2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006-2007
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2008
7 Copyright (C) Matthieu Patou <mat@matws.net> 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/dlinklist.h"
26 #include "dsdb/samdb/samdb.h"
27 #include <ldb_module.h>
28 #include "param/param.h"
29 #include "librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "lib/util/tsort.h"
33 /* change this when we change something in our schema code that
34 * requires a re-index of the database
36 #define SAMDB_INDEXING_VERSION "2"
39 override the name to attribute handler function
41 const struct ldb_schema_attribute *dsdb_attribute_handler_override(struct ldb_context *ldb,
45 struct dsdb_schema *schema = talloc_get_type_abort(private_data, struct dsdb_schema);
46 const struct dsdb_attribute *a = dsdb_attribute_by_lDAPDisplayName(schema, name);
48 /* this will fall back to ldb internal handling */
51 return a->ldb_schema_attribute;
54 static int dsdb_schema_set_attributes(struct ldb_context *ldb, struct dsdb_schema *schema, bool write_attributes)
56 int ret = LDB_SUCCESS;
57 struct ldb_result *res;
58 struct ldb_result *res_idx;
59 struct dsdb_attribute *attr;
60 struct ldb_message *mod_msg;
62 struct ldb_message *msg;
63 struct ldb_message *msg_idx;
65 /* setup our own attribute name to schema handler */
66 ldb_schema_attribute_set_override_handler(ldb, dsdb_attribute_handler_override, schema);
68 if (!write_attributes) {
72 mem_ctx = talloc_new(ldb);
77 msg = ldb_msg_new(mem_ctx);
82 msg_idx = ldb_msg_new(mem_ctx);
87 msg->dn = ldb_dn_new(msg, ldb, "@ATTRIBUTES");
92 msg_idx->dn = ldb_dn_new(msg_idx, ldb, "@INDEXLIST");
98 ret = ldb_msg_add_string(msg_idx, "@IDXONE", "1");
99 if (ret != LDB_SUCCESS) {
104 ret = ldb_msg_add_string(msg_idx, "@IDXVERSION", SAMDB_INDEXING_VERSION);
105 if (ret != LDB_SUCCESS) {
109 for (attr = schema->attributes; attr; attr = attr->next) {
110 const char *syntax = attr->syntax->ldb_syntax;
113 syntax = attr->syntax->ldap_oid;
117 * Write out a rough approximation of the schema
118 * as an @ATTRIBUTES value, for bootstrapping
120 if (strcmp(syntax, LDB_SYNTAX_INTEGER) == 0) {
121 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "INTEGER");
122 } else if (strcmp(syntax, LDB_SYNTAX_DIRECTORY_STRING) == 0) {
123 ret = ldb_msg_add_string(msg, attr->lDAPDisplayName, "CASE_INSENSITIVE");
125 if (ret != LDB_SUCCESS) {
129 if (attr->searchFlags & SEARCH_FLAG_ATTINDEX) {
130 ret = ldb_msg_add_string(msg_idx, "@IDXATTR", attr->lDAPDisplayName);
131 if (ret != LDB_SUCCESS) {
137 if (ret != LDB_SUCCESS) {
138 talloc_free(mem_ctx);
143 * Try to avoid churning the attributes too much,
144 * we only want to do this if they have changed
146 ret = ldb_search(ldb, mem_ctx, &res, msg->dn, LDB_SCOPE_BASE, NULL,
148 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
149 ret = ldb_add(ldb, msg);
150 } else if (ret != LDB_SUCCESS) {
151 } else if (res->count != 1) {
152 ret = ldb_add(ldb, msg);
155 /* Annoyingly added to our search results */
156 ldb_msg_remove_attr(res->msgs[0], "distinguishedName");
158 ret = ldb_msg_difference(ldb, mem_ctx,
159 res->msgs[0], msg, &mod_msg);
160 if (ret != LDB_SUCCESS) {
163 if (mod_msg->num_elements > 0) {
