4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2013
6 Copyright (C) Andrew Tridgell 2005-2009
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010-2011
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
59 struct replmd_private {
61 struct la_entry *la_list;
63 struct la_backlink *la_backlinks;
65 struct nc_entry *prev, *next;
68 uint64_t mod_usn_urgent;
70 struct ldb_dn *schema_dn;
74 struct la_entry *next, *prev;
75 struct drsuapi_DsReplicaLinkedAttribute *la;
78 struct replmd_replicated_request {
79 struct ldb_module *module;
80 struct ldb_request *req;
82 const struct dsdb_schema *schema;
83 struct GUID our_invocation_id;
85 /* the controls we pass down */
86 struct ldb_control **controls;
88 /* details for the mode where we apply a bunch of inbound replication meessages */
90 uint32_t index_current;
91 struct dsdb_extended_replicated_objects *objs;
93 struct ldb_message *search_msg;
94 struct GUID local_parent_guid;
102 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar);
103 static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete);
105 enum urgent_situation {
106 REPL_URGENT_ON_CREATE = 1,
107 REPL_URGENT_ON_UPDATE = 2,
108 REPL_URGENT_ON_DELETE = 4
111 enum deletion_state {
112 OBJECT_NOT_DELETED=1,
119 static void replmd_deletion_state(struct ldb_module *module,
120 const struct ldb_message *msg,
121 enum deletion_state *current_state,
122 enum deletion_state *next_state)
125 bool enabled = false;
128 *current_state = OBJECT_REMOVED;
129 if (next_state != NULL) {
130 *next_state = OBJECT_REMOVED;
135 ret = dsdb_recyclebin_enabled(module, &enabled);
136 if (ret != LDB_SUCCESS) {
140 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
142 *current_state = OBJECT_TOMBSTONE;
143 if (next_state != NULL) {
144 *next_state = OBJECT_REMOVED;
149 if (ldb_msg_check_string_attribute(msg, "isRecycled", "TRUE")) {
150 *current_state = OBJECT_RECYCLED;
151 if (next_state != NULL) {
152 *next_state = OBJECT_REMOVED;
157 *current_state = OBJECT_DELETED;
158 if (next_state != NULL) {
159 *next_state = OBJECT_RECYCLED;
164 *current_state = OBJECT_NOT_DELETED;
165 if (next_state == NULL) {
170 *next_state = OBJECT_DELETED;
172 *next_state = OBJECT_TOMBSTONE;
176 static const struct {
177 const char *update_name;
178 enum urgent_situation repl_situation;
179 } urgent_objects[] = {
180 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
181 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
182 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
183 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
184 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
185 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
189 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
190 static const char *urgent_attrs[] = {
193 "userAccountControl",
198 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
199 enum urgent_situation situation)
202 for (i=0; urgent_objects[i].update_name; i++) {
204 if ((situation & urgent_objects[i].repl_situation) == 0) {
208 for (j=0; j<objectclass_el->num_values; j++) {
209 const struct ldb_val *v = &objectclass_el->values[j];
210 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
218 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
220 if (ldb_attr_in_list(urgent_attrs, el->name)) {
227 static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar);
230 initialise the module
231 allocate the private structure and build the list
232 of partition DNs for use by replmd_notify()
234 static int replmd_init(struct ldb_module *module)
236 struct replmd_private *replmd_private;
237 struct ldb_context *ldb = ldb_module_get_ctx(module);
239 replmd_private = talloc_zero(module, struct replmd_private);
240 if (replmd_private == NULL) {
242 return LDB_ERR_OPERATIONS_ERROR;
244 ldb_module_set_private(module, replmd_private);
246 replmd_private->schema_dn = ldb_get_schema_basedn(ldb);
248 return ldb_next_init(module);
252 cleanup our per-transaction contexts
254 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
256 talloc_free(replmd_private->la_ctx);
257 replmd_private->la_list = NULL;
258 replmd_private->la_ctx = NULL;
260 talloc_free(replmd_private->bl_ctx);
261 replmd_private->la_backlinks = NULL;
262 replmd_private->bl_ctx = NULL;
267 struct la_backlink *next, *prev;
268 const char *attr_name;
269 struct GUID forward_guid, target_guid;
274 process a backlinks we accumulated during a transaction, adding and
275 deleting the backlinks from the target objects
277 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
279 struct ldb_dn *target_dn, *source_dn;
281 struct ldb_context *ldb = ldb_module_get_ctx(module);
282 struct ldb_message *msg;
283 TALLOC_CTX *tmp_ctx = talloc_new(bl);
289 - construct ldb_message
290 - either an add or a delete
292 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
293 if (ret != LDB_SUCCESS) {
294 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
295 GUID_string(bl, &bl->target_guid)));
299 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
300 if (ret != LDB_SUCCESS) {
301 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
302 GUID_string(bl, &bl->forward_guid));
303 talloc_free(tmp_ctx);
307 msg = ldb_msg_new(tmp_ctx);
309 ldb_module_oom(module);
310 talloc_free(tmp_ctx);
311 return LDB_ERR_OPERATIONS_ERROR;
314 /* construct a ldb_message for adding/deleting the backlink */
316 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
318 ldb_module_oom(module);
319 talloc_free(tmp_ctx);
320 return LDB_ERR_OPERATIONS_ERROR;
322 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
323 if (ret != LDB_SUCCESS) {
324 talloc_free(tmp_ctx);
327 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
329 /* a backlink should never be single valued. Unfortunately the
330 exchange schema has a attribute
331 msExchBridgeheadedLocalConnectorsDNBL which is single
332 valued and a backlink. We need to cope with that by
333 ignoring the single value flag */
334 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
336 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
337 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
338 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
339 cope with possible corruption where the backlink has
340 already been removed */
341 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
342 ldb_dn_get_linearized(target_dn),
343 ldb_dn_get_linearized(source_dn),
344 ldb_errstring(ldb)));
346 } else if (ret != LDB_SUCCESS) {
347 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
348 bl->active?"add":"remove",
349 ldb_dn_get_linearized(source_dn),
350 ldb_dn_get_linearized(target_dn),
352 talloc_free(tmp_ctx);
355 talloc_free(tmp_ctx);
360 add a backlink to the list of backlinks to add/delete in the prepare
363 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
364 struct GUID *forward_guid, struct GUID *target_guid,
365 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
367 const struct dsdb_attribute *target_attr;
368 struct la_backlink *bl;
369 struct replmd_private *replmd_private =
370 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
372 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
375 * windows 2003 has a broken schema where the
376 * definition of msDS-IsDomainFor is missing (which is
377 * supposed to be the backlink of the
378 * msDS-HasDomainNCs attribute
383 /* see if its already in the list */
384 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
385 if (GUID_equal(forward_guid, &bl->forward_guid) &&
386 GUID_equal(target_guid, &bl->target_guid) &&
387 (target_attr->lDAPDisplayName == bl->attr_name ||
388 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
394 /* we found an existing one */
395 if (bl->active == active) {
398 DLIST_REMOVE(replmd_private->la_backlinks, bl);
403 if (replmd_private->bl_ctx == NULL) {
404 replmd_private->bl_ctx = talloc_new(replmd_private);
405 if (replmd_private->bl_ctx == NULL) {
406 ldb_module_oom(module);
407 return LDB_ERR_OPERATIONS_ERROR;
412 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
414 ldb_module_oom(module);
415 return LDB_ERR_OPERATIONS_ERROR;
418 /* Ensure the schema does not go away before the bl->attr_name is used */
419 if (!talloc_reference(bl, schema)) {
421 ldb_module_oom(module);
422 return LDB_ERR_OPERATIONS_ERROR;
425 bl->attr_name = target_attr->lDAPDisplayName;
426 bl->forward_guid = *forward_guid;
427 bl->target_guid = *target_guid;
430 /* the caller may ask for this backlink to be processed
433 int ret = replmd_process_backlink(module, bl, NULL);
438 DLIST_ADD(replmd_private->la_backlinks, bl);
445 * Callback for most write operations in this module:
447 * notify the repl task that a object has changed. The notifies are
448 * gathered up in the replmd_private structure then written to the
449 * @REPLCHANGED object in each partition during the prepare_commit
451 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
454 struct replmd_replicated_request *ac =
455 talloc_get_type_abort(req->context, struct replmd_replicated_request);
456 struct replmd_private *replmd_private =
457 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
458 struct nc_entry *modified_partition;
459 struct ldb_control *partition_ctrl;
460 const struct dsdb_control_current_partition *partition;
462 struct ldb_control **controls;
464 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
466 controls = ares->controls;
467 if (ldb_request_get_control(ac->req,
468 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
470 * Remove the current partition control from what we pass up
471 * the chain if it hasn't been requested manually.
473 controls = ldb_controls_except_specified(ares->controls, ares,
477 if (ares->error != LDB_SUCCESS) {
478 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
479 return ldb_module_done(ac->req, controls,
480 ares->response, ares->error);
483 if (ares->type != LDB_REPLY_DONE) {
484 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
485 return ldb_module_done(ac->req, NULL,
486 NULL, LDB_ERR_OPERATIONS_ERROR);
489 if (!partition_ctrl) {
490 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
491 return ldb_module_done(ac->req, NULL,
492 NULL, LDB_ERR_OPERATIONS_ERROR);
495 partition = talloc_get_type_abort(partition_ctrl->data,
496 struct dsdb_control_current_partition);
498 if (ac->seq_num > 0) {
499 for (modified_partition = replmd_private->ncs; modified_partition;
500 modified_partition = modified_partition->next) {
501 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
506 if (modified_partition == NULL) {
507 modified_partition = talloc_zero(replmd_private, struct nc_entry);
508 if (!modified_partition) {
509 ldb_oom(ldb_module_get_ctx(ac->module));
510 return ldb_module_done(ac->req, NULL,
511 NULL, LDB_ERR_OPERATIONS_ERROR);
513 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
514 if (!modified_partition->dn) {
515 ldb_oom(ldb_module_get_ctx(ac->module));
516 return ldb_module_done(ac->req, NULL,
517 NULL, LDB_ERR_OPERATIONS_ERROR);
519 DLIST_ADD(replmd_private->ncs, modified_partition);
522 if (ac->seq_num > modified_partition->mod_usn) {
523 modified_partition->mod_usn = ac->seq_num;
525 modified_partition->mod_usn_urgent = ac->seq_num;
530 if (ac->apply_mode) {
531 ret = replmd_replicated_apply_isDeleted(ac);
532 if (ret != LDB_SUCCESS) {
533 return ldb_module_done(ac->req, NULL, NULL, ret);
537 /* free the partition control container here, for the
538 * common path. Other cases will have it cleaned up
539 * eventually with the ares */
540 talloc_free(partition_ctrl);
541 return ldb_module_done(ac->req, controls,
542 ares->response, LDB_SUCCESS);
548 * update a @REPLCHANGED record in each partition if there have been
549 * any writes of replicated data in the partition
551 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
553 struct replmd_private *replmd_private =
554 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
556 while (replmd_private->ncs) {
558 struct nc_entry *modified_partition = replmd_private->ncs;
560 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
561 modified_partition->mod_usn,
562 modified_partition->mod_usn_urgent, parent);
563 if (ret != LDB_SUCCESS) {
564 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
565 ldb_dn_get_linearized(modified_partition->dn)));
568 DLIST_REMOVE(replmd_private->ncs, modified_partition);
569 talloc_free(modified_partition);
577 created a replmd_replicated_request context
579 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
580 struct ldb_request *req)
582 struct ldb_context *ldb;
583 struct replmd_replicated_request *ac;
584 const struct GUID *our_invocation_id;
586 ldb = ldb_module_get_ctx(module);
588 ac = talloc_zero(req, struct replmd_replicated_request);
597 ac->schema = dsdb_get_schema(ldb, ac);
599 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
600 "replmd_modify: no dsdb_schema loaded");
601 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
606 /* get our invocationId */
607 our_invocation_id = samdb_ntds_invocation_id(ldb);
608 if (!our_invocation_id) {
609 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
610 "replmd_add: unable to find invocationId\n");
614 ac->our_invocation_id = *our_invocation_id;
620 add a time element to a record
622 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
624 struct ldb_message_element *el;
628 if (ldb_msg_find_element(msg, attr) != NULL) {
632 s = ldb_timestring(msg, t);
634 return LDB_ERR_OPERATIONS_ERROR;
637 ret = ldb_msg_add_string(msg, attr, s);
638 if (ret != LDB_SUCCESS) {
642 el = ldb_msg_find_element(msg, attr);
643 /* always set as replace. This works because on add ops, the flag
645 el->flags = LDB_FLAG_MOD_REPLACE;
651 add a uint64_t element to a record
653 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
654 const char *attr, uint64_t v)
656 struct ldb_message_element *el;
659 if (ldb_msg_find_element(msg, attr) != NULL) {
663 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
664 if (ret != LDB_SUCCESS) {
668 el = ldb_msg_find_element(msg, attr);
669 /* always set as replace. This works because on add ops, the flag
671 el->flags = LDB_FLAG_MOD_REPLACE;
676 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
677 const struct replPropertyMetaData1 *m2,
678 const uint32_t *rdn_attid)
681 * This assignment seems inoccous, but it is critical for the
682 * system, as we need to do the comparisons as a unsigned
683 * quantity, not signed (enums are signed integers)
685 uint32_t attid_1 = m1->attid;
686 uint32_t attid_2 = m2->attid;
688 if (attid_1 == attid_2) {
693 * See above regarding this being an unsigned comparison.
