4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/session.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
516 if (ldb_msg_find_element(msg, attr) != NULL) {
520 s = ldb_timestring(msg, t);
522 return LDB_ERR_OPERATIONS_ERROR;
525 ret = ldb_msg_add_string(msg, attr, s);
526 if (ret != LDB_SUCCESS) {
530 el = ldb_msg_find_element(msg, attr);
531 /* always set as replace. This works because on add ops, the flag
533 el->flags = LDB_FLAG_MOD_REPLACE;
539 add a uint64_t element to a record
541 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
542 const char *attr, uint64_t v)
544 struct ldb_message_element *el;
547 if (ldb_msg_find_element(msg, attr) != NULL) {
551 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
552 if (ret != LDB_SUCCESS) {
556 el = ldb_msg_find_element(msg, attr);
557 /* always set as replace. This works because on add ops, the flag
559 el->flags = LDB_FLAG_MOD_REPLACE;
564 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
565 const struct replPropertyMetaData1 *m2,
566 const uint32_t *rdn_attid)
568 if (m1->attid == m2->attid) {
573 * the rdn attribute should be at the end!
574 * so we need to return a value greater than zero
575 * which means m1 is greater than m2
577 if (m1->attid == *rdn_attid) {
582 * the rdn attribute should be at the end!
583 * so we need to return a value less than zero
584 * which means m2 is greater than m1
586 if (m2->attid == *rdn_attid) {
590 return m1->attid > m2->attid ? 1 : -1;
593 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
594 const struct dsdb_schema *schema,
597 const char *rdn_name;
598 const struct dsdb_attribute *rdn_sa;
600 rdn_name = ldb_dn_get_rdn_name(dn);
602 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
603 return LDB_ERR_OPERATIONS_ERROR;
606 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
607 if (rdn_sa == NULL) {
608 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
609 return LDB_ERR_OPERATIONS_ERROR;
612 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
613 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
615 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
620 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
621 const struct ldb_message_element *e2,
622 const struct dsdb_schema *schema)
624 const struct dsdb_attribute *a1;
625 const struct dsdb_attribute *a2;
628 * TODO: make this faster by caching the dsdb_attribute pointer
629 * on the ldb_messag_element
632 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
633 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
636 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
640 return strcasecmp(e1->name, e2->name);
642 if (a1->attributeID_id == a2->attributeID_id) {
645 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
648 static void replmd_ldb_message_sort(struct ldb_message *msg,
649 const struct dsdb_schema *schema)
651 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
654 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
655 const struct GUID *invocation_id, uint64_t seq_num,
656 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
660 fix up linked attributes in replmd_add.
661 This involves setting up the right meta-data in extended DN
662 components, and creating backlinks to the object
664 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
665 uint64_t seq_num, const struct GUID *invocationId, time_t t,
666 struct GUID *guid, const struct dsdb_attribute *sa)
669 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
670 struct ldb_context *ldb = ldb_module_get_ctx(module);
672 /* We will take a reference to the schema in replmd_add_backlink */
673 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
676 unix_to_nt_time(&now, t);
678 for (i=0; i<el->num_values; i++) {
679 struct ldb_val *v = &el->values[i];
680 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
681 struct GUID target_guid;
685 /* note that the DN already has the extended
686 components from the extended_dn_store module */
687 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
688 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
689 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
694 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
695 if (ret != LDB_SUCCESS) {
696 talloc_free(tmp_ctx);
701 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
702 seq_num, seq_num, now, 0, false);
703 if (ret != LDB_SUCCESS) {
704 talloc_free(tmp_ctx);
708 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
709 if (ret != LDB_SUCCESS) {
710 talloc_free(tmp_ctx);
715 talloc_free(tmp_ctx);
721 intercept add requests
723 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
725 struct ldb_context *ldb;
726 struct ldb_control *control;
727 struct replmd_replicated_request *ac;
728 enum ndr_err_code ndr_err;
729 struct ldb_request *down_req;
730 struct ldb_message *msg;
731 const DATA_BLOB *guid_blob;
733 struct replPropertyMetaDataBlob nmd;
734 struct ldb_val nmd_value;
735 const struct GUID *our_invocation_id;
736 time_t t = time(NULL);
741 unsigned int functional_level;
743 bool allow_add_guid = false;
744 bool remove_current_guid = false;
745 bool is_urgent = false;
746 struct ldb_message_element *objectclass_el;
748 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
749 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
751 allow_add_guid = true;
754 /* do not manipulate our control entries */
755 if (ldb_dn_is_special(req->op.add.message->dn)) {
756 return ldb_next_request(module, req);
759 ldb = ldb_module_get_ctx(module);
761 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
763 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
764 if (guid_blob != NULL) {
765 if (!allow_add_guid) {
766 ldb_set_errstring(ldb,
767 "replmd_add: it's not allowed to add an object with objectGUID!");
768 return LDB_ERR_UNWILLING_TO_PERFORM;
770 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
771 if (!NT_STATUS_IS_OK(status)) {
772 ldb_set_errstring(ldb,
773 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
774 return LDB_ERR_UNWILLING_TO_PERFORM;
776 /* we remove this attribute as it can be a string and
777 * will not be treated correctly and then we will re-add
778 * it later on in the good format */
779 remove_current_guid = true;
783 guid = GUID_random();
786 ac = replmd_ctx_init(module, req);
788 return ldb_module_oom(module);
791 functional_level = dsdb_functional_level(ldb);
793 /* Get a sequence number from the backend */
794 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
795 if (ret != LDB_SUCCESS) {
800 /* get our invocationId */
801 our_invocation_id = samdb_ntds_invocation_id(ldb);
802 if (!our_invocation_id) {
803 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
804 "replmd_add: unable to find invocationId\n");
806 return LDB_ERR_OPERATIONS_ERROR;
809 /* we have to copy the message as the caller might have it as a const */
810 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
814 return LDB_ERR_OPERATIONS_ERROR;
817 /* generated times */
818 unix_to_nt_time(&now, t);
819 time_str = ldb_timestring(msg, t);
823 return LDB_ERR_OPERATIONS_ERROR;
825 if (remove_current_guid) {
826 ldb_msg_remove_attr(msg,"objectGUID");
830 * remove autogenerated attributes
832 ldb_msg_remove_attr(msg, "whenCreated");
833 ldb_msg_remove_attr(msg, "whenChanged");
834 ldb_msg_remove_attr(msg, "uSNCreated");
835 ldb_msg_remove_attr(msg, "uSNChanged");
836 ldb_msg_remove_attr(msg, "replPropertyMetaData");
839 * readd replicated attributes
841 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
842 if (ret != LDB_SUCCESS) {
848 /* build the replication meta_data */
851 nmd.ctr.ctr1.count = msg->num_elements;
852 nmd.ctr.ctr1.array = talloc_array(msg,
853 struct replPropertyMetaData1,
855 if (!nmd.ctr.ctr1.array) {
858 return LDB_ERR_OPERATIONS_ERROR;
861 for (i=0; i < msg->num_elements; i++) {
862 struct ldb_message_element *e = &msg->elements[i];
863 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
864 const struct dsdb_attribute *sa;
866 if (e->name[0] == '@') continue;
868 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
870 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
871 "replmd_add: attribute '%s' not defined in schema\n",
874 return LDB_ERR_NO_SUCH_ATTRIBUTE;
877 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
878 /* if the attribute is not replicated (0x00000001)
879 * or constructed (0x00000004) it has no metadata
884 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
885 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
886 if (ret != LDB_SUCCESS) {
890 /* linked attributes are not stored in
891 replPropertyMetaData in FL above w2k */
895 m->attid = sa->attributeID_id;
897 m->originating_change_time = now;
898 m->originating_invocation_id = *our_invocation_id;
899 m->originating_usn = ac->seq_num;
900 m->local_usn = ac->seq_num;
904 /* fix meta data count */
905 nmd.ctr.ctr1.count = ni;
908 * sort meta data array, and move the rdn attribute entry to the end
910 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
911 if (ret != LDB_SUCCESS) {
916 /* generated NDR encoded values */
917 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
919 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
920 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
923 return LDB_ERR_OPERATIONS_ERROR;
927 * add the autogenerated values
929 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
930 if (ret != LDB_SUCCESS) {
935 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
936 if (ret != LDB_SUCCESS) {
941 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
942 if (ret != LDB_SUCCESS) {
947 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
948 if (ret != LDB_SUCCESS) {
953 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
954 if (ret != LDB_SUCCESS) {
961 * sort the attributes by attid before storing the object
963 replmd_ldb_message_sort(msg, ac->schema);
965 objectclass_el = ldb_msg_find_element(msg, "objectClass");
966 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
967 REPL_URGENT_ON_CREATE);
969 ac->is_urgent = is_urgent;
970 ret = ldb_build_add_req(&down_req, ldb, ac,
973 ac, replmd_op_callback,
976 LDB_REQ_SET_LOCATION(down_req);
977 if (ret != LDB_SUCCESS) {
982 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
983 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
984 if (ret != LDB_SUCCESS) {
990 /* mark the control done */
992 control->critical = 0;
995 /* go on with the call chain */
996 return ldb_next_request(module, down_req);
1001 * update the replPropertyMetaData for one element
1003 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1004 struct ldb_message *msg,
1005 struct ldb_message_element *el,
1006 struct ldb_message_element *old_el,
1007 struct replPropertyMetaDataBlob *omd,
1008 const struct dsdb_schema *schema,
1010 const struct GUID *our_invocation_id,
1014 const struct dsdb_attribute *a;
1015 struct replPropertyMetaData1 *md1;
1017 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1019 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1021 return LDB_ERR_OPERATIONS_ERROR;
1024 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1028 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1029 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1033 for (i=0; i<omd->ctr.ctr1.count; i++) {
1034 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1037 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1038 /* linked attributes are not stored in
1039 replPropertyMetaData in FL above w2k, but we do
1040 raise the seqnum for the object */
1041 if (*seq_num == 0 &&
1042 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1043 return LDB_ERR_OPERATIONS_ERROR;
1048 if (i == omd->ctr.ctr1.count) {
