4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/dom_sid.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/security.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
515 if (ldb_msg_find_element(msg, attr) != NULL) {
519 s = ldb_timestring(msg, t);
521 return LDB_ERR_OPERATIONS_ERROR;
524 if (ldb_msg_add_string(msg, attr, s) != LDB_SUCCESS) {
525 return LDB_ERR_OPERATIONS_ERROR;
528 el = ldb_msg_find_element(msg, attr);
529 /* always set as replace. This works because on add ops, the flag
531 el->flags = LDB_FLAG_MOD_REPLACE;
537 add a uint64_t element to a record
539 static int add_uint64_element(struct ldb_message *msg, const char *attr, uint64_t v)
541 struct ldb_message_element *el;
543 if (ldb_msg_find_element(msg, attr) != NULL) {
547 if (ldb_msg_add_fmt(msg, attr, "%llu", (unsigned long long)v) != LDB_SUCCESS) {
548 return LDB_ERR_OPERATIONS_ERROR;
551 el = ldb_msg_find_element(msg, attr);
552 /* always set as replace. This works because on add ops, the flag
554 el->flags = LDB_FLAG_MOD_REPLACE;
559 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
560 const struct replPropertyMetaData1 *m2,
561 const uint32_t *rdn_attid)
563 if (m1->attid == m2->attid) {
568 * the rdn attribute should be at the end!
569 * so we need to return a value greater than zero
570 * which means m1 is greater than m2
572 if (m1->attid == *rdn_attid) {
577 * the rdn attribute should be at the end!
578 * so we need to return a value less than zero
579 * which means m2 is greater than m1
581 if (m2->attid == *rdn_attid) {
585 return m1->attid > m2->attid ? 1 : -1;
588 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
589 const struct dsdb_schema *schema,
592 const char *rdn_name;
593 const struct dsdb_attribute *rdn_sa;
595 rdn_name = ldb_dn_get_rdn_name(dn);
597 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
598 return LDB_ERR_OPERATIONS_ERROR;
601 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
602 if (rdn_sa == NULL) {
603 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
604 return LDB_ERR_OPERATIONS_ERROR;
607 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
608 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
610 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
615 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
616 const struct ldb_message_element *e2,
617 const struct dsdb_schema *schema)
619 const struct dsdb_attribute *a1;
620 const struct dsdb_attribute *a2;
623 * TODO: make this faster by caching the dsdb_attribute pointer
624 * on the ldb_messag_element
627 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
628 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
631 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
635 return strcasecmp(e1->name, e2->name);
637 if (a1->attributeID_id == a2->attributeID_id) {
640 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
643 static void replmd_ldb_message_sort(struct ldb_message *msg,
644 const struct dsdb_schema *schema)
646 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
649 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
650 const struct GUID *invocation_id, uint64_t seq_num,
651 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
655 fix up linked attributes in replmd_add.
656 This involves setting up the right meta-data in extended DN
657 components, and creating backlinks to the object
659 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
660 uint64_t seq_num, const struct GUID *invocationId, time_t t,
661 struct GUID *guid, const struct dsdb_attribute *sa)
664 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
665 struct ldb_context *ldb = ldb_module_get_ctx(module);
667 /* We will take a reference to the schema in replmd_add_backlink */
668 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
671 unix_to_nt_time(&now, t);
673 for (i=0; i<el->num_values; i++) {
674 struct ldb_val *v = &el->values[i];
675 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
676 struct GUID target_guid;
680 /* note that the DN already has the extended
681 components from the extended_dn_store module */
682 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
683 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
684 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
685 if (ret != LDB_SUCCESS) {
686 talloc_free(tmp_ctx);
689 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
696 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
697 seq_num, seq_num, now, 0, false);
698 if (ret != LDB_SUCCESS) {
699 talloc_free(tmp_ctx);
703 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
704 if (ret != LDB_SUCCESS) {
705 talloc_free(tmp_ctx);
710 talloc_free(tmp_ctx);
716 intercept add requests
718 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
720 struct ldb_context *ldb;
721 struct ldb_control *control;
722 struct replmd_replicated_request *ac;
723 enum ndr_err_code ndr_err;
724 struct ldb_request *down_req;
725 struct ldb_message *msg;
726 const DATA_BLOB *guid_blob;
728 struct replPropertyMetaDataBlob nmd;
729 struct ldb_val nmd_value;
730 const struct GUID *our_invocation_id;
731 time_t t = time(NULL);
736 unsigned int functional_level;
738 bool allow_add_guid = false;
739 bool remove_current_guid = false;
740 bool is_urgent = false;
741 struct ldb_message_element *objectclass_el;
743 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
744 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
746 allow_add_guid = true;
749 /* do not manipulate our control entries */
750 if (ldb_dn_is_special(req->op.add.message->dn)) {
751 return ldb_next_request(module, req);
754 ldb = ldb_module_get_ctx(module);
756 functional_level = dsdb_functional_level(ldb);
758 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
760 ac = replmd_ctx_init(module, req);
762 return LDB_ERR_OPERATIONS_ERROR;
765 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
766 if ( guid_blob != NULL ) {
767 if( !allow_add_guid ) {
768 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
769 "replmd_add: it's not allowed to add an object with objectGUID\n");
771 return LDB_ERR_UNWILLING_TO_PERFORM;
773 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
774 if ( !NT_STATUS_IS_OK(status)) {
775 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
776 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
778 return LDB_ERR_UNWILLING_TO_PERFORM;
780 /* we remove this attribute as it can be a string and will not be treated
781 correctly and then we will readd it latter on in the good format*/
782 remove_current_guid = true;
786 guid = GUID_random();
789 /* Get a sequence number from the backend */
790 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
791 if (ret != LDB_SUCCESS) {
796 /* get our invocationId */
797 our_invocation_id = samdb_ntds_invocation_id(ldb);
798 if (!our_invocation_id) {
799 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
800 "replmd_add: unable to find invocationId\n");
802 return LDB_ERR_OPERATIONS_ERROR;
805 /* we have to copy the message as the caller might have it as a const */
806 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
810 return LDB_ERR_OPERATIONS_ERROR;
813 /* generated times */
814 unix_to_nt_time(&now, t);
815 time_str = ldb_timestring(msg, t);
819 return LDB_ERR_OPERATIONS_ERROR;
821 if (remove_current_guid) {
822 ldb_msg_remove_attr(msg,"objectGUID");
826 * remove autogenerated attributes
828 ldb_msg_remove_attr(msg, "whenCreated");
829 ldb_msg_remove_attr(msg, "whenChanged");
830 ldb_msg_remove_attr(msg, "uSNCreated");
831 ldb_msg_remove_attr(msg, "uSNChanged");
832 ldb_msg_remove_attr(msg, "replPropertyMetaData");
835 * readd replicated attributes
837 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
838 if (ret != LDB_SUCCESS) {
844 /* build the replication meta_data */
847 nmd.ctr.ctr1.count = msg->num_elements;
848 nmd.ctr.ctr1.array = talloc_array(msg,
849 struct replPropertyMetaData1,
851 if (!nmd.ctr.ctr1.array) {
854 return LDB_ERR_OPERATIONS_ERROR;
857 for (i=0; i < msg->num_elements; i++) {
858 struct ldb_message_element *e = &msg->elements[i];
859 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
860 const struct dsdb_attribute *sa;
862 if (e->name[0] == '@') continue;
864 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
866 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
867 "replmd_add: attribute '%s' not defined in schema\n",
870 return LDB_ERR_NO_SUCH_ATTRIBUTE;
873 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
874 /* if the attribute is not replicated (0x00000001)
875 * or constructed (0x00000004) it has no metadata
880 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
881 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
882 if (ret != LDB_SUCCESS) {
886 /* linked attributes are not stored in
887 replPropertyMetaData in FL above w2k */
891 m->attid = sa->attributeID_id;
893 m->originating_change_time = now;
894 m->originating_invocation_id = *our_invocation_id;
895 m->originating_usn = ac->seq_num;
896 m->local_usn = ac->seq_num;
900 /* fix meta data count */
901 nmd.ctr.ctr1.count = ni;
904 * sort meta data array, and move the rdn attribute entry to the end
906 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
907 if (ret != LDB_SUCCESS) {
912 /* generated NDR encoded values */
913 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
915 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
916 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
919 return LDB_ERR_OPERATIONS_ERROR;
923 * add the autogenerated values
925 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
926 if (ret != LDB_SUCCESS) {
931 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
932 if (ret != LDB_SUCCESS) {
937 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
938 if (ret != LDB_SUCCESS) {
943 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
944 if (ret != LDB_SUCCESS) {
949 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
950 if (ret != LDB_SUCCESS) {
957 * sort the attributes by attid before storing the object
959 replmd_ldb_message_sort(msg, ac->schema);
961 objectclass_el = ldb_msg_find_element(msg, "objectClass");
962 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
963 REPL_URGENT_ON_CREATE);
965 ac->is_urgent = is_urgent;
966 ret = ldb_build_add_req(&down_req, ldb, ac,
969 ac, replmd_op_callback,
972 if (ret != LDB_SUCCESS) {
977 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
978 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
979 if (ret != LDB_SUCCESS) {
985 /* mark the control done */
987 control->critical = 0;
990 /* go on with the call chain */
991 return ldb_next_request(module, down_req);
996 * update the replPropertyMetaData for one element
998 static int replmd_update_rpmd_element(struct ldb_context *ldb,
999 struct ldb_message *msg,
1000 struct ldb_message_element *el,
1001 struct ldb_message_element *old_el,
1002 struct replPropertyMetaDataBlob *omd,
1003 const struct dsdb_schema *schema,
1005 const struct GUID *our_invocation_id,
1009 const struct dsdb_attribute *a;
1010 struct replPropertyMetaData1 *md1;
1012 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1014 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1016 return LDB_ERR_OPERATIONS_ERROR;
1019 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1023 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1024 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1028 for (i=0; i<omd->ctr.ctr1.count; i++) {
1029 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1032 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1033 /* linked attributes are not stored in
