_is_special(req->op.del.dn)) {
2501 return ldb_next_request(module, req);
2504 tmp_ctx = talloc_new(ldb);
2507 return LDB_ERR_OPERATIONS_ERROR;
2510 schema = dsdb_get_schema(ldb, tmp_ctx);
2512 return LDB_ERR_OPERATIONS_ERROR;
2515 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2517 /* we need the complete msg off disk, so we can work out which
2518 attributes need to be removed */
2519 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2520 DSDB_FLAG_NEXT_MODULE |
2521 DSDB_SEARCH_SHOW_RECYCLED |
2522 DSDB_SEARCH_REVEAL_INTERNALS |
2523 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2524 if (ret != LDB_SUCCESS) {
2525 talloc_free(tmp_ctx);
2528 old_msg = res->msgs[0];
2531 ret = dsdb_recyclebin_enabled(module, &enabled);
2532 if (ret != LDB_SUCCESS) {
2533 talloc_free(tmp_ctx);
2537 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2539 deletion_state = OBJECT_TOMBSTONE;
2540 next_deletion_state = OBJECT_REMOVED;
2541 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2542 deletion_state = OBJECT_RECYCLED;
2543 next_deletion_state = OBJECT_REMOVED;
2545 deletion_state = OBJECT_DELETED;
2546 next_deletion_state = OBJECT_RECYCLED;
2549 deletion_state = OBJECT_NOT_DELETED;
2551 next_deletion_state = OBJECT_DELETED;
2553 next_deletion_state = OBJECT_TOMBSTONE;
2557 if (next_deletion_state == OBJECT_REMOVED) {
2558 struct auth_session_info *session_info =
2559 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2560 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2561 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2562 ldb_dn_get_linearized(old_msg->dn));
2563 return LDB_ERR_UNWILLING_TO_PERFORM;
2566 /* it is already deleted - really remove it this time */
2567 talloc_free(tmp_ctx);
2568 return ldb_next_request(module, req);
2571 rdn_name = ldb_dn_get_rdn_name(old_dn);
2572 rdn_value = ldb_dn_get_rdn_val(old_dn);
2573 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2574 talloc_free(tmp_ctx);
2575 return ldb_operr(ldb);
2578 msg = ldb_msg_new(tmp_ctx);
2580 ldb_module_oom(module);
2581 talloc_free(tmp_ctx);
2582 return LDB_ERR_OPERATIONS_ERROR;
2587 if (deletion_state == OBJECT_NOT_DELETED){
2588 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2589 disallow_move_on_delete =
2590 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2591 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2593 /* work out where we will be renaming this object to */
2594 if (!disallow_move_on_delete) {
2595 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2597 if (ret != LDB_SUCCESS) {
2598 /* this is probably an attempted delete on a partition
2599 * that doesn't allow delete operations, such as the
2600 * schema partition */
2601 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2602 ldb_dn_get_linearized(old_dn));
2603 talloc_free(tmp_ctx);
2604 return LDB_ERR_UNWILLING_TO_PERFORM;
2607 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2608 if (new_dn == NULL) {
2609 ldb_module_oom(module);
2610 talloc_free(tmp_ctx);
2611 return LDB_ERR_OPERATIONS_ERROR;
2615 /* get the objects GUID from the search we just did */
2616 guid = samdb_result_guid(old_msg, "objectGUID");
2618 /* Add a formatted child */
2619 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2621 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2622 GUID_string(tmp_ctx, &guid));
2624 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2625 ldb_dn_get_linearized(new_dn)));
2626 talloc_free(tmp_ctx);
2627 return LDB_ERR_OPERATIONS_ERROR;
2630 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2631 if (ret != LDB_SUCCESS) {
2632 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2633 ldb_module_oom(module);
2634 talloc_free(tmp_ctx);
2637 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2641 now we need to modify the object in the following ways:
2643 - add isDeleted=TRUE
2644 - update rDN and name, with new rDN
2645 - remove linked attributes
2646 - remove objectCategory and sAMAccountType
2647 - remove attribs not on the preserved list
2648 - preserved if in above list, or is rDN
2649 - remove all linked attribs from this object
2650 - remove all links from other objects to this object
2651 - add lastKnownParent
2652 - update replPropertyMetaData?