1049 /* we need to add a new one */
1050 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1051 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1052 if (omd->ctr.ctr1.array == NULL) {
1054 return LDB_ERR_OPERATIONS_ERROR;
1056 omd->ctr.ctr1.count++;
1057 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1060 /* Get a new sequence number from the backend. We only do this
1061 * if we have a change that requires a new
1062 * replPropertyMetaData element
1064 if (*seq_num == 0) {
1065 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1066 if (ret != LDB_SUCCESS) {
1067 return LDB_ERR_OPERATIONS_ERROR;
1071 md1 = &omd->ctr.ctr1.array[i];
1073 md1->attid = a->attributeID_id;
1074 md1->originating_change_time = now;
1075 md1->originating_invocation_id = *our_invocation_id;
1076 md1->originating_usn = *seq_num;
1077 md1->local_usn = *seq_num;
1082 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1084 uint32_t count = omd.ctr.ctr1.count;
1087 for (i=0; i < count; i++) {
1088 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1089 if (max < m.local_usn) {
1097 * update the replPropertyMetaData object each time we modify an
1098 * object. This is needed for DRS replication, as the merge on the
1099 * client is based on this object
1101 static int replmd_update_rpmd(struct ldb_module *module,
1102 const struct dsdb_schema *schema,
1103 struct ldb_request *req,
1104 struct ldb_message *msg, uint64_t *seq_num,
1108 const struct ldb_val *omd_value;
1109 enum ndr_err_code ndr_err;
1110 struct replPropertyMetaDataBlob omd;
1113 const struct GUID *our_invocation_id;
1115 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1116 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1117 struct ldb_result *res;
1118 struct ldb_context *ldb;
1119 struct ldb_message_element *objectclass_el;
1120 enum urgent_situation situation;
1121 bool rodc, rmd_is_provided;
1123 ldb = ldb_module_get_ctx(module);
1125 our_invocation_id = samdb_ntds_invocation_id(ldb);
1126 if (!our_invocation_id) {
1127 /* this happens during an initial vampire while
1128 updating the schema */
1129 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1133 unix_to_nt_time(&now, t);
1135 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1136 rmd_is_provided = true;
1138 rmd_is_provided = false;
1141 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1142 * otherwise we consider we are updating */
1143 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1144 situation = REPL_URGENT_ON_DELETE;
1146 situation = REPL_URGENT_ON_UPDATE;
1149 if (rmd_is_provided) {
1150 /* In this case the change_replmetadata control was supplied */
1151 /* We check that it's the only attribute that is provided
1152 * (it's a rare case so it's better to keep the code simplier)
1153 * We also check that the highest local_usn is bigger than
1156 if( msg->num_elements != 1 ||
1157 strncmp(msg->elements[0].name,
1158 "replPropertyMetaData", 20) ) {
1159 DEBUG(0,(__location__ ": changereplmetada control called without "\
1160 "a specified replPropertyMetaData attribute or with others\n"));
1161 return LDB_ERR_OPERATIONS_ERROR;
1163 if (situation == REPL_URGENT_ON_DELETE) {
1164 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1165 return LDB_ERR_OPERATIONS_ERROR;
1167 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1169 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1170 ldb_dn_get_linearized(msg->dn)));
1171 return LDB_ERR_OPERATIONS_ERROR;
1173 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1174 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1175 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1176 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1177 ldb_dn_get_linearized(msg->dn)));
1178 return LDB_ERR_OPERATIONS_ERROR;
1180 *seq_num = find_max_local_usn(omd);
1182 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1183 DSDB_FLAG_NEXT_MODULE |
1184 DSDB_SEARCH_SHOW_RECYCLED |
1185 DSDB_SEARCH_SHOW_EXTENDED_DN |
1186 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1187 DSDB_SEARCH_REVEAL_INTERNALS);
1189 if (ret != LDB_SUCCESS || res->count != 1) {
1190 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1191 ldb_dn_get_linearized(msg->dn)));
1192 return LDB_ERR_OPERATIONS_ERROR;
1195 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1196 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1201 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1202 if (*seq_num <= db_seq) {
1203 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1204 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1205 (long long)*seq_num, (long long)db_seq));
1206 return LDB_ERR_OPERATIONS_ERROR;
1210 /* search for the existing replPropertyMetaDataBlob. We need
1211 * to use REVEAL and ask for DNs in storage format to support
1212 * the check for values being the same in
1213 * replmd_update_rpmd_element()
1215 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1216 DSDB_FLAG_NEXT_MODULE |
1217 DSDB_SEARCH_SHOW_RECYCLED |
1218 DSDB_SEARCH_SHOW_EXTENDED_DN |
1219 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1220 DSDB_SEARCH_REVEAL_INTERNALS);
1221 if (ret != LDB_SUCCESS || res->count != 1) {
1222 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1223 ldb_dn_get_linearized(msg->dn)));
1224 return LDB_ERR_OPERATIONS_ERROR;
1227 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1228 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1233 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1235 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1236 ldb_dn_get_linearized(msg->dn)));
1237 return LDB_ERR_OPERATIONS_ERROR;
1240 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1241 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1242 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1243 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1244 ldb_dn_get_linearized(msg->dn)));
1245 return LDB_ERR_OPERATIONS_ERROR;
1248 if (omd.version != 1) {
1249 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1250 omd.version, ldb_dn_get_linearized(msg->dn)));
1251 return LDB_ERR_OPERATIONS_ERROR;
1254 for (i=0; i<msg->num_elements; i++) {
1255 struct ldb_message_element *old_el;
1256 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1257 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1258 our_invocation_id, now);
1259 if (ret != LDB_SUCCESS) {
1263 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1264 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1270 * replmd_update_rpmd_element has done an update if the
1273 if (*seq_num != 0) {
1274 struct ldb_val *md_value;
1275 struct ldb_message_element *el;
1277 /*if we are RODC and this is a DRSR update then its ok*/
1278 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1279 ret = samdb_rodc(ldb, &rodc);
1280 if (ret != LDB_SUCCESS) {
1281 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1283 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1284 return LDB_ERR_REFERRAL;
1288 md_value = talloc(msg, struct ldb_val);
1289 if (md_value == NULL) {
1291 return LDB_ERR_OPERATIONS_ERROR;
1294 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1295 if (ret != LDB_SUCCESS) {
1299 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1300 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1301 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1302 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1303 ldb_dn_get_linearized(msg->dn)));
1304 return LDB_ERR_OPERATIONS_ERROR;
1307 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1308 if (ret != LDB_SUCCESS) {
1309 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1310 ldb_dn_get_linearized(msg->dn)));
1315 el->values = md_value;
1322 struct dsdb_dn *dsdb_dn;
1327 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1329 return GUID_compare(pdn1->guid, pdn2->guid);
1332 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1333 unsigned int count, struct GUID *guid,
1336 struct parsed_dn *ret;
1338 if (dn && GUID_all_zero(guid)) {
1339 /* when updating a link using DRS, we sometimes get a
1340 NULL GUID. We then need to try and match by DN */
1341 for (i=0; i<count; i++) {
1342 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1343 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1349 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1354 get a series of message element values as an array of DNs and GUIDs
1355 the result is sorted by GUID
1357 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1358 struct ldb_message_element *el, struct parsed_dn **pdn,
1359 const char *ldap_oid)
1362 struct ldb_context *ldb = ldb_module_get_ctx(module);
1369 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1371 ldb_module_oom(module);
1372 return LDB_ERR_OPERATIONS_ERROR;
1375 for (i=0; i<el->num_values; i++) {
1376 struct ldb_val *v = &el->values[i];
1379 struct parsed_dn *p;
1383 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1384 if (p->dsdb_dn == NULL) {
1385 return LDB_ERR_INVALID_DN_SYNTAX;
1388 dn = p->dsdb_dn->dn;
1390 p->guid = talloc(*pdn, struct GUID);
1391 if (p->guid == NULL) {
1392 ldb_module_oom(module);
1393 return LDB_ERR_OPERATIONS_ERROR;
1396 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1397 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1398 /* we got a DN without a GUID - go find the GUID */
1399 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1400 if (ret != LDB_SUCCESS) {
1401 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1402 ldb_dn_get_linearized(dn));
1405 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1406 if (ret != LDB_SUCCESS) {
1409 } else if (!NT_STATUS_IS_OK(status)) {
1410 return LDB_ERR_OPERATIONS_ERROR;
1413 /* keep a pointer to the original ldb_val */
1417 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1423 build a new extended DN, including all meta data fields
1425 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1426 RMD_ADDTIME = originating_add_time
1427 RMD_INVOCID = originating_invocation_id
1428 RMD_CHANGETIME = originating_change_time
1429 RMD_ORIGINATING_USN = originating_usn
1430 RMD_LOCAL_USN = local_usn
1431 RMD_VERSION = version
1433 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1434 const struct GUID *invocation_id, uint64_t seq_num,
1435 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1437 struct ldb_dn *dn = dsdb_dn->dn;
1438 const char *tstring, *usn_string, *flags_string;
1439 struct ldb_val tval;
1441 struct ldb_val usnv, local_usnv;
1442 struct ldb_val vers, flagsv;
1445 const char *dnstring;
1447 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1449 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1451 return LDB_ERR_OPERATIONS_ERROR;
1453 tval = data_blob_string_const(tstring);
1455 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1457 return LDB_ERR_OPERATIONS_ERROR;
1459 usnv = data_blob_string_const(usn_string);
1461 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1463 return LDB_ERR_OPERATIONS_ERROR;
1465 local_usnv = data_blob_string_const(usn_string);
1467 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1469 return LDB_ERR_OPERATIONS_ERROR;
1471 vers = data_blob_string_const(vstring);
1473 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1474 if (!NT_STATUS_IS_OK(status)) {
1475 return LDB_ERR_OPERATIONS_ERROR;
1478 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1479 if (!flags_string) {
1480 return LDB_ERR_OPERATIONS_ERROR;
1482 flagsv = data_blob_string_const(flags_string);
1484 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1485 if (ret != LDB_SUCCESS) return ret;
1486 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1487 if (ret != LDB_SUCCESS) return ret;