1034 replPropertyMetaData in FL above w2k, but we do
1035 raise the seqnum for the object */
1036 if (*seq_num == 0 &&
1037 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1038 return LDB_ERR_OPERATIONS_ERROR;
1043 if (i == omd->ctr.ctr1.count) {
1044 /* we need to add a new one */
1045 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1046 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1047 if (omd->ctr.ctr1.array == NULL) {
1049 return LDB_ERR_OPERATIONS_ERROR;
1051 omd->ctr.ctr1.count++;
1052 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1055 /* Get a new sequence number from the backend. We only do this
1056 * if we have a change that requires a new
1057 * replPropertyMetaData element
1059 if (*seq_num == 0) {
1060 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1061 if (ret != LDB_SUCCESS) {
1062 return LDB_ERR_OPERATIONS_ERROR;
1066 md1 = &omd->ctr.ctr1.array[i];
1068 md1->attid = a->attributeID_id;
1069 md1->originating_change_time = now;
1070 md1->originating_invocation_id = *our_invocation_id;
1071 md1->originating_usn = *seq_num;
1072 md1->local_usn = *seq_num;
1077 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1079 uint32_t count = omd.ctr.ctr1.count;
1082 for (i=0; i < count; i++) {
1083 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1084 if (max < m.local_usn) {
1092 * update the replPropertyMetaData object each time we modify an
1093 * object. This is needed for DRS replication, as the merge on the
1094 * client is based on this object
1096 static int replmd_update_rpmd(struct ldb_module *module,
1097 const struct dsdb_schema *schema,
1098 struct ldb_request *req,
1099 struct ldb_message *msg, uint64_t *seq_num,
1103 const struct ldb_val *omd_value;
1104 enum ndr_err_code ndr_err;
1105 struct replPropertyMetaDataBlob omd;
1108 const struct GUID *our_invocation_id;
1110 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1111 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1112 struct ldb_result *res;
1113 struct ldb_context *ldb;
1114 struct ldb_message_element *objectclass_el;
1115 enum urgent_situation situation;
1116 bool rodc, rmd_is_provided;
1118 ldb = ldb_module_get_ctx(module);
1120 our_invocation_id = samdb_ntds_invocation_id(ldb);
1121 if (!our_invocation_id) {
1122 /* this happens during an initial vampire while
1123 updating the schema */
1124 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1128 unix_to_nt_time(&now, t);
1130 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1131 rmd_is_provided = true;
1133 rmd_is_provided = false;
1136 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1137 * otherwise we consider we are updating */
1138 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1139 situation = REPL_URGENT_ON_DELETE;
1141 situation = REPL_URGENT_ON_UPDATE;
1144 if (rmd_is_provided) {
1145 /* In this case the change_replmetadata control was supplied */
1146 /* We check that it's the only attribute that is provided
1147 * (it's a rare case so it's better to keep the code simplier)
1148 * We also check that the highest local_usn is bigger than
1151 if( msg->num_elements != 1 ||
1152 strncmp(msg->elements[0].name,
1153 "replPropertyMetaData", 20) ) {
1154 DEBUG(0,(__location__ ": changereplmetada control called without "\
1155 "a specified replPropertyMetaData attribute or with others\n"));
1156 return LDB_ERR_OPERATIONS_ERROR;
1158 if (situation == REPL_URGENT_ON_DELETE) {
1159 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1160 return LDB_ERR_OPERATIONS_ERROR;
1162 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1164 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1165 ldb_dn_get_linearized(msg->dn)));
1166 return LDB_ERR_OPERATIONS_ERROR;
1168 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1169 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1171 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1172 ldb_dn_get_linearized(msg->dn)));
1173 return LDB_ERR_OPERATIONS_ERROR;
1175 *seq_num = find_max_local_usn(omd);
1177 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1178 DSDB_FLAG_NEXT_MODULE |
1179 DSDB_SEARCH_SHOW_DELETED |
1180 DSDB_SEARCH_SHOW_EXTENDED_DN |
1181 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1182 DSDB_SEARCH_REVEAL_INTERNALS);
1184 if (ret != LDB_SUCCESS || res->count != 1) {
1185 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1186 ldb_dn_get_linearized(msg->dn)));
1187 return LDB_ERR_OPERATIONS_ERROR;
1190 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1191 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1196 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1197 if (*seq_num <= db_seq) {
1198 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1199 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1200 (long long)*seq_num, (long long)db_seq));
1201 return LDB_ERR_OPERATIONS_ERROR;
1205 /* search for the existing replPropertyMetaDataBlob. We need
1206 * to use REVEAL and ask for DNs in storage format to support
1207 * the check for values being the same in
1208 * replmd_update_rpmd_element()
1210 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1211 DSDB_FLAG_NEXT_MODULE |
1212 DSDB_SEARCH_SHOW_DELETED |
1213 DSDB_SEARCH_SHOW_EXTENDED_DN |
1214 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1215 DSDB_SEARCH_REVEAL_INTERNALS);
1216 if (ret != LDB_SUCCESS || res->count != 1) {
1217 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1218 ldb_dn_get_linearized(msg->dn)));
1219 return LDB_ERR_OPERATIONS_ERROR;
1222 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1223 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1228 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1230 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1231 ldb_dn_get_linearized(msg->dn)));
1232 return LDB_ERR_OPERATIONS_ERROR;
1235 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1236 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1237 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1238 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1239 ldb_dn_get_linearized(msg->dn)));
1240 return LDB_ERR_OPERATIONS_ERROR;
1243 if (omd.version != 1) {
1244 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1245 omd.version, ldb_dn_get_linearized(msg->dn)));
1246 return LDB_ERR_OPERATIONS_ERROR;
1249 for (i=0; i<msg->num_elements; i++) {
1250 struct ldb_message_element *old_el;
1251 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1252 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1253 our_invocation_id, now);
1254 if (ret != LDB_SUCCESS) {
1258 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1259 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1265 * replmd_update_rpmd_element has done an update if the
1268 if (*seq_num != 0) {
1269 struct ldb_val *md_value;
1270 struct ldb_message_element *el;
1272 /*if we are RODC and this is a DRSR update then its ok*/
1273 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1274 ret = samdb_rodc(ldb, &rodc);
1275 if (ret != LDB_SUCCESS) {
1276 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1278 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1279 return LDB_ERR_REFERRAL;
1283 md_value = talloc(msg, struct ldb_val);
1284 if (md_value == NULL) {
1286 return LDB_ERR_OPERATIONS_ERROR;
1289 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1290 if (ret != LDB_SUCCESS) {
1294 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1295 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1296 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1297 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1298 ldb_dn_get_linearized(msg->dn)));
1299 return LDB_ERR_OPERATIONS_ERROR;
1302 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1303 if (ret != LDB_SUCCESS) {
1304 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1305 ldb_dn_get_linearized(msg->dn)));
1310 el->values = md_value;
1317 struct dsdb_dn *dsdb_dn;
1322 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1324 return GUID_compare(pdn1->guid, pdn2->guid);
1327 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1329 struct parsed_dn *ret;
1330 if (dn && GUID_all_zero(guid)) {
1331 /* when updating a link using DRS, we sometimes get a
1332 NULL GUID. We then need to try and match by DN */
1334 for (i=0; i<count; i++) {
1335 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1336 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1342 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1347 get a series of message element values as an array of DNs and GUIDs
1348 the result is sorted by GUID
1350 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1351 struct ldb_message_element *el, struct parsed_dn **pdn,
1352 const char *ldap_oid)
1355 struct ldb_context *ldb = ldb_module_get_ctx(module);
1362 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1364 ldb_module_oom(module);
1365 return LDB_ERR_OPERATIONS_ERROR;
1368 for (i=0; i<el->num_values; i++) {
1369 struct ldb_val *v = &el->values[i];
1372 struct parsed_dn *p;
1376 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1377 if (p->dsdb_dn == NULL) {
1378 return LDB_ERR_INVALID_DN_SYNTAX;
1381 dn = p->dsdb_dn->dn;
1383 p->guid = talloc(*pdn, struct GUID);
1384 if (p->guid == NULL) {
1385 ldb_module_oom(module);
1386 return LDB_ERR_OPERATIONS_ERROR;
1389 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1390 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1391 /* we got a DN without a GUID - go find the GUID */
1392 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1393 if (ret != LDB_SUCCESS) {
1394 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1395 ldb_dn_get_linearized(dn));
1398 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1399 if (ret != LDB_SUCCESS) {
1402 } else if (!NT_STATUS_IS_OK(status)) {
1403 return LDB_ERR_OPERATIONS_ERROR;
1406 /* keep a pointer to the original ldb_val */
1410 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1416 build a new extended DN, including all meta data fields
1418 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1419 RMD_ADDTIME = originating_add_time
1420 RMD_INVOCID = originating_invocation_id
1421 RMD_CHANGETIME = originating_change_time
1422 RMD_ORIGINATING_USN = originating_usn
1423 RMD_LOCAL_USN = local_usn
1424 RMD_VERSION = version
1426 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1427 const struct GUID *invocation_id, uint64_t seq_num,
1428 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1430 struct ldb_dn *dn = dsdb_dn->dn;
1431 const char *tstring, *usn_string, *flags_string;
1432 struct ldb_val tval;
1434 struct ldb_val usnv, local_usnv;
1435 struct ldb_val vers, flagsv;
1438 const char *dnstring;
1440 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1442 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1444 return LDB_ERR_OPERATIONS_ERROR;
1446 tval = data_blob_string_const(tstring);
1448 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1450 return LDB_ERR_OPERATIONS_ERROR;
1452 usnv = data_blob_string_const(usn_string);
1454 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1456 return LDB_ERR_OPERATIONS_ERROR;
1458 local_usnv = data_blob_string_const(usn_string);
1460 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1462 return LDB_ERR_OPERATIONS_ERROR;
1464 vers = data_blob_string_const(vstring);
1466 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1467 if (!NT_STATUS_IS_OK(status)) {
1468 return LDB_ERR_OPERATIONS_ERROR;
1471 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1472 if (!flags_string) {
1473 return LDB_ERR_OPERATIONS_ERROR;