2654 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2657 /* we need the storage form of the parent GUID */
2658 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2659 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2660 DSDB_FLAG_NEXT_MODULE |
2661 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2662 DSDB_SEARCH_REVEAL_INTERNALS|
2663 DSDB_SEARCH_SHOW_RECYCLED, req);
2664 if (ret != LDB_SUCCESS) {
2665 talloc_free(tmp_ctx);
2669 if (deletion_state == OBJECT_NOT_DELETED){
2670 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2671 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2672 if (ret != LDB_SUCCESS) {
2673 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2674 ldb_module_oom(module);
2675 talloc_free(tmp_ctx);
2678 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2681 switch (next_deletion_state){
2683 case OBJECT_DELETED:
2685 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2686 if (ret != LDB_SUCCESS) {
2687 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2688 ldb_module_oom(module);
2689 talloc_free(tmp_ctx);
2692 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2694 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2695 if (ret != LDB_SUCCESS) {
2696 talloc_free(tmp_ctx);
2697 ldb_module_oom(module);
2701 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2702 if (ret != LDB_SUCCESS) {
2703 talloc_free(tmp_ctx);
2704 ldb_module_oom(module);
2710 case OBJECT_RECYCLED:
2711 case OBJECT_TOMBSTONE:
2713 /* we also mark it as recycled, meaning this object can't be
2714 recovered (we are stripping its attributes) */
2715 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2716 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2717 if (ret != LDB_SUCCESS) {
2718 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2719 ldb_module_oom(module);
2720 talloc_free(tmp_ctx);
2723 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2726 /* work out which of the old attributes we will be removing */
2727 for (i=0; i<old_msg->num_elements; i++) {
2728 const struct dsdb_attribute *sa;
2729 el = &old_msg->elements[i];
2730 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2732 talloc_free(tmp_ctx);
2733 return LDB_ERR_OPERATIONS_ERROR;
2735 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2736 /* don't remove the rDN */
2739 if (sa->linkID && sa->linkID & 1) {
2740 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
2741 if (ret != LDB_SUCCESS) {
2742 talloc_free(tmp_ctx);
2743 return LDB_ERR_OPERATIONS_ERROR;
2747 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2750 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2751 if (ret != LDB_SUCCESS) {
2752 talloc_free(tmp_ctx);
2753 ldb_module_oom(module);
2763 if (deletion_state == OBJECT_NOT_DELETED) {
2764 const struct dsdb_attribute *sa;
2766 /* work out what the new rdn value is, for updating the
2767 rDN and name fields */
2768 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2769 if (new_rdn_value == NULL) {
2770 talloc_free(tmp_ctx);
2771 return ldb_operr(ldb);
2774 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2776 talloc_free(tmp_ctx);
2777 return LDB_ERR_OPERATIONS_ERROR;
2780 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2782 if (ret != LDB_SUCCESS) {
2783 talloc_free(tmp_ctx);
2786 el->flags = LDB_FLAG_MOD_REPLACE;
2788 el = ldb_msg_find_element(old_msg, "name");
2790 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2791 if (ret != LDB_SUCCESS) {
2792 talloc_free(tmp_ctx);
2795 el->flags = LDB_FLAG_MOD_REPLACE;
2799 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
2800 if (ret != LDB_SUCCESS) {
2801 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2802 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2803 talloc_free(tmp_ctx);
2807 if (deletion_state == OBJECT_NOT_DELETED) {
2808 /* now rename onto the new DN */
2809 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
2810 if (ret != LDB_SUCCESS){
2811 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2812 ldb_dn_get_linearized(old_dn),
2813 ldb_dn_get_linearized(new_dn),
2814 ldb_errstring(ldb)));
2815 talloc_free(tmp_ctx);
2820 talloc_free(tmp_ctx);
2822 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2827 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2832 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2834 int ret = LDB_ERR_OTHER;
2835 /* TODO: do some error mapping */
2839 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2841 struct ldb_context *ldb;
2842 struct ldb_request *change_req;
2843 enum ndr_err_code ndr_err;
2844 struct ldb_message *msg;
2845 struct replPropertyMetaDataBlob *md;
2846 struct ldb_val md_value;
2851 * TODO: check if the parent object exist
2855 * TODO: handle the conflict case where an object with the
2859 ldb = ldb_module_get_ctx(ar->module);
2860 msg = ar->objs->objects[ar->index_current].msg;
2861 md = ar->objs->objects[ar->index_current].meta_data;
2863 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2864 if (ret != LDB_SUCCESS) {
2865 return replmd_replicated_request_error(ar, ret);
2868 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2869 if (ret != LDB_SUCCESS) {
2870 return replmd_replicated_request_error(ar, ret);
2873 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2874 if (ret != LDB_SUCCESS) {
2875 return replmd_replicated_request_error(ar, ret);
2878 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2879 if (ret != LDB_SUCCESS) {
2880 return replmd_replicated_request_error(ar, ret);
2883 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2884 if (ret != LDB_SUCCESS) {
2885 return replmd_replicated_request_error(ar, ret);
2888 /* remove any message elements that have zero values */
2889 for (i=0; i<msg->num_elements; i++) {
2890 struct ldb_message_element *el = &msg->elements[i];
2892 if (el->num_values == 0) {