694 * Otherwise when the high bit is set on non-standard
695 * attributes, they would end up first, before objectClass
698 return attid_1 > attid_2 ? 1 : -1;
701 static int replmd_replPropertyMetaDataCtr1_verify(struct ldb_context *ldb,
702 struct replPropertyMetaDataCtr1 *ctr1,
705 if (ctr1->count == 0) {
706 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
707 "No elements found in replPropertyMetaData for %s!\n",
708 ldb_dn_get_linearized(dn));
709 return LDB_ERR_CONSTRAINT_VIOLATION;
712 /* the objectClass attribute is value 0x00000000, so must be first */
713 if (ctr1->array[0].attid != DRSUAPI_ATTID_objectClass) {
714 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
715 "No objectClass found in replPropertyMetaData for %s!\n",
716 ldb_dn_get_linearized(dn));
717 return LDB_ERR_OBJECT_CLASS_VIOLATION;
723 static int replmd_replPropertyMetaDataCtr1_sort_and_verify(struct ldb_context *ldb,
724 struct replPropertyMetaDataCtr1 *ctr1,
727 /* Note this is O(n^2) for the almost-sorted case, which this is */
728 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, NULL,
729 replmd_replPropertyMetaData1_attid_sort);
730 return replmd_replPropertyMetaDataCtr1_verify(ldb, ctr1, dn);
733 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
734 const struct ldb_message_element *e2,
735 const struct dsdb_schema *schema)
737 const struct dsdb_attribute *a1;
738 const struct dsdb_attribute *a2;
741 * TODO: make this faster by caching the dsdb_attribute pointer
742 * on the ldb_messag_element
745 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
746 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
749 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
753 return strcasecmp(e1->name, e2->name);
755 if (a1->attributeID_id == a2->attributeID_id) {
758 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
761 static void replmd_ldb_message_sort(struct ldb_message *msg,
762 const struct dsdb_schema *schema)
764 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
767 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
768 const struct GUID *invocation_id, uint64_t seq_num,
769 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
773 fix up linked attributes in replmd_add.
774 This involves setting up the right meta-data in extended DN
775 components, and creating backlinks to the object
777 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
778 uint64_t seq_num, const struct GUID *invocationId, NTTIME now,
779 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
782 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
783 struct ldb_context *ldb = ldb_module_get_ctx(module);
785 /* We will take a reference to the schema in replmd_add_backlink */
786 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
788 for (i=0; i<el->num_values; i++) {
789 struct ldb_val *v = &el->values[i];
790 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
791 struct GUID target_guid;
795 /* note that the DN already has the extended
796 components from the extended_dn_store module */
797 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
798 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
799 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
800 if (ret != LDB_SUCCESS) {
801 talloc_free(tmp_ctx);
804 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
805 if (ret != LDB_SUCCESS) {
806 talloc_free(tmp_ctx);
811 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
812 seq_num, seq_num, now, 0, false);
813 if (ret != LDB_SUCCESS) {
814 talloc_free(tmp_ctx);
818 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
819 if (ret != LDB_SUCCESS) {
820 talloc_free(tmp_ctx);
825 talloc_free(tmp_ctx);
831 intercept add requests
833 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
835 struct ldb_context *ldb;
836 struct ldb_control *control;
837 struct replmd_replicated_request *ac;
838 enum ndr_err_code ndr_err;
839 struct ldb_request *down_req;
840 struct ldb_message *msg;
841 const DATA_BLOB *guid_blob;
843 struct replPropertyMetaDataBlob nmd;
844 struct ldb_val nmd_value;
847 * The use of a time_t here seems odd, but as the NTTIME
848 * elements are actually declared as NTTIME_1sec in the IDL,
849 * getting a higher resolution timestamp is not required.
851 time_t t = time(NULL);
856 unsigned int functional_level;
858 bool allow_add_guid = false;
859 bool remove_current_guid = false;
860 bool is_urgent = false;
861 bool is_schema_nc = false;
862 struct ldb_message_element *objectclass_el;
863 struct replmd_private *replmd_private =
864 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
866 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
867 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
869 allow_add_guid = true;
872 /* do not manipulate our control entries */
873 if (ldb_dn_is_special(req->op.add.message->dn)) {
874 return ldb_next_request(module, req);
877 ldb = ldb_module_get_ctx(module);
879 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
881 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
882 if (guid_blob != NULL) {
883 if (!allow_add_guid) {
884 ldb_set_errstring(ldb,
885 "replmd_add: it's not allowed to add an object with objectGUID!");
886 return LDB_ERR_UNWILLING_TO_PERFORM;
888 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
889 if (!NT_STATUS_IS_OK(status)) {
890 ldb_set_errstring(ldb,
891 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
892 return LDB_ERR_UNWILLING_TO_PERFORM;
894 /* we remove this attribute as it can be a string and
895 * will not be treated correctly and then we will re-add
896 * it later on in the good format */
897 remove_current_guid = true;
901 guid = GUID_random();
904 ac = replmd_ctx_init(module, req);
906 return ldb_module_oom(module);
909 functional_level = dsdb_functional_level(ldb);
911 /* Get a sequence number from the backend */
912 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
913 if (ret != LDB_SUCCESS) {
918 /* we have to copy the message as the caller might have it as a const */
919 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
923 return LDB_ERR_OPERATIONS_ERROR;
926 /* generated times */
927 unix_to_nt_time(&now, t);
928 time_str = ldb_timestring(msg, t);
932 return LDB_ERR_OPERATIONS_ERROR;
934 if (remove_current_guid) {
935 ldb_msg_remove_attr(msg,"objectGUID");
939 * remove autogenerated attributes
941 ldb_msg_remove_attr(msg, "whenCreated");
942 ldb_msg_remove_attr(msg, "whenChanged");
943 ldb_msg_remove_attr(msg, "uSNCreated");
944 ldb_msg_remove_attr(msg, "uSNChanged");
945 ldb_msg_remove_attr(msg, "replPropertyMetaData");
948 * readd replicated attributes
950 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
951 if (ret != LDB_SUCCESS) {
957 /* build the replication meta_data */
960 nmd.ctr.ctr1.count = msg->num_elements;
961 nmd.ctr.ctr1.array = talloc_array(msg,
962 struct replPropertyMetaData1,
964 if (!nmd.ctr.ctr1.array) {
967 return LDB_ERR_OPERATIONS_ERROR;
970 is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
972 for (i=0; i < msg->num_elements; i++) {
973 struct ldb_message_element *e = &msg->elements[i];
974 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
975 const struct dsdb_attribute *sa;
977 if (e->name[0] == '@') continue;
979 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
981 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
982 "replmd_add: attribute '%s' not defined in schema\n",
985 return LDB_ERR_NO_SUCH_ATTRIBUTE;
988 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
989 /* if the attribute is not replicated (0x00000001)
990 * or constructed (0x00000004) it has no metadata
995 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
996 ret = replmd_add_fix_la(module, e, ac->seq_num,
997 &ac->our_invocation_id, now,
999 if (ret != LDB_SUCCESS) {
1003 /* linked attributes are not stored in
1004 replPropertyMetaData in FL above w2k */
1008 m->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
1010 if (m->attid == DRSUAPI_ATTID_isDeleted) {
1011 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1014 if (rdn_val == NULL) {
1017 return LDB_ERR_OPERATIONS_ERROR;
1020 rdn = (const char*)rdn_val->data;
1021 if (strcmp(rdn, "Deleted Objects") == 0) {
1023 * Set the originating_change_time to 29/12/9999 at 23:59:59
1024 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1026 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1028 m->originating_change_time = now;
1031 m->originating_change_time = now;
1033 m->originating_invocation_id = ac->our_invocation_id;
1034 m->originating_usn = ac->seq_num;
1035 m->local_usn = ac->seq_num;
1039 /* fix meta data count */
1040 nmd.ctr.ctr1.count = ni;
1043 * sort meta data array
1045 ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &nmd.ctr.ctr1, msg->dn);
1046 if (ret != LDB_SUCCESS) {
1047 ldb_asprintf_errstring(ldb, "%s: error during direct ADD: %s", __func__, ldb_errstring(ldb));
1052 /* generated NDR encoded values */
1053 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
1055 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1056 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1059 return LDB_ERR_OPERATIONS_ERROR;
1063 * add the autogenerated values
1065 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
1066 if (ret != LDB_SUCCESS) {
1071 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
1072 if (ret != LDB_SUCCESS) {
1077 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
1078 if (ret != LDB_SUCCESS) {
1083 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1084 if (ret != LDB_SUCCESS) {
1089 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1090 if (ret != LDB_SUCCESS) {
1097 * sort the attributes by attid before storing the object
1099 replmd_ldb_message_sort(msg, ac->schema);
1102 * Assert that we do have an objectClass
1104 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1105 if (objectclass_el == NULL) {
1106 ldb_asprintf_errstring(ldb, __location__
1107 ": objectClass missing on %s\n",
1108 ldb_dn_get_linearized(msg->dn));
1110 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1112 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1113 REPL_URGENT_ON_CREATE);
1115 ac->is_urgent = is_urgent;
1116 ret = ldb_build_add_req(&down_req, ldb, ac,
1119 ac, replmd_op_callback,
1122 LDB_REQ_SET_LOCATION(down_req);
1123 if (ret != LDB_SUCCESS) {
1128 /* current partition control is needed by "replmd_op_callback" */
1129 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1130 ret = ldb_request_add_control(down_req,
1131 DSDB_CONTROL_CURRENT_PARTITION_OID,
1133 if (ret != LDB_SUCCESS) {
1139 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1140 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1141 if (ret != LDB_SUCCESS) {
1147 /* mark the control done */
1149 control->critical = 0;
1151 /* go on with the call chain */
1152 return ldb_next_request(module, down_req);
1157 * update the replPropertyMetaData for one element
1159 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1160 struct ldb_message *msg,
1161 struct ldb_message_element *el,
1162 struct ldb_message_element *old_el,
1163 struct replPropertyMetaDataBlob *omd,
1164 const struct dsdb_schema *schema,
1166 const struct GUID *our_invocation_id,
1169 struct ldb_request *req)
1172 const struct dsdb_attribute *a;
1173 struct replPropertyMetaData1 *md1;
1174 bool may_skip = false;
1177 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1179 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1180 /* allow this to make it possible for dbcheck
1181 to remove bad attributes */
1185 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1187 return LDB_ERR_OPERATIONS_ERROR;
1190 attid = dsdb_attribute_get_attid(a, is_schema_nc);
1192 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1197 * if the attribute's value haven't changed, and this isn't
1198 * just a delete of everything then return LDB_SUCCESS Unless
1199 * we have the provision control or if the attribute is
1200 * interSiteTopologyGenerator as this page explain:
1201 * http://support.microsoft.com/kb/224815 this attribute is
1202 * periodicaly written by the DC responsible for the intersite
1203 * generation in a given site
1205 * Unchanged could be deleting or replacing an already-gone
1206 * thing with an unconstrained delete/empty replace or a
1207 * replace with the same value, but not an add with the same
1208 * value because that could be about adding a duplicate (which
1209 * is for someone else to error out on).
1211 if (old_el != NULL && ldb_msg_element_equal_ordered(el, old_el)) {
1212 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1215 } else if (old_el == NULL && el->num_values == 0) {
1216 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1218 } else if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
1224 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1225 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1227 * allow this to make it possible for dbcheck
1228 * to rebuild broken metadata
1234 for (i=0; i<omd->ctr.ctr1.count; i++) {
1236 * First check if we find it under the msDS-IntID,
1237 * then check if we find it under the OID and
1240 * This allows the administrator to simply re-write
1241 * the attributes and so restore replication, which is
1242 * likely what they will try to do.