1475 flagsv = data_blob_string_const(flags_string);
1477 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1478 if (ret != LDB_SUCCESS) return ret;
1479 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1480 if (ret != LDB_SUCCESS) return ret;
1481 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1482 if (ret != LDB_SUCCESS) return ret;
1483 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1484 if (ret != LDB_SUCCESS) return ret;
1485 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1486 if (ret != LDB_SUCCESS) return ret;
1487 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1488 if (ret != LDB_SUCCESS) return ret;
1489 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1490 if (ret != LDB_SUCCESS) return ret;
1492 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1493 if (dnstring == NULL) {
1494 return LDB_ERR_OPERATIONS_ERROR;
1496 *v = data_blob_string_const(dnstring);
1501 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1502 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1503 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1504 uint32_t version, bool deleted);
1507 check if any links need upgrading from w2k format
1509 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1511 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1514 for (i=0; i<count; i++) {
1519 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1520 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1524 /* it's an old one that needs upgrading */
1525 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1527 if (ret != LDB_SUCCESS) {
1535 update an extended DN, including all meta data fields
1537 see replmd_build_la_val for value names
1539 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1540 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1541 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1542 uint32_t version, bool deleted)
1544 struct ldb_dn *dn = dsdb_dn->dn;
1545 const char *tstring, *usn_string, *flags_string;
1546 struct ldb_val tval;
1548 struct ldb_val usnv, local_usnv;
1549 struct ldb_val vers, flagsv;
1550 const struct ldb_val *old_addtime;
1551 uint32_t old_version;
1554 const char *dnstring;
1556 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1558 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1560 return LDB_ERR_OPERATIONS_ERROR;
1562 tval = data_blob_string_const(tstring);
1564 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1566 return LDB_ERR_OPERATIONS_ERROR;
1568 usnv = data_blob_string_const(usn_string);
1570 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1572 return LDB_ERR_OPERATIONS_ERROR;
1574 local_usnv = data_blob_string_const(usn_string);
1576 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1577 if (!NT_STATUS_IS_OK(status)) {
1578 return LDB_ERR_OPERATIONS_ERROR;
1581 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1582 if (!flags_string) {
1583 return LDB_ERR_OPERATIONS_ERROR;
1585 flagsv = data_blob_string_const(flags_string);
1587 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1588 if (ret != LDB_SUCCESS) return ret;
1590 /* get the ADDTIME from the original */
1591 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1592 if (old_addtime == NULL) {
1593 old_addtime = &tval;
1595 if (dsdb_dn != old_dsdb_dn) {
1596 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1597 if (ret != LDB_SUCCESS) return ret;
1600 /* use our invocation id */
1601 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1602 if (ret != LDB_SUCCESS) return ret;
1604 /* changetime is the current time */
1605 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1606 if (ret != LDB_SUCCESS) return ret;
1608 /* update the USN */
1609 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1610 if (ret != LDB_SUCCESS) return ret;
1612 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1613 if (ret != LDB_SUCCESS) return ret;
1615 /* increase the version by 1 */
1616 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1617 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1618 version = old_version+1;
1620 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1621 vers = data_blob_string_const(vstring);
1622 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1623 if (ret != LDB_SUCCESS) return ret;
1625 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1626 if (dnstring == NULL) {
1627 return LDB_ERR_OPERATIONS_ERROR;
1629 *v = data_blob_string_const(dnstring);
1635 handle adding a linked attribute
1637 static int replmd_modify_la_add(struct ldb_module *module,
1638 const struct dsdb_schema *schema,
1639 struct ldb_message *msg,
1640 struct ldb_message_element *el,
1641 struct ldb_message_element *old_el,
1642 const struct dsdb_attribute *schema_attr,
1645 struct GUID *msg_guid)
1648 struct parsed_dn *dns, *old_dns;
1649 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1651 struct ldb_val *new_values = NULL;
1652 unsigned int num_new_values = 0;
1653 unsigned old_num_values = old_el?old_el->num_values:0;
1654 const struct GUID *invocation_id;
1655 struct ldb_context *ldb = ldb_module_get_ctx(module);
1658 unix_to_nt_time(&now, t);
1660 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1661 if (ret != LDB_SUCCESS) {
1662 talloc_free(tmp_ctx);
1666 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1667 if (ret != LDB_SUCCESS) {
1668 talloc_free(tmp_ctx);
1672 invocation_id = samdb_ntds_invocation_id(ldb);
1673 if (!invocation_id) {
1674 talloc_free(tmp_ctx);
1675 return LDB_ERR_OPERATIONS_ERROR;
1678 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1679 if (ret != LDB_SUCCESS) {
1680 talloc_free(tmp_ctx);
1684 /* for each new value, see if it exists already with the same GUID */
1685 for (i=0; i<el->num_values; i++) {
1686 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1688 /* this is a new linked attribute value */
1689 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1690 if (new_values == NULL) {
1691 ldb_module_oom(module);
1692 talloc_free(tmp_ctx);
1693 return LDB_ERR_OPERATIONS_ERROR;
1695 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1696 invocation_id, seq_num, seq_num, now, 0, false);
1697 if (ret != LDB_SUCCESS) {
1698 talloc_free(tmp_ctx);
1703 /* this is only allowed if the GUID was
1704 previously deleted. */
1705 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1707 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1708 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1709 el->name, GUID_string(tmp_ctx, p->guid));
1710 talloc_free(tmp_ctx);
1711 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1713 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1714 invocation_id, seq_num, seq_num, now, 0, false);
1715 if (ret != LDB_SUCCESS) {
1716 talloc_free(tmp_ctx);
1721 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1722 if (ret != LDB_SUCCESS) {
1723 talloc_free(tmp_ctx);
1728 /* add the new ones on to the end of the old values, constructing a new el->values */
1729 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1731 old_num_values+num_new_values);
1732 if (el->values == NULL) {
1733 ldb_module_oom(module);
1734 return LDB_ERR_OPERATIONS_ERROR;
1737 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1738 el->num_values = old_num_values + num_new_values;
1740 talloc_steal(msg->elements, el->values);
1741 talloc_steal(el->values, new_values);
1743 talloc_free(tmp_ctx);
1745 /* we now tell the backend to replace all existing values
1746 with the one we have constructed */
1747 el->flags = LDB_FLAG_MOD_REPLACE;
1754 handle deleting all active linked attributes
1756 static int replmd_modify_la_delete(struct ldb_module *module,
1757 const struct dsdb_schema *schema,
1758 struct ldb_message *msg,
1759 struct ldb_message_element *el,
1760 struct ldb_message_element *old_el,
1761 const struct dsdb_attribute *schema_attr,
1764 struct GUID *msg_guid)
1767 struct parsed_dn *dns, *old_dns;
1768 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1770 const struct GUID *invocation_id;
1771 struct ldb_context *ldb = ldb_module_get_ctx(module);
1774 unix_to_nt_time(&now, t);
1776 /* check if there is nothing to delete */
1777 if ((!old_el || old_el->num_values == 0) &&
1778 el->num_values == 0) {
1782 if (!old_el || old_el->num_values == 0) {
1783 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1786 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1787 if (ret != LDB_SUCCESS) {
1788 talloc_free(tmp_ctx);
1792 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1793 if (ret != LDB_SUCCESS) {
1794 talloc_free(tmp_ctx);
1798 invocation_id = samdb_ntds_invocation_id(ldb);
1799 if (!invocation_id) {
1800 return LDB_ERR_OPERATIONS_ERROR;
1803 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1804 if (ret != LDB_SUCCESS) {
1805 talloc_free(tmp_ctx);
1811 /* see if we are being asked to delete any links that
1812 don't exist or are already deleted */
1813 for (i=0; i<el->num_values; i++) {
1814 struct parsed_dn *p = &dns[i];
1815 struct parsed_dn *p2;
1818 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1820 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1821 el->name, GUID_string(tmp_ctx, p->guid));
1822 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1824 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1825 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1826 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1827 el->name, GUID_string(tmp_ctx, p->guid));
1828 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1832 /* for each new value, see if it exists already with the same GUID
1833 if it is not already deleted and matches the delete list then delete it
1835 for (i=0; i<old_el->num_values; i++) {
1836 struct parsed_dn *p = &old_dns[i];
1839 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1843 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1844 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1846 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1847 invocation_id, seq_num, seq_num, now, 0, true);
1848 if (ret != LDB_SUCCESS) {
1849 talloc_free(tmp_ctx);
1853 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1854 if (ret != LDB_SUCCESS) {
1855 talloc_free(tmp_ctx);
1860 el->values = talloc_steal(msg->elements, old_el->values);
1861 el->num_values = old_el->num_values;
1863 talloc_free(tmp_ctx);
1865 /* we now tell the backend to replace all existing values
1866 with the one we have constructed */
1867 el->flags = LDB_FLAG_MOD_REPLACE;
1873 handle replacing a linked attribute
1875 static int replmd_modify_la_replace(struct ldb_module *module,
1876 const struct dsdb_schema *schema,
1877 struct ldb_message *msg,
1878 struct ldb_message_element *el,
1879 struct ldb_message_element *old_el,
1880 const struct dsdb_attribute *schema_attr,
1883 struct GUID *msg_guid)
1886 struct parsed_dn *dns, *old_dns;
1887 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1889 const struct GUID *invocation_id;
1890 struct ldb_context *ldb = ldb_module_get_ctx(module);
1891 struct ldb_val *new_values = NULL;
1892 unsigned int num_new_values = 0;
1893 unsigned int old_num_values = old_el?old_el->num_values:0;
1896 unix_to_nt_time(&now, t);
1898 /* check if there is nothing to replace */
1899 if ((!old_el || old_el->num_values == 0) &&
1900 el->num_values == 0) {
1904 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1905 if (ret != LDB_SUCCESS) {
1906 talloc_free(tmp_ctx);
1910 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1911 if (ret != LDB_SUCCESS) {
1912 talloc_free(tmp_ctx);
1916 invocation_id = samdb_ntds_invocation_id(ldb);
1917 if (!invocation_id) {
1918 return LDB_ERR_OPERATIONS_ERROR;