2893 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2895 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2896 msg->num_elements--;
2903 * the meta data array is already sorted by the caller
2905 for (i=0; i < md->ctr.ctr1.count; i++) {
2906 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2908 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2909 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2910 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2911 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2912 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2914 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2915 if (ret != LDB_SUCCESS) {
2916 return replmd_replicated_request_error(ar, ret);
2919 replmd_ldb_message_sort(msg, ar->schema);
2922 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2923 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2927 ret = ldb_build_add_req(&change_req,
2935 LDB_REQ_SET_LOCATION(change_req);
2936 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2938 return ldb_next_request(ar->module, change_req);
2942 return true if an update is newer than an existing entry
2943 see section 5.11 of MS-ADTS
2945 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2946 const struct GUID *update_invocation_id,
2947 uint32_t current_version,
2948 uint32_t update_version,
2949 uint32_t current_usn,
2950 uint32_t update_usn,
2951 NTTIME current_change_time,
2952 NTTIME update_change_time)
2954 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2955 if (update_usn != current_usn) {
2956 return update_usn >= current_usn;
2959 if (update_version != current_version) {
2960 return update_version >= current_version;
2962 if (update_change_time != current_change_time) {
2963 return update_change_time >= current_change_time;
2965 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2968 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2969 struct replPropertyMetaData1 *new_m)
2971 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2972 &new_m->originating_invocation_id,
2975 cur_m->originating_usn,
2976 new_m->originating_usn,
2977 cur_m->originating_change_time,
2978 new_m->originating_change_time);
2981 static struct replPropertyMetaData1 *
2982 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2983 enum drsuapi_DsAttributeId attid)
2986 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2988 for (i = 0; i < rpmd_ctr->count; i++) {
2989 if (rpmd_ctr->array[i].attid == attid) {
2990 return &rpmd_ctr->array[i];
2998 handle renames that come in over DRS replication
3000 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3001 struct ldb_message *msg,
3002 struct replPropertyMetaDataBlob *rmd,
3003 struct replPropertyMetaDataBlob *omd,
3004 struct ldb_request *parent)
3006 struct replPropertyMetaData1 *md_remote;
3007 struct replPropertyMetaData1 *md_local;
3009 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3014 /* now we need to check for double renames. We could have a
3015 * local rename pending which our replication partner hasn't
3016 * received yet. We choose which one wins by looking at the
3017 * attribute stamps on the two objects, the newer one wins
3019 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3020 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3021 /* if there is no name attribute then we have to assume the
3022 object we've received is in fact newer */
3023 if (!md_remote || !md_local ||
3024 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3025 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3026 ldb_dn_get_linearized(ar->search_msg->dn),
3027 ldb_dn_get_linearized(msg->dn)));
3028 /* pass rename to the next module
3029 * so it doesn't appear as an originating update */
3030 return dsdb_module_rename(ar->module,
3031 ar->search_msg->dn, msg->dn,
3032 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX, parent);
3035 /* we're going to keep our old object */
3036 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3037 ldb_dn_get_linearized(ar->search_msg->dn),
3038 ldb_dn_get_linearized(msg->dn)));
3043 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3045 struct ldb_context *ldb;
3046 struct ldb_request *change_req;
3047 enum ndr_err_code ndr_err;
3048 struct ldb_message *msg;
3049 struct replPropertyMetaDataBlob *rmd;
3050 struct replPropertyMetaDataBlob omd;
3051 const struct ldb_val *omd_value;
3052 struct replPropertyMetaDataBlob nmd;
3053 struct ldb_val nmd_value;
3056 unsigned int removed_attrs = 0;
3059 ldb = ldb_module_get_ctx(ar->module);
3060 msg = ar->objs->objects[ar->index_current].msg;
3061 rmd = ar->objs->objects[ar->index_current].meta_data;
3065 /* find existing meta data */
3066 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3068 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3069 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3070 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3071 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3072 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3075 if (omd.version != 1) {
3076 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3080 /* handle renames that come in over DRS */
3081 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
3082 if (ret != LDB_SUCCESS) {
3083 ldb_debug(ldb, LDB_DEBUG_FATAL,
3084 "replmd_replicated_request rename %s => %s failed - %s\n",
3085 ldb_dn_get_linearized(ar->search_msg->dn),
3086 ldb_dn_get_linearized(msg->dn),
3087 ldb_errstring(ldb));
3088 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3093 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3094 nmd.ctr.ctr1.array = talloc_array(ar,
3095 struct replPropertyMetaData1,
3096 nmd.ctr.ctr1.count);
3097 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3099 /* first copy the old meta data */
3100 for (i=0; i < omd.ctr.ctr1.count; i++) {