1244 if (attid == omd->ctr.ctr1.array[i].attid) {
1248 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) {
1253 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1254 /* linked attributes are not stored in
1255 replPropertyMetaData in FL above w2k, but we do
1256 raise the seqnum for the object */
1257 if (*seq_num == 0 &&
1258 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1259 return LDB_ERR_OPERATIONS_ERROR;
1264 if (i == omd->ctr.ctr1.count) {
1265 /* we need to add a new one */
1266 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1267 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1268 if (omd->ctr.ctr1.array == NULL) {
1270 return LDB_ERR_OPERATIONS_ERROR;
1272 omd->ctr.ctr1.count++;
1273 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1276 /* Get a new sequence number from the backend. We only do this
1277 * if we have a change that requires a new
1278 * replPropertyMetaData element
1280 if (*seq_num == 0) {
1281 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1282 if (ret != LDB_SUCCESS) {
1283 return LDB_ERR_OPERATIONS_ERROR;
1287 md1 = &omd->ctr.ctr1.array[i];
1290 if (md1->attid == DRSUAPI_ATTID_isDeleted) {
1291 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1294 if (rdn_val == NULL) {
1296 return LDB_ERR_OPERATIONS_ERROR;
1299 rdn = (const char*)rdn_val->data;
1300 if (strcmp(rdn, "Deleted Objects") == 0) {
1302 * Set the originating_change_time to 29/12/9999 at 23:59:59
1303 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1305 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1307 md1->originating_change_time = now;
1310 md1->originating_change_time = now;
1312 md1->originating_invocation_id = *our_invocation_id;
1313 md1->originating_usn = *seq_num;
1314 md1->local_usn = *seq_num;
1320 * Bump the replPropertyMetaData version on an attribute, and if it
1321 * has changed (or forced by leaving rdn_old NULL), update the value
1324 * This is important, as calling a modify operation may not change the
1325 * version number if the values appear unchanged, but a rename between
1326 * parents bumps this value.
1329 static int replmd_update_rpmd_rdn_attr(struct ldb_context *ldb,
1330 struct ldb_message *msg,
1331 const struct ldb_val *rdn_new,
1332 const struct ldb_val *rdn_old,
1333 struct replPropertyMetaDataBlob *omd,
1334 struct replmd_replicated_request *ar,
1338 struct ldb_message_element new_el = {
1339 .flags = LDB_FLAG_MOD_REPLACE,
1340 .name = ldb_dn_get_rdn_name(msg->dn),
1342 .values = discard_const_p(struct ldb_val, rdn_new)
1344 struct ldb_message_element old_el = {
1345 .flags = LDB_FLAG_MOD_REPLACE,
1346 .name = ldb_dn_get_rdn_name(msg->dn),
1347 .num_values = rdn_old ? 1 : 0,
1348 .values = discard_const_p(struct ldb_val, rdn_old)
1351 if (ldb_msg_element_equal_ordered(&new_el, &old_el) == false) {
1352 int ret = ldb_msg_add(msg, &new_el, LDB_FLAG_MOD_REPLACE);
1353 if (ret != LDB_SUCCESS) {
1354 return ldb_oom(ldb);
1358 return replmd_update_rpmd_element(ldb, msg, &new_el, NULL,
1359 omd, ar->schema, &ar->seq_num,
1360 &ar->our_invocation_id,
1361 now, is_schema_nc, ar->req);
1365 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1367 uint32_t count = omd.ctr.ctr1.count;
1370 for (i=0; i < count; i++) {
1371 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1372 if (max < m.local_usn) {
1380 * update the replPropertyMetaData object each time we modify an
1381 * object. This is needed for DRS replication, as the merge on the
1382 * client is based on this object
1384 static int replmd_update_rpmd(struct ldb_module *module,
1385 const struct dsdb_schema *schema,
1386 struct ldb_request *req,
1387 const char * const *rename_attrs,
1388 struct ldb_message *msg, uint64_t *seq_num,
1389 time_t t, bool is_schema_nc,
1390 bool *is_urgent, bool *rodc)
1392 const struct ldb_val *omd_value;
1393 enum ndr_err_code ndr_err;
1394 struct replPropertyMetaDataBlob omd;
1397 const struct GUID *our_invocation_id;
1399 const char * const *attrs = NULL;
1400 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1401 struct ldb_result *res;
1402 struct ldb_context *ldb;
1403 struct ldb_message_element *objectclass_el;
1404 enum urgent_situation situation;
1405 bool rmd_is_provided;
1406 bool rmd_is_just_resorted = false;
1407 const char *not_rename_attrs[4 + msg->num_elements];
1410 attrs = rename_attrs;
1412 for (i = 0; i < msg->num_elements; i++) {
1413 not_rename_attrs[i] = msg->elements[i].name;
1415 not_rename_attrs[i] = "replPropertyMetaData";
1416 not_rename_attrs[i+1] = "objectClass";
1417 not_rename_attrs[i+2] = "instanceType";
1418 not_rename_attrs[i+3] = NULL;
1419 attrs = not_rename_attrs;
1422 ldb = ldb_module_get_ctx(module);
1424 our_invocation_id = samdb_ntds_invocation_id(ldb);
1425 if (!our_invocation_id) {
1426 /* this happens during an initial vampire while
1427 updating the schema */
1428 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1432 unix_to_nt_time(&now, t);
1434 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1435 rmd_is_provided = true;
1436 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID)) {
1437 rmd_is_just_resorted = true;
1440 rmd_is_provided = false;
1443 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1444 * otherwise we consider we are updating */
1445 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1446 situation = REPL_URGENT_ON_DELETE;
1447 } else if (rename_attrs) {
1448 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1450 situation = REPL_URGENT_ON_UPDATE;
1453 if (rmd_is_provided) {
1454 /* In this case the change_replmetadata control was supplied */
1455 /* We check that it's the only attribute that is provided
1456 * (it's a rare case so it's better to keep the code simplier)
1457 * We also check that the highest local_usn is bigger or the same as
1460 if( msg->num_elements != 1 ||
1461 strncmp(msg->elements[0].name,
1462 "replPropertyMetaData", 20) ) {
1463 DEBUG(0,(__location__ ": changereplmetada control called without "\
1464 "a specified replPropertyMetaData attribute or with others\n"));
1465 return LDB_ERR_OPERATIONS_ERROR;
1467 if (situation != REPL_URGENT_ON_UPDATE) {
1468 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1469 return LDB_ERR_OPERATIONS_ERROR;
1471 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1473 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1474 ldb_dn_get_linearized(msg->dn)));
1475 return LDB_ERR_OPERATIONS_ERROR;
1477 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1478 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1479 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1480 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1481 ldb_dn_get_linearized(msg->dn)));
1482 return LDB_ERR_OPERATIONS_ERROR;
1485 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1486 DSDB_FLAG_NEXT_MODULE |
1487 DSDB_SEARCH_SHOW_RECYCLED |
1488 DSDB_SEARCH_SHOW_EXTENDED_DN |
1489 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1490 DSDB_SEARCH_REVEAL_INTERNALS, req);
1492 if (ret != LDB_SUCCESS) {
1496 if (rmd_is_just_resorted == false) {
1497 *seq_num = find_max_local_usn(omd);
1499 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1502 * The test here now allows for a new
1503 * replPropertyMetaData with no change, if was
1504 * just dbcheck re-sorting the values.
1506 if (*seq_num <= db_seq) {
1507 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)" \
1508 " is less than uSNChanged (max = %lld uSNChanged = %lld)\n",
1509 (long long)*seq_num, (long long)db_seq));
1510 return LDB_ERR_OPERATIONS_ERROR;
1515 /* search for the existing replPropertyMetaDataBlob. We need
1516 * to use REVEAL and ask for DNs in storage format to support
1517 * the check for values being the same in
1518 * replmd_update_rpmd_element()
1520 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1521 DSDB_FLAG_NEXT_MODULE |
1522 DSDB_SEARCH_SHOW_RECYCLED |
1523 DSDB_SEARCH_SHOW_EXTENDED_DN |
1524 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1525 DSDB_SEARCH_REVEAL_INTERNALS, req);
1526 if (ret != LDB_SUCCESS) {
1530 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1532 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1533 ldb_dn_get_linearized(msg->dn)));
1534 return LDB_ERR_OPERATIONS_ERROR;
1537 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1538 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1539 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1540 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1541 ldb_dn_get_linearized(msg->dn)));
1542 return LDB_ERR_OPERATIONS_ERROR;
1545 if (omd.version != 1) {
1546 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1547 omd.version, ldb_dn_get_linearized(msg->dn)));
1548 return LDB_ERR_OPERATIONS_ERROR;
1551 for (i=0; i<msg->num_elements; i++) {
1552 struct ldb_message_element *old_el;
1553 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1554 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1558 if (ret != LDB_SUCCESS) {
1562 if (!*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1563 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1570 * Assert that we have an objectClass attribute - this is major
1571 * corruption if we don't have this!
1573 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1574 if (objectclass_el != NULL) {
1576 * Now check if this objectClass means we need to do urgent replication
1578 if (!*is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1582 } else if (!ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
1583 ldb_asprintf_errstring(ldb, __location__
1584 ": objectClass missing on %s\n",
1585 ldb_dn_get_linearized(msg->dn));
1586 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1590 * replmd_update_rpmd_element has done an update if the
1593 if (*seq_num != 0 || rmd_is_just_resorted == true) {
1594 struct ldb_val *md_value;
1595 struct ldb_message_element *el;
1597 /*if we are RODC and this is a DRSR update then its ok*/
1598 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1599 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1600 unsigned instanceType;
1602 ret = samdb_rodc(ldb, rodc);
1603 if (ret != LDB_SUCCESS) {
1604 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1606 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1607 return LDB_ERR_REFERRAL;
1610 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1611 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1612 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1613 "cannot change replicated attribute on partial replica");
1617 md_value = talloc(msg, struct ldb_val);
1618 if (md_value == NULL) {
1620 return LDB_ERR_OPERATIONS_ERROR;
1623 ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &omd.ctr.ctr1, msg->dn);
1624 if (ret != LDB_SUCCESS) {
1625 ldb_asprintf_errstring(ldb, "%s: %s", __func__, ldb_errstring(ldb));
1629 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1630 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1631 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1632 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1633 ldb_dn_get_linearized(msg->dn)));
1634 return LDB_ERR_OPERATIONS_ERROR;
1637 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1638 if (ret != LDB_SUCCESS) {
1639 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1640 ldb_dn_get_linearized(msg->dn)));
1645 el->values = md_value;
1652 struct dsdb_dn *dsdb_dn;
1657 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1659 return GUID_compare(&pdn1->guid, &pdn2->guid);
1662 static int GUID_compare_struct(struct GUID *g1, struct GUID g2)
1664 return GUID_compare(g1, &g2);
1667 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1668 unsigned int count, struct GUID *guid,
1671 struct parsed_dn *ret;
1673 if (dn && GUID_all_zero(guid)) {
1674 /* when updating a link using DRS, we sometimes get a
1675 NULL GUID. We then need to try and match by DN */
1676 for (i=0; i<count; i++) {
1677 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1678 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1684 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare_struct, ret);
1689 get a series of message element values as an array of DNs and GUIDs
1690 the result is sorted by GUID
1692 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1693 struct ldb_message_element *el, struct parsed_dn **pdn,
1694 const char *ldap_oid, struct ldb_request *parent)
1697 struct ldb_context *ldb = ldb_module_get_ctx(module);
1704 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1706 ldb_module_oom(module);
1707 return LDB_ERR_OPERATIONS_ERROR;
1710 for (i=0; i<el->num_values; i++) {
1711 struct ldb_val *v = &el->values[i];
1714 struct parsed_dn *p;
1718 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1719 if (p->dsdb_dn == NULL) {
1720 return LDB_ERR_INVALID_DN_SYNTAX;
1723 dn = p->dsdb_dn->dn;
1725 status = dsdb_get_extended_dn_guid(dn, &p->guid, "GUID");
1726 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1727 /* we got a DN without a GUID - go find the GUID */
1728 int ret = dsdb_module_guid_by_dn(module, dn, &p->guid, parent);
1729 if (ret != LDB_SUCCESS) {
1730 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1731 ldb_dn_get_linearized(dn));
1732 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1733 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1734 ldb_attr_cmp(el->name, "member") == 0) {
1735 return LDB_ERR_UNWILLING_TO_PERFORM;
1739 ret = dsdb_set_extended_dn_guid(dn, &p->guid, "GUID");
1740 if (ret != LDB_SUCCESS) {