1488 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1489 if (ret != LDB_SUCCESS) return ret;
1490 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1491 if (ret != LDB_SUCCESS) return ret;
1492 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1493 if (ret != LDB_SUCCESS) return ret;
1494 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1495 if (ret != LDB_SUCCESS) return ret;
1496 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1497 if (ret != LDB_SUCCESS) return ret;
1499 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1500 if (dnstring == NULL) {
1501 return LDB_ERR_OPERATIONS_ERROR;
1503 *v = data_blob_string_const(dnstring);
1508 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1509 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1510 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1511 uint32_t version, bool deleted);
1514 check if any links need upgrading from w2k format
1516 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1518 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1521 for (i=0; i<count; i++) {
1526 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1527 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1531 /* it's an old one that needs upgrading */
1532 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1534 if (ret != LDB_SUCCESS) {
1542 update an extended DN, including all meta data fields
1544 see replmd_build_la_val for value names
1546 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1547 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1548 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1549 uint32_t version, bool deleted)
1551 struct ldb_dn *dn = dsdb_dn->dn;
1552 const char *tstring, *usn_string, *flags_string;
1553 struct ldb_val tval;
1555 struct ldb_val usnv, local_usnv;
1556 struct ldb_val vers, flagsv;
1557 const struct ldb_val *old_addtime;
1558 uint32_t old_version;
1561 const char *dnstring;
1563 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1565 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1567 return LDB_ERR_OPERATIONS_ERROR;
1569 tval = data_blob_string_const(tstring);
1571 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1573 return LDB_ERR_OPERATIONS_ERROR;
1575 usnv = data_blob_string_const(usn_string);
1577 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1579 return LDB_ERR_OPERATIONS_ERROR;
1581 local_usnv = data_blob_string_const(usn_string);
1583 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1584 if (!NT_STATUS_IS_OK(status)) {
1585 return LDB_ERR_OPERATIONS_ERROR;
1588 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1589 if (!flags_string) {
1590 return LDB_ERR_OPERATIONS_ERROR;
1592 flagsv = data_blob_string_const(flags_string);
1594 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1595 if (ret != LDB_SUCCESS) return ret;
1597 /* get the ADDTIME from the original */
1598 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1599 if (old_addtime == NULL) {
1600 old_addtime = &tval;
1602 if (dsdb_dn != old_dsdb_dn) {
1603 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1604 if (ret != LDB_SUCCESS) return ret;
1607 /* use our invocation id */
1608 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1609 if (ret != LDB_SUCCESS) return ret;
1611 /* changetime is the current time */
1612 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1613 if (ret != LDB_SUCCESS) return ret;
1615 /* update the USN */
1616 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1617 if (ret != LDB_SUCCESS) return ret;
1619 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1620 if (ret != LDB_SUCCESS) return ret;
1622 /* increase the version by 1 */
1623 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1624 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1625 version = old_version+1;
1627 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1628 vers = data_blob_string_const(vstring);
1629 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1630 if (ret != LDB_SUCCESS) return ret;
1632 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1633 if (dnstring == NULL) {
1634 return LDB_ERR_OPERATIONS_ERROR;
1636 *v = data_blob_string_const(dnstring);
1642 handle adding a linked attribute
1644 static int replmd_modify_la_add(struct ldb_module *module,
1645 const struct dsdb_schema *schema,
1646 struct ldb_message *msg,
1647 struct ldb_message_element *el,
1648 struct ldb_message_element *old_el,
1649 const struct dsdb_attribute *schema_attr,
1652 struct GUID *msg_guid)
1655 struct parsed_dn *dns, *old_dns;
1656 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1658 struct ldb_val *new_values = NULL;
1659 unsigned int num_new_values = 0;
1660 unsigned old_num_values = old_el?old_el->num_values:0;
1661 const struct GUID *invocation_id;
1662 struct ldb_context *ldb = ldb_module_get_ctx(module);
1665 unix_to_nt_time(&now, t);
1667 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1668 if (ret != LDB_SUCCESS) {
1669 talloc_free(tmp_ctx);
1673 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1674 if (ret != LDB_SUCCESS) {
1675 talloc_free(tmp_ctx);
1679 invocation_id = samdb_ntds_invocation_id(ldb);
1680 if (!invocation_id) {
1681 talloc_free(tmp_ctx);
1682 return LDB_ERR_OPERATIONS_ERROR;
1685 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1686 if (ret != LDB_SUCCESS) {
1687 talloc_free(tmp_ctx);
1691 /* for each new value, see if it exists already with the same GUID */
1692 for (i=0; i<el->num_values; i++) {
1693 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1695 /* this is a new linked attribute value */
1696 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1697 if (new_values == NULL) {
1698 ldb_module_oom(module);
1699 talloc_free(tmp_ctx);
1700 return LDB_ERR_OPERATIONS_ERROR;
1702 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1703 invocation_id, seq_num, seq_num, now, 0, false);
1704 if (ret != LDB_SUCCESS) {
1705 talloc_free(tmp_ctx);
1710 /* this is only allowed if the GUID was
1711 previously deleted. */
1712 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1714 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1715 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1716 el->name, GUID_string(tmp_ctx, p->guid));
1717 talloc_free(tmp_ctx);
1718 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1720 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1721 invocation_id, seq_num, seq_num, now, 0, false);
1722 if (ret != LDB_SUCCESS) {
1723 talloc_free(tmp_ctx);
1728 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1729 if (ret != LDB_SUCCESS) {
1730 talloc_free(tmp_ctx);
1735 /* add the new ones on to the end of the old values, constructing a new el->values */
1736 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1738 old_num_values+num_new_values);
1739 if (el->values == NULL) {
1740 ldb_module_oom(module);
1741 return LDB_ERR_OPERATIONS_ERROR;
1744 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1745 el->num_values = old_num_values + num_new_values;
1747 talloc_steal(msg->elements, el->values);
1748 talloc_steal(el->values, new_values);
1750 talloc_free(tmp_ctx);
1752 /* we now tell the backend to replace all existing values
1753 with the one we have constructed */
1754 el->flags = LDB_FLAG_MOD_REPLACE;
1761 handle deleting all active linked attributes
1763 static int replmd_modify_la_delete(struct ldb_module *module,
1764 const struct dsdb_schema *schema,
1765 struct ldb_message *msg,
1766 struct ldb_message_element *el,
1767 struct ldb_message_element *old_el,
1768 const struct dsdb_attribute *schema_attr,
1771 struct GUID *msg_guid)
1774 struct parsed_dn *dns, *old_dns;
1775 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1777 const struct GUID *invocation_id;
1778 struct ldb_context *ldb = ldb_module_get_ctx(module);
1781 unix_to_nt_time(&now, t);
1783 /* check if there is nothing to delete */
1784 if ((!old_el || old_el->num_values == 0) &&
1785 el->num_values == 0) {
1789 if (!old_el || old_el->num_values == 0) {
1790 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1793 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1794 if (ret != LDB_SUCCESS) {
1795 talloc_free(tmp_ctx);
1799 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1800 if (ret != LDB_SUCCESS) {
1801 talloc_free(tmp_ctx);
1805 invocation_id = samdb_ntds_invocation_id(ldb);
1806 if (!invocation_id) {
1807 return LDB_ERR_OPERATIONS_ERROR;
1810 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1811 if (ret != LDB_SUCCESS) {
1812 talloc_free(tmp_ctx);
1818 /* see if we are being asked to delete any links that
1819 don't exist or are already deleted */
1820 for (i=0; i<el->num_values; i++) {
1821 struct parsed_dn *p = &dns[i];
1822 struct parsed_dn *p2;
1825 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1827 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1828 el->name, GUID_string(tmp_ctx, p->guid));
1829 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1831 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1832 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1833 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1834 el->name, GUID_string(tmp_ctx, p->guid));
1835 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1839 /* for each new value, see if it exists already with the same GUID
1840 if it is not already deleted and matches the delete list then delete it
1842 for (i=0; i<old_el->num_values; i++) {
1843 struct parsed_dn *p = &old_dns[i];
1846 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1850 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1851 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1853 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1854 invocation_id, seq_num, seq_num, now, 0, true);
1855 if (ret != LDB_SUCCESS) {
1856 talloc_free(tmp_ctx);
1860 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1861 if (ret != LDB_SUCCESS) {
1862 talloc_free(tmp_ctx);
1867 el->values = talloc_steal(msg->elements, old_el->values);
1868 el->num_values = old_el->num_values;
1870 talloc_free(tmp_ctx);
1872 /* we now tell the backend to replace all existing values
1873 with the one we have constructed */
1874 el->flags = LDB_FLAG_MOD_REPLACE;
1880 handle replacing a linked attribute
1882 static int replmd_modify_la_replace(struct ldb_module *module,
1883 const struct dsdb_schema *schema,
1884 struct ldb_message *msg,
1885 struct ldb_message_element *el,
1886 struct ldb_message_element *old_el,
1887 const struct dsdb_attribute *schema_attr,
1890 struct GUID *msg_guid)
1893 struct parsed_dn *dns, *old_dns;
1894 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1896 const struct GUID *invocation_id;
1897 struct ldb_context *ldb = ldb_module_get_ctx(module);
1898 struct ldb_val *new_values = NULL;
1899 unsigned int num_new_values = 0;
1900 unsigned int old_num_values = old_el?old_el->num_values:0;
1903 unix_to_nt_time(&now, t);
1905 /* check if there is nothing to replace */
1906 if ((!old_el || old_el->num_values == 0) &&
1907 el->num_values == 0) {
1911 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1912 if (ret != LDB_SUCCESS) {
1913 talloc_free(tmp_ctx);
1917 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1918 if (ret != LDB_SUCCESS) {
1919 talloc_free(tmp_ctx);
1923 invocation_id = samdb_ntds_invocation_id(ldb);
1924 if (!invocation_id) {
1925 return LDB_ERR_OPERATIONS_ERROR;
1928 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1929 if (ret != LDB_SUCCESS) {
1930 talloc_free(tmp_ctx);
1934 /* mark all the old ones as deleted */
1935 for (i=0; i<old_num_values; i++) {
1936 struct parsed_dn *old_p = &old_dns[i];
1937 struct parsed_dn *p;
1938 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1940 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1942 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1943 if (ret != LDB_SUCCESS) {