3101 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3105 /* now merge in the new meta data */
3106 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3109 for (j=0; j < ni; j++) {
3112 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3116 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3117 &rmd->ctr.ctr1.array[i]);
3119 /* replace the entry */
3120 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3125 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3126 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3127 msg->elements[i-removed_attrs].name,
3128 ldb_dn_get_linearized(msg->dn),
3129 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3132 /* we don't want to apply this change so remove the attribute */
3133 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3140 if (found) continue;
3142 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3147 * finally correct the size of the meta_data array
3149 nmd.ctr.ctr1.count = ni;
3152 * the rdn attribute (the alias for the name attribute),
3153 * 'cn' for most objects is the last entry in the meta data array
3156 * sort the new meta data array
3158 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3159 if (ret != LDB_SUCCESS) {
3164 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3166 if (msg->num_elements == 0) {
3167 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3170 ar->index_current++;
3171 return replmd_replicated_apply_next(ar);
3174 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3175 ar->index_current, msg->num_elements);
3177 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3178 if (ret != LDB_SUCCESS) {
3179 return replmd_replicated_request_error(ar, ret);
3182 for (i=0; i<ni; i++) {
3183 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3186 /* create the meta data value */
3187 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3188 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3189 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3190 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3191 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3195 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3196 * and replPopertyMetaData attributes
3198 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3199 if (ret != LDB_SUCCESS) {
3200 return replmd_replicated_request_error(ar, ret);
3202 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3203 if (ret != LDB_SUCCESS) {
3204 return replmd_replicated_request_error(ar, ret);
3206 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3207 if (ret != LDB_SUCCESS) {
3208 return replmd_replicated_request_error(ar, ret);
3211 replmd_ldb_message_sort(msg, ar->schema);
3213 /* we want to replace the old values */
3214 for (i=0; i < msg->num_elements; i++) {
3215 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3219 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3220 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3224 ret = ldb_build_mod_req(&change_req,
3232 LDB_REQ_SET_LOCATION(change_req);
3233 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3235 return ldb_next_request(ar->module, change_req);
3238 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3239 struct ldb_reply *ares)
3241 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3242 struct replmd_replicated_request);
3246 return ldb_module_done(ar->req, NULL, NULL,
3247 LDB_ERR_OPERATIONS_ERROR);
3249 if (ares->error != LDB_SUCCESS &&
3250 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3251 return ldb_module_done(ar->req, ares->controls,
3252 ares->response, ares->error);
3255 switch (ares->type) {
3256 case LDB_REPLY_ENTRY:
3257 ar->search_msg = talloc_steal(ar, ares->message);
3260 case LDB_REPLY_REFERRAL:
3261 /* we ignore referrals */
3264 case LDB_REPLY_DONE:
3265 if (ar->search_msg != NULL) {
3266 ret = replmd_replicated_apply_merge(ar);
3268 ret = replmd_replicated_apply_add(ar);
3270 if (ret != LDB_SUCCESS) {
3271 return ldb_module_done(ar->req, NULL, NULL, ret);
3279 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3281 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3283 struct ldb_context *ldb;
3287 struct ldb_request *search_req;
3288 struct ldb_search_options_control *options;
3290 if (ar->index_current >= ar->objs->num_objects) {
3291 /* done with it, go to next stage */
3292 return replmd_replicated_uptodate_vector(ar);
3295 ldb = ldb_module_get_ctx(ar->module);
3296 ar->search_msg = NULL;
3298 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3299 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3301 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3302 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3303 talloc_free(tmp_str);
3305 ret = ldb_build_search_req(&search_req,
3314 replmd_replicated_apply_search_callback,
3316 LDB_REQ_SET_LOCATION(search_req);
3318 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3320 if (ret != LDB_SUCCESS) {
3324 /* we need to cope with cross-partition links, so search for
3325 the GUID over all partitions */
3326 options = talloc(search_req, struct ldb_search_options_control);
3327 if (options == NULL) {
3328 DEBUG(0, (__location__ ": out of memory\n"));
3329 return LDB_ERR_OPERATIONS_ERROR;
3331 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3333 ret = ldb_request_add_control(search_req,
3334 LDB_CONTROL_SEARCH_OPTIONS_OID,
3336 if (ret != LDB_SUCCESS) {
3340 return ldb_next_request(ar->module, search_req);
3343 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3344 struct ldb_reply *ares)
3346 struct ldb_context *ldb;
3347 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3348 struct replmd_replicated_request);
3349 ldb = ldb_module_get_ctx(ar->module);
3352 return ldb_module_done(ar->req, NULL, NULL,
3353 LDB_ERR_OPERATIONS_ERROR);
3355 if (ares->error != LDB_SUCCESS) {
3356 return ldb_module_done(ar->req, ares->controls,