1743 } else if (!NT_STATUS_IS_OK(status)) {
1744 return LDB_ERR_OPERATIONS_ERROR;
1747 /* keep a pointer to the original ldb_val */
1751 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1757 build a new extended DN, including all meta data fields
1759 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1760 RMD_ADDTIME = originating_add_time
1761 RMD_INVOCID = originating_invocation_id
1762 RMD_CHANGETIME = originating_change_time
1763 RMD_ORIGINATING_USN = originating_usn
1764 RMD_LOCAL_USN = local_usn
1765 RMD_VERSION = version
1767 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1768 const struct GUID *invocation_id, uint64_t seq_num,
1769 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1771 struct ldb_dn *dn = dsdb_dn->dn;
1772 const char *tstring, *usn_string, *flags_string;
1773 struct ldb_val tval;
1775 struct ldb_val usnv, local_usnv;
1776 struct ldb_val vers, flagsv;
1779 const char *dnstring;
1781 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1783 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1785 return LDB_ERR_OPERATIONS_ERROR;
1787 tval = data_blob_string_const(tstring);
1789 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1791 return LDB_ERR_OPERATIONS_ERROR;
1793 usnv = data_blob_string_const(usn_string);
1795 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1797 return LDB_ERR_OPERATIONS_ERROR;
1799 local_usnv = data_blob_string_const(usn_string);
1801 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1803 return LDB_ERR_OPERATIONS_ERROR;
1805 vers = data_blob_string_const(vstring);
1807 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1808 if (!NT_STATUS_IS_OK(status)) {
1809 return LDB_ERR_OPERATIONS_ERROR;
1812 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1813 if (!flags_string) {
1814 return LDB_ERR_OPERATIONS_ERROR;
1816 flagsv = data_blob_string_const(flags_string);
1818 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1819 if (ret != LDB_SUCCESS) return ret;
1820 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1821 if (ret != LDB_SUCCESS) return ret;
1822 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1823 if (ret != LDB_SUCCESS) return ret;
1824 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1825 if (ret != LDB_SUCCESS) return ret;
1826 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1827 if (ret != LDB_SUCCESS) return ret;
1828 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1829 if (ret != LDB_SUCCESS) return ret;
1830 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1831 if (ret != LDB_SUCCESS) return ret;
1833 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1834 if (dnstring == NULL) {
1835 return LDB_ERR_OPERATIONS_ERROR;
1837 *v = data_blob_string_const(dnstring);
1842 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1843 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1844 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1845 uint32_t version, bool deleted);
1848 check if any links need upgrading from w2k format
1850 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1852 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1855 for (i=0; i<count; i++) {
1860 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1861 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1865 /* it's an old one that needs upgrading */
1866 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1868 if (ret != LDB_SUCCESS) {
1876 update an extended DN, including all meta data fields
1878 see replmd_build_la_val for value names
1880 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1881 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1882 uint64_t usn, uint64_t local_usn, NTTIME nttime,
1883 uint32_t version, bool deleted)
1885 struct ldb_dn *dn = dsdb_dn->dn;
1886 const char *tstring, *usn_string, *flags_string;
1887 struct ldb_val tval;
1889 struct ldb_val usnv, local_usnv;
1890 struct ldb_val vers, flagsv;
1891 const struct ldb_val *old_addtime;
1892 uint32_t old_version;
1895 const char *dnstring;
1897 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1899 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1901 return LDB_ERR_OPERATIONS_ERROR;
1903 tval = data_blob_string_const(tstring);
1905 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)usn);
1907 return LDB_ERR_OPERATIONS_ERROR;
1909 usnv = data_blob_string_const(usn_string);
1911 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1913 return LDB_ERR_OPERATIONS_ERROR;
1915 local_usnv = data_blob_string_const(usn_string);
1917 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1918 if (!NT_STATUS_IS_OK(status)) {
1919 return LDB_ERR_OPERATIONS_ERROR;
1922 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1923 if (!flags_string) {
1924 return LDB_ERR_OPERATIONS_ERROR;
1926 flagsv = data_blob_string_const(flags_string);
1928 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1929 if (ret != LDB_SUCCESS) return ret;
1931 /* get the ADDTIME from the original */
1932 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1933 if (old_addtime == NULL) {
1934 old_addtime = &tval;
1936 if (dsdb_dn != old_dsdb_dn ||
1937 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1938 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1939 if (ret != LDB_SUCCESS) return ret;
1942 /* use our invocation id */
1943 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1944 if (ret != LDB_SUCCESS) return ret;
1946 /* changetime is the current time */
1947 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1948 if (ret != LDB_SUCCESS) return ret;
1950 /* update the USN */
1951 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1952 if (ret != LDB_SUCCESS) return ret;
1954 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1955 if (ret != LDB_SUCCESS) return ret;
1957 /* increase the version by 1 */
1958 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1959 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1960 version = old_version+1;
1962 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1963 vers = data_blob_string_const(vstring);
1964 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1965 if (ret != LDB_SUCCESS) return ret;
1967 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1968 if (dnstring == NULL) {
1969 return LDB_ERR_OPERATIONS_ERROR;
1971 *v = data_blob_string_const(dnstring);
1977 handle adding a linked attribute
1979 static int replmd_modify_la_add(struct ldb_module *module,
1980 const struct dsdb_schema *schema,
1981 struct ldb_message *msg,
1982 struct ldb_message_element *el,
1983 struct ldb_message_element *old_el,
1984 const struct dsdb_attribute *schema_attr,
1987 struct GUID *msg_guid,
1988 struct ldb_request *parent)
1991 struct parsed_dn *dns, *old_dns;
1992 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1994 struct ldb_val *new_values = NULL;
1995 unsigned int num_new_values = 0;
1996 unsigned old_num_values = old_el?old_el->num_values:0;
1997 const struct GUID *invocation_id;
1998 struct ldb_context *ldb = ldb_module_get_ctx(module);
2001 unix_to_nt_time(&now, t);
2003 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2004 if (ret != LDB_SUCCESS) {
2005 talloc_free(tmp_ctx);
2009 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2010 if (ret != LDB_SUCCESS) {
2011 talloc_free(tmp_ctx);
2015 invocation_id = samdb_ntds_invocation_id(ldb);
2016 if (!invocation_id) {
2017 talloc_free(tmp_ctx);
2018 return LDB_ERR_OPERATIONS_ERROR;
2021 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2022 if (ret != LDB_SUCCESS) {
2023 talloc_free(tmp_ctx);
2027 /* for each new value, see if it exists already with the same GUID */
2028 for (i=0; i<el->num_values; i++) {
2029 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, &dns[i].guid, NULL);
2031 /* this is a new linked attribute value */
2032 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
2033 if (new_values == NULL) {
2034 ldb_module_oom(module);
2035 talloc_free(tmp_ctx);
2036 return LDB_ERR_OPERATIONS_ERROR;
2038 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2039 invocation_id, seq_num, seq_num, now, 0, false);
2040 if (ret != LDB_SUCCESS) {
2041 talloc_free(tmp_ctx);
2046 /* this is only allowed if the GUID was
2047 previously deleted. */
2048 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
2050 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
2051 struct GUID_txt_buf guid_str;
2052 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
2053 el->name, GUID_buf_string(&p->guid, &guid_str));
2054 talloc_free(tmp_ctx);
2055 /* error codes for 'member' need to be
2057 if (ldb_attr_cmp(el->name, "member") == 0) {
2058 return LDB_ERR_ENTRY_ALREADY_EXISTS;
2060 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2063 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
2064 invocation_id, seq_num, seq_num, now, 0, false);
2065 if (ret != LDB_SUCCESS) {
2066 talloc_free(tmp_ctx);
2071 ret = replmd_add_backlink(module, schema, msg_guid, &dns[i].guid, true, schema_attr, true);
2072 if (ret != LDB_SUCCESS) {
2073 talloc_free(tmp_ctx);
2078 /* add the new ones on to the end of the old values, constructing a new el->values */
2079 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2081 old_num_values+num_new_values);
2082 if (el->values == NULL) {
2083 ldb_module_oom(module);
2084 return LDB_ERR_OPERATIONS_ERROR;
2087 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
2088 el->num_values = old_num_values + num_new_values;
2090 talloc_steal(msg->elements, el->values);
2091 talloc_steal(el->values, new_values);
2093 talloc_free(tmp_ctx);
2095 /* we now tell the backend to replace all existing values
2096 with the one we have constructed */
2097 el->flags = LDB_FLAG_MOD_REPLACE;
2104 handle deleting all active linked attributes
2106 static int replmd_modify_la_delete(struct ldb_module *module,
2107 const struct dsdb_schema *schema,
2108 struct ldb_message *msg,
2109 struct ldb_message_element *el,
2110 struct ldb_message_element *old_el,
2111 const struct dsdb_attribute *schema_attr,
2114 struct GUID *msg_guid,
2115 struct ldb_request *parent)
2118 struct parsed_dn *dns, *old_dns;
2119 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2121 const struct GUID *invocation_id;
2122 struct ldb_context *ldb = ldb_module_get_ctx(module);
2125 unix_to_nt_time(&now, t);
2127 /* check if there is nothing to delete */
2128 if ((!old_el || old_el->num_values == 0) &&
2129 el->num_values == 0) {
2133 if (!old_el || old_el->num_values == 0) {
2134 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2137 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2138 if (ret != LDB_SUCCESS) {
2139 talloc_free(tmp_ctx);
2143 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2144 if (ret != LDB_SUCCESS) {
2145 talloc_free(tmp_ctx);
2149 invocation_id = samdb_ntds_invocation_id(ldb);
2150 if (!invocation_id) {
2151 return LDB_ERR_OPERATIONS_ERROR;
2154 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
2155 if (ret != LDB_SUCCESS) {
2156 talloc_free(tmp_ctx);
2162 /* see if we are being asked to delete any links that
2163 don't exist or are already deleted */
2164 for (i=0; i<el->num_values; i++) {
2165 struct parsed_dn *p = &dns[i];
2166 struct parsed_dn *p2;
2169 p2 = parsed_dn_find(old_dns, old_el->num_values, &p->guid, NULL);
2171 struct GUID_txt_buf buf;
2172 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
2173 el->name, GUID_buf_string(&p->guid, &buf));
2174 if (ldb_attr_cmp(el->name, "member") == 0) {
2175 return LDB_ERR_UNWILLING_TO_PERFORM;
2177 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2180 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
2181 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
2182 struct GUID_txt_buf buf;
2183 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
2184 el->name, GUID_buf_string(&p->guid, &buf));
2185 if (ldb_attr_cmp(el->name, "member") == 0) {
2186 return LDB_ERR_UNWILLING_TO_PERFORM;
2188 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2193 /* for each new value, see if it exists already with the same GUID
2194 if it is not already deleted and matches the delete list then delete it
2196 for (i=0; i<old_el->num_values; i++) {
2197 struct parsed_dn *p = &old_dns[i];
2200 if (el->num_values && parsed_dn_find(dns, el->num_values, &p->guid, NULL) == NULL) {
2204 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
2205 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2207 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2208 invocation_id, seq_num, seq_num, now, 0, true);
2209 if (ret != LDB_SUCCESS) {
2210 talloc_free(tmp_ctx);
2214 ret = replmd_add_backlink(module, schema, msg_guid, &old_dns[i].guid, false, schema_attr, true);
2215 if (ret != LDB_SUCCESS) {
2216 talloc_free(tmp_ctx);
2221 el->values = talloc_steal(msg->elements, old_el->values);
2222 el->num_values = old_el->num_values;
2224 talloc_free(tmp_ctx);
2226 /* we now tell the backend to replace all existing values
2227 with the one we have constructed */
2228 el->flags = LDB_FLAG_MOD_REPLACE;
2234 handle replacing a linked attribute
2236 static int replmd_modify_la_replace(struct ldb_module *module,
2237 const struct dsdb_schema *schema,
2238 struct ldb_message *msg,
2239 struct ldb_message_element *el,
2240 struct ldb_message_element *old_el,
2241 const struct dsdb_attribute *schema_attr,
2244 struct GUID *msg_guid,
2245 struct ldb_request *parent)
2248 struct parsed_dn *dns, *old_dns;
2249 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2251 const struct GUID *invocation_id;