164 ret = dsdb_replace(ldb, mod_msg, 0);
166 talloc_free(mod_msg);
169 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
170 /* We might be on a read-only DB or LDAP */
173 if (ret != LDB_SUCCESS) {
174 talloc_free(mem_ctx);
178 /* Now write out the indexes, as found in the schema (if they have changed) */
180 ret = ldb_search(ldb, mem_ctx, &res_idx, msg_idx->dn, LDB_SCOPE_BASE,
182 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
183 ret = ldb_add(ldb, msg_idx);
184 } else if (ret != LDB_SUCCESS) {
185 } else if (res_idx->count != 1) {
186 ret = ldb_add(ldb, msg_idx);
189 /* Annoyingly added to our search results */
190 ldb_msg_remove_attr(res_idx->msgs[0], "distinguishedName");
192 ret = ldb_msg_difference(ldb, mem_ctx,
193 res_idx->msgs[0], msg_idx, &mod_msg);
194 if (ret != LDB_SUCCESS) {
197 if (mod_msg->num_elements > 0) {
198 ret = dsdb_replace(ldb, mod_msg, 0);
200 talloc_free(mod_msg);
202 if (ret == LDB_ERR_OPERATIONS_ERROR || ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS || ret == LDB_ERR_INVALID_DN_SYNTAX) {
203 /* We might be on a read-only DB */
206 talloc_free(mem_ctx);
210 talloc_free(mem_ctx);
211 return ldb_operr(ldb);
216 create extra attribute shortcuts
218 static void dsdb_setup_attribute_shortcuts(struct ldb_context *ldb, struct dsdb_schema *schema)
220 struct dsdb_attribute *attribute;
222 /* setup fast access to one_way_link and DN format */
223 for (attribute=schema->attributes; attribute; attribute=attribute->next) {
224 attribute->dn_format = dsdb_dn_oid_to_format(attribute->syntax->ldap_oid);
226 if (attribute->dn_format == DSDB_INVALID_DN) {
227 attribute->one_way_link = false;
231 /* these are not considered to be one way links for
232 the purpose of DN link fixups */
233 if (ldb_attr_cmp("distinguishedName", attribute->lDAPDisplayName) == 0 ||
234 ldb_attr_cmp("objectCategory", attribute->lDAPDisplayName) == 0) {
235 attribute->one_way_link = false;
239 if (attribute->linkID == 0) {
240 attribute->one_way_link = true;
243 /* handle attributes with a linkID but no backlink */
244 if (dsdb_attribute_by_linkID(schema, attribute->linkID) == NULL) {
245 attribute->one_way_link = true;
248 attribute->one_way_link = false;
252 static int uint32_cmp(uint32_t c1, uint32_t c2)
254 if (c1 == c2) return 0;
255 return c1 > c2 ? 1 : -1;
258 static int dsdb_compare_class_by_lDAPDisplayName(struct dsdb_class **c1, struct dsdb_class **c2)
260 return strcasecmp((*c1)->lDAPDisplayName, (*c2)->lDAPDisplayName);
262 static int dsdb_compare_class_by_governsID_id(struct dsdb_class **c1, struct dsdb_class **c2)
264 return uint32_cmp((*c1)->governsID_id, (*c2)->governsID_id);
266 static int dsdb_compare_class_by_governsID_oid(struct dsdb_class **c1, struct dsdb_class **c2)
268 return strcasecmp((*c1)->governsID_oid, (*c2)->governsID_oid);
270 static int dsdb_compare_class_by_cn(struct dsdb_class **c1, struct dsdb_class **c2)
272 return strcasecmp((*c1)->cn, (*c2)->cn);
275 static int dsdb_compare_attribute_by_lDAPDisplayName(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
277 return strcasecmp((*a1)->lDAPDisplayName, (*a2)->lDAPDisplayName);
279 static int dsdb_compare_attribute_by_attributeID_id(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