1944 talloc_free(tmp_ctx);
1948 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1950 /* we don't delete it if we are re-adding it */
1954 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1955 invocation_id, seq_num, seq_num, now, 0, true);
1956 if (ret != LDB_SUCCESS) {
1957 talloc_free(tmp_ctx);
1962 /* for each new value, either update its meta-data, or add it
1965 for (i=0; i<el->num_values; i++) {
1966 struct parsed_dn *p = &dns[i], *old_p;
1969 (old_p = parsed_dn_find(old_dns,
1970 old_num_values, p->guid, NULL)) != NULL) {
1971 /* update in place */
1972 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1973 old_p->dsdb_dn, invocation_id,
1974 seq_num, seq_num, now, 0, false);
1975 if (ret != LDB_SUCCESS) {
1976 talloc_free(tmp_ctx);
1981 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1983 if (new_values == NULL) {
1984 ldb_module_oom(module);
1985 talloc_free(tmp_ctx);
1986 return LDB_ERR_OPERATIONS_ERROR;
1988 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1989 invocation_id, seq_num, seq_num, now, 0, false);
1990 if (ret != LDB_SUCCESS) {
1991 talloc_free(tmp_ctx);
1997 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1998 if (ret != LDB_SUCCESS) {
1999 talloc_free(tmp_ctx);
2004 /* add the new values to the end of old_el */
2005 if (num_new_values != 0) {
2006 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2007 struct ldb_val, old_num_values+num_new_values);
2008 if (el->values == NULL) {
2009 ldb_module_oom(module);
2010 return LDB_ERR_OPERATIONS_ERROR;
2012 memcpy(&el->values[old_num_values], &new_values[0],
2013 sizeof(struct ldb_val)*num_new_values);
2014 el->num_values = old_num_values + num_new_values;
2015 talloc_steal(msg->elements, new_values);
2017 el->values = old_el->values;
2018 el->num_values = old_el->num_values;
2019 talloc_steal(msg->elements, el->values);
2022 talloc_free(tmp_ctx);
2024 /* we now tell the backend to replace all existing values
2025 with the one we have constructed */
2026 el->flags = LDB_FLAG_MOD_REPLACE;
2033 handle linked attributes in modify requests
2035 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2036 struct ldb_message *msg,
2037 uint64_t seq_num, time_t t)
2039 struct ldb_result *res;
2042 struct ldb_context *ldb = ldb_module_get_ctx(module);
2043 struct ldb_message *old_msg;
2045 const struct dsdb_schema *schema;
2046 struct GUID old_guid;
2049 /* there the replmd_update_rpmd code has already
2050 * checked and saw that there are no linked
2055 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2056 /* don't do anything special for linked attributes */
2060 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2061 DSDB_FLAG_NEXT_MODULE |
2062 DSDB_SEARCH_SHOW_RECYCLED |
2063 DSDB_SEARCH_REVEAL_INTERNALS |
2064 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2065 if (ret != LDB_SUCCESS) {
2068 schema = dsdb_get_schema(ldb, res);
2070 return LDB_ERR_OPERATIONS_ERROR;
2073 old_msg = res->msgs[0];
2075 old_guid = samdb_result_guid(old_msg, "objectGUID");
2077 for (i=0; i<msg->num_elements; i++) {
2078 struct ldb_message_element *el = &msg->elements[i];
2079 struct ldb_message_element *old_el, *new_el;
2080 const struct dsdb_attribute *schema_attr
2081 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2083 ldb_asprintf_errstring(ldb,
2084 "%s: attribute %s is not a valid attribute in schema",
2085 __FUNCTION__, el->name);
2086 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2088 if (schema_attr->linkID == 0) {
2091 if ((schema_attr->linkID & 1) == 1) {
2092 /* Odd is for the target. Illegal to modify */
2093 ldb_asprintf_errstring(ldb,
2094 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2095 return LDB_ERR_UNWILLING_TO_PERFORM;
2097 old_el = ldb_msg_find_element(old_msg, el->name);
2098 switch (el->flags & LDB_FLAG_MOD_MASK) {
2099 case LDB_FLAG_MOD_REPLACE:
2100 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2102 case LDB_FLAG_MOD_DELETE:
2103 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2105 case LDB_FLAG_MOD_ADD:
2106 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2109 ldb_asprintf_errstring(ldb,
2110 "invalid flags 0x%x for %s linked attribute",
2111 el->flags, el->name);
2112 return LDB_ERR_UNWILLING_TO_PERFORM;
2114 if (ret != LDB_SUCCESS) {
2118 ldb_msg_remove_attr(old_msg, el->name);
2120 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2121 new_el->num_values = el->num_values;
2122 new_el->values = talloc_steal(msg->elements, el->values);
2124 /* TODO: this relises a bit too heavily on the exact
2125 behaviour of ldb_msg_find_element and
2126 ldb_msg_remove_element */
2127 old_el = ldb_msg_find_element(msg, el->name);
2129 ldb_msg_remove_element(msg, old_el);
2140 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2142 struct ldb_context *ldb;
2143 struct replmd_replicated_request *ac;
2144 struct ldb_request *down_req;
2145 struct ldb_message *msg;
2146 time_t t = time(NULL);
2148 bool is_urgent = false;
2149 struct loadparm_context *lp_ctx;
2151 unsigned int functional_level;
2152 const DATA_BLOB *guid_blob;
2154 /* do not manipulate our control entries */
2155 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2156 return ldb_next_request(module, req);
2159 ldb = ldb_module_get_ctx(module);
2161 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2163 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2164 if ( guid_blob != NULL ) {
2165 ldb_set_errstring(ldb,
2166 "replmd_modify: it's not allowed to change the objectGUID!");
2167 return LDB_ERR_CONSTRAINT_VIOLATION;
2170 ac = replmd_ctx_init(module, req);
2172 return ldb_module_oom(module);
2175 functional_level = dsdb_functional_level(ldb);
2177 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2178 struct loadparm_context);
2180 /* we have to copy the message as the caller might have it as a const */
2181 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2185 return LDB_ERR_OPERATIONS_ERROR;
2188 ldb_msg_remove_attr(msg, "whenChanged");
2189 ldb_msg_remove_attr(msg, "uSNChanged");
2191 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2192 if (ret == LDB_ERR_REFERRAL) {
2193 referral = talloc_asprintf(req,
2195 lpcfg_dnsdomain(lp_ctx),
2196 ldb_dn_get_linearized(msg->dn));
2197 ret = ldb_module_send_referral(req, referral);
2199 return ldb_module_done(req, NULL, NULL, ret);
2202 if (ret != LDB_SUCCESS) {
2207 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2208 if (ret != LDB_SUCCESS) {
2214 * - replace the old object with the newly constructed one
2217 ac->is_urgent = is_urgent;
2219 ret = ldb_build_mod_req(&down_req, ldb, ac,
2222 ac, replmd_op_callback,
2224 LDB_REQ_SET_LOCATION(down_req);
2225 if (ret != LDB_SUCCESS) {
2230 /* If we are in functional level 2000, then
2231 * replmd_modify_handle_linked_attribs will have done
2233 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2234 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2235 if (ret != LDB_SUCCESS) {
2241 talloc_steal(down_req, msg);
2243 /* we only change whenChanged and uSNChanged if the seq_num
2245 if (ac->seq_num != 0) {
2246 ret = add_time_element(msg, "whenChanged", t);
2247 if (ret != LDB_SUCCESS) {
2252 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2253 if (ret != LDB_SUCCESS) {
2259 /* go on with the call chain */
2260 return ldb_next_request(module, down_req);
2263 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2266 handle a rename request
2268 On a rename we need to do an extra ldb_modify which sets the
2269 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2271 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2273 struct ldb_context *ldb;
2274 struct replmd_replicated_request *ac;
2276 struct ldb_request *down_req;
2278 /* do not manipulate our control entries */
2279 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2280 return ldb_next_request(module, req);
2283 ldb = ldb_module_get_ctx(module);
2285 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2287 ac = replmd_ctx_init(module, req);
2289 return ldb_module_oom(module);
2292 ret = ldb_build_rename_req(&down_req, ldb, ac,
2293 ac->req->op.rename.olddn,
2294 ac->req->op.rename.newdn,
2296 ac, replmd_rename_callback,
2298 LDB_REQ_SET_LOCATION(down_req);
2299 if (ret != LDB_SUCCESS) {
2304 /* go on with the call chain */
2305 return ldb_next_request(module, down_req);
2308 /* After the rename is compleated, update the whenchanged etc */
2309 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2311 struct ldb_context *ldb;
2312 struct replmd_replicated_request *ac;
2313 struct ldb_request *down_req;
2314 struct ldb_message *msg;
2315 time_t t = time(NULL);
2318 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2319 ldb = ldb_module_get_ctx(ac->module);
2321 if (ares->error != LDB_SUCCESS) {
2322 return ldb_module_done(ac->req, ares->controls,
2323 ares->response, ares->error);
2326 if (ares->type != LDB_REPLY_DONE) {
2327 ldb_set_errstring(ldb,
2328 "invalid ldb_reply_type in callback");
2330 return ldb_module_done(ac->req, NULL, NULL,
2331 LDB_ERR_OPERATIONS_ERROR);
2334 /* Get a sequence number from the backend */
2335 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2336 if (ret != LDB_SUCCESS) {
2341 * - replace the old object with the newly constructed one
2344 msg = ldb_msg_new(ac);
2347 return LDB_ERR_OPERATIONS_ERROR;
2350 msg->dn = ac->req->op.rename.newdn;
2352 ret = ldb_build_mod_req(&down_req, ldb, ac,
2355 ac, replmd_op_callback,
2357 LDB_REQ_SET_LOCATION(down_req);
2358 if (ret != LDB_SUCCESS) {
2362 talloc_steal(down_req, msg);
2364 ret = add_time_element(msg, "whenChanged", t);
2365 if (ret != LDB_SUCCESS) {
2370 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2371 if (ret != LDB_SUCCESS) {
2376 /* go on with the call chain - do the modify after the rename */
2377 return ldb_next_request(ac->module, down_req);
2381 remove links from objects that point at this object when an object
2384 static int replmd_delete_remove_link(struct ldb_module *module,
2385 const struct dsdb_schema *schema,
2387 struct ldb_message_element *el,
2388 const struct dsdb_attribute *sa)
2391 TALLOC_CTX *tmp_ctx = talloc_new(module);
2392 struct ldb_context *ldb = ldb_module_get_ctx(module);
2394 for (i=0; i<el->num_values; i++) {
2395 struct dsdb_dn *dsdb_dn;
2399 struct ldb_message *msg;
2400 const struct dsdb_attribute *target_attr;
2401 struct ldb_message_element *el2;
2402 struct ldb_val dn_val;
2404 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2408 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2410 talloc_free(tmp_ctx);
2411 return LDB_ERR_OPERATIONS_ERROR;
2414 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2415 if (!NT_STATUS_IS_OK(status)) {
2416 talloc_free(tmp_ctx);
2417 return LDB_ERR_OPERATIONS_ERROR;
2420 /* remove the link */
2421 msg = ldb_msg_new(tmp_ctx);
2423 ldb_module_oom(module);
2424 talloc_free(tmp_ctx);
2425 return LDB_ERR_OPERATIONS_ERROR;
2429 msg->dn = dsdb_dn->dn;
2431 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2432 if (target_attr == NULL) {
2436 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2437 if (ret != LDB_SUCCESS) {
2438 ldb_module_oom(module);
2439 talloc_free(tmp_ctx);
2440 return LDB_ERR_OPERATIONS_ERROR;
2442 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2443 el2->values = &dn_val;
2444 el2->num_values = 1;
2446 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2447 if (ret != LDB_SUCCESS) {
2448 talloc_free(tmp_ctx);
2452 talloc_free(tmp_ctx);
2458 handle update of replication meta data for deletion of objects
2460 This also handles the mapping of delete to a rename operation
2461 to allow deletes to be replicated.