2252 struct ldb_context *ldb = ldb_module_get_ctx(module);
2253 struct ldb_val *new_values = NULL;
2254 unsigned int num_new_values = 0;
2255 unsigned int old_num_values = old_el?old_el->num_values:0;
2258 unix_to_nt_time(&now, t);
2260 /* check if there is nothing to replace */
2261 if ((!old_el || old_el->num_values == 0) &&
2262 el->num_values == 0) {
2266 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2267 if (ret != LDB_SUCCESS) {
2268 talloc_free(tmp_ctx);
2272 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2273 if (ret != LDB_SUCCESS) {
2274 talloc_free(tmp_ctx);
2278 invocation_id = samdb_ntds_invocation_id(ldb);
2279 if (!invocation_id) {
2280 return LDB_ERR_OPERATIONS_ERROR;
2283 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2284 if (ret != LDB_SUCCESS) {
2285 talloc_free(tmp_ctx);
2289 /* mark all the old ones as deleted */
2290 for (i=0; i<old_num_values; i++) {
2291 struct parsed_dn *old_p = &old_dns[i];
2292 struct parsed_dn *p;
2293 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2295 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2297 ret = replmd_add_backlink(module, schema, msg_guid, &old_dns[i].guid, false, schema_attr, false);
2298 if (ret != LDB_SUCCESS) {
2299 talloc_free(tmp_ctx);
2303 p = parsed_dn_find(dns, el->num_values, &old_p->guid, NULL);
2305 /* we don't delete it if we are re-adding it */
2309 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2310 invocation_id, seq_num, seq_num, now, 0, true);
2311 if (ret != LDB_SUCCESS) {
2312 talloc_free(tmp_ctx);
2317 /* for each new value, either update its meta-data, or add it
2320 for (i=0; i<el->num_values; i++) {
2321 struct parsed_dn *p = &dns[i], *old_p;
2324 (old_p = parsed_dn_find(old_dns,
2325 old_num_values, &p->guid, NULL)) != NULL) {
2326 /* update in place */
2327 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2328 old_p->dsdb_dn, invocation_id,
2329 seq_num, seq_num, now, 0, false);
2330 if (ret != LDB_SUCCESS) {
2331 talloc_free(tmp_ctx);
2336 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2338 if (new_values == NULL) {
2339 ldb_module_oom(module);
2340 talloc_free(tmp_ctx);
2341 return LDB_ERR_OPERATIONS_ERROR;
2343 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2344 invocation_id, seq_num, seq_num, now, 0, false);
2345 if (ret != LDB_SUCCESS) {
2346 talloc_free(tmp_ctx);
2352 ret = replmd_add_backlink(module, schema, msg_guid, &dns[i].guid, true, schema_attr, false);
2353 if (ret != LDB_SUCCESS) {
2354 talloc_free(tmp_ctx);
2359 /* add the new values to the end of old_el */
2360 if (num_new_values != 0) {
2361 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2362 struct ldb_val, old_num_values+num_new_values);
2363 if (el->values == NULL) {
2364 ldb_module_oom(module);
2365 return LDB_ERR_OPERATIONS_ERROR;
2367 memcpy(&el->values[old_num_values], &new_values[0],
2368 sizeof(struct ldb_val)*num_new_values);
2369 el->num_values = old_num_values + num_new_values;
2370 talloc_steal(msg->elements, new_values);
2372 el->values = old_el->values;
2373 el->num_values = old_el->num_values;
2374 talloc_steal(msg->elements, el->values);
2377 talloc_free(tmp_ctx);
2379 /* we now tell the backend to replace all existing values
2380 with the one we have constructed */
2381 el->flags = LDB_FLAG_MOD_REPLACE;
2388 handle linked attributes in modify requests
2390 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2391 struct ldb_message *msg,
2392 uint64_t seq_num, time_t t,
2393 struct ldb_request *parent)
2395 struct ldb_result *res;
2398 struct ldb_context *ldb = ldb_module_get_ctx(module);
2399 struct ldb_message *old_msg;
2401 const struct dsdb_schema *schema;
2402 struct GUID old_guid;
2405 /* there the replmd_update_rpmd code has already
2406 * checked and saw that there are no linked
2411 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2412 /* don't do anything special for linked attributes */
2416 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2417 DSDB_FLAG_NEXT_MODULE |
2418 DSDB_SEARCH_SHOW_RECYCLED |
2419 DSDB_SEARCH_REVEAL_INTERNALS |
2420 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2422 if (ret != LDB_SUCCESS) {
2425 schema = dsdb_get_schema(ldb, res);
2427 return LDB_ERR_OPERATIONS_ERROR;
2430 old_msg = res->msgs[0];
2432 old_guid = samdb_result_guid(old_msg, "objectGUID");
2434 for (i=0; i<msg->num_elements; i++) {
2435 struct ldb_message_element *el = &msg->elements[i];
2436 struct ldb_message_element *old_el, *new_el;
2437 const struct dsdb_attribute *schema_attr
2438 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2440 ldb_asprintf_errstring(ldb,
2441 "%s: attribute %s is not a valid attribute in schema",
2442 __FUNCTION__, el->name);
2443 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2445 if (schema_attr->linkID == 0) {
2448 if ((schema_attr->linkID & 1) == 1) {
2449 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2452 /* Odd is for the target. Illegal to modify */
2453 ldb_asprintf_errstring(ldb,
2454 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2455 return LDB_ERR_UNWILLING_TO_PERFORM;
2457 old_el = ldb_msg_find_element(old_msg, el->name);
2458 switch (el->flags & LDB_FLAG_MOD_MASK) {
2459 case LDB_FLAG_MOD_REPLACE:
2460 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2462 case LDB_FLAG_MOD_DELETE:
2463 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2465 case LDB_FLAG_MOD_ADD:
2466 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2469 ldb_asprintf_errstring(ldb,
2470 "invalid flags 0x%x for %s linked attribute",
2471 el->flags, el->name);
2472 return LDB_ERR_UNWILLING_TO_PERFORM;
2474 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2475 ldb_asprintf_errstring(ldb,
2476 "Attribute %s is single valued but more than one value has been supplied",
2478 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2480 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2485 if (ret != LDB_SUCCESS) {
2489 ldb_msg_remove_attr(old_msg, el->name);
2491 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2492 new_el->num_values = el->num_values;
2493 new_el->values = talloc_steal(msg->elements, el->values);
2495 /* TODO: this relises a bit too heavily on the exact
2496 behaviour of ldb_msg_find_element and
2497 ldb_msg_remove_element */
2498 old_el = ldb_msg_find_element(msg, el->name);
2500 ldb_msg_remove_element(msg, old_el);
2511 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2513 struct ldb_context *ldb;
2514 struct replmd_replicated_request *ac;
2515 struct ldb_request *down_req;
2516 struct ldb_message *msg;
2517 time_t t = time(NULL);
2519 bool is_urgent = false, rodc = false;
2520 bool is_schema_nc = false;
2521 unsigned int functional_level;
2522 const struct ldb_message_element *guid_el = NULL;
2523 struct ldb_control *sd_propagation_control;
2524 struct replmd_private *replmd_private =
2525 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
2527 /* do not manipulate our control entries */
2528 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2529 return ldb_next_request(module, req);
2532 sd_propagation_control = ldb_request_get_control(req,
2533 DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
2534 if (sd_propagation_control != NULL) {
2535 if (req->op.mod.message->num_elements != 1) {
2536 return ldb_module_operr(module);
2538 ret = strcmp(req->op.mod.message->elements[0].name,
2539 "nTSecurityDescriptor");
2541 return ldb_module_operr(module);
2544 return ldb_next_request(module, req);
2547 ldb = ldb_module_get_ctx(module);
2549 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2551 guid_el = ldb_msg_find_element(req->op.mod.message, "objectGUID");
2552 if (guid_el != NULL) {
2553 ldb_set_errstring(ldb,
2554 "replmd_modify: it's not allowed to change the objectGUID!");
2555 return LDB_ERR_CONSTRAINT_VIOLATION;
2558 ac = replmd_ctx_init(module, req);
2560 return ldb_module_oom(module);
2563 functional_level = dsdb_functional_level(ldb);
2565 /* we have to copy the message as the caller might have it as a const */
2566 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2570 return LDB_ERR_OPERATIONS_ERROR;
2573 ldb_msg_remove_attr(msg, "whenChanged");
2574 ldb_msg_remove_attr(msg, "uSNChanged");
2576 is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
2578 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2579 msg, &ac->seq_num, t, is_schema_nc,
2581 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2582 struct loadparm_context *lp_ctx;
2585 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2586 struct loadparm_context);
2588 referral = talloc_asprintf(req,
2590 lpcfg_dnsdomain(lp_ctx),
2591 ldb_dn_get_linearized(msg->dn));
2592 ret = ldb_module_send_referral(req, referral);
2597 if (ret != LDB_SUCCESS) {
2602 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2603 if (ret != LDB_SUCCESS) {
2609 * - replace the old object with the newly constructed one
2612 ac->is_urgent = is_urgent;
2614 ret = ldb_build_mod_req(&down_req, ldb, ac,
2617 ac, replmd_op_callback,
2619 LDB_REQ_SET_LOCATION(down_req);
2620 if (ret != LDB_SUCCESS) {
2625 /* current partition control is needed by "replmd_op_callback" */
2626 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2627 ret = ldb_request_add_control(down_req,
2628 DSDB_CONTROL_CURRENT_PARTITION_OID,
2630 if (ret != LDB_SUCCESS) {
2636 /* If we are in functional level 2000, then
2637 * replmd_modify_handle_linked_attribs will have done
2639 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2640 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2641 if (ret != LDB_SUCCESS) {
2647 talloc_steal(down_req, msg);
2649 /* we only change whenChanged and uSNChanged if the seq_num
2651 if (ac->seq_num != 0) {
2652 ret = add_time_element(msg, "whenChanged", t);
2653 if (ret != LDB_SUCCESS) {
2659 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2660 if (ret != LDB_SUCCESS) {
2667 /* go on with the call chain */
2668 return ldb_next_request(module, down_req);
2671 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2674 handle a rename request
2676 On a rename we need to do an extra ldb_modify which sets the
2677 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2679 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2681 struct ldb_context *ldb;
2682 struct replmd_replicated_request *ac;
2684 struct ldb_request *down_req;
2686 /* do not manipulate our control entries */
2687 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2688 return ldb_next_request(module, req);
2691 ldb = ldb_module_get_ctx(module);
2693 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2695 ac = replmd_ctx_init(module, req);
2697 return ldb_module_oom(module);
2700 ret = ldb_build_rename_req(&down_req, ldb, ac,
2701 ac->req->op.rename.olddn,
2702 ac->req->op.rename.newdn,
2704 ac, replmd_rename_callback,
2706 LDB_REQ_SET_LOCATION(down_req);
2707 if (ret != LDB_SUCCESS) {
2712 /* go on with the call chain */
2713 return ldb_next_request(module, down_req);
2716 /* After the rename is compleated, update the whenchanged etc */
2717 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2719 struct ldb_context *ldb;
2720 struct ldb_request *down_req;
2721 struct ldb_message *msg;
2722 const struct dsdb_attribute *rdn_attr;
2723 const char *rdn_name;
2724 const struct ldb_val *rdn_val;
2725 const char *attrs[5] = { NULL, };
2726 time_t t = time(NULL);
2728 bool is_urgent = false, rodc = false;
2730 struct replmd_replicated_request *ac =
2731 talloc_get_type(req->context, struct replmd_replicated_request);
2732 struct replmd_private *replmd_private =
2733 talloc_get_type(ldb_module_get_private(ac->module),
2734 struct replmd_private);
2736 ldb = ldb_module_get_ctx(ac->module);
2738 if (ares->error != LDB_SUCCESS) {
2739 return ldb_module_done(ac->req, ares->controls,
2740 ares->response, ares->error);
2743 if (ares->type != LDB_REPLY_DONE) {
2744 ldb_set_errstring(ldb,
2745 "invalid ldb_reply_type in callback");
2747 return ldb_module_done(ac->req, NULL, NULL,
2748 LDB_ERR_OPERATIONS_ERROR);
2752 * - replace the old object with the newly constructed one
2755 msg = ldb_msg_new(ac);
2758 return LDB_ERR_OPERATIONS_ERROR;
2761 msg->dn = ac->req->op.rename.newdn;
2763 is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
2765 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2766 if (rdn_name == NULL) {
2768 return ldb_module_done(ac->req, NULL, NULL,
2772 /* normalize the rdn attribute name */
2773 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2774 if (rdn_attr == NULL) {
2776 return ldb_module_done(ac->req, NULL, NULL,
2779 rdn_name = rdn_attr->lDAPDisplayName;
2781 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2782 if (rdn_val == NULL) {
2784 return ldb_module_done(ac->req, NULL, NULL,
2788 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2790 return ldb_module_done(ac->req, NULL, NULL,
2793 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2795 return ldb_module_done(ac->req, NULL, NULL,
2798 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2800 return ldb_module_done(ac->req, NULL, NULL,
2803 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2805 return ldb_module_done(ac->req, NULL, NULL,
2810 * here we let replmd_update_rpmd() only search for
2811 * the existing "replPropertyMetaData" and rdn_name attributes.
2813 * We do not want the existing "name" attribute as
2814 * the "name" attribute needs to get the version
2815 * updated on rename even if the rdn value hasn't changed.