3357 ares->response, ares->error);
3360 if (ares->type != LDB_REPLY_DONE) {
3361 ldb_set_errstring(ldb, "Invalid reply type\n!");
3362 return ldb_module_done(ar->req, NULL, NULL,
3363 LDB_ERR_OPERATIONS_ERROR);
3368 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3371 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3373 struct ldb_context *ldb;
3374 struct ldb_request *change_req;
3375 enum ndr_err_code ndr_err;
3376 struct ldb_message *msg;
3377 struct replUpToDateVectorBlob ouv;
3378 const struct ldb_val *ouv_value;
3379 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3380 struct replUpToDateVectorBlob nuv;
3381 struct ldb_val nuv_value;
3382 struct ldb_message_element *nuv_el = NULL;
3383 const struct GUID *our_invocation_id;
3384 struct ldb_message_element *orf_el = NULL;
3385 struct repsFromToBlob nrf;
3386 struct ldb_val *nrf_value = NULL;
3387 struct ldb_message_element *nrf_el = NULL;
3391 time_t t = time(NULL);
3394 uint32_t instanceType;
3396 ldb = ldb_module_get_ctx(ar->module);
3397 ruv = ar->objs->uptodateness_vector;
3403 unix_to_nt_time(&now, t);
3405 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3406 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3407 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3408 ldb_dn_get_linearized(ar->search_msg->dn)));
3409 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3413 * first create the new replUpToDateVector
3415 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3417 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3418 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3419 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3420 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3421 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3424 if (ouv.version != 2) {
3425 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3430 * the new uptodateness vector will at least
3431 * contain 1 entry, one for the source_dsa
3433 * plus optional values from our old vector and the one from the source_dsa
3435 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3436 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3437 nuv.ctr.ctr2.cursors = talloc_array(ar,
3438 struct drsuapi_DsReplicaCursor2,
3439 nuv.ctr.ctr2.count);
3440 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3442 /* first copy the old vector */
3443 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3444 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3448 /* get our invocation_id if we have one already attached to the ldb */
3449 our_invocation_id = samdb_ntds_invocation_id(ldb);
3451 /* merge in the source_dsa vector is available */
3452 for (i=0; (ruv && i < ruv->count); i++) {
3455 if (our_invocation_id &&
3456 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3457 our_invocation_id)) {
3461 for (j=0; j < ni; j++) {
3462 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3463 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3470 * we update only the highest_usn and not the latest_sync_success time,
3471 * because the last success stands for direct replication
3473 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3474 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3479 if (found) continue;
3481 /* if it's not there yet, add it */
3482 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3487 * merge in the current highwatermark for the source_dsa
3490 for (j=0; j < ni; j++) {
3491 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3492 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3499 * here we update the highest_usn and last_sync_success time
3500 * because we're directly replicating from the source_dsa
3502 * and use the tmp_highest_usn because this is what we have just applied
3505 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3506 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3511 * here we update the highest_usn and last_sync_success time
3512 * because we're directly replicating from the source_dsa
3514 * and use the tmp_highest_usn because this is what we have just applied
3517 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3518 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3519 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3524 * finally correct the size of the cursors array
3526 nuv.ctr.ctr2.count = ni;
3531 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3534 * create the change ldb_message
3536 msg = ldb_msg_new(ar);
3537 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3538 msg->dn = ar->search_msg->dn;
3540 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3541 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3542 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3543 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3544 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3546 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3547 if (ret != LDB_SUCCESS) {
3548 return replmd_replicated_request_error(ar, ret);
3550 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3553 * now create the new repsFrom value from the given repsFromTo1 structure
3557 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3558 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3561 * first see if we already have a repsFrom value for the current source dsa
3562 * if so we'll later replace this value
3564 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3566 for (i=0; i < orf_el->num_values; i++) {
3567 struct repsFromToBlob *trf;
3569 trf = talloc(ar, struct repsFromToBlob);
3570 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3572 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3573 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3574 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3575 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3576 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3579 if (trf->version != 1) {