2463 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2465 int ret = LDB_ERR_OTHER;
2466 bool retb, disallow_move_on_delete;
2467 struct ldb_dn *old_dn, *new_dn;
2468 const char *rdn_name;
2469 const struct ldb_val *rdn_value, *new_rdn_value;
2471 struct ldb_context *ldb = ldb_module_get_ctx(module);
2472 const struct dsdb_schema *schema;
2473 struct ldb_message *msg, *old_msg;
2474 struct ldb_message_element *el;
2475 TALLOC_CTX *tmp_ctx;
2476 struct ldb_result *res, *parent_res;
2477 const char *preserved_attrs[] = {
2478 /* yes, this really is a hard coded list. See MS-ADTS
2479 section 3.1.1.5.5.1.1 */
2480 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2481 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2482 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2483 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2484 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2485 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2486 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2487 "whenChanged", NULL};
2488 unsigned int i, el_count = 0;
2489 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2490 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2491 enum deletion_state deletion_state, next_deletion_state;
2494 if (ldb_dn_is_special(req->op.del.dn)) {
2495 return ldb_next_request(module, req);
2498 tmp_ctx = talloc_new(ldb);
2501 return LDB_ERR_OPERATIONS_ERROR;
2504 schema = dsdb_get_schema(ldb, tmp_ctx);
2506 return LDB_ERR_OPERATIONS_ERROR;
2509 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2511 /* we need the complete msg off disk, so we can work out which
2512 attributes need to be removed */
2513 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2514 DSDB_FLAG_NEXT_MODULE |
2515 DSDB_SEARCH_SHOW_RECYCLED |
2516 DSDB_SEARCH_REVEAL_INTERNALS |
2517 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2518 if (ret != LDB_SUCCESS) {
2519 talloc_free(tmp_ctx);
2522 old_msg = res->msgs[0];
2525 ret = dsdb_recyclebin_enabled(module, &enabled);
2526 if (ret != LDB_SUCCESS) {
2527 talloc_free(tmp_ctx);
2531 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2533 deletion_state = OBJECT_TOMBSTONE;
2534 next_deletion_state = OBJECT_REMOVED;
2535 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2536 deletion_state = OBJECT_RECYCLED;
2537 next_deletion_state = OBJECT_REMOVED;
2539 deletion_state = OBJECT_DELETED;
2540 next_deletion_state = OBJECT_RECYCLED;
2543 deletion_state = OBJECT_NOT_DELETED;
2545 next_deletion_state = OBJECT_DELETED;
2547 next_deletion_state = OBJECT_TOMBSTONE;
2551 if (next_deletion_state == OBJECT_REMOVED) {
2552 struct auth_session_info *session_info =
2553 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2554 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2555 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2556 ldb_dn_get_linearized(old_msg->dn));
2557 return LDB_ERR_UNWILLING_TO_PERFORM;
2560 /* it is already deleted - really remove it this time */
2561 talloc_free(tmp_ctx);
2562 return ldb_next_request(module, req);
2565 rdn_name = ldb_dn_get_rdn_name(old_dn);
2566 rdn_value = ldb_dn_get_rdn_val(old_dn);
2567 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2568 talloc_free(tmp_ctx);
2569 return ldb_operr(ldb);
2572 msg = ldb_msg_new(tmp_ctx);
2574 ldb_module_oom(module);
2575 talloc_free(tmp_ctx);
2576 return LDB_ERR_OPERATIONS_ERROR;
2581 if (deletion_state == OBJECT_NOT_DELETED){
2582 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2583 disallow_move_on_delete =
2584 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2585 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2587 /* work out where we will be renaming this object to */
2588 if (!disallow_move_on_delete) {
2589 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2591 if (ret != LDB_SUCCESS) {
2592 /* this is probably an attempted delete on a partition
2593 * that doesn't allow delete operations, such as the
2594 * schema partition */
2595 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2596 ldb_dn_get_linearized(old_dn));
2597 talloc_free(tmp_ctx);
2598 return LDB_ERR_UNWILLING_TO_PERFORM;
2601 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2602 if (new_dn == NULL) {
2603 ldb_module_oom(module);
2604 talloc_free(tmp_ctx);
2605 return LDB_ERR_OPERATIONS_ERROR;
2609 /* get the objects GUID from the search we just did */
2610 guid = samdb_result_guid(old_msg, "objectGUID");
2612 /* Add a formatted child */
2613 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2615 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2616 GUID_string(tmp_ctx, &guid));
2618 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2619 ldb_dn_get_linearized(new_dn)));
2620 talloc_free(tmp_ctx);
2621 return LDB_ERR_OPERATIONS_ERROR;
2624 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2625 if (ret != LDB_SUCCESS) {
2626 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2627 ldb_module_oom(module);
2628 talloc_free(tmp_ctx);
2631 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2635 now we need to modify the object in the following ways:
2637 - add isDeleted=TRUE
2638 - update rDN and name, with new rDN
2639 - remove linked attributes
2640 - remove objectCategory and sAMAccountType
2641 - remove attribs not on the preserved list
2642 - preserved if in above list, or is rDN
2643 - remove all linked attribs from this object
2644 - remove all links from other objects to this object
2645 - add lastKnownParent
2646 - update replPropertyMetaData?
2648 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2651 /* we need the storage form of the parent GUID */
2652 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2653 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2654 DSDB_FLAG_NEXT_MODULE |
2655 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2656 DSDB_SEARCH_REVEAL_INTERNALS|
2657 DSDB_SEARCH_SHOW_RECYCLED);
2658 if (ret != LDB_SUCCESS) {
2659 talloc_free(tmp_ctx);
2663 if (deletion_state == OBJECT_NOT_DELETED){
2664 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2665 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2666 if (ret != LDB_SUCCESS) {
2667 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2668 ldb_module_oom(module);
2669 talloc_free(tmp_ctx);
2672 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2675 switch (next_deletion_state){
2677 case OBJECT_DELETED:
2679 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2680 if (ret != LDB_SUCCESS) {
2681 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2682 ldb_module_oom(module);
2683 talloc_free(tmp_ctx);
2686 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2688 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2689 if (ret != LDB_SUCCESS) {
2690 talloc_free(tmp_ctx);
2691 ldb_module_oom(module);
2695 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2696 if (ret != LDB_SUCCESS) {
2697 talloc_free(tmp_ctx);
2698 ldb_module_oom(module);
2704 case OBJECT_RECYCLED:
2705 case OBJECT_TOMBSTONE:
2707 /* we also mark it as recycled, meaning this object can't be
2708 recovered (we are stripping its attributes) */
2709 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2710 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2711 if (ret != LDB_SUCCESS) {
2712 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2713 ldb_module_oom(module);
2714 talloc_free(tmp_ctx);
2717 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2720 /* work out which of the old attributes we will be removing */
2721 for (i=0; i<old_msg->num_elements; i++) {
2722 const struct dsdb_attribute *sa;
2723 el = &old_msg->elements[i];
2724 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2726 talloc_free(tmp_ctx);
2727 return LDB_ERR_OPERATIONS_ERROR;
2729 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2730 /* don't remove the rDN */
2733 if (sa->linkID && sa->linkID & 1) {
2734 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2735 if (ret != LDB_SUCCESS) {
2736 talloc_free(tmp_ctx);
2737 return LDB_ERR_OPERATIONS_ERROR;
2741 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2744 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2745 if (ret != LDB_SUCCESS) {
2746 talloc_free(tmp_ctx);
2747 ldb_module_oom(module);
2757 if (deletion_state == OBJECT_NOT_DELETED) {
2758 const struct dsdb_attribute *sa;
2760 /* work out what the new rdn value is, for updating the
2761 rDN and name fields */
2762 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2763 if (new_rdn_value == NULL) {
2764 talloc_free(tmp_ctx);
2765 return ldb_operr(ldb);
2768 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2770 talloc_free(tmp_ctx);
2771 return LDB_ERR_OPERATIONS_ERROR;
2774 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2776 if (ret != LDB_SUCCESS) {
2777 talloc_free(tmp_ctx);
2780 el->flags = LDB_FLAG_MOD_REPLACE;
2782 el = ldb_msg_find_element(old_msg, "name");
2784 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2785 if (ret != LDB_SUCCESS) {
2786 talloc_free(tmp_ctx);
2789 el->flags = LDB_FLAG_MOD_REPLACE;
2793 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2794 if (ret != LDB_SUCCESS) {
2795 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2796 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2797 talloc_free(tmp_ctx);
2801 if (deletion_state == OBJECT_NOT_DELETED) {
2802 /* now rename onto the new DN */
2803 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2804 if (ret != LDB_SUCCESS){
2805 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2806 ldb_dn_get_linearized(old_dn),
2807 ldb_dn_get_linearized(new_dn),
2808 ldb_errstring(ldb)));
2809 talloc_free(tmp_ctx);
2814 talloc_free(tmp_ctx);
2816 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2821 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2826 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2828 int ret = LDB_ERR_OTHER;
2829 /* TODO: do some error mapping */
2833 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2835 struct ldb_context *ldb;
2836 struct ldb_request *change_req;
2837 enum ndr_err_code ndr_err;
2838 struct ldb_message *msg;
2839 struct replPropertyMetaDataBlob *md;
2840 struct ldb_val md_value;
2845 * TODO: check if the parent object exist
2849 * TODO: handle the conflict case where an object with the
2853 ldb = ldb_module_get_ctx(ar->module);
2854 msg = ar->objs->objects[ar->index_current].msg;
2855 md = ar->objs->objects[ar->index_current].meta_data;
2857 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2858 if (ret != LDB_SUCCESS) {
2859 return replmd_replicated_request_error(ar, ret);
2862 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2863 if (ret != LDB_SUCCESS) {
2864 return replmd_replicated_request_error(ar, ret);
2867 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2868 if (ret != LDB_SUCCESS) {
2869 return replmd_replicated_request_error(ar, ret);
2872 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2873 if (ret != LDB_SUCCESS) {
2874 return replmd_replicated_request_error(ar, ret);
2877 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2878 if (ret != LDB_SUCCESS) {
2879 return replmd_replicated_request_error(ar, ret);
2882 /* remove any message elements that have zero values */
2883 for (i=0; i<msg->num_elements; i++) {
2884 struct ldb_message_element *el = &msg->elements[i];
2886 if (el->num_values == 0) {
2887 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2889 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2890 msg->num_elements--;
2897 * the meta data array is already sorted by the caller
2899 for (i=0; i < md->ctr.ctr1.count; i++) {