1921 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1922 if (ret != LDB_SUCCESS) {
1923 talloc_free(tmp_ctx);
1927 /* mark all the old ones as deleted */
1928 for (i=0; i<old_num_values; i++) {
1929 struct parsed_dn *old_p = &old_dns[i];
1930 struct parsed_dn *p;
1931 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1933 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1935 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1936 if (ret != LDB_SUCCESS) {
1937 talloc_free(tmp_ctx);
1941 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1943 /* we don't delete it if we are re-adding it */
1947 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1948 invocation_id, seq_num, seq_num, now, 0, true);
1949 if (ret != LDB_SUCCESS) {
1950 talloc_free(tmp_ctx);
1955 /* for each new value, either update its meta-data, or add it
1958 for (i=0; i<el->num_values; i++) {
1959 struct parsed_dn *p = &dns[i], *old_p;
1962 (old_p = parsed_dn_find(old_dns,
1963 old_num_values, p->guid, NULL)) != NULL) {
1964 /* update in place */
1965 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1966 old_p->dsdb_dn, invocation_id,
1967 seq_num, seq_num, now, 0, false);
1968 if (ret != LDB_SUCCESS) {
1969 talloc_free(tmp_ctx);
1974 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1976 if (new_values == NULL) {
1977 ldb_module_oom(module);
1978 talloc_free(tmp_ctx);
1979 return LDB_ERR_OPERATIONS_ERROR;
1981 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1982 invocation_id, seq_num, seq_num, now, 0, false);
1983 if (ret != LDB_SUCCESS) {
1984 talloc_free(tmp_ctx);
1990 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1991 if (ret != LDB_SUCCESS) {
1992 talloc_free(tmp_ctx);
1997 /* add the new values to the end of old_el */
1998 if (num_new_values != 0) {
1999 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2000 struct ldb_val, old_num_values+num_new_values);
2001 if (el->values == NULL) {
2002 ldb_module_oom(module);
2003 return LDB_ERR_OPERATIONS_ERROR;
2005 memcpy(&el->values[old_num_values], &new_values[0],
2006 sizeof(struct ldb_val)*num_new_values);
2007 el->num_values = old_num_values + num_new_values;
2008 talloc_steal(msg->elements, new_values);
2010 el->values = old_el->values;
2011 el->num_values = old_el->num_values;
2012 talloc_steal(msg->elements, el->values);
2015 talloc_free(tmp_ctx);
2017 /* we now tell the backend to replace all existing values
2018 with the one we have constructed */
2019 el->flags = LDB_FLAG_MOD_REPLACE;
2026 handle linked attributes in modify requests
2028 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2029 struct ldb_message *msg,
2030 uint64_t seq_num, time_t t)
2032 struct ldb_result *res;
2035 struct ldb_context *ldb = ldb_module_get_ctx(module);
2036 struct ldb_message *old_msg;
2038 const struct dsdb_schema *schema;
2039 struct GUID old_guid;
2042 /* there the replmd_update_rpmd code has already
2043 * checked and saw that there are no linked
2048 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2049 /* don't do anything special for linked attributes */
2053 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2054 DSDB_FLAG_NEXT_MODULE |
2055 DSDB_SEARCH_SHOW_DELETED |
2056 DSDB_SEARCH_REVEAL_INTERNALS |
2057 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2058 if (ret != LDB_SUCCESS) {
2061 schema = dsdb_get_schema(ldb, res);
2063 return LDB_ERR_OPERATIONS_ERROR;
2066 old_msg = res->msgs[0];
2068 old_guid = samdb_result_guid(old_msg, "objectGUID");
2070 for (i=0; i<msg->num_elements; i++) {
2071 struct ldb_message_element *el = &msg->elements[i];
2072 struct ldb_message_element *old_el, *new_el;
2073 const struct dsdb_attribute *schema_attr
2074 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2076 ldb_asprintf_errstring(ldb,
2077 "attribute %s is not a valid attribute in schema", el->name);
2078 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2080 if (schema_attr->linkID == 0) {
2083 if ((schema_attr->linkID & 1) == 1) {
2084 /* Odd is for the target. Illegal to modify */
2085 ldb_asprintf_errstring(ldb,
2086 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2087 return LDB_ERR_UNWILLING_TO_PERFORM;
2089 old_el = ldb_msg_find_element(old_msg, el->name);
2090 switch (el->flags & LDB_FLAG_MOD_MASK) {
2091 case LDB_FLAG_MOD_REPLACE:
2092 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2094 case LDB_FLAG_MOD_DELETE:
2095 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2097 case LDB_FLAG_MOD_ADD:
2098 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2101 ldb_asprintf_errstring(ldb,
2102 "invalid flags 0x%x for %s linked attribute",
2103 el->flags, el->name);
2104 return LDB_ERR_UNWILLING_TO_PERFORM;
2106 if (ret != LDB_SUCCESS) {
2110 ldb_msg_remove_attr(old_msg, el->name);
2112 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2113 new_el->num_values = el->num_values;
2114 new_el->values = talloc_steal(msg->elements, el->values);
2116 /* TODO: this relises a bit too heavily on the exact
2117 behaviour of ldb_msg_find_element and
2118 ldb_msg_remove_element */
2119 old_el = ldb_msg_find_element(msg, el->name);
2121 ldb_msg_remove_element(msg, old_el);
2132 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2134 struct ldb_context *ldb;
2135 struct replmd_replicated_request *ac;
2136 struct ldb_request *down_req;
2137 struct ldb_message *msg;
2138 time_t t = time(NULL);
2140 bool is_urgent = false;
2141 struct loadparm_context *lp_ctx;
2143 unsigned int functional_level;
2145 /* do not manipulate our control entries */
2146 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2147 return ldb_next_request(module, req);
2150 ldb = ldb_module_get_ctx(module);
2151 functional_level = dsdb_functional_level(ldb);
2153 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2154 struct loadparm_context);
2156 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2158 ac = replmd_ctx_init(module, req);
2160 return LDB_ERR_OPERATIONS_ERROR;
2163 /* we have to copy the message as the caller might have it as a const */
2164 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2168 return LDB_ERR_OPERATIONS_ERROR;
2171 ldb_msg_remove_attr(msg, "whenChanged");
2172 ldb_msg_remove_attr(msg, "uSNChanged");
2174 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2175 if (ret == LDB_ERR_REFERRAL) {
2176 referral = talloc_asprintf(req,
2178 lpcfg_dnsdomain(lp_ctx),
2179 ldb_dn_get_linearized(msg->dn));
2180 ret = ldb_module_send_referral(req, referral);
2182 return ldb_module_done(req, NULL, NULL, ret);
2185 if (ret != LDB_SUCCESS) {
2190 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2191 if (ret != LDB_SUCCESS) {
2197 * - replace the old object with the newly constructed one
2200 ac->is_urgent = is_urgent;
2202 ret = ldb_build_mod_req(&down_req, ldb, ac,
2205 ac, replmd_op_callback,
2207 if (ret != LDB_SUCCESS) {
2212 /* If we are in functional level 2000, then
2213 * replmd_modify_handle_linked_attribs will have done
2215 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2216 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2217 if (ret != LDB_SUCCESS) {
2223 talloc_steal(down_req, msg);
2225 /* we only change whenChanged and uSNChanged if the seq_num
2227 if (ac->seq_num != 0) {
2228 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2233 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2239 /* go on with the call chain */
2240 return ldb_next_request(module, down_req);
2243 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2246 handle a rename request
2248 On a rename we need to do an extra ldb_modify which sets the
2249 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2251 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2253 struct ldb_context *ldb;
2254 struct replmd_replicated_request *ac;
2256 struct ldb_request *down_req;
2258 /* do not manipulate our control entries */
2259 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2260 return ldb_next_request(module, req);
2263 ldb = ldb_module_get_ctx(module);
2265 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2267 ac = replmd_ctx_init(module, req);
2269 return LDB_ERR_OPERATIONS_ERROR;
2271 ret = ldb_build_rename_req(&down_req, ldb, ac,
2272 ac->req->op.rename.olddn,
2273 ac->req->op.rename.newdn,
2275 ac, replmd_rename_callback,
2278 if (ret != LDB_SUCCESS) {
2283 /* go on with the call chain */
2284 return ldb_next_request(module, down_req);
2287 /* After the rename is compleated, update the whenchanged etc */
2288 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2290 struct ldb_context *ldb;
2291 struct replmd_replicated_request *ac;
2292 struct ldb_request *down_req;
2293 struct ldb_message *msg;
2294 time_t t = time(NULL);
2297 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2298 ldb = ldb_module_get_ctx(ac->module);
2300 if (ares->error != LDB_SUCCESS) {
2301 return ldb_module_done(ac->req, ares->controls,
2302 ares->response, ares->error);
2305 if (ares->type != LDB_REPLY_DONE) {
2306 ldb_set_errstring(ldb,
2307 "invalid ldb_reply_type in callback");
2309 return ldb_module_done(ac->req, NULL, NULL,
2310 LDB_ERR_OPERATIONS_ERROR);
2313 /* Get a sequence number from the backend */
2314 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2315 if (ret != LDB_SUCCESS) {
2320 * - replace the old object with the newly constructed one
2323 msg = ldb_msg_new(ac);
2326 return LDB_ERR_OPERATIONS_ERROR;
2329 msg->dn = ac->req->op.rename.newdn;
2331 ret = ldb_build_mod_req(&down_req, ldb, ac,
2334 ac, replmd_op_callback,
2337 if (ret != LDB_SUCCESS) {
2341 talloc_steal(down_req, msg);
2343 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2348 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2353 /* go on with the call chain - do the modify after the rename */
2354 return ldb_next_request(ac->module, down_req);
2358 remove links from objects that point at this object when an object
2361 static int replmd_delete_remove_link(struct ldb_module *module,
2362 const struct dsdb_schema *schema,
2364 struct ldb_message_element *el,
2365 const struct dsdb_attribute *sa)
2368 TALLOC_CTX *tmp_ctx = talloc_new(module);
2369 struct ldb_context *ldb = ldb_module_get_ctx(module);
2371 for (i=0; i<el->num_values; i++) {
2372 struct dsdb_dn *dsdb_dn;
2376 struct ldb_message *msg;
2377 const struct dsdb_attribute *target_attr;
2378 struct ldb_message_element *el2;
2379 struct ldb_val dn_val;
2381 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2385 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2387 talloc_free(tmp_ctx);
2388 return LDB_ERR_OPERATIONS_ERROR;
2391 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2392 if (!NT_STATUS_IS_OK(status)) {
2393 talloc_free(tmp_ctx);
2394 return LDB_ERR_OPERATIONS_ERROR;
2397 /* remove the link */
2398 msg = ldb_msg_new(tmp_ctx);
2400 ldb_module_oom(module);
2401 talloc_free(tmp_ctx);
2402 return LDB_ERR_OPERATIONS_ERROR;
2406 msg->dn = dsdb_dn->dn;
2408 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2409 if (target_attr == NULL) {
2413 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2414 if (ret != LDB_SUCCESS) {
2415 ldb_module_oom(module);
2416 talloc_free(tmp_ctx);
2417 return LDB_ERR_OPERATIONS_ERROR;
2419 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2420 el2->values = &dn_val;
2421 el2->num_values = 1;
2423 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2424 if (ret != LDB_SUCCESS) {
2425 talloc_free(tmp_ctx);
2429 talloc_free(tmp_ctx);
2435 handle update of replication meta data for deletion of objects
2437 This also handles the mapping of delete to a rename operation
2438 to allow deletes to be replicated.
