getncchanges: don't process DRSUAPI_DRS_CRITICAL_ONLY for EXOPs

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12398

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index 2860b90614adc78e366a5f9ef05c503542119440..92235ac274e126dd0430a9c6b064f62fa9926e70 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -1471,10 +1471,16 @@ static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
        enum ldb_scope scope = LDB_SCOPE_SUBTREE;
        //const char *extra_filter;
        struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
+       bool critical_only = false;
+
+       if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
+               critical_only = true;
+       }
 
        if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
            req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
                scope = LDB_SCOPE_BASE;
+               critical_only = false;
        }
 
        //extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
@@ -1490,7 +1496,7 @@ static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
                search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
        }
 
-       if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
+       if (critical_only) {
                search_filter = talloc_asprintf(mem_ctx,
                                                "(&%s(isCriticalSystemObject=TRUE))",
                                                search_filter);