2817 * This is the diff of the meta data, for a moved user
2818 * on a w2k8r2 server:
2821 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2822 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2823 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2824 * version : 0x00000001 (1)
2825 * reserved : 0x00000000 (0)
2826 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2827 * local_usn : 0x00000000000037a5 (14245)
2828 * array: struct replPropertyMetaData1
2829 * attid : DRSUAPI_ATTID_name (0x90001)
2830 * - version : 0x00000001 (1)
2831 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2832 * + version : 0x00000002 (2)
2833 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2834 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2835 * - originating_usn : 0x00000000000037a5 (14245)
2836 * - local_usn : 0x00000000000037a5 (14245)
2837 * + originating_usn : 0x0000000000003834 (14388)
2838 * + local_usn : 0x0000000000003834 (14388)
2839 * array: struct replPropertyMetaData1
2840 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2841 * version : 0x00000004 (4)
2843 attrs[0] = "replPropertyMetaData";
2844 attrs[1] = "objectClass";
2845 attrs[2] = "instanceType";
2846 attrs[3] = rdn_name;
2849 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2850 msg, &ac->seq_num, t,
2851 is_schema_nc, &is_urgent, &rodc);
2852 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2853 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2854 struct loadparm_context *lp_ctx;
2857 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2858 struct loadparm_context);
2860 referral = talloc_asprintf(req,
2862 lpcfg_dnsdomain(lp_ctx),
2863 ldb_dn_get_linearized(olddn));
2864 ret = ldb_module_send_referral(req, referral);
2866 return ldb_module_done(req, NULL, NULL, ret);
2869 if (ret != LDB_SUCCESS) {
2871 return ldb_module_done(ac->req, NULL, NULL, ret);
2874 if (ac->seq_num == 0) {
2876 return ldb_module_done(ac->req, NULL, NULL,
2878 "internal error seq_num == 0"));
2880 ac->is_urgent = is_urgent;
2882 ret = ldb_build_mod_req(&down_req, ldb, ac,
2885 ac, replmd_op_callback,
2887 LDB_REQ_SET_LOCATION(down_req);
2888 if (ret != LDB_SUCCESS) {
2893 /* current partition control is needed by "replmd_op_callback" */
2894 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2895 ret = ldb_request_add_control(down_req,
2896 DSDB_CONTROL_CURRENT_PARTITION_OID,
2898 if (ret != LDB_SUCCESS) {
2904 talloc_steal(down_req, msg);
2906 ret = add_time_element(msg, "whenChanged", t);
2907 if (ret != LDB_SUCCESS) {
2913 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2914 if (ret != LDB_SUCCESS) {
2920 /* go on with the call chain - do the modify after the rename */
2921 return ldb_next_request(ac->module, down_req);
2925 * remove links from objects that point at this object when an object
2926 * is deleted. We remove it from the NEXT module per MS-DRSR 5.160
2927 * RemoveObj which states that link removal due to the object being
2928 * deleted is NOT an originating update - they just go away!
2931 static int replmd_delete_remove_link(struct ldb_module *module,
2932 const struct dsdb_schema *schema,
2934 struct ldb_message_element *el,
2935 const struct dsdb_attribute *sa,
2936 struct ldb_request *parent)
2939 TALLOC_CTX *tmp_ctx = talloc_new(module);
2940 struct ldb_context *ldb = ldb_module_get_ctx(module);
2942 for (i=0; i<el->num_values; i++) {
2943 struct dsdb_dn *dsdb_dn;
2947 struct ldb_message *msg;
2948 const struct dsdb_attribute *target_attr;
2949 struct ldb_message_element *el2;
2950 struct ldb_val dn_val;
2952 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2956 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2958 talloc_free(tmp_ctx);
2959 return LDB_ERR_OPERATIONS_ERROR;
2962 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2963 if (!NT_STATUS_IS_OK(status)) {
2964 talloc_free(tmp_ctx);
2965 return LDB_ERR_OPERATIONS_ERROR;
2968 /* remove the link */
2969 msg = ldb_msg_new(tmp_ctx);
2971 ldb_module_oom(module);
2972 talloc_free(tmp_ctx);
2973 return LDB_ERR_OPERATIONS_ERROR;
2977 msg->dn = dsdb_dn->dn;
2979 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2980 if (target_attr == NULL) {
2984 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2985 if (ret != LDB_SUCCESS) {
2986 ldb_module_oom(module);
2987 talloc_free(tmp_ctx);
2988 return LDB_ERR_OPERATIONS_ERROR;
2990 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2991 el2->values = &dn_val;
2992 el2->num_values = 1;
2994 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2995 if (ret != LDB_SUCCESS) {
2996 talloc_free(tmp_ctx);
3000 talloc_free(tmp_ctx);
3006 handle update of replication meta data for deletion of objects
3008 This also handles the mapping of delete to a rename operation
3009 to allow deletes to be replicated.
3011 It also handles the incoming deleted objects, to ensure they are
3012 fully deleted here. In that case re_delete is true, and we do not
3013 use this as a signal to change the deleted state, just reinforce it.
3016 static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete)
3018 int ret = LDB_ERR_OTHER;
3019 bool retb, disallow_move_on_delete;
3020 struct ldb_dn *old_dn, *new_dn;
3021 const char *rdn_name;
3022 const struct ldb_val *rdn_value, *new_rdn_value;
3024 struct ldb_context *ldb = ldb_module_get_ctx(module);
3025 const struct dsdb_schema *schema;
3026 struct ldb_message *msg, *old_msg;
3027 struct ldb_message_element *el;
3028 TALLOC_CTX *tmp_ctx;
3029 struct ldb_result *res, *parent_res;
3030 const char *preserved_attrs[] = {
3031 /* yes, this really is a hard coded list. See MS-ADTS
3032 section 3.1.1.5.5.1.1 */
3033 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
3034 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
3035 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
3036 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
3037 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
3038 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
3039 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
3040 "whenChanged", NULL};
3041 unsigned int i, el_count = 0;
3042 enum deletion_state deletion_state, next_deletion_state;
3044 if (ldb_dn_is_special(req->op.del.dn)) {
3045 return ldb_next_request(module, req);
3049 * We have to allow dbcheck to remove an object that
3050 * is beyond repair, and to do so totally. This could
3051 * mean we we can get a partial object from the other
3052 * DC, causing havoc, so dbcheck suggests
3053 * re-replication first. dbcheck sets both DBCHECK
3054 * and RELAX in this situation.
3056 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)
3057 && ldb_request_get_control(req, DSDB_CONTROL_DBCHECK)) {
3058 /* really, really remove it */
3059 return ldb_next_request(module, req);
3062 tmp_ctx = talloc_new(ldb);
3065 return LDB_ERR_OPERATIONS_ERROR;
3068 schema = dsdb_get_schema(ldb, tmp_ctx);
3070 talloc_free(tmp_ctx);
3071 return LDB_ERR_OPERATIONS_ERROR;
3074 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
3076 /* we need the complete msg off disk, so we can work out which
3077 attributes need to be removed */
3078 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
3079 DSDB_FLAG_NEXT_MODULE |
3080 DSDB_SEARCH_SHOW_RECYCLED |
3081 DSDB_SEARCH_REVEAL_INTERNALS |
3082 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
3083 if (ret != LDB_SUCCESS) {
3084 ldb_asprintf_errstring(ldb_module_get_ctx(module),
3085 "repmd_delete: Failed to %s %s, because we failed to find it: %s",
3086 re_delete ? "re-delete" : "delete",
3087 ldb_dn_get_linearized(old_dn),
3088 ldb_errstring(ldb_module_get_ctx(module)));
3089 talloc_free(tmp_ctx);
3092 old_msg = res->msgs[0];
3094 replmd_deletion_state(module, old_msg,
3096 &next_deletion_state);
3098 /* This supports us noticing an incoming isDeleted and acting on it */
3100 SMB_ASSERT(deletion_state > OBJECT_NOT_DELETED);
3101 next_deletion_state = deletion_state;
3104 if (next_deletion_state == OBJECT_REMOVED) {
3106 * We have to prevent objects being deleted, even if
3107 * the administrator really wants them gone, as
3108 * without the tombstone, we can get a partial object
3109 * from the other DC, causing havoc.
3111 * The only other valid case is when the 180 day
3112 * timeout has expired, when relax is specified.
3114 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
3115 /* it is already deleted - really remove it this time */
3116 talloc_free(tmp_ctx);
3117 return ldb_next_request(module, req);
3120 ldb_asprintf_errstring(ldb, "Refusing to delete tombstone object %s. "
3121 "This check is to prevent corruption of the replicated state.",
3122 ldb_dn_get_linearized(old_msg->dn));
3123 return LDB_ERR_UNWILLING_TO_PERFORM;
3126 rdn_name = ldb_dn_get_rdn_name(old_dn);
3127 rdn_value = ldb_dn_get_rdn_val(old_dn);
3128 if ((rdn_name == NULL) || (rdn_value == NULL)) {
3129 talloc_free(tmp_ctx);
3130 return ldb_operr(ldb);
3133 msg = ldb_msg_new(tmp_ctx);
3135 ldb_module_oom(module);
3136 talloc_free(tmp_ctx);
3137 return LDB_ERR_OPERATIONS_ERROR;
3142 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
3143 disallow_move_on_delete =
3144 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
3145 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
3147 /* work out where we will be renaming this object to */
3148 if (!disallow_move_on_delete) {
3149 struct ldb_dn *deleted_objects_dn;
3150 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
3151 &deleted_objects_dn);
3154 * We should not move objects if we can't find the
3155 * deleted objects DN. Not moving (or otherwise
3156 * harming) the Deleted Objects DN itself is handled
3159 if (re_delete && (ret != LDB_SUCCESS)) {
3160 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
3161 if (new_dn == NULL) {
3162 ldb_module_oom(module);
3163 talloc_free(tmp_ctx);
3164 return LDB_ERR_OPERATIONS_ERROR;
3166 } else if (ret != LDB_SUCCESS) {
3167 /* this is probably an attempted delete on a partition
3168 * that doesn't allow delete operations, such as the
3169 * schema partition */
3170 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
3171 ldb_dn_get_linearized(old_dn));
3172 talloc_free(tmp_ctx);
3173 return LDB_ERR_UNWILLING_TO_PERFORM;
3175 new_dn = deleted_objects_dn;
3178 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
3179 if (new_dn == NULL) {
3180 ldb_module_oom(module);
3181 talloc_free(tmp_ctx);
3182 return LDB_ERR_OPERATIONS_ERROR;
3186 if (deletion_state == OBJECT_NOT_DELETED) {
3187 /* get the objects GUID from the search we just did */
3188 guid = samdb_result_guid(old_msg, "objectGUID");
3190 /* Add a formatted child */
3191 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
3193 ldb_dn_escape_value(tmp_ctx, *rdn_value),
3194 GUID_string(tmp_ctx, &guid));
3196 ldb_asprintf_errstring(ldb, __location__
3197 ": Unable to add a formatted child to dn: %s",
3198 ldb_dn_get_linearized(new_dn));
3199 talloc_free(tmp_ctx);
3200 return LDB_ERR_OPERATIONS_ERROR;
3203 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
3204 if (ret != LDB_SUCCESS) {
3205 ldb_asprintf_errstring(ldb, __location__
3206 ": Failed to add isDeleted string to the msg");
3207 talloc_free(tmp_ctx);
3210 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3213 * No matter what has happened with other renames etc, try again to
3214 * get this to be under the deleted DN. See MS-DRSR 5.160 RemoveObj
3217 struct ldb_dn *rdn = ldb_dn_copy(tmp_ctx, old_dn);
3218 retb = ldb_dn_remove_base_components(rdn, ldb_dn_get_comp_num(rdn) - 1);
3220 ldb_asprintf_errstring(ldb, __location__
3221 ": Unable to add a prepare rdn of %s",
3222 ldb_dn_get_linearized(rdn));
3223 talloc_free(tmp_ctx);
3224 return LDB_ERR_OPERATIONS_ERROR;
3226 SMB_ASSERT(ldb_dn_get_comp_num(rdn) == 1);
3228 retb = ldb_dn_add_child(new_dn, rdn);
3230 ldb_asprintf_errstring(ldb, __location__
3231 ": Unable to add rdn %s to base dn: %s",
3232 ldb_dn_get_linearized(rdn),
3233 ldb_dn_get_linearized(new_dn));
3234 talloc_free(tmp_ctx);
3235 return LDB_ERR_OPERATIONS_ERROR;
3240 now we need to modify the object in the following ways:
3242 - add isDeleted=TRUE
3243 - update rDN and name, with new rDN
3244 - remove linked attributes
3245 - remove objectCategory and sAMAccountType
3246 - remove attribs not on the preserved list
3247 - preserved if in above list, or is rDN
3248 - remove all linked attribs from this object
3249 - remove all links from other objects to this object
3250 - add lastKnownParent
3251 - update replPropertyMetaData?