2440 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2442 int ret = LDB_ERR_OTHER;
2444 struct ldb_dn *old_dn, *new_dn;
2445 const char *rdn_name;
2446 const struct ldb_val *rdn_value, *new_rdn_value;
2448 struct ldb_context *ldb = ldb_module_get_ctx(module);
2449 const struct dsdb_schema *schema;
2450 struct ldb_message *msg, *old_msg;
2451 struct ldb_message_element *el;
2452 TALLOC_CTX *tmp_ctx;
2453 struct ldb_result *res, *parent_res;
2454 const char *preserved_attrs[] = {
2455 /* yes, this really is a hard coded list. See MS-ADTS
2456 section 3.1.1.5.5.1.1 */
2457 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2458 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2459 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2460 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2461 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2462 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2463 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2464 "whenChanged", NULL};
2465 unsigned int i, el_count = 0;
2466 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2467 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2468 enum deletion_state deletion_state, next_deletion_state;
2471 if (ldb_dn_is_special(req->op.del.dn)) {
2472 return ldb_next_request(module, req);
2475 tmp_ctx = talloc_new(ldb);
2478 return LDB_ERR_OPERATIONS_ERROR;
2481 schema = dsdb_get_schema(ldb, tmp_ctx);
2483 return LDB_ERR_OPERATIONS_ERROR;
2486 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2488 /* we need the complete msg off disk, so we can work out which
2489 attributes need to be removed */
2490 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2491 DSDB_FLAG_NEXT_MODULE |
2492 DSDB_SEARCH_SHOW_DELETED |
2493 DSDB_SEARCH_REVEAL_INTERNALS |
2494 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2495 if (ret != LDB_SUCCESS) {
2496 talloc_free(tmp_ctx);
2499 old_msg = res->msgs[0];
2502 ret = dsdb_recyclebin_enabled(module, &enabled);
2503 if (ret != LDB_SUCCESS) {
2504 talloc_free(tmp_ctx);
2508 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2510 deletion_state = OBJECT_TOMBSTONE;
2511 next_deletion_state = OBJECT_REMOVED;
2512 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2513 deletion_state = OBJECT_RECYCLED;
2514 next_deletion_state = OBJECT_REMOVED;
2516 deletion_state = OBJECT_DELETED;
2517 next_deletion_state = OBJECT_RECYCLED;
2520 deletion_state = OBJECT_NOT_DELETED;
2522 next_deletion_state = OBJECT_DELETED;
2524 next_deletion_state = OBJECT_TOMBSTONE;
2528 if (next_deletion_state == OBJECT_REMOVED) {
2529 struct auth_session_info *session_info =
2530 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2531 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2532 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2533 ldb_dn_get_linearized(old_msg->dn));
2534 return LDB_ERR_UNWILLING_TO_PERFORM;
2537 /* it is already deleted - really remove it this time */
2538 talloc_free(tmp_ctx);
2539 return ldb_next_request(module, req);
2542 rdn_name = ldb_dn_get_rdn_name(old_dn);
2543 rdn_value = ldb_dn_get_rdn_val(old_dn);
2545 msg = ldb_msg_new(tmp_ctx);
2547 ldb_module_oom(module);
2548 talloc_free(tmp_ctx);
2549 return LDB_ERR_OPERATIONS_ERROR;
2554 if (deletion_state == OBJECT_NOT_DELETED){
2555 /* work out where we will be renaming this object to */
2556 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn, &new_dn);
2557 if (ret != LDB_SUCCESS) {
2558 /* this is probably an attempted delete on a partition
2559 * that doesn't allow delete operations, such as the
2560 * schema partition */
2561 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2562 ldb_dn_get_linearized(old_dn));
2563 talloc_free(tmp_ctx);
2564 return LDB_ERR_UNWILLING_TO_PERFORM;
2567 /* get the objects GUID from the search we just did */
2568 guid = samdb_result_guid(old_msg, "objectGUID");
2570 /* Add a formatted child */
2571 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2574 GUID_string(tmp_ctx, &guid));
2576 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2577 ldb_dn_get_linearized(new_dn)));
2578 talloc_free(tmp_ctx);
2579 return LDB_ERR_OPERATIONS_ERROR;
2582 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2583 if (ret != LDB_SUCCESS) {
2584 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2585 ldb_module_oom(module);
2586 talloc_free(tmp_ctx);
2589 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2593 now we need to modify the object in the following ways:
2595 - add isDeleted=TRUE
2596 - update rDN and name, with new rDN
2597 - remove linked attributes
2598 - remove objectCategory and sAMAccountType
2599 - remove attribs not on the preserved list
2600 - preserved if in above list, or is rDN
2601 - remove all linked attribs from this object
2602 - remove all links from other objects to this object
2603 - add lastKnownParent
2604 - update replPropertyMetaData?