3580 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3584 * we compare the source dsa objectGUID not the invocation_id
3585 * because we want only one repsFrom value per source dsa
3586 * and when the invocation_id of the source dsa has changed we don't need
3587 * the old repsFrom with the old invocation_id
3589 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3590 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3596 nrf_value = &orf_el->values[i];
3601 * copy over all old values to the new ldb_message
3603 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3604 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3609 * if we haven't found an old repsFrom value for the current source dsa
3610 * we'll add a new value
3613 struct ldb_val zero_value;
3614 ZERO_STRUCT(zero_value);
3615 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3616 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3618 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3621 /* we now fill the value which is already attached to ldb_message */
3622 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3624 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3625 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3626 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3627 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3631 * the ldb_message_element for the attribute, has all the old values and the new one
3632 * so we'll replace the whole attribute with all values
3634 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3637 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3638 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3642 /* prepare the ldb_modify() request */
3643 ret = ldb_build_mod_req(&change_req,
3649 replmd_replicated_uptodate_modify_callback,
3651 LDB_REQ_SET_LOCATION(change_req);
3652 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3654 return ldb_next_request(ar->module, change_req);
3657 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3658 struct ldb_reply *ares)
3660 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3661 struct replmd_replicated_request);
3665 return ldb_module_done(ar->req, NULL, NULL,
3666 LDB_ERR_OPERATIONS_ERROR);
3668 if (ares->error != LDB_SUCCESS &&
3669 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3670 return ldb_module_done(ar->req, ares->controls,
3671 ares->response, ares->error);
3674 switch (ares->type) {
3675 case LDB_REPLY_ENTRY:
3676 ar->search_msg = talloc_steal(ar, ares->message);
3679 case LDB_REPLY_REFERRAL:
3680 /* we ignore referrals */
3683 case LDB_REPLY_DONE:
3684 if (ar->search_msg == NULL) {
3685 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3687 ret = replmd_replicated_uptodate_modify(ar);
3689 if (ret != LDB_SUCCESS) {
3690 return ldb_module_done(ar->req, NULL, NULL, ret);
3699 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3701 struct ldb_context *ldb;
3703 static const char *attrs[] = {
3704 "replUpToDateVector",
3709 struct ldb_request *search_req;
3711 ldb = ldb_module_get_ctx(ar->module);
3712 ar->search_msg = NULL;
3714 ret = ldb_build_search_req(&search_req,
3717 ar->objs->partition_dn,
3723 replmd_replicated_uptodate_search_callback,
3725 LDB_REQ_SET_LOCATION(search_req);
3726 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3728 return ldb_next_request(ar->module, search_req);
3733 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3735 struct ldb_context *ldb;
3736 struct dsdb_extended_replicated_objects *objs;
3737 struct replmd_replicated_request *ar;
3738 struct ldb_control **ctrls;
3741 struct replmd_private *replmd_private =
3742 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3744 ldb = ldb_module_get_ctx(module);
3746 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3748 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3750 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3751 return LDB_ERR_PROTOCOL_ERROR;
3754 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3755 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3756 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3757 return LDB_ERR_PROTOCOL_ERROR;
3760 ar = replmd_ctx_init(module, req);
3762 return LDB_ERR_OPERATIONS_ERROR;
3764 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3765 ar->apply_mode = true;
3767 ar->schema = dsdb_get_schema(ldb, ar);
3769 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3771 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3772 return LDB_ERR_CONSTRAINT_VIOLATION;
3775 ctrls = req->controls;
3777 if (req->controls) {
3778 req->controls = talloc_memdup(ar, req->controls,
3779 talloc_get_size(req->controls));
3780 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3783 /* This allows layers further down to know if a change came in over replication */
3784 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3785 if (ret != LDB_SUCCESS) {
3789 /* If this change contained linked attributes in the body
3790 * (rather than in the links section) we need to update
3791 * backlinks in linked_attributes */
3792 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3793 if (ret != LDB_SUCCESS) {
3797 ar->controls = req->controls;
3798 req->controls = ctrls;
3800 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3802 /* save away the linked attributes for the end of the
3804 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3805 struct la_entry *la_entry;
3807 if (replmd_private->la_ctx == NULL) {
3808 replmd_private->la_ctx = talloc_new(replmd_private);
3810 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3811 if (la_entry == NULL) {
3813 return LDB_ERR_OPERATIONS_ERROR;
3815 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3816 if (la_entry->la == NULL) {
3817 talloc_free(la_entry);