3253 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
3256 if (deletion_state == OBJECT_NOT_DELETED) {
3257 struct ldb_dn *parent_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
3258 char *parent_dn_str = NULL;
3260 /* we need the storage form of the parent GUID */
3261 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
3263 DSDB_FLAG_NEXT_MODULE |
3264 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3265 DSDB_SEARCH_REVEAL_INTERNALS|
3266 DSDB_SEARCH_SHOW_RECYCLED, req);
3267 if (ret != LDB_SUCCESS) {
3268 ldb_asprintf_errstring(ldb_module_get_ctx(module),
3269 "repmd_delete: Failed to %s %s, "
3270 "because we failed to find it's parent (%s): %s",
3271 re_delete ? "re-delete" : "delete",
3272 ldb_dn_get_linearized(old_dn),
3273 ldb_dn_get_linearized(parent_dn),
3274 ldb_errstring(ldb_module_get_ctx(module)));
3275 talloc_free(tmp_ctx);
3280 * Now we can use the DB version,
3281 * it will have the extended DN info in it
3283 parent_dn = parent_res->msgs[0]->dn;
3284 parent_dn_str = ldb_dn_get_extended_linearized(tmp_ctx,
3287 if (parent_dn_str == NULL) {
3288 talloc_free(tmp_ctx);
3289 return ldb_module_oom(module);
3292 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3294 if (ret != LDB_SUCCESS) {
3295 ldb_asprintf_errstring(ldb, __location__
3296 ": Failed to add lastKnownParent "
3297 "string when deleting %s",
3298 ldb_dn_get_linearized(old_dn));
3299 talloc_free(tmp_ctx);
3302 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3304 if (next_deletion_state == OBJECT_DELETED) {
3305 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
3306 if (ret != LDB_SUCCESS) {
3307 ldb_asprintf_errstring(ldb, __location__
3308 ": Failed to add msDS-LastKnownRDN "
3309 "string when deleting %s",
3310 ldb_dn_get_linearized(old_dn));
3311 talloc_free(tmp_ctx);
3314 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3318 switch (next_deletion_state) {
3320 case OBJECT_RECYCLED:
3321 case OBJECT_TOMBSTONE:
3324 * MS-ADTS 3.1.1.5.5.1.1 Tombstone Requirements
3325 * describes what must be removed from a tombstone
3328 * MS-ADTS 3.1.1.5.5.1.3 Recycled-Object Requirements
3329 * describes what must be removed from a recycled
3335 * we also mark it as recycled, meaning this object can't be
3336 * recovered (we are stripping its attributes).
3337 * This is done only if we have this schema object of course ...
3338 * This behavior is identical to the one of Windows 2008R2 which
3339 * always set the isRecycled attribute, even if the recycle-bin is
3340 * not activated and what ever the forest level is.
3342 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3343 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3344 if (ret != LDB_SUCCESS) {
3345 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3346 ldb_module_oom(module);
3347 talloc_free(tmp_ctx);
3350 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3353 /* work out which of the old attributes we will be removing */
3354 for (i=0; i<old_msg->num_elements; i++) {
3355 const struct dsdb_attribute *sa;
3356 el = &old_msg->elements[i];
3357 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3359 talloc_free(tmp_ctx);
3360 return LDB_ERR_OPERATIONS_ERROR;
3362 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3363 /* don't remove the rDN */
3366 if (sa->linkID && (sa->linkID & 1)) {
3368 we have a backlink in this object
3369 that needs to be removed. We're not
3370 allowed to remove it directly
3371 however, so we instead setup a
3372 modify to delete the corresponding
3375 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3376 if (ret != LDB_SUCCESS) {
3377 const char *old_dn_str
3378 = ldb_dn_get_linearized(old_dn);
3379 ldb_asprintf_errstring(ldb,
3381 ": Failed to remove backlink of "
3382 "%s when deleting %s",
3385 talloc_free(tmp_ctx);
3386 return LDB_ERR_OPERATIONS_ERROR;
3388 /* now we continue, which means we
3389 won't remove this backlink
3395 if (ldb_attr_in_list(preserved_attrs, el->name)) {
3398 if (sa->searchFlags & SEARCH_FLAG_PRESERVEONDELETE) {
3402 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3403 if (ret != LDB_SUCCESS) {
3404 talloc_free(tmp_ctx);
3405 ldb_module_oom(module);
3412 case OBJECT_DELETED:
3414 * MS-ADTS 3.1.1.5.5.1.2 Deleted-Object Requirements
3415 * describes what must be removed from a deleted
3419 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3420 if (ret != LDB_SUCCESS) {
3421 talloc_free(tmp_ctx);
3422 ldb_module_oom(module);
3426 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3427 if (ret != LDB_SUCCESS) {
3428 talloc_free(tmp_ctx);
3429 ldb_module_oom(module);
3439 if (deletion_state == OBJECT_NOT_DELETED) {
3440 const struct dsdb_attribute *sa;
3442 /* work out what the new rdn value is, for updating the
3443 rDN and name fields */
3444 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3445 if (new_rdn_value == NULL) {
3446 talloc_free(tmp_ctx);
3447 return ldb_operr(ldb);
3450 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3452 talloc_free(tmp_ctx);
3453 return LDB_ERR_OPERATIONS_ERROR;
3456 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3458 if (ret != LDB_SUCCESS) {
3459 talloc_free(tmp_ctx);
3462 el->flags = LDB_FLAG_MOD_REPLACE;
3464 el = ldb_msg_find_element(old_msg, "name");
3466 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3467 if (ret != LDB_SUCCESS) {
3468 talloc_free(tmp_ctx);
3471 el->flags = LDB_FLAG_MOD_REPLACE;
3476 * TODO: Per MS-DRSR 5.160 RemoveObj we should remove links directly, not as an originating update!
3481 * No matter what has happned with other renames, try again to
3482 * get this to be under the deleted DN.
3484 if (strcmp(ldb_dn_get_linearized(old_dn), ldb_dn_get_linearized(new_dn)) != 0) {
3485 /* now rename onto the new DN */
3486 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3487 if (ret != LDB_SUCCESS){
3488 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3489 ldb_dn_get_linearized(old_dn),
3490 ldb_dn_get_linearized(new_dn),
3491 ldb_errstring(ldb)));
3492 talloc_free(tmp_ctx);
3498 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3499 if (ret != LDB_SUCCESS) {
3500 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3501 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3502 talloc_free(tmp_ctx);
3506 talloc_free(tmp_ctx);
3508 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3511 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
3513 return replmd_delete_internals(module, req, false);
3517 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3522 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3524 int ret = LDB_ERR_OTHER;
3525 /* TODO: do some error mapping */
3527 /* Let the caller know the full WERROR */
3528 ar->objs->error = status;
3534 static struct replPropertyMetaData1 *
3535 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3536 enum drsuapi_DsAttributeId attid)
3539 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3541 for (i = 0; i < rpmd_ctr->count; i++) {
3542 if (rpmd_ctr->array[i].attid == attid) {
3543 return &rpmd_ctr->array[i];
3551 return true if an update is newer than an existing entry
3552 see section 5.11 of MS-ADTS
3554 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3555 const struct GUID *update_invocation_id,
3556 uint32_t current_version,
3557 uint32_t update_version,
3558 NTTIME current_change_time,
3559 NTTIME update_change_time)
3561 if (update_version != current_version) {
3562 return update_version > current_version;
3564 if (update_change_time != current_change_time) {
3565 return update_change_time > current_change_time;
3567 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3570 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3571 struct replPropertyMetaData1 *new_m)
3573 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3574 &new_m->originating_invocation_id,
3577 cur_m->originating_change_time,
3578 new_m->originating_change_time);
3581 static bool replmd_replPropertyMetaData1_new_should_be_taken(uint32_t dsdb_repl_flags,
3582 struct replPropertyMetaData1 *cur_m,
3583 struct replPropertyMetaData1 *new_m)
3588 * If the new replPropertyMetaData entry for this attribute is
3589 * not provided (this happens in the case where we look for
3590 * ATTID_name, but the name was not changed), then the local
3591 * state is clearly still current, as the remote
3592 * server didn't send it due to being older the high watermark
3595 if (new_m == NULL) {
3599 if (dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
3601 * if we compare equal then do an
3602 * update. This is used when a client
3603 * asks for a FULL_SYNC, and can be
3604 * used to recover a corrupt
3607 * This call is a bit tricky, what we
3608 * are doing it turning the 'is_newer'
3609 * call into a 'not is older' by
3610 * swapping cur_m and new_m, and negating the
3613 cmp = !replmd_replPropertyMetaData1_is_newer(new_m,
3616 cmp = replmd_replPropertyMetaData1_is_newer(cur_m,
3626 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3628 const struct ldb_val *rdn_val;
3629 const char *rdn_name;
3630 struct ldb_dn *new_dn;
3632 rdn_val = ldb_dn_get_rdn_val(dn);
3633 rdn_name = ldb_dn_get_rdn_name(dn);
3634 if (!rdn_val || !rdn_name) {
3638 new_dn = ldb_dn_copy(mem_ctx, dn);
3643 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3647 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3649 ldb_dn_escape_value(new_dn, *rdn_val),
3650 GUID_string(new_dn, guid))) {
3659 perform a modify operation which sets the rDN and name attributes to
3660 their current values. This has the effect of changing these
3661 attributes to have been last updated by the current DC. This is
3662 needed to ensure that renames performed as part of conflict
3663 resolution are propogated to other DCs
3665 static int replmd_name_modify(struct replmd_replicated_request *ar,
3666 struct ldb_request *req, struct ldb_dn *dn)
3668 struct ldb_message *msg;
3669 const char *rdn_name;
3670 const struct ldb_val *rdn_val;
3671 const struct dsdb_attribute *rdn_attr;
3674 msg = ldb_msg_new(req);
3680 rdn_name = ldb_dn_get_rdn_name(dn);
3681 if (rdn_name == NULL) {
3685 /* normalize the rdn attribute name */
3686 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3687 if (rdn_attr == NULL) {
3690 rdn_name = rdn_attr->lDAPDisplayName;
3692 rdn_val = ldb_dn_get_rdn_val(dn);
3693 if (rdn_val == NULL) {
3697 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3700 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3703 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3706 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3710 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3711 if (ret != LDB_SUCCESS) {
3712 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3713 ldb_dn_get_linearized(dn),
3714 ldb_errstring(ldb_module_get_ctx(ar->module))));
3724 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3725 ldb_dn_get_linearized(dn)));
3726 return LDB_ERR_OPERATIONS_ERROR;
3731 callback for conflict DN handling where we have renamed the incoming
3732 record. After renaming it, we need to ensure the change of name and
3733 rDN for the incoming record is seen as an originating update by this DC.