2606 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2609 /* we need the storage form of the parent GUID */
2610 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2611 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2612 DSDB_FLAG_NEXT_MODULE |
2613 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2614 DSDB_SEARCH_REVEAL_INTERNALS|
2615 DSDB_SEARCH_SHOW_DELETED);
2616 if (ret != LDB_SUCCESS) {
2617 talloc_free(tmp_ctx);
2621 if (deletion_state == OBJECT_NOT_DELETED){
2622 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2623 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2624 if (ret != LDB_SUCCESS) {
2625 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2626 ldb_module_oom(module);
2627 talloc_free(tmp_ctx);
2630 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2633 switch (next_deletion_state){
2635 case OBJECT_DELETED:
2637 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2638 if (ret != LDB_SUCCESS) {
2639 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2640 ldb_module_oom(module);
2641 talloc_free(tmp_ctx);
2644 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2646 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2647 if (ret != LDB_SUCCESS) {
2648 talloc_free(tmp_ctx);
2649 ldb_module_oom(module);
2653 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2654 if (ret != LDB_SUCCESS) {
2655 talloc_free(tmp_ctx);
2656 ldb_module_oom(module);
2662 case OBJECT_RECYCLED:
2663 case OBJECT_TOMBSTONE:
2665 /* we also mark it as recycled, meaning this object can't be
2666 recovered (we are stripping its attributes) */
2667 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2668 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2669 if (ret != LDB_SUCCESS) {
2670 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2671 ldb_module_oom(module);
2672 talloc_free(tmp_ctx);
2675 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2678 /* work out which of the old attributes we will be removing */
2679 for (i=0; i<old_msg->num_elements; i++) {
2680 const struct dsdb_attribute *sa;
2681 el = &old_msg->elements[i];
2682 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2684 talloc_free(tmp_ctx);
2685 return LDB_ERR_OPERATIONS_ERROR;
2687 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2688 /* don't remove the rDN */
2691 if (sa->linkID && sa->linkID & 1) {
2692 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2693 if (ret != LDB_SUCCESS) {
2694 talloc_free(tmp_ctx);
2695 return LDB_ERR_OPERATIONS_ERROR;
2699 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2702 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2703 if (ret != LDB_SUCCESS) {
2704 talloc_free(tmp_ctx);
2705 ldb_module_oom(module);
2715 if (deletion_state == OBJECT_NOT_DELETED) {
2716 /* work out what the new rdn value is, for updating the
2717 rDN and name fields */
2718 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2720 ret = ldb_msg_add_value(msg, strlower_talloc(tmp_ctx, rdn_name), new_rdn_value, &el);
2721 if (ret != LDB_SUCCESS) {
2722 talloc_free(tmp_ctx);
2725 el->flags = LDB_FLAG_MOD_REPLACE;
2727 el = ldb_msg_find_element(old_msg, "name");
2729 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2730 if (ret != LDB_SUCCESS) {
2731 talloc_free(tmp_ctx);
2734 el->flags = LDB_FLAG_MOD_REPLACE;
2738 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2739 if (ret != LDB_SUCCESS) {
2740 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2741 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2742 talloc_free(tmp_ctx);
2746 if (deletion_state == OBJECT_NOT_DELETED) {
2747 /* now rename onto the new DN */
2748 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2749 if (ret != LDB_SUCCESS){
2750 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2751 ldb_dn_get_linearized(old_dn),
2752 ldb_dn_get_linearized(new_dn),
2753 ldb_errstring(ldb)));
2754 talloc_free(tmp_ctx);
2759 talloc_free(tmp_ctx);
2761 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2766 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2771 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2773 int ret = LDB_ERR_OTHER;
2774 /* TODO: do some error mapping */
2778 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2780 struct ldb_context *ldb;
2781 struct ldb_request *change_req;
2782 enum ndr_err_code ndr_err;
2783 struct ldb_message *msg;
2784 struct replPropertyMetaDataBlob *md;
2785 struct ldb_val md_value;
2790 * TODO: check if the parent object exist
2794 * TODO: handle the conflict case where an object with the
2798 ldb = ldb_module_get_ctx(ar->module);
2799 msg = ar->objs->objects[ar->index_current].msg;
2800 md = ar->objs->objects[ar->index_current].meta_data;
2802 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2803 if (ret != LDB_SUCCESS) {
2804 return replmd_replicated_request_error(ar, ret);
2807 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2808 if (ret != LDB_SUCCESS) {
2809 return replmd_replicated_request_error(ar, ret);
2812 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2813 if (ret != LDB_SUCCESS) {
2814 return replmd_replicated_request_error(ar, ret);
2817 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2818 if (ret != LDB_SUCCESS) {
2819 return replmd_replicated_request_error(ar, ret);
2822 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2823 if (ret != LDB_SUCCESS) {
2824 return replmd_replicated_request_error(ar, ret);
2827 /* remove any message elements that have zero values */
2828 for (i=0; i<msg->num_elements; i++) {
2829 struct ldb_message_element *el = &msg->elements[i];
2831 if (el->num_values == 0) {
2832 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2834 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2835 msg->num_elements--;
2842 * the meta data array is already sorted by the caller
2844 for (i=0; i < md->ctr.ctr1.count; i++) {
2845 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2847 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2848 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2849 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2850 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2851 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2853 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2854 if (ret != LDB_SUCCESS) {
2855 return replmd_replicated_request_error(ar, ret);
2858 replmd_ldb_message_sort(msg, ar->schema);
2861 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2862 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2866 ret = ldb_build_add_req(&change_req,
2874 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2876 return ldb_next_request(ar->module, change_req);
2880 return true if an update is newer than an existing entry
2881 see section 5.11 of MS-ADTS
2883 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2884 const struct GUID *update_invocation_id,
2885 uint32_t current_version,
2886 uint32_t update_version,
2887 NTTIME current_change_time,
2888 NTTIME update_change_time)
2890 if (update_version != current_version) {
2891 return update_version > current_version;
2893 if (update_change_time > current_change_time) {
2896 if (update_change_time == current_change_time) {
2897 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
2902 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2903 struct replPropertyMetaData1 *new_m)
2905 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2906 &new_m->originating_invocation_id,
2909 cur_m->originating_change_time,
2910 new_m->originating_change_time);
2913 static struct replPropertyMetaData1 *
2914 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2915 enum drsuapi_DsAttributeId attid)
2918 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2920 for (i = 0; i < rpmd_ctr->count; i++) {
2921 if (rpmd_ctr->array[i].attid == attid) {
2922 return &rpmd_ctr->array[i];
2928 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
2930 struct ldb_context *ldb;
2931 struct ldb_request *change_req;
2932 enum ndr_err_code ndr_err;
2933 struct ldb_message *msg;
2934 struct replPropertyMetaDataBlob *rmd;
2935 struct replPropertyMetaDataBlob omd;
2936 const struct ldb_val *omd_value;
2937 struct replPropertyMetaDataBlob nmd;
2938 struct ldb_val nmd_value;
2939 struct replPropertyMetaData1 *md_remote;
2940 struct replPropertyMetaData1 *md_local;
2943 unsigned int removed_attrs = 0;
2946 ldb = ldb_module_get_ctx(ar->module);
2947 msg = ar->objs->objects[ar->index_current].msg;
2948 rmd = ar->objs->objects[ar->index_current].meta_data;
2952 /* find existing meta data */
2953 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
2955 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
2956 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
2957 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2958 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2959 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2962 if (omd.version != 1) {
2963 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
2967 /* check if remote 'name' has change,
2968 * which indicates a rename operation */
2969 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTRIBUTE_name);
2971 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTRIBUTE_name);
2972 SMB_ASSERT(md_local);
2973 if (replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
2974 SMB_ASSERT(ldb_dn_compare(msg->dn, ar->search_msg->dn) != 0);
2975 /* TODO: Find appropriate local name (dn) for the object
2976 * and modify msg->dn appropriately */
2978 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
2979 ldb_dn_get_linearized(ar->search_msg->dn),
2980 ldb_dn_get_linearized(msg->dn)));
2981 /* pass rename to the next module
2982 * so it doesn't appear as an originating update */
2983 ret = dsdb_module_rename(ar->module,
2984 ar->search_msg->dn, msg->dn,
2985 DSDB_FLAG_NEXT_MODULE);
2986 if (ret != LDB_SUCCESS) {
2987 ldb_debug(ldb, LDB_DEBUG_FATAL,
2988 "replmd_replicated_request rename %s => %s failed - %s\n",
2989 ldb_dn_get_linearized(ar->search_msg->dn),
2990 ldb_dn_get_linearized(msg->dn),
2991 ldb_errstring(ldb));
2992 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
2999 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3000 nmd.ctr.ctr1.array = talloc_array(ar,
3001 struct replPropertyMetaData1,
3002 nmd.ctr.ctr1.count);
3003 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3005 /* first copy the old meta data */
3006 for (i=0; i < omd.ctr.ctr1.count; i++) {
3007 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3011 /* now merge in the new meta data */
3012 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3015 for (j=0; j < ni; j++) {
3018 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3022 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3023 &rmd->ctr.ctr1.array[i]);
3025 /* replace the entry */
3026 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3031 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) {
3032 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3033 msg->elements[i-removed_attrs].name,
3034 ldb_dn_get_linearized(msg->dn),
3035 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3038 /* we don't want to apply this change so remove the attribute */
3039 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3046 if (found) continue;
3048 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3053 * finally correct the size of the meta_data array
3055 nmd.ctr.ctr1.count = ni;
3058 * the rdn attribute (the alias for the name attribute),
3059 * 'cn' for most objects is the last entry in the meta data array
3062 * sort the new meta data array
3064 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3065 if (ret != LDB_SUCCESS) {
3070 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3072 if (msg->num_elements == 0) {
3073 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3076 ar->index_current++;
3077 return replmd_replicated_apply_next(ar);
3080 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3081 ar->index_current, msg->num_elements);
3083 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3084 if (ret != LDB_SUCCESS) {
3085 return replmd_replicated_request_error(ar, ret);
3088 for (i=0; i<ni; i++) {
3089 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3092 /* create the meta data value */
3093 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3094 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3095 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3096 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3097 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3101 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3102 * and replPopertyMetaData attributes
3104 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3105 if (ret != LDB_SUCCESS) {
3106 return replmd_replicated_request_error(ar, ret);
3108 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3109 if (ret != LDB_SUCCESS) {
3110 return replmd_replicated_request_error(ar, ret);
3112 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3113 if (ret != LDB_SUCCESS) {