2900 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2902 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2903 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2904 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2905 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2906 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2908 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2909 if (ret != LDB_SUCCESS) {
2910 return replmd_replicated_request_error(ar, ret);
2913 replmd_ldb_message_sort(msg, ar->schema);
2916 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2917 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2921 ret = ldb_build_add_req(&change_req,
2929 LDB_REQ_SET_LOCATION(change_req);
2930 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2932 return ldb_next_request(ar->module, change_req);
2936 return true if an update is newer than an existing entry
2937 see section 5.11 of MS-ADTS
2939 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2940 const struct GUID *update_invocation_id,
2941 uint32_t current_version,
2942 uint32_t update_version,
2943 uint32_t current_usn,
2944 uint32_t update_usn,
2945 NTTIME current_change_time,
2946 NTTIME update_change_time)
2948 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2949 if (update_usn != current_usn) {
2950 return update_usn >= current_usn;
2953 if (update_version != current_version) {
2954 return update_version >= current_version;
2956 if (update_change_time != current_change_time) {
2957 return update_change_time >= current_change_time;
2959 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2962 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2963 struct replPropertyMetaData1 *new_m)
2965 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2966 &new_m->originating_invocation_id,
2969 cur_m->originating_usn,
2970 new_m->originating_usn,
2971 cur_m->originating_change_time,
2972 new_m->originating_change_time);
2975 static struct replPropertyMetaData1 *
2976 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2977 enum drsuapi_DsAttributeId attid)
2980 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2982 for (i = 0; i < rpmd_ctr->count; i++) {
2983 if (rpmd_ctr->array[i].attid == attid) {
2984 return &rpmd_ctr->array[i];
2992 handle renames that come in over DRS replication
2994 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
2995 struct ldb_message *msg,
2996 struct replPropertyMetaDataBlob *rmd,
2997 struct replPropertyMetaDataBlob *omd)
2999 struct replPropertyMetaData1 *md_remote;
3000 struct replPropertyMetaData1 *md_local;
3002 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3007 /* now we need to check for double renames. We could have a
3008 * local rename pending which our replication partner hasn't
3009 * received yet. We choose which one wins by looking at the
3010 * attribute stamps on the two objects, the newer one wins
3012 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3013 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3014 /* if there is no name attribute then we have to assume the
3015 object we've received is in fact newer */
3016 if (!md_remote || !md_local ||
3017 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3018 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3019 ldb_dn_get_linearized(ar->search_msg->dn),
3020 ldb_dn_get_linearized(msg->dn)));
3021 /* pass rename to the next module
3022 * so it doesn't appear as an originating update */
3023 return dsdb_module_rename(ar->module,
3024 ar->search_msg->dn, msg->dn,
3025 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
3028 /* we're going to keep our old object */
3029 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3030 ldb_dn_get_linearized(ar->search_msg->dn),
3031 ldb_dn_get_linearized(msg->dn)));
3036 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3038 struct ldb_context *ldb;
3039 struct ldb_request *change_req;
3040 enum ndr_err_code ndr_err;
3041 struct ldb_message *msg;
3042 struct replPropertyMetaDataBlob *rmd;
3043 struct replPropertyMetaDataBlob omd;
3044 const struct ldb_val *omd_value;
3045 struct replPropertyMetaDataBlob nmd;
3046 struct ldb_val nmd_value;
3049 unsigned int removed_attrs = 0;
3052 ldb = ldb_module_get_ctx(ar->module);
3053 msg = ar->objs->objects[ar->index_current].msg;
3054 rmd = ar->objs->objects[ar->index_current].meta_data;
3058 /* find existing meta data */
3059 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3061 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3062 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3063 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3064 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3065 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3068 if (omd.version != 1) {
3069 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3073 /* handle renames that come in over DRS */
3074 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd);
3075 if (ret != LDB_SUCCESS) {
3076 ldb_debug(ldb, LDB_DEBUG_FATAL,
3077 "replmd_replicated_request rename %s => %s failed - %s\n",
3078 ldb_dn_get_linearized(ar->search_msg->dn),
3079 ldb_dn_get_linearized(msg->dn),
3080 ldb_errstring(ldb));
3081 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3086 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3087 nmd.ctr.ctr1.array = talloc_array(ar,
3088 struct replPropertyMetaData1,
3089 nmd.ctr.ctr1.count);
3090 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3092 /* first copy the old meta data */
3093 for (i=0; i < omd.ctr.ctr1.count; i++) {
3094 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3098 /* now merge in the new meta data */
3099 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3102 for (j=0; j < ni; j++) {
3105 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3109 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3110 &rmd->ctr.ctr1.array[i]);
3112 /* replace the entry */
3113 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3118 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3119 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3120 msg->elements[i-removed_attrs].name,
3121 ldb_dn_get_linearized(msg->dn),
3122 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3125 /* we don't want to apply this change so remove the attribute */
3126 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3133 if (found) continue;
3135 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3140 * finally correct the size of the meta_data array
3142 nmd.ctr.ctr1.count = ni;
3145 * the rdn attribute (the alias for the name attribute),
3146 * 'cn' for most objects is the last entry in the meta data array
3149 * sort the new meta data array
3151 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3152 if (ret != LDB_SUCCESS) {
3157 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3159 if (msg->num_elements == 0) {
3160 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3163 ar->index_current++;
3164 return replmd_replicated_apply_next(ar);
3167 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3168 ar->index_current, msg->num_elements);
3170 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3171 if (ret != LDB_SUCCESS) {
3172 return replmd_replicated_request_error(ar, ret);
3175 for (i=0; i<ni; i++) {
3176 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3179 /* create the meta data value */
3180 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3181 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3182 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3183 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3184 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3188 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3189 * and replPopertyMetaData attributes
3191 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3192 if (ret != LDB_SUCCESS) {
3193 return replmd_replicated_request_error(ar, ret);
3195 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3196 if (ret != LDB_SUCCESS) {
3197 return replmd_replicated_request_error(ar, ret);
3199 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3200 if (ret != LDB_SUCCESS) {
3201 return replmd_replicated_request_error(ar, ret);
3204 replmd_ldb_message_sort(msg, ar->schema);
3206 /* we want to replace the old values */
3207 for (i=0; i < msg->num_elements; i++) {
3208 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3212 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3213 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3217 ret = ldb_build_mod_req(&change_req,
3225 LDB_REQ_SET_LOCATION(change_req);
3226 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3228 return ldb_next_request(ar->module, change_req);
3231 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3232 struct ldb_reply *ares)
3234 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3235 struct replmd_replicated_request);
3239 return ldb_module_done(ar->req, NULL, NULL,
3240 LDB_ERR_OPERATIONS_ERROR);
3242 if (ares->error != LDB_SUCCESS &&
3243 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3244 return ldb_module_done(ar->req, ares->controls,
3245 ares->response, ares->error);
3248 switch (ares->type) {
3249 case LDB_REPLY_ENTRY:
3250 ar->search_msg = talloc_steal(ar, ares->message);
3253 case LDB_REPLY_REFERRAL:
3254 /* we ignore referrals */
3257 case LDB_REPLY_DONE:
3258 if (ar->search_msg != NULL) {
3259 ret = replmd_replicated_apply_merge(ar);
3261 ret = replmd_replicated_apply_add(ar);
3263 if (ret != LDB_SUCCESS) {
3264 return ldb_module_done(ar->req, NULL, NULL, ret);
3272 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3274 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3276 struct ldb_context *ldb;
3280 struct ldb_request *search_req;
3281 struct ldb_search_options_control *options;
3283 if (ar->index_current >= ar->objs->num_objects) {
3284 /* done with it, go to next stage */
3285 return replmd_replicated_uptodate_vector(ar);
3288 ldb = ldb_module_get_ctx(ar->module);
3289 ar->search_msg = NULL;
3291 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3292 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3294 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3295 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3296 talloc_free(tmp_str);
3298 ret = ldb_build_search_req(&search_req,
3307 replmd_replicated_apply_search_callback,
3309 LDB_REQ_SET_LOCATION(search_req);
3311 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3313 if (ret != LDB_SUCCESS) {
3317 /* we need to cope with cross-partition links, so search for
3318 the GUID over all partitions */
3319 options = talloc(search_req, struct ldb_search_options_control);
3320 if (options == NULL) {
3321 DEBUG(0, (__location__ ": out of memory\n"));
3322 return LDB_ERR_OPERATIONS_ERROR;
3324 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3326 ret = ldb_request_add_control(search_req,
3327 LDB_CONTROL_SEARCH_OPTIONS_OID,
3329 if (ret != LDB_SUCCESS) {
3333 return ldb_next_request(ar->module, search_req);
3336 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3337 struct ldb_reply *ares)
3339 struct ldb_context *ldb;
3340 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3341 struct replmd_replicated_request);
3342 ldb = ldb_module_get_ctx(ar->module);
3345 return ldb_module_done(ar->req, NULL, NULL,
3346 LDB_ERR_OPERATIONS_ERROR);
3348 if (ares->error != LDB_SUCCESS) {
3349 return ldb_module_done(ar->req, ares->controls,
3350 ares->response, ares->error);
3353 if (ares->type != LDB_REPLY_DONE) {
3354 ldb_set_errstring(ldb, "Invalid reply type\n!");
3355 return ldb_module_done(ar->req, NULL, NULL,