3819 return LDB_ERR_OPERATIONS_ERROR;
3821 *la_entry->la = ar->objs->linked_attributes[i];
3823 /* we need to steal the non-scalars so they stay
3824 around until the end of the transaction */
3825 talloc_steal(la_entry->la, la_entry->la->identifier);
3826 talloc_steal(la_entry->la, la_entry->la->value.blob);
3828 DLIST_ADD(replmd_private->la_list, la_entry);
3831 return replmd_replicated_apply_next(ar);
3835 process one linked attribute structure
3837 static int replmd_process_linked_attribute(struct ldb_module *module,
3838 struct la_entry *la_entry,
3839 struct ldb_request *parent)
3841 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3842 struct ldb_context *ldb = ldb_module_get_ctx(module);
3843 struct ldb_message *msg;
3844 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3845 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3847 const struct dsdb_attribute *attr;
3848 struct dsdb_dn *dsdb_dn;
3849 uint64_t seq_num = 0;
3850 struct ldb_message_element *old_el;
3852 time_t t = time(NULL);
3853 struct ldb_result *res;
3854 const char *attrs[2];
3855 struct parsed_dn *pdn_list, *pdn;
3856 struct GUID guid = GUID_zero();
3858 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3859 const struct GUID *our_invocation_id;
3862 linked_attributes[0]:
3863 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3865 identifier: struct drsuapi_DsReplicaObjectIdentifier
3866 __ndr_size : 0x0000003a (58)
3867 __ndr_size_sid : 0x00000000 (0)
3868 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3870 __ndr_size_dn : 0x00000000 (0)
3872 attid : DRSUAPI_ATTID_member (0x1F)
3873 value: struct drsuapi_DsAttributeValue
3874 __ndr_size : 0x0000007e (126)
3876 blob : DATA_BLOB length=126
3877 flags : 0x00000001 (1)
3878 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3879 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3880 meta_data: struct drsuapi_DsReplicaMetaData
3881 version : 0x00000015 (21)
3882 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3883 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3884 originating_usn : 0x000000000001e19c (123292)
3886 (for cases where the link is to a normal DN)
3887 &target: struct drsuapi_DsReplicaObjectIdentifier3
3888 __ndr_size : 0x0000007e (126)
3889 __ndr_size_sid : 0x0000001c (28)
3890 guid : 7639e594-db75-4086-b0d4-67890ae46031
3891 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3892 __ndr_size_dn : 0x00000022 (34)
3893 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3896 /* find the attribute being modified */
3897 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3899 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3900 talloc_free(tmp_ctx);
3901 return LDB_ERR_OPERATIONS_ERROR;
3904 attrs[0] = attr->lDAPDisplayName;
3907 /* get the existing message from the db for the object with
3908 this GUID, returning attribute being modified. We will then
3909 use this msg as the basis for a modify call */
3910 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3911 DSDB_FLAG_NEXT_MODULE |
3912 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3913 DSDB_SEARCH_SHOW_RECYCLED |
3914 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3915 DSDB_SEARCH_REVEAL_INTERNALS,
3917 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3918 if (ret != LDB_SUCCESS) {
3919 talloc_free(tmp_ctx);
3922 if (res->count != 1) {
3923 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3924 GUID_string(tmp_ctx, &la->identifier->guid));
3925 talloc_free(tmp_ctx);
3926 return LDB_ERR_NO_SUCH_OBJECT;
3930 if (msg->num_elements == 0) {
3931 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3932 if (ret != LDB_SUCCESS) {
3933 ldb_module_oom(module);
3934 talloc_free(tmp_ctx);
3935 return LDB_ERR_OPERATIONS_ERROR;
3938 old_el = &msg->elements[0];
3939 old_el->flags = LDB_FLAG_MOD_REPLACE;
3942 /* parse the existing links */
3943 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
3944 if (ret != LDB_SUCCESS) {
3945 talloc_free(tmp_ctx);
3949 /* get our invocationId */
3950 our_invocation_id = samdb_ntds_invocation_id(ldb);
3951 if (!our_invocation_id) {
3952 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3953 talloc_free(tmp_ctx);
3954 return LDB_ERR_OPERATIONS_ERROR;
3957 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3958 if (ret != LDB_SUCCESS) {
3959 talloc_free(tmp_ctx);
3963 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3964 if (!W_ERROR_IS_OK(status)) {
3965 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3966 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3967 return LDB_ERR_OPERATIONS_ERROR;
3970 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3971 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3972 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3974 ldb_dn_get_linearized(dsdb_dn->dn),
3975 ldb_dn_get_linearized(msg->dn));
3976 return LDB_ERR_OPERATIONS_ERROR;
3979 /* re-resolve the DN by GUID, as the DRS server may give us an
3981 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
3982 if (ret != LDB_SUCCESS) {
3983 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3984 GUID_string(tmp_ctx, &guid),
3985 ldb_dn_get_linearized(dsdb_dn->dn)));
3988 /* see if this link already exists */
3989 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3991 /* see if this update is newer than what we have already */
3992 struct GUID invocation_id = GUID_zero();
3993 uint32_t version = 0;
3994 uint32_t originating_usn = 0;
3995 NTTIME change_time = 0;
3996 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3998 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3999 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
4000 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
4001 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
4003 if (!replmd_update_is_newer(&invocation_id,
4004 &la->meta_data.originating_invocation_id,