3114 return replmd_replicated_request_error(ar, ret);
3117 replmd_ldb_message_sort(msg, ar->schema);
3119 /* we want to replace the old values */
3120 for (i=0; i < msg->num_elements; i++) {
3121 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3125 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3126 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3130 ret = ldb_build_mod_req(&change_req,
3138 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3140 return ldb_next_request(ar->module, change_req);
3143 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3144 struct ldb_reply *ares)
3146 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3147 struct replmd_replicated_request);
3151 return ldb_module_done(ar->req, NULL, NULL,
3152 LDB_ERR_OPERATIONS_ERROR);
3154 if (ares->error != LDB_SUCCESS &&
3155 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3156 return ldb_module_done(ar->req, ares->controls,
3157 ares->response, ares->error);
3160 switch (ares->type) {
3161 case LDB_REPLY_ENTRY:
3162 ar->search_msg = talloc_steal(ar, ares->message);
3165 case LDB_REPLY_REFERRAL:
3166 /* we ignore referrals */
3169 case LDB_REPLY_DONE:
3170 if (ar->search_msg != NULL) {
3171 ret = replmd_replicated_apply_merge(ar);
3173 ret = replmd_replicated_apply_add(ar);
3175 if (ret != LDB_SUCCESS) {
3176 return ldb_module_done(ar->req, NULL, NULL, ret);
3184 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3186 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3188 struct ldb_context *ldb;
3192 struct ldb_request *search_req;
3193 struct ldb_search_options_control *options;
3195 if (ar->index_current >= ar->objs->num_objects) {
3196 /* done with it, go to next stage */
3197 return replmd_replicated_uptodate_vector(ar);
3200 ldb = ldb_module_get_ctx(ar->module);
3201 ar->search_msg = NULL;
3203 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3204 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3206 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3207 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3208 talloc_free(tmp_str);
3210 ret = ldb_build_search_req(&search_req,
3219 replmd_replicated_apply_search_callback,
3222 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
3223 if (ret != LDB_SUCCESS) {
3227 /* we need to cope with cross-partition links, so search for
3228 the GUID over all partitions */
3229 options = talloc(search_req, struct ldb_search_options_control);
3230 if (options == NULL) {
3231 DEBUG(0, (__location__ ": out of memory\n"));
3232 return LDB_ERR_OPERATIONS_ERROR;
3234 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3236 ret = ldb_request_add_control(search_req,
3237 LDB_CONTROL_SEARCH_OPTIONS_OID,
3239 if (ret != LDB_SUCCESS) {
3243 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3245 return ldb_next_request(ar->module, search_req);
3248 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3249 struct ldb_reply *ares)
3251 struct ldb_context *ldb;
3252 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3253 struct replmd_replicated_request);
3254 ldb = ldb_module_get_ctx(ar->module);
3257 return ldb_module_done(ar->req, NULL, NULL,
3258 LDB_ERR_OPERATIONS_ERROR);
3260 if (ares->error != LDB_SUCCESS) {
3261 return ldb_module_done(ar->req, ares->controls,
3262 ares->response, ares->error);
3265 if (ares->type != LDB_REPLY_DONE) {
3266 ldb_set_errstring(ldb, "Invalid reply type\n!");
3267 return ldb_module_done(ar->req, NULL, NULL,
3268 LDB_ERR_OPERATIONS_ERROR);
3273 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3276 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3278 struct ldb_context *ldb;
3279 struct ldb_request *change_req;
3280 enum ndr_err_code ndr_err;
3281 struct ldb_message *msg;
3282 struct replUpToDateVectorBlob ouv;
3283 const struct ldb_val *ouv_value;
3284 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3285 struct replUpToDateVectorBlob nuv;
3286 struct ldb_val nuv_value;
3287 struct ldb_message_element *nuv_el = NULL;
3288 const struct GUID *our_invocation_id;
3289 struct ldb_message_element *orf_el = NULL;
3290 struct repsFromToBlob nrf;
3291 struct ldb_val *nrf_value = NULL;
3292 struct ldb_message_element *nrf_el = NULL;
3296 time_t t = time(NULL);
3300 ldb = ldb_module_get_ctx(ar->module);
3301 ruv = ar->objs->uptodateness_vector;
3307 unix_to_nt_time(&now, t);
3310 * first create the new replUpToDateVector
3312 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3314 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3315 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3316 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3317 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3318 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3321 if (ouv.version != 2) {
3322 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3327 * the new uptodateness vector will at least
3328 * contain 1 entry, one for the source_dsa
3330 * plus optional values from our old vector and the one from the source_dsa
3332 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3333 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3334 nuv.ctr.ctr2.cursors = talloc_array(ar,
3335 struct drsuapi_DsReplicaCursor2,
3336 nuv.ctr.ctr2.count);
3337 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3339 /* first copy the old vector */
3340 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3341 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3345 /* get our invocation_id if we have one already attached to the ldb */
3346 our_invocation_id = samdb_ntds_invocation_id(ldb);
3348 /* merge in the source_dsa vector is available */
3349 for (i=0; (ruv && i < ruv->count); i++) {
3352 if (our_invocation_id &&
3353 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3354 our_invocation_id)) {
3358 for (j=0; j < ni; j++) {
3359 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3360 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3367 * we update only the highest_usn and not the latest_sync_success time,
3368 * because the last success stands for direct replication
3370 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3371 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3376 if (found) continue;
3378 /* if it's not there yet, add it */
3379 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3384 * merge in the current highwatermark for the source_dsa
3387 for (j=0; j < ni; j++) {
3388 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3389 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3396 * here we update the highest_usn and last_sync_success time
3397 * because we're directly replicating from the source_dsa
3399 * and use the tmp_highest_usn because this is what we have just applied
3402 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3403 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3408 * here we update the highest_usn and last_sync_success time
3409 * because we're directly replicating from the source_dsa
3411 * and use the tmp_highest_usn because this is what we have just applied
3414 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3415 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3416 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3421 * finally correct the size of the cursors array
3423 nuv.ctr.ctr2.count = ni;
3428 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3431 * create the change ldb_message
3433 msg = ldb_msg_new(ar);
3434 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3435 msg->dn = ar->search_msg->dn;
3437 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3438 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3439 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3440 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3441 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3443 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3444 if (ret != LDB_SUCCESS) {
3445 return replmd_replicated_request_error(ar, ret);
3447 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3450 * now create the new repsFrom value from the given repsFromTo1 structure
3454 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3455 /* and fix some values... */
3456 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3457 nrf.ctr.ctr1.last_success = now;
3458 nrf.ctr.ctr1.last_attempt = now;
3459 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3460 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3463 * first see if we already have a repsFrom value for the current source dsa
3464 * if so we'll later replace this value
3466 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3468 for (i=0; i < orf_el->num_values; i++) {
3469 struct repsFromToBlob *trf;
3471 trf = talloc(ar, struct repsFromToBlob);
3472 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3474 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3475 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3476 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3477 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3478 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3481 if (trf->version != 1) {
3482 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3486 * we compare the source dsa objectGUID not the invocation_id
3487 * because we want only one repsFrom value per source dsa
3488 * and when the invocation_id of the source dsa has changed we don't need
3489 * the old repsFrom with the old invocation_id
3491 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3492 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3498 nrf_value = &orf_el->values[i];
3503 * copy over all old values to the new ldb_message
3505 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3506 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3511 * if we haven't found an old repsFrom value for the current source dsa
3512 * we'll add a new value
3515 struct ldb_val zero_value;
3516 ZERO_STRUCT(zero_value);
3517 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3518 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3520 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3523 /* we now fill the value which is already attached to ldb_message */
3524 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3526 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3527 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3528 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3529 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3533 * the ldb_message_element for the attribute, has all the old values and the new one
3534 * so we'll replace the whole attribute with all values
3536 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3539 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3540 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3544 /* prepare the ldb_modify() request */
3545 ret = ldb_build_mod_req(&change_req,
3551 replmd_replicated_uptodate_modify_callback,
3553 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3555 return ldb_next_request(ar->module, change_req);
3558 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3559 struct ldb_reply *ares)
3561 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3562 struct replmd_replicated_request);
3566 return ldb_module_done(ar->req, NULL, NULL,
3567 LDB_ERR_OPERATIONS_ERROR);
3569 if (ares->error != LDB_SUCCESS &&
3570 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3571 return ldb_module_done(ar->req, ares->controls,
3572 ares->response, ares->error);
3575 switch (ares->type) {
3576 case LDB_REPLY_ENTRY:
3577 ar->search_msg = talloc_steal(ar, ares->message);
3580 case LDB_REPLY_REFERRAL:
3581 /* we ignore referrals */
3584 case LDB_REPLY_DONE:
3585 if (ar->search_msg == NULL) {
3586 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3588 ret = replmd_replicated_uptodate_modify(ar);
3590 if (ret != LDB_SUCCESS) {
3591 return ldb_module_done(ar->req, NULL, NULL, ret);
3600 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3602 struct ldb_context *ldb;
3604 static const char *attrs[] = {
3605 "replUpToDateVector",
3609 struct ldb_request *search_req;
3611 ldb = ldb_module_get_ctx(ar->module);
3612 ar->search_msg = NULL;
3614 ret = ldb_build_search_req(&search_req,
3617 ar->objs->partition_dn,
3623 replmd_replicated_uptodate_search_callback,
3625 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3627 return ldb_next_request(ar->module, search_req);
3632 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3634 struct ldb_context *ldb;
3635 struct dsdb_extended_replicated_objects *objs;
3636 struct replmd_replicated_request *ar;
3637 struct ldb_control **ctrls;
3640 struct replmd_private *replmd_private =
3641 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3643 ldb = ldb_module_get_ctx(module);
3645 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3647 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3649 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3650 return LDB_ERR_PROTOCOL_ERROR;