281 return uint32_cmp((*a1)->attributeID_id, (*a2)->attributeID_id);
283 static int dsdb_compare_attribute_by_msDS_IntId(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
285 return uint32_cmp((*a1)->msDS_IntId, (*a2)->msDS_IntId);
287 static int dsdb_compare_attribute_by_attributeID_oid(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
289 return strcasecmp((*a1)->attributeID_oid, (*a2)->attributeID_oid);
291 static int dsdb_compare_attribute_by_linkID(struct dsdb_attribute **a1, struct dsdb_attribute **a2)
293 return uint32_cmp((*a1)->linkID, (*a2)->linkID);
297 * Clean up Classes and Attributes accessor arrays
299 static void dsdb_sorted_accessors_free(struct dsdb_schema *schema)
301 /* free classes accessors */
302 TALLOC_FREE(schema->classes_by_lDAPDisplayName);
303 TALLOC_FREE(schema->classes_by_governsID_id);
304 TALLOC_FREE(schema->classes_by_governsID_oid);
305 TALLOC_FREE(schema->classes_by_cn);
306 /* free attribute accessors */
307 TALLOC_FREE(schema->attributes_by_lDAPDisplayName);
308 TALLOC_FREE(schema->attributes_by_attributeID_id);
309 TALLOC_FREE(schema->attributes_by_msDS_IntId);
310 TALLOC_FREE(schema->attributes_by_attributeID_oid);
311 TALLOC_FREE(schema->attributes_by_linkID);
315 create the sorted accessor arrays for the schema
317 int dsdb_setup_sorted_accessors(struct ldb_context *ldb,
318 struct dsdb_schema *schema)
320 struct dsdb_class *cur;
321 struct dsdb_attribute *a;
323 unsigned int num_int_id;
326 /* free all caches */
327 dsdb_sorted_accessors_free(schema);
329 /* count the classes */
330 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) /* noop */ ;
331 schema->num_classes = i;
333 /* setup classes_by_* */
334 schema->classes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_class *, i);
335 schema->classes_by_governsID_id = talloc_array(schema, struct dsdb_class *, i);
336 schema->classes_by_governsID_oid = talloc_array(schema, struct dsdb_class *, i);
337 schema->classes_by_cn = talloc_array(schema, struct dsdb_class *, i);
338 if (schema->classes_by_lDAPDisplayName == NULL ||
339 schema->classes_by_governsID_id == NULL ||
340 schema->classes_by_governsID_oid == NULL ||
341 schema->classes_by_cn == NULL) {
345 for (i=0, cur=schema->classes; cur; i++, cur=cur->next) {
346 schema->classes_by_lDAPDisplayName[i] = cur;
347 schema->classes_by_governsID_id[i] = cur;
348 schema->classes_by_governsID_oid[i] = cur;
349 schema->classes_by_cn[i] = cur;
352 /* sort the arrays */
353 TYPESAFE_QSORT(schema->classes_by_lDAPDisplayName, schema->num_classes, dsdb_compare_class_by_lDAPDisplayName);
354 TYPESAFE_QSORT(schema->classes_by_governsID_id, schema->num_classes, dsdb_compare_class_by_governsID_id);
355 TYPESAFE_QSORT(schema->classes_by_governsID_oid, schema->num_classes, dsdb_compare_class_by_governsID_oid);
356 TYPESAFE_QSORT(schema->classes_by_cn, schema->num_classes, dsdb_compare_class_by_cn);
358 /* now build the attribute accessor arrays */
360 /* count the attributes
361 * and attributes with msDS-IntId set */
363 for (i=0, a=schema->attributes; a; i++, a=a->next) {
364 if (a->msDS_IntId != 0) {
368 schema->num_attributes = i;
369 schema->num_int_id_attr = num_int_id;
371 /* setup attributes_by_* */
372 schema->attributes_by_lDAPDisplayName = talloc_array(schema, struct dsdb_attribute *, i);