3735 This also handles updating lastKnownParent for entries sent to lostAndFound
3737 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3739 struct replmd_replicated_request *ar =
3740 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3741 struct ldb_dn *conflict_dn = NULL;
3744 if (ares->error != LDB_SUCCESS) {
3745 /* call the normal callback for everything except success */
3746 return replmd_op_callback(req, ares);
3749 switch (req->operation) {
3751 conflict_dn = req->op.add.message->dn;
3754 conflict_dn = req->op.mod.message->dn;
3757 smb_panic("replmd_op_name_modify_callback called in unknown circumstances");
3760 /* perform a modify of the rDN and name of the record */
3761 ret = replmd_name_modify(ar, req, conflict_dn);
3762 if (ret != LDB_SUCCESS) {
3764 return replmd_op_callback(req, ares);
3767 if (ar->objs->objects[ar->index_current].last_known_parent) {
3768 struct ldb_message *msg = ldb_msg_new(req);
3770 ldb_module_oom(ar->module);
3771 return LDB_ERR_OPERATIONS_ERROR;
3774 msg->dn = req->op.add.message->dn;
3776 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3777 ldb_dn_get_extended_linearized(msg, ar->objs->objects[ar->index_current].last_known_parent, 1));
3778 if (ret != LDB_SUCCESS) {
3779 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3780 ldb_module_oom(ar->module);
3783 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
3785 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3786 if (ret != LDB_SUCCESS) {
3787 DEBUG(0,(__location__ ": Failed to modify lastKnownParent of lostAndFound DN '%s' - %s",
3788 ldb_dn_get_linearized(msg->dn),
3789 ldb_errstring(ldb_module_get_ctx(ar->module))));
3795 return replmd_op_callback(req, ares);
3799 callback for replmd_replicated_apply_add()
3800 This copes with the creation of conflict records in the case where
3801 the DN exists, but with a different objectGUID
3803 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3805 struct ldb_dn *conflict_dn;
3806 struct replmd_replicated_request *ar =
3807 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3808 struct ldb_result *res;
3809 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3811 const struct ldb_val *omd_value;
3812 struct replPropertyMetaDataBlob omd, *rmd;
3813 enum ndr_err_code ndr_err;
3814 bool rename_incoming_record, rodc;
3815 struct replPropertyMetaData1 *rmd_name, *omd_name;
3816 struct ldb_message *msg;
3817 struct ldb_request *down_req = NULL;
3819 /* call the normal callback for success */
3820 if (ares->error == LDB_SUCCESS) {
3821 return callback(req, ares);
3825 * we have a conflict, and need to decide if we will keep the
3826 * new record or the old record
3829 msg = ar->objs->objects[ar->index_current].msg;
3830 conflict_dn = msg->dn;
3832 /* For failures other than conflicts, fail the whole operation here */
3833 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3834 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to locally apply remote add of %s: %s",
3835 ldb_dn_get_linearized(conflict_dn),
3836 ldb_errstring(ldb_module_get_ctx(ar->module)));
3838 return ldb_module_done(ar->req, NULL, NULL,
3839 LDB_ERR_OPERATIONS_ERROR);
3842 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3843 if (ret != LDB_SUCCESS) {
3844 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to determine if we are an RODC when attempting to form conflict DN: %s", ldb_errstring(ldb_module_get_ctx(ar->module)));
3845 return ldb_module_done(ar->req, NULL, NULL,
3846 LDB_ERR_OPERATIONS_ERROR);
3852 * We are on an RODC, or were a GC for this
3853 * partition, so we have to fail this until
3854 * someone who owns the partition sorts it
3857 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3858 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3859 " - We must fail the operation until a master for this partition resolves the conflict",
3860 ldb_dn_get_linearized(conflict_dn));
3865 * first we need the replPropertyMetaData attribute from the
3866 * local, conflicting record
3868 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3870 DSDB_FLAG_NEXT_MODULE |
3871 DSDB_SEARCH_SHOW_DELETED |
3872 DSDB_SEARCH_SHOW_RECYCLED, req);
3873 if (ret != LDB_SUCCESS) {
3874 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3875 ldb_dn_get_linearized(conflict_dn)));
3879 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3880 if (omd_value == NULL) {
3881 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3882 ldb_dn_get_linearized(conflict_dn)));
3886 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3887 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3888 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3889 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3890 ldb_dn_get_linearized(conflict_dn)));
3894 rmd = ar->objs->objects[ar->index_current].meta_data;
3897 * we decide which is newer based on the RPMD on the name
3898 * attribute. See [MS-DRSR] ResolveNameConflict.
3900 * We expect omd_name to be present, as this is from a local
3901 * search, but while rmd_name should have been given to us by
3902 * the remote server, if it is missing we just prefer the
3904 * replmd_replPropertyMetaData1_new_should_be_taken()
3906 rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3907 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3909 DEBUG(0,(__location__ ": Failed to find name attribute in local LDB replPropertyMetaData for %s\n",
3910 ldb_dn_get_linearized(conflict_dn)));
3915 * Should we preserve the current record, and so rename the
3916 * incoming record to be a conflict?
3918 rename_incoming_record
3919 = !replmd_replPropertyMetaData1_new_should_be_taken(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING,
3920 omd_name, rmd_name);
3922 if (rename_incoming_record) {
3924 struct ldb_dn *new_dn;
3926 guid = samdb_result_guid(msg, "objectGUID");
3927 if (GUID_all_zero(&guid)) {
3928 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3929 ldb_dn_get_linearized(conflict_dn)));
3932 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3933 if (new_dn == NULL) {
3934 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3935 ldb_dn_get_linearized(conflict_dn)));
3939 DEBUG(2,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3940 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3942 /* re-submit the request, but with the new DN */
3943 callback = replmd_op_name_modify_callback;
3946 /* we are renaming the existing record */
3948 struct ldb_dn *new_dn;
3950 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3951 if (GUID_all_zero(&guid)) {
3952 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3953 ldb_dn_get_linearized(conflict_dn)));
3957 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3958 if (new_dn == NULL) {
3959 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3960 ldb_dn_get_linearized(conflict_dn)));
3964 DEBUG(2,(__location__ ": Resolving conflict record via existing-record rename '%s' -> '%s'\n",
3965 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3967 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3968 DSDB_FLAG_OWN_MODULE, req);
3969 if (ret != LDB_SUCCESS) {
3970 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3971 ldb_dn_get_linearized(conflict_dn),
3972 ldb_dn_get_linearized(new_dn),
3973 ldb_errstring(ldb_module_get_ctx(ar->module))));
3978 * now we need to ensure that the rename is seen as an
3979 * originating update. We do that with a modify.
3981 ret = replmd_name_modify(ar, req, new_dn);
3982 if (ret != LDB_SUCCESS) {
3986 DEBUG(2,(__location__ ": With conflicting record renamed, re-apply replicated creation of '%s'\n",
3987 ldb_dn_get_linearized(req->op.add.message->dn)));
3990 ret = ldb_build_add_req(&down_req,
3991 ldb_module_get_ctx(ar->module),
3998 if (ret != LDB_SUCCESS) {
4001 LDB_REQ_SET_LOCATION(down_req);
4003 /* current partition control needed by "repmd_op_callback" */
4004 ret = ldb_request_add_control(down_req,
4005 DSDB_CONTROL_CURRENT_PARTITION_OID,
4007 if (ret != LDB_SUCCESS) {
4008 return replmd_replicated_request_error(ar, ret);
4011 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
4012 /* this tells the partition module to make it a
4013 partial replica if creating an NC */
4014 ret = ldb_request_add_control(down_req,
4015 DSDB_CONTROL_PARTIAL_REPLICA,
4017 if (ret != LDB_SUCCESS) {
4018 return replmd_replicated_request_error(ar, ret);
4023 * Finally we re-run the add, otherwise the new record won't
4024 * exist, as we are here because of that exact failure!
4026 return ldb_next_request(ar->module, down_req);
4029 /* on failure make the caller get the error. This means
4030 * replication will stop with an error, but there is not much
4033 return ldb_module_done(ar->req, NULL, NULL,
4038 callback for replmd_replicated_apply_add()
4039 This copes with the creation of conflict records in the case where
4040 the DN exists, but with a different objectGUID
4042 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
4044 struct replmd_replicated_request *ar =
4045 talloc_get_type_abort(req->context, struct replmd_replicated_request);
4047 if (ar->objs->objects[ar->index_current].last_known_parent) {
4048 /* This is like a conflict DN, where we put the object in LostAndFound
4049 see MS-DRSR 4.1.10.6.10 FindBestParentObject */
4050 return replmd_op_possible_conflict_callback(req, ares, replmd_op_name_modify_callback);
4053 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
4057 this is called when a new object comes in over DRS
4059 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
4061 struct ldb_context *ldb;
4062 struct ldb_request *change_req;
4063 enum ndr_err_code ndr_err;
4064 struct ldb_message *msg;
4065 struct replPropertyMetaDataBlob *md;
4066 struct ldb_val md_value;
4069 bool remote_isDeleted = false;
4072 time_t t = time(NULL);
4073 const struct ldb_val *rdn_val;
4074 struct replmd_private *replmd_private =
4075 talloc_get_type(ldb_module_get_private(ar->module),
4076 struct replmd_private);
4077 unix_to_nt_time(&now, t);
4079 ldb = ldb_module_get_ctx(ar->module);
4080 msg = ar->objs->objects[ar->index_current].msg;
4081 md = ar->objs->objects[ar->index_current].meta_data;
4082 is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
4084 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4085 if (ret != LDB_SUCCESS) {
4086 return replmd_replicated_request_error(ar, ret);
4089 ret = dsdb_msg_add_guid(msg,
4090 &ar->objs->objects[ar->index_current].object_guid,
4092 if (ret != LDB_SUCCESS) {
4093 return replmd_replicated_request_error(ar, ret);
4096 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4097 if (ret != LDB_SUCCESS) {
4098 return replmd_replicated_request_error(ar, ret);
4101 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
4102 if (ret != LDB_SUCCESS) {
4103 return replmd_replicated_request_error(ar, ret);
4106 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4107 if (ret != LDB_SUCCESS) {
4108 return replmd_replicated_request_error(ar, ret);
4111 /* remove any message elements that have zero values */
4112 for (i=0; i<msg->num_elements; i++) {
4113 struct ldb_message_element *el = &msg->elements[i];
4115 if (el->num_values == 0) {
4116 if (ldb_attr_cmp(msg->elements[i].name, "objectClass") == 0) {
4117 ldb_asprintf_errstring(ldb, __location__
4118 ": empty objectClass sent on %s, aborting replication\n",
4119 ldb_dn_get_linearized(msg->dn));
4120 return replmd_replicated_request_error(ar, LDB_ERR_OBJECT_CLASS_VIOLATION);
4123 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
4125 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
4126 msg->num_elements--;
4133 struct GUID_txt_buf guid_txt;
4135 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
4136 DEBUG(4, ("DRS replication add message of %s:\n%s\n",
4137 GUID_buf_string(&ar->objs->objects[ar->index_current].object_guid, &guid_txt),
4142 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
4143 "isDeleted", false);
4146 * the meta data array is already sorted by the caller, except
4147 * for the RDN, which needs to be added.
4151 rdn_val = ldb_dn_get_rdn_val(msg->dn);
4152 ret = replmd_update_rpmd_rdn_attr(ldb, msg, rdn_val, NULL,
4153 md, ar, now, is_schema_nc);
4154 if (ret != LDB_SUCCESS) {
4155 ldb_asprintf_errstring(ldb, "%s: error during DRS repl ADD: %s", __func__, ldb_errstring(ldb));
4156 return replmd_replicated_request_error(ar, ret);
4159 ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &md->ctr.ctr1, msg->dn);
4160 if (ret != LDB_SUCCESS) {
4161 ldb_asprintf_errstring(ldb, "%s: error during DRS repl ADD: %s", __func__, ldb_errstring(ldb));
4162 return replmd_replicated_request_error(ar, ret);
4165 for (i=0; i < md->ctr.ctr1.count; i++) {
4166 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
4168 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
4169 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4171 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4172 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4174 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
4175 if (ret != LDB_SUCCESS) {
4176 return replmd_replicated_request_error(ar, ret);
4179 replmd_ldb_message_sort(msg, ar->schema);
4181 if (!remote_isDeleted) {
4182 ret = dsdb_module_schedule_sd_propagation(ar->module,
4183 ar->objs->partition_dn,
4185 if (ret != LDB_SUCCESS) {
4186 return replmd_replicated_request_error(ar, ret);
4190 ar->isDeleted = remote_isDeleted;
4192 ret = ldb_build_add_req(&change_req,
4198 replmd_op_add_callback,
4200 LDB_REQ_SET_LOCATION(change_req);
4201 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4203 /* current partition control needed by "repmd_op_callback" */
4204 ret = ldb_request_add_control(change_req,
4205 DSDB_CONTROL_CURRENT_PARTITION_OID,
4207 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4209 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
4210 /* this tells the partition module to make it a
4211 partial replica if creating an NC */
4212 ret = ldb_request_add_control(change_req,
4213 DSDB_CONTROL_PARTIAL_REPLICA,
4215 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4218 return ldb_next_request(ar->module, change_req);
4221 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
4222 struct ldb_reply *ares)
4224 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4225 struct replmd_replicated_request);
4229 return ldb_module_done(ar->req, NULL, NULL,
4230 LDB_ERR_OPERATIONS_ERROR);
4234 * The error NO_SUCH_OBJECT is not expected, unless the search
4235 * base is the partition DN, and that case doesn't happen here
4236 * because then we wouldn't get a parent_guid_value in any
4239 if (ares->error != LDB_SUCCESS) {
4240 return ldb_module_done(ar->req, ares->controls,
4241 ares->response, ares->error);
4244 switch (ares->type) {
4245 case LDB_REPLY_ENTRY:
4247 struct ldb_message *parent_msg = ares->message;
4248 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
4249 struct ldb_dn *parent_dn;
4252 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
4253 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
4254 /* Per MS-DRSR 4.1.10.6.10
4255 * FindBestParentObject we need to move this
4256 * new object under a deleted object to
4258 struct ldb_dn *nc_root;
4260 ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
4261 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
4262 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4263 "No suitable NC root found for %s. "
4264 "We need to move this object because parent object %s "
4265 "is deleted, but this object is not.",
4266 ldb_dn_get_linearized(msg->dn),
4267 ldb_dn_get_linearized(parent_msg->dn));
4268 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
4269 } else if (ret != LDB_SUCCESS) {
4270 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4271 "Unable to find NC root for %s: %s. "
4272 "We need to move this object because parent object %s "
4273 "is deleted, but this object is not.",
4274 ldb_dn_get_linearized(msg->dn),
4275 ldb_errstring(ldb_module_get_ctx(ar->module)),
4276 ldb_dn_get_linearized(parent_msg->dn));
4277