3653 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3654 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3655 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3656 return LDB_ERR_PROTOCOL_ERROR;
3659 ar = replmd_ctx_init(module, req);
3661 return LDB_ERR_OPERATIONS_ERROR;
3663 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3664 ar->apply_mode = true;
3666 ar->schema = dsdb_get_schema(ldb, ar);
3668 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3670 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3671 return LDB_ERR_CONSTRAINT_VIOLATION;
3674 ctrls = req->controls;
3676 if (req->controls) {
3677 req->controls = talloc_memdup(ar, req->controls,
3678 talloc_get_size(req->controls));
3679 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3682 /* This allows layers further down to know if a change came in over replication */
3683 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3684 if (ret != LDB_SUCCESS) {
3688 /* If this change contained linked attributes in the body
3689 * (rather than in the links section) we need to update
3690 * backlinks in linked_attributes */
3691 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3692 if (ret != LDB_SUCCESS) {
3696 ar->controls = req->controls;
3697 req->controls = ctrls;
3699 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3701 /* save away the linked attributes for the end of the
3703 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3704 struct la_entry *la_entry;
3706 if (replmd_private->la_ctx == NULL) {
3707 replmd_private->la_ctx = talloc_new(replmd_private);
3709 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3710 if (la_entry == NULL) {
3712 return LDB_ERR_OPERATIONS_ERROR;
3714 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3715 if (la_entry->la == NULL) {
3716 talloc_free(la_entry);
3718 return LDB_ERR_OPERATIONS_ERROR;
3720 *la_entry->la = ar->objs->linked_attributes[i];
3722 /* we need to steal the non-scalars so they stay
3723 around until the end of the transaction */
3724 talloc_steal(la_entry->la, la_entry->la->identifier);
3725 talloc_steal(la_entry->la, la_entry->la->value.blob);
3727 DLIST_ADD(replmd_private->la_list, la_entry);
3730 return replmd_replicated_apply_next(ar);
3734 process one linked attribute structure
3736 static int replmd_process_linked_attribute(struct ldb_module *module,
3737 struct la_entry *la_entry)
3739 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3740 struct ldb_context *ldb = ldb_module_get_ctx(module);
3741 struct ldb_message *msg;
3742 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3743 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3745 const struct dsdb_attribute *attr;
3746 struct dsdb_dn *dsdb_dn;
3747 uint64_t seq_num = 0;
3748 struct ldb_message_element *old_el;
3750 time_t t = time(NULL);
3751 struct ldb_result *res;
3752 const char *attrs[2];
3753 struct parsed_dn *pdn_list, *pdn;
3754 struct GUID guid = GUID_zero();
3756 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3757 const struct GUID *our_invocation_id;
3760 linked_attributes[0]:
3761 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3763 identifier: struct drsuapi_DsReplicaObjectIdentifier
3764 __ndr_size : 0x0000003a (58)
3765 __ndr_size_sid : 0x00000000 (0)
3766 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3768 __ndr_size_dn : 0x00000000 (0)
3770 attid : DRSUAPI_ATTRIBUTE_member (0x1F)
3771 value: struct drsuapi_DsAttributeValue
3772 __ndr_size : 0x0000007e (126)
3774 blob : DATA_BLOB length=126
3775 flags : 0x00000001 (1)
3776 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3777 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3778 meta_data: struct drsuapi_DsReplicaMetaData
3779 version : 0x00000015 (21)
3780 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3781 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3782 originating_usn : 0x000000000001e19c (123292)
3784 (for cases where the link is to a normal DN)
3785 &target: struct drsuapi_DsReplicaObjectIdentifier3
3786 __ndr_size : 0x0000007e (126)
3787 __ndr_size_sid : 0x0000001c (28)
3788 guid : 7639e594-db75-4086-b0d4-67890ae46031
3789 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3790 __ndr_size_dn : 0x00000022 (34)
3791 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3794 /* find the attribute being modified */
3795 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3797 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3798 talloc_free(tmp_ctx);
3799 return LDB_ERR_OPERATIONS_ERROR;
3802 attrs[0] = attr->lDAPDisplayName;
3805 /* get the existing message from the db for the object with
3806 this GUID, returning attribute being modified. We will then
3807 use this msg as the basis for a modify call */
3808 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3809 DSDB_FLAG_NEXT_MODULE |
3810 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3811 DSDB_SEARCH_SHOW_DELETED |
3812 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3813 DSDB_SEARCH_REVEAL_INTERNALS,
3814 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3815 if (ret != LDB_SUCCESS) {
3816 talloc_free(tmp_ctx);
3819 if (res->count != 1) {
3820 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3821 GUID_string(tmp_ctx, &la->identifier->guid));
3822 talloc_free(tmp_ctx);
3823 return LDB_ERR_NO_SUCH_OBJECT;
3827 if (msg->num_elements == 0) {
3828 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3829 if (ret != LDB_SUCCESS) {
3830 ldb_module_oom(module);
3831 talloc_free(tmp_ctx);
3832 return LDB_ERR_OPERATIONS_ERROR;
3835 old_el = &msg->elements[0];
3836 old_el->flags = LDB_FLAG_MOD_REPLACE;
3839 /* parse the existing links */
3840 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3841 if (ret != LDB_SUCCESS) {
3842 talloc_free(tmp_ctx);
3846 /* get our invocationId */
3847 our_invocation_id = samdb_ntds_invocation_id(ldb);
3848 if (!our_invocation_id) {
3849 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3850 talloc_free(tmp_ctx);
3851 return LDB_ERR_OPERATIONS_ERROR;
3854 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3855 if (ret != LDB_SUCCESS) {
3856 talloc_free(tmp_ctx);
3860 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3861 if (!W_ERROR_IS_OK(status)) {
3862 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3863 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3864 return LDB_ERR_OPERATIONS_ERROR;
3867 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3868 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3869 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3871 ldb_dn_get_linearized(dsdb_dn->dn),
3872 ldb_dn_get_linearized(msg->dn));
3873 return LDB_ERR_OPERATIONS_ERROR;
3876 /* re-resolve the DN by GUID, as the DRS server may give us an
3878 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3879 if (ret != LDB_SUCCESS) {
3880 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3881 GUID_string(tmp_ctx, &guid),
3882 ldb_dn_get_linearized(dsdb_dn->dn)));
3885 /* see if this link already exists */
3886 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3888 /* see if this update is newer than what we have already */
3889 struct GUID invocation_id = GUID_zero();
3890 uint32_t version = 0;
3891 NTTIME change_time = 0;
3892 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3894 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3895 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3896 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3898 if (!replmd_update_is_newer(&invocation_id,
3899 &la->meta_data.originating_invocation_id,
3901 la->meta_data.version,
3903 la->meta_data.originating_change_time)) {
3904 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3905 old_el->name, ldb_dn_get_linearized(msg->dn),
3906 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
3907 talloc_free(tmp_ctx);
3911 /* get a seq_num for this change */
3912 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3913 if (ret != LDB_SUCCESS) {
3914 talloc_free(tmp_ctx);
3918 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
3919 /* remove the existing backlink */
3920 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
3921 if (ret != LDB_SUCCESS) {
3922 talloc_free(tmp_ctx);
3927 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
3928 &la->meta_data.originating_invocation_id,
3929 la->meta_data.originating_usn, seq_num,
3930 la->meta_data.originating_change_time,
3931 la->meta_data.version,
3933 if (ret != LDB_SUCCESS) {
3934 talloc_free(tmp_ctx);
3939 /* add the new backlink */
3940 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
3941 if (ret != LDB_SUCCESS) {
3942 talloc_free(tmp_ctx);
3947 /* get a seq_num for this change */
3948 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3949 if (ret != LDB_SUCCESS) {
3950 talloc_free(tmp_ctx);
3954 old_el->values = talloc_realloc(msg->elements, old_el->values,
3955 struct ldb_val, old_el->num_values+1);
3956 if (!old_el->values) {
3957 ldb_module_oom(module);
3958 return LDB_ERR_OPERATIONS_ERROR;
3960 old_el->num_values++;
3962 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
3963 &la->meta_data.originating_invocation_id,
3964 la->meta_data.originating_usn, seq_num,
3965 la->meta_data.originating_change_time,
3966 la->meta_data.version,
3967 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
3968 if (ret != LDB_SUCCESS) {
3969 talloc_free(tmp_ctx);
3974 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
3976 if (ret != LDB_SUCCESS) {
3977 talloc_free(tmp_ctx);
3983 /* we only change whenChanged and uSNChanged if the seq_num
3985 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
3986 talloc_free(tmp_ctx);
3987 return LDB_ERR_OPERATIONS_ERROR;
3990 if (add_uint64_element(msg, "uSNChanged", seq_num) != LDB_SUCCESS) {
3991 talloc_free(tmp_ctx);
3992 return LDB_ERR_OPERATIONS_ERROR;
3995 ret = dsdb_check_single_valued_link(attr, old_el);
3996 if (ret != LDB_SUCCESS) {
3997 talloc_free(tmp_ctx);
4001 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
4002 if (ret != LDB_SUCCESS) {
4003 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4005 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4006 talloc_free(tmp_ctx);
4010 talloc_free(tmp_ctx);
4015 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4017 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4018 return replmd_extended_replicated_objects(module, req);
4021 return ldb_next_request(module, req);
4026 we hook into the transaction operations to allow us to
4027 perform the linked attribute updates at the end of the whole
4028 transaction. This allows a forward linked attribute to be created
4029 before the object is created. During a vampire, w2k8 sends us linked
4030 attributes before the objects they are part of.
4032 static int replmd_start_transaction(struct ldb_module *module)
4034 /* create our private structure for this transaction */
4035 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4036 struct replmd_private);
4037 replmd_txn_cleanup(replmd_private);
4039 /* free any leftover mod_usn records from cancelled
4041 while (replmd_private->ncs) {
4042 struct nc_entry *e = replmd_private->ncs;
4043 DLIST_REMOVE(replmd_private->ncs, e);
4047 return ldb_next_start_trans(module);
4051 on prepare commit we loop over our queued la_context structures and
4054 static int replmd_prepare_commit(struct ldb_module *module)
4056 struct replmd_private *replmd_private =
4057 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4058 struct la_entry *la, *prev;
4059 struct la_backlink *bl;
4062 /* walk the list backwards, to do the first entry first, as we
4063 * added the entries with DLIST_ADD() which puts them at the
4064 * start of the list */
4065 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4066 prev = DLIST_PREV(la);
4067 DLIST_REMOVE(replmd_private->la_list, la);
4068 ret = replmd_process_linked_attribute(module, la);
4069 if (ret != LDB_SUCCESS) {
4070 replmd_txn_cleanup(replmd_private);
4075 /* process our backlink list, creating and deleting backlinks
4077 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4078 ret = replmd_process_backlink(module, bl);
4079 if (ret != LDB_SUCCESS) {
4080 replmd_txn_cleanup(replmd_private);
4085 replmd_txn_cleanup(replmd_private);
4087 /* possibly change @REPLCHANGED */
4088 ret = replmd_notify_store(module);
4089 if (ret != LDB_SUCCESS) {
4093 return ldb_next_prepare_commit(module);
4096 static int replmd_del_transaction(struct ldb_module *module)
4098 struct replmd_private *replmd_private =
4099 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4100 replmd_txn_cleanup(replmd_private);
4102 return ldb_next_del_trans(module);
4106 _PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4107 .name = "repl_meta_data",
4108 .init_context = replmd_init,
4110 .modify = replmd_modify,
4111 .rename = replmd_rename,
4112 .del = replmd_delete,
4113 .extended = replmd_extended,
4114 .start_transaction = replmd_start_transaction,
4115 .prepare_commit = replmd_prepare_commit,
4116 .del_transaction = replmd_del_transaction,