373 schema->attributes_by_attributeID_id = talloc_array(schema, struct dsdb_attribute *, i);
374 schema->attributes_by_msDS_IntId = talloc_array(schema,
375 struct dsdb_attribute *, num_int_id);
376 schema->attributes_by_attributeID_oid = talloc_array(schema, struct dsdb_attribute *, i);
377 schema->attributes_by_linkID = talloc_array(schema, struct dsdb_attribute *, i);
378 if (schema->attributes_by_lDAPDisplayName == NULL ||
379 schema->attributes_by_attributeID_id == NULL ||
380 schema->attributes_by_msDS_IntId == NULL ||
381 schema->attributes_by_attributeID_oid == NULL ||
382 schema->attributes_by_linkID == NULL) {
387 for (i=0, a=schema->attributes; a; i++, a=a->next) {
388 schema->attributes_by_lDAPDisplayName[i] = a;
389 schema->attributes_by_attributeID_id[i] = a;
390 schema->attributes_by_attributeID_oid[i] = a;
391 schema->attributes_by_linkID[i] = a;
392 /* append attr-by-msDS-IntId values */
393 if (a->msDS_IntId != 0) {
394 schema->attributes_by_msDS_IntId[num_int_id] = a;
398 SMB_ASSERT(num_int_id == schema->num_int_id_attr);
400 /* sort the arrays */
401 TYPESAFE_QSORT(schema->attributes_by_lDAPDisplayName, schema->num_attributes, dsdb_compare_attribute_by_lDAPDisplayName);
402 TYPESAFE_QSORT(schema->attributes_by_attributeID_id, schema->num_attributes, dsdb_compare_attribute_by_attributeID_id);
403 TYPESAFE_QSORT(schema->attributes_by_msDS_IntId, schema->num_int_id_attr, dsdb_compare_attribute_by_msDS_IntId);
404 TYPESAFE_QSORT(schema->attributes_by_attributeID_oid, schema->num_attributes, dsdb_compare_attribute_by_attributeID_oid);
405 TYPESAFE_QSORT(schema->attributes_by_linkID, schema->num_attributes, dsdb_compare_attribute_by_linkID);
407 dsdb_setup_attribute_shortcuts(ldb, schema);
409 ret = schema_fill_constructed(schema);
410 if (ret != LDB_SUCCESS) {
411 dsdb_sorted_accessors_free(schema);
418 dsdb_sorted_accessors_free(schema);
423 * Attach the schema to an opaque pointer on the ldb,
424 * so ldb modules can find it
426 int dsdb_set_schema(struct ldb_context *ldb, struct dsdb_schema *schema)
428 struct dsdb_schema *old_schema;
431 ret = dsdb_setup_sorted_accessors(ldb, schema);
432 if (ret != LDB_SUCCESS) {
436 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
438 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
439 if (ret != LDB_SUCCESS) {
443 /* Remove the reference to the schema we just overwrote - if there was
444 * none, NULL is harmless here */
445 if (old_schema != schema) {
446 talloc_unlink(ldb, old_schema);
447 talloc_steal(ldb, schema);
450 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
451 if (ret != LDB_SUCCESS) {
455 /* Set the new attributes based on the new schema */
456 ret = dsdb_schema_set_attributes(ldb, schema, true);
457 if (ret != LDB_SUCCESS) {
465 * Global variable to hold one copy of the schema, used to avoid memory bloat
467 static struct dsdb_schema *global_schema;
470 * Make this ldb use a specified schema, already fully calculated and belonging to another ldb
472 int dsdb_reference_schema(struct ldb_context *ldb, struct dsdb_schema *schema,
473 bool write_attributes)
476 struct dsdb_schema *old_schema;
477 old_schema = ldb_get_opaque(ldb, "dsdb_schema");
478 ret = ldb_set_opaque(ldb, "dsdb_schema", schema);