3356 LDB_ERR_OPERATIONS_ERROR);
3361 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3364 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3366 struct ldb_context *ldb;
3367 struct ldb_request *change_req;
3368 enum ndr_err_code ndr_err;
3369 struct ldb_message *msg;
3370 struct replUpToDateVectorBlob ouv;
3371 const struct ldb_val *ouv_value;
3372 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3373 struct replUpToDateVectorBlob nuv;
3374 struct ldb_val nuv_value;
3375 struct ldb_message_element *nuv_el = NULL;
3376 const struct GUID *our_invocation_id;
3377 struct ldb_message_element *orf_el = NULL;
3378 struct repsFromToBlob nrf;
3379 struct ldb_val *nrf_value = NULL;
3380 struct ldb_message_element *nrf_el = NULL;
3384 time_t t = time(NULL);
3387 uint32_t instanceType;
3389 ldb = ldb_module_get_ctx(ar->module);
3390 ruv = ar->objs->uptodateness_vector;
3396 unix_to_nt_time(&now, t);
3398 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3399 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3400 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3401 ldb_dn_get_linearized(ar->search_msg->dn)));
3402 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3406 * first create the new replUpToDateVector
3408 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3410 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3411 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3412 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3413 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3414 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3417 if (ouv.version != 2) {
3418 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3423 * the new uptodateness vector will at least
3424 * contain 1 entry, one for the source_dsa
3426 * plus optional values from our old vector and the one from the source_dsa
3428 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3429 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3430 nuv.ctr.ctr2.cursors = talloc_array(ar,
3431 struct drsuapi_DsReplicaCursor2,
3432 nuv.ctr.ctr2.count);
3433 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3435 /* first copy the old vector */
3436 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3437 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3441 /* get our invocation_id if we have one already attached to the ldb */
3442 our_invocation_id = samdb_ntds_invocation_id(ldb);
3444 /* merge in the source_dsa vector is available */
3445 for (i=0; (ruv && i < ruv->count); i++) {
3448 if (our_invocation_id &&
3449 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3450 our_invocation_id)) {
3454 for (j=0; j < ni; j++) {
3455 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3456 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3463 * we update only the highest_usn and not the latest_sync_success time,
3464 * because the last success stands for direct replication
3466 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3467 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3472 if (found) continue;
3474 /* if it's not there yet, add it */
3475 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3480 * merge in the current highwatermark for the source_dsa
3483 for (j=0; j < ni; j++) {
3484 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3485 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3492 * here we update the highest_usn and last_sync_success time
3493 * because we're directly replicating from the source_dsa
3495 * and use the tmp_highest_usn because this is what we have just applied
3498 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3499 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3504 * here we update the highest_usn and last_sync_success time
3505 * because we're directly replicating from the source_dsa
3507 * and use the tmp_highest_usn because this is what we have just applied
3510 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3511 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3512 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3517 * finally correct the size of the cursors array
3519 nuv.ctr.ctr2.count = ni;
3524 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3527 * create the change ldb_message
3529 msg = ldb_msg_new(ar);
3530 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3531 msg->dn = ar->search_msg->dn;
3533 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3534 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3535 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3536 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3537 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3539 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3540 if (ret != LDB_SUCCESS) {
3541 return replmd_replicated_request_error(ar, ret);
3543 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3546 * now create the new repsFrom value from the given repsFromTo1 structure
3550 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3551 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3554 * first see if we already have a repsFrom value for the current source dsa
3555 * if so we'll later replace this value
3557 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3559 for (i=0; i < orf_el->num_values; i++) {
3560 struct repsFromToBlob *trf;
3562 trf = talloc(ar, struct repsFromToBlob);
3563 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3565 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3566 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3567 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3568 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3569 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3572 if (trf->version != 1) {
3573 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3577 * we compare the source dsa objectGUID not the invocation_id
3578 * because we want only one repsFrom value per source dsa
3579 * and when the invocation_id of the source dsa has changed we don't need
3580 * the old repsFrom with the old invocation_id
3582 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3583 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3589 nrf_value = &orf_el->values[i];
3594 * copy over all old values to the new ldb_message
3596 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3597 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3602 * if we haven't found an old repsFrom value for the current source dsa
3603 * we'll add a new value
3606 struct ldb_val zero_value;
3607 ZERO_STRUCT(zero_value);
3608 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3609 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3611 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3614 /* we now fill the value which is already attached to ldb_message */
3615 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3617 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3618 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3619 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3620 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3624 * the ldb_message_element for the attribute, has all the old values and the new one
3625 * so we'll replace the whole attribute with all values
3627 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3630 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3631 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3635 /* prepare the ldb_modify() request */
3636 ret = ldb_build_mod_req(&change_req,
3642 replmd_replicated_uptodate_modify_callback,
3644 LDB_REQ_SET_LOCATION(change_req);
3645 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3647 return ldb_next_request(ar->module, change_req);
3650 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3651 struct ldb_reply *ares)
3653 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3654 struct replmd_replicated_request);
3658 return ldb_module_done(ar->req, NULL, NULL,
3659 LDB_ERR_OPERATIONS_ERROR);
3661 if (ares->error != LDB_SUCCESS &&
3662 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3663 return ldb_module_done(ar->req, ares->controls,
3664 ares->response, ares->error);
3667 switch (ares->type) {
3668 case LDB_REPLY_ENTRY:
3669 ar->search_msg = talloc_steal(ar, ares->message);
3672 case LDB_REPLY_REFERRAL:
3673 /* we ignore referrals */
3676 case LDB_REPLY_DONE:
3677 if (ar->search_msg == NULL) {
3678 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3680 ret = replmd_replicated_uptodate_modify(ar);
3682 if (ret != LDB_SUCCESS) {
3683 return ldb_module_done(ar->req, NULL, NULL, ret);
3692 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3694 struct ldb_context *ldb;
3696 static const char *attrs[] = {
3697 "replUpToDateVector",
3702 struct ldb_request *search_req;
3704 ldb = ldb_module_get_ctx(ar->module);
3705 ar->search_msg = NULL;
3707 ret = ldb_build_search_req(&search_req,
3710 ar->objs->partition_dn,
3716 replmd_replicated_uptodate_search_callback,
3718 LDB_REQ_SET_LOCATION(search_req);
3719 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3721 return ldb_next_request(ar->module, search_req);
3726 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3728 struct ldb_context *ldb;
3729 struct dsdb_extended_replicated_objects *objs;
3730 struct replmd_replicated_request *ar;
3731 struct ldb_control **ctrls;
3734 struct replmd_private *replmd_private =
3735 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3737 ldb = ldb_module_get_ctx(module);
3739 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3741 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3743 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3744 return LDB_ERR_PROTOCOL_ERROR;
3747 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3748 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3749 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3750 return LDB_ERR_PROTOCOL_ERROR;
3753 ar = replmd_ctx_init(module, req);
3755 return LDB_ERR_OPERATIONS_ERROR;
3757 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3758 ar->apply_mode = true;
3760 ar->schema = dsdb_get_schema(ldb, ar);
3762 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3764 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3765 return LDB_ERR_CONSTRAINT_VIOLATION;
3768 ctrls = req->controls;
3770 if (req->controls) {
3771 req->controls = talloc_memdup(ar, req->controls,
3772 talloc_get_size(req->controls));
3773 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3776 /* This allows layers further down to know if a change came in over replication */
3777 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3778 if (ret != LDB_SUCCESS) {
3782 /* If this change contained linked attributes in the body
3783 * (rather than in the links section) we need to update
3784 * backlinks in linked_attributes */
3785 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3786 if (ret != LDB_SUCCESS) {
3790 ar->controls = req->controls;
3791 req->controls = ctrls;
3793 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3795 /* save away the linked attributes for the end of the
3797 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3798 struct la_entry *la_entry;
3800 if (replmd_private->la_ctx == NULL) {
3801 replmd_private->la_ctx = talloc_new(replmd_private);
3803 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3804 if (la_entry == NULL) {
3806 return LDB_ERR_OPERATIONS_ERROR;
3808 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3809 if (la_entry->la == NULL) {
3810 talloc_free(la_entry);
3812 return LDB_ERR_OPERATIONS_ERROR;
3814 *la_entry->la = ar->objs->linked_attributes[i];