4006 la->meta_data.version,
4008 la->meta_data.originating_usn,
4010 la->meta_data.originating_change_time)) {
4011 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4012 old_el->name, ldb_dn_get_linearized(msg->dn),
4013 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4014 talloc_free(tmp_ctx);
4018 /* get a seq_num for this change */
4019 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4020 if (ret != LDB_SUCCESS) {
4021 talloc_free(tmp_ctx);
4025 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4026 /* remove the existing backlink */
4027 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4028 if (ret != LDB_SUCCESS) {
4029 talloc_free(tmp_ctx);
4034 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4035 &la->meta_data.originating_invocation_id,
4036 la->meta_data.originating_usn, seq_num,
4037 la->meta_data.originating_change_time,
4038 la->meta_data.version,
4040 if (ret != LDB_SUCCESS) {
4041 talloc_free(tmp_ctx);
4046 /* add the new backlink */
4047 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4048 if (ret != LDB_SUCCESS) {
4049 talloc_free(tmp_ctx);
4054 /* get a seq_num for this change */
4055 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4056 if (ret != LDB_SUCCESS) {
4057 talloc_free(tmp_ctx);
4061 old_el->values = talloc_realloc(msg->elements, old_el->values,
4062 struct ldb_val, old_el->num_values+1);
4063 if (!old_el->values) {
4064 ldb_module_oom(module);
4065 return LDB_ERR_OPERATIONS_ERROR;
4067 old_el->num_values++;
4069 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4070 &la->meta_data.originating_invocation_id,
4071 la->meta_data.originating_usn, seq_num,
4072 la->meta_data.originating_change_time,
4073 la->meta_data.version,
4074 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4075 if (ret != LDB_SUCCESS) {
4076 talloc_free(tmp_ctx);
4081 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4083 if (ret != LDB_SUCCESS) {
4084 talloc_free(tmp_ctx);
4090 /* we only change whenChanged and uSNChanged if the seq_num
4092 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4093 talloc_free(tmp_ctx);
4094 return ldb_operr(ldb);
4097 if (add_uint64_element(ldb, msg, "uSNChanged",
4098 seq_num) != LDB_SUCCESS) {
4099 talloc_free(tmp_ctx);
4100 return ldb_operr(ldb);
4103 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4104 if (old_el == NULL) {
4105 talloc_free(tmp_ctx);
4106 return ldb_operr(ldb);
4109 ret = dsdb_check_single_valued_link(attr, old_el);
4110 if (ret != LDB_SUCCESS) {
4111 talloc_free(tmp_ctx);
4115 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4117 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
4118 if (ret != LDB_SUCCESS) {
4119 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4121 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4122 talloc_free(tmp_ctx);
4126 talloc_free(tmp_ctx);
4131 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4133 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4134 return replmd_extended_replicated_objects(module, req);
4137 return ldb_next_request(module, req);
4142 we hook into the transaction operations to allow us to
4143 perform the linked attribute updates at the end of the whole
4144 transaction. This allows a forward linked attribute to be created
4145 before the object is created. During a vampire, w2k8 sends us linked
4146 attributes before the objects they are part of.
4148 static int replmd_start_transaction(struct ldb_module *module)
4150 /* create our private structure for this transaction */
4151 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4152 struct replmd_private);
4153 replmd_txn_cleanup(replmd_private);
4155 /* free any leftover mod_usn records from cancelled
4157 while (replmd_private->ncs) {
4158 struct nc_entry *e = replmd_private->ncs;
4159 DLIST_REMOVE(replmd_private->ncs, e);
4163 return ldb_next_start_trans(module);
4167 on prepare commit we loop over our queued la_context structures and
4170 static int replmd_prepare_commit(struct ldb_module *module)
4172 struct replmd_private *replmd_private =
4173 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4174 struct la_entry *la, *prev;
4175 struct la_backlink *bl;
4178 /* walk the list backwards, to do the first entry first, as we
4179 * added the entries with DLIST_ADD() which puts them at the
4180 * start of the list */
4181 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4182 prev = DLIST_PREV(la);
4183 DLIST_REMOVE(replmd_private->la_list, la);
4184 ret = replmd_process_linked_attribute(module, la, NULL);
4185 if (ret != LDB_SUCCESS) {
4186 replmd_txn_cleanup(replmd_private);
4191 /* process our backlink list, creating and deleting backlinks
4193 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4194 ret = replmd_process_backlink(module, bl, NULL);
4195 if (ret != LDB_SUCCESS) {
4196 replmd_txn_cleanup(replmd_private);
4201 replmd_txn_cleanup(replmd_private);
4203 /* possibly change @REPLCHANGED */
4204 ret = replmd_notify_store(module, NULL);
4205 if (ret != LDB_SUCCESS) {
4209 return ldb_next_prepare_commit(module);
4212 static int replmd_del_transaction(struct ldb_module *module)
4214 struct replmd_private *replmd_private =
4215 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4216 replmd_txn_cleanup(replmd_private);
4218 return ldb_next_del_trans(module);
4222 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4223 .name = "repl_meta_data",
4224 .init_context = replmd_init,
4226 .modify = replmd_modify,
4227 .rename = replmd_rename,
4228 .del = replmd_delete,
4229 .extended = replmd_extended,
4230 .start_transaction = replmd_start_transaction,
4231 .prepare_commit = replmd_prepare_commit,
4232 .del_transaction = replmd_del_transaction,
4235 int ldb_repl_meta_data_module_init(const char *version)
4237 LDB_MODULE_CHECK_VERSION(version);
4238 return ldb_register_module(&ldb_repl_meta_data_module_ops);