479 if (ret != LDB_SUCCESS) {
483 /* Remove the reference to the schema we just overwrote - if there was
484 * none, NULL is harmless here */
485 talloc_unlink(ldb, old_schema);
487 if (talloc_reference(ldb, schema) == NULL) {
491 /* Make this ldb use local schema preferably */
492 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", NULL);
493 if (ret != LDB_SUCCESS) {
497 ret = dsdb_schema_set_attributes(ldb, schema, write_attributes);
498 if (ret != LDB_SUCCESS) {
506 * Make this ldb use the 'global' schema, setup to avoid having multiple copies in this process
508 int dsdb_set_global_schema(struct ldb_context *ldb)
511 void *use_global_schema = (void *)1;
512 if (!global_schema) {
515 ret = ldb_set_opaque(ldb, "dsdb_use_global_schema", use_global_schema);
516 if (ret != LDB_SUCCESS) {
520 /* Set the new attributes based on the new schema */
521 ret = dsdb_schema_set_attributes(ldb, global_schema, false /* Don't write attributes, it's expensive */);
522 if (ret == LDB_SUCCESS) {
523 /* Keep a reference to this schema, just in case the original copy is replaced */
524 if (talloc_reference(ldb, global_schema) == NULL) {
532 bool dsdb_uses_global_schema(struct ldb_context *ldb)
534 return (ldb_get_opaque(ldb, "dsdb_use_global_schema") != NULL);
538 * Find the schema object for this ldb
540 * If reference_ctx is not NULL, then talloc_reference onto that context
543 struct dsdb_schema *dsdb_get_schema(struct ldb_context *ldb, TALLOC_CTX *reference_ctx)
546 struct dsdb_schema *schema_out;
547 struct dsdb_schema *schema_in;
548 bool use_global_schema;
549 TALLOC_CTX *tmp_ctx = talloc_new(reference_ctx);
554 /* see if we have a cached copy */
555 use_global_schema = dsdb_uses_global_schema(ldb);
556 if (use_global_schema) {
557 schema_in = global_schema;
559 p = ldb_get_opaque(ldb, "dsdb_schema");
561 schema_in = talloc_get_type(p, struct dsdb_schema);
563 talloc_free(tmp_ctx);
568 if (schema_in->refresh_fn && !schema_in->refresh_in_progress) {
569 if (!talloc_reference(tmp_ctx, schema_in)) {
571 * ensure that the schema_in->refresh_in_progress
572 * remains valid for the right amount of time
574 talloc_free(tmp_ctx);
577 schema_in->refresh_in_progress = true;
578 /* This may change schema, if it needs to reload it from disk */
579 schema_out = schema_in->refresh_fn(schema_in->loaded_from_module,
582 schema_in->refresh_in_progress = false;
584 schema_out = schema_in;
587 /* This removes the extra reference above */
588 talloc_free(tmp_ctx);
589 if (!reference_ctx) {
592 return talloc_reference(reference_ctx, schema_out);
597 * Make the schema found on this ldb the 'global' schema
600 void dsdb_make_schema_global(struct ldb_context *ldb, struct dsdb_schema *schema)
607 talloc_unlink(talloc_autofree_context(), global_schema);
610 /* we want the schema to be around permanently */
611 talloc_reparent(ldb, talloc_autofree_context(), schema);
612 global_schema = schema;
614 /* This calls the talloc_reference() of the global schema back onto the ldb */
615 dsdb_set_global_schema(ldb);
619 * When loading the schema from LDIF files, we don't get the extended DNs.
621 * We need to set these up, so that from the moment we start the provision,
622 * the defaultObjectCategory links are set up correctly.