3816 /* we need to steal the non-scalars so they stay
3817 around until the end of the transaction */
3818 talloc_steal(la_entry->la, la_entry->la->identifier);
3819 talloc_steal(la_entry->la, la_entry->la->value.blob);
3821 DLIST_ADD(replmd_private->la_list, la_entry);
3824 return replmd_replicated_apply_next(ar);
3828 process one linked attribute structure
3830 static int replmd_process_linked_attribute(struct ldb_module *module,
3831 struct la_entry *la_entry)
3833 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3834 struct ldb_context *ldb = ldb_module_get_ctx(module);
3835 struct ldb_message *msg;
3836 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3837 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3839 const struct dsdb_attribute *attr;
3840 struct dsdb_dn *dsdb_dn;
3841 uint64_t seq_num = 0;
3842 struct ldb_message_element *old_el;
3844 time_t t = time(NULL);
3845 struct ldb_result *res;
3846 const char *attrs[2];
3847 struct parsed_dn *pdn_list, *pdn;
3848 struct GUID guid = GUID_zero();
3850 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3851 const struct GUID *our_invocation_id;
3854 linked_attributes[0]:
3855 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3857 identifier: struct drsuapi_DsReplicaObjectIdentifier
3858 __ndr_size : 0x0000003a (58)
3859 __ndr_size_sid : 0x00000000 (0)
3860 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3862 __ndr_size_dn : 0x00000000 (0)
3864 attid : DRSUAPI_ATTID_member (0x1F)
3865 value: struct drsuapi_DsAttributeValue
3866 __ndr_size : 0x0000007e (126)
3868 blob : DATA_BLOB length=126
3869 flags : 0x00000001 (1)
3870 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3871 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3872 meta_data: struct drsuapi_DsReplicaMetaData
3873 version : 0x00000015 (21)
3874 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3875 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3876 originating_usn : 0x000000000001e19c (123292)
3878 (for cases where the link is to a normal DN)
3879 &target: struct drsuapi_DsReplicaObjectIdentifier3
3880 __ndr_size : 0x0000007e (126)
3881 __ndr_size_sid : 0x0000001c (28)
3882 guid : 7639e594-db75-4086-b0d4-67890ae46031
3883 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3884 __ndr_size_dn : 0x00000022 (34)
3885 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3888 /* find the attribute being modified */
3889 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3891 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3892 talloc_free(tmp_ctx);
3893 return LDB_ERR_OPERATIONS_ERROR;
3896 attrs[0] = attr->lDAPDisplayName;
3899 /* get the existing message from the db for the object with
3900 this GUID, returning attribute being modified. We will then
3901 use this msg as the basis for a modify call */
3902 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3903 DSDB_FLAG_NEXT_MODULE |
3904 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3905 DSDB_SEARCH_SHOW_RECYCLED |
3906 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3907 DSDB_SEARCH_REVEAL_INTERNALS,
3908 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3909 if (ret != LDB_SUCCESS) {
3910 talloc_free(tmp_ctx);
3913 if (res->count != 1) {
3914 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3915 GUID_string(tmp_ctx, &la->identifier->guid));
3916 talloc_free(tmp_ctx);
3917 return LDB_ERR_NO_SUCH_OBJECT;
3921 if (msg->num_elements == 0) {
3922 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3923 if (ret != LDB_SUCCESS) {
3924 ldb_module_oom(module);
3925 talloc_free(tmp_ctx);
3926 return LDB_ERR_OPERATIONS_ERROR;
3929 old_el = &msg->elements[0];
3930 old_el->flags = LDB_FLAG_MOD_REPLACE;
3933 /* parse the existing links */
3934 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3935 if (ret != LDB_SUCCESS) {
3936 talloc_free(tmp_ctx);
3940 /* get our invocationId */
3941 our_invocation_id = samdb_ntds_invocation_id(ldb);
3942 if (!our_invocation_id) {
3943 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3944 talloc_free(tmp_ctx);
3945 return LDB_ERR_OPERATIONS_ERROR;
3948 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3949 if (ret != LDB_SUCCESS) {
3950 talloc_free(tmp_ctx);
3954 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3955 if (!W_ERROR_IS_OK(status)) {
3956 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3957 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3958 return LDB_ERR_OPERATIONS_ERROR;
3961 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3962 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3963 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3965 ldb_dn_get_linearized(dsdb_dn->dn),
3966 ldb_dn_get_linearized(msg->dn));
3967 return LDB_ERR_OPERATIONS_ERROR;
3970 /* re-resolve the DN by GUID, as the DRS server may give us an
3972 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3973 if (ret != LDB_SUCCESS) {
3974 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3975 GUID_string(tmp_ctx, &guid),
3976 ldb_dn_get_linearized(dsdb_dn->dn)));
3979 /* see if this link already exists */
3980 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3982 /* see if this update is newer than what we have already */
3983 struct GUID invocation_id = GUID_zero();
3984 uint32_t version = 0;
3985 uint32_t originating_usn = 0;
3986 NTTIME change_time = 0;
3987 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3989 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3990 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3991 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
3992 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3994 if (!replmd_update_is_newer(&invocation_id,
3995 &la->meta_data.originating_invocation_id,
3997 la->meta_data.version,
3999 la->meta_data.originating_usn,
4001 la->meta_data.originating_change_time)) {
4002 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4003 old_el->name, ldb_dn_get_linearized(msg->dn),
4004 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4005 talloc_free(tmp_ctx);
4009 /* get a seq_num for this change */
4010 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4011 if (ret != LDB_SUCCESS) {
4012 talloc_free(tmp_ctx);
4016 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4017 /* remove the existing backlink */
4018 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4019 if (ret != LDB_SUCCESS) {
4020 talloc_free(tmp_ctx);
4025 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4026 &la->meta_data.originating_invocation_id,
4027 la->meta_data.originating_usn, seq_num,
4028 la->meta_data.originating_change_time,
4029 la->meta_data.version,
4031 if (ret != LDB_SUCCESS) {
4032 talloc_free(tmp_ctx);
4037 /* add the new backlink */
4038 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4039 if (ret != LDB_SUCCESS) {
4040 talloc_free(tmp_ctx);
4045 /* get a seq_num for this change */
4046 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4047 if (ret != LDB_SUCCESS) {
4048 talloc_free(tmp_ctx);
4052 old_el->values = talloc_realloc(msg->elements, old_el->values,
4053 struct ldb_val, old_el->num_values+1);
4054 if (!old_el->values) {
4055 ldb_module_oom(module);
4056 return LDB_ERR_OPERATIONS_ERROR;
4058 old_el->num_values++;
4060 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4061 &la->meta_data.originating_invocation_id,
4062 la->meta_data.originating_usn, seq_num,
4063 la->meta_data.originating_change_time,
4064 la->meta_data.version,
4065 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4066 if (ret != LDB_SUCCESS) {
4067 talloc_free(tmp_ctx);
4072 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4074 if (ret != LDB_SUCCESS) {
4075 talloc_free(tmp_ctx);
4081 /* we only change whenChanged and uSNChanged if the seq_num
4083 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4084 talloc_free(tmp_ctx);
4085 return ldb_operr(ldb);
4088 if (add_uint64_element(ldb, msg, "uSNChanged",
4089 seq_num) != LDB_SUCCESS) {
4090 talloc_free(tmp_ctx);
4091 return ldb_operr(ldb);
4094 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4095 if (old_el == NULL) {
4096 talloc_free(tmp_ctx);
4097 return ldb_operr(ldb);
4100 ret = dsdb_check_single_valued_link(attr, old_el);
4101 if (ret != LDB_SUCCESS) {
4102 talloc_free(tmp_ctx);
4106 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4108 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
4109 if (ret != LDB_SUCCESS) {
4110 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4112 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4113 talloc_free(tmp_ctx);
4117 talloc_free(tmp_ctx);
4122 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4124 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4125 return replmd_extended_replicated_objects(module, req);
4128 return ldb_next_request(module, req);
4133 we hook into the transaction operations to allow us to
4134 perform the linked attribute updates at the end of the whole
4135 transaction. This allows a forward linked attribute to be created
4136 before the object is created. During a vampire, w2k8 sends us linked
4137 attributes before the objects they are part of.
4139 static int replmd_start_transaction(struct ldb_module *module)
4141 /* create our private structure for this transaction */
4142 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4143 struct replmd_private);
4144 replmd_txn_cleanup(replmd_private);
4146 /* free any leftover mod_usn records from cancelled
4148 while (replmd_private->ncs) {
4149 struct nc_entry *e = replmd_private->ncs;
4150 DLIST_REMOVE(replmd_private->ncs, e);
4154 return ldb_next_start_trans(module);
4158 on prepare commit we loop over our queued la_context structures and
4161 static int replmd_prepare_commit(struct ldb_module *module)
4163 struct replmd_private *replmd_private =
4164 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4165 struct la_entry *la, *prev;
4166 struct la_backlink *bl;
4169 /* walk the list backwards, to do the first entry first, as we
4170 * added the entries with DLIST_ADD() which puts them at the
4171 * start of the list */
4172 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4173 prev = DLIST_PREV(la);
4174 DLIST_REMOVE(replmd_private->la_list, la);
4175 ret = replmd_process_linked_attribute(module, la);
4176 if (ret != LDB_SUCCESS) {
4177 replmd_txn_cleanup(replmd_private);
4182 /* process our backlink list, creating and deleting backlinks
4184 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4185 ret = replmd_process_backlink(module, bl);
4186 if (ret != LDB_SUCCESS) {
4187 replmd_txn_cleanup(replmd_private);
4192 replmd_txn_cleanup(replmd_private);
4194 /* possibly change @REPLCHANGED */
4195 ret = replmd_notify_store(module);
4196 if (ret != LDB_SUCCESS) {
4200 return ldb_next_prepare_commit(module);
4203 static int replmd_del_transaction(struct ldb_module *module)
4205 struct replmd_private *replmd_private =
4206 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4207 replmd_txn_cleanup(replmd_private);
4209 return ldb_next_del_trans(module);
4213 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4214 .name = "repl_meta_data",
4215 .init_context = replmd_init,
4217 .modify = replmd_modify,
4218 .rename = replmd_rename,
4219 .del = replmd_delete,
4220 .extended = replmd_extended,
4221 .start_transaction = replmd_start_transaction,
4222 .prepare_commit = replmd_prepare_commit,
4223 .del_transaction = replmd_del_transaction,
4226 int ldb_repl_meta_data_module_init(const char *version)
4228 LDB_MODULE_CHECK_VERSION(version);
4229 return ldb_register_module(&ldb_repl_meta_data_module_ops);