624 int dsdb_schema_fill_extended_dn(struct ldb_context *ldb, struct dsdb_schema *schema)
626 struct dsdb_class *cur;
627 const struct dsdb_class *target_class;
628 for (cur = schema->classes; cur; cur = cur->next) {
629 const struct ldb_val *rdn;
632 struct ldb_dn *dn = ldb_dn_new(NULL, ldb, cur->defaultObjectCategory);
635 return LDB_ERR_INVALID_DN_SYNTAX;
637 rdn = ldb_dn_get_component_val(dn, 0);
640 return LDB_ERR_INVALID_DN_SYNTAX;
642 target_class = dsdb_class_by_cn_ldb_val(schema, rdn);
645 return LDB_ERR_CONSTRAINT_VIOLATION;
648 status = GUID_to_ndr_blob(&target_class->objectGUID, dn, &guid);
649 if (!NT_STATUS_IS_OK(status)) {
651 return ldb_operr(ldb);
653 ldb_dn_set_extended_component(dn, "GUID", &guid);
655 cur->defaultObjectCategory = ldb_dn_get_extended_linearized(cur, dn, 1);
662 * Add an element to the schema (attribute or class) from an LDB message
664 WERROR dsdb_schema_set_el_from_ldb_msg(struct ldb_context *ldb, struct dsdb_schema *schema,
665 struct ldb_message *msg)
667 if (samdb_find_attribute(ldb, msg,
668 "objectclass", "attributeSchema") != NULL) {
669 return dsdb_attribute_from_ldb(ldb, schema, msg);
670 } else if (samdb_find_attribute(ldb, msg,
671 "objectclass", "classSchema") != NULL) {
672 return dsdb_class_from_ldb(schema, msg);
675 /* Don't fail on things not classes or attributes */
680 * Rather than read a schema from the LDB itself, read it from an ldif
681 * file. This allows schema to be loaded and used while adding the
682 * schema itself to the directory.
685 WERROR dsdb_set_schema_from_ldif(struct ldb_context *ldb, const char *pf, const char *df)
687 struct ldb_ldif *ldif;
688 struct ldb_message *msg;
692 struct dsdb_schema *schema;
693 const struct ldb_val *prefix_val;
694 const struct ldb_val *info_val;
695 struct ldb_val info_val_default;
698 mem_ctx = talloc_new(ldb);
703 schema = dsdb_new_schema(mem_ctx);
705 schema->fsmo.we_are_master = true;
706 schema->fsmo.master_dn = ldb_dn_new_fmt(schema, ldb, "@PROVISION_SCHEMA_MASTER");
707 if (!schema->fsmo.master_dn) {
712 * load the prefixMap attribute from pf
714 ldif = ldb_ldif_read_string(ldb, &pf);
716 status = WERR_INVALID_PARAM;
719 talloc_steal(mem_ctx, ldif);
721 ret = ldb_msg_normalize(ldb, mem_ctx, ldif->msg, &msg);
722 if (ret != LDB_SUCCESS) {
727 prefix_val = ldb_msg_find_ldb_val(msg, "prefixMap");
729 status = WERR_INVALID_PARAM;
733 info_val = ldb_msg_find_ldb_val(msg, "schemaInfo");
735 status = dsdb_schema_info_blob_new(mem_ctx, &info_val_default);
736 W_ERROR_NOT_OK_GOTO(status, failed);
737 info_val = &info_val_default;
740 status = dsdb_load_oid_mappings_ldb(schema, prefix_val, info_val);
741 if (!W_ERROR_IS_OK(status)) {
742 DEBUG(0,("ERROR: dsdb_load_oid_mappings_ldb() failed with %s\n", win_errstr(status)));
746 /* load the attribute and class definitions out of df */
747 while ((ldif = ldb_ldif_read_string(ldb, &df))) {
748 talloc_steal(mem_ctx, ldif);
750 ret = ldb_msg_normalize(ldb, ldif, ldif->msg, &msg);
751 if (ret != LDB_SUCCESS) {
755 status = dsdb_schema_set_el_from_ldb_msg(ldb, schema, msg);
757 if (!W_ERROR_IS_OK(status)) {
762 ret = dsdb_set_schema(ldb, schema);
763 if (ret != LDB_SUCCESS) {
764 status = WERR_FOOBAR;
768 ret = dsdb_schema_fill_extended_dn(ldb, schema);
769 if (ret != LDB_SUCCESS) {
770 status = WERR_FOOBAR;
780 talloc_free(mem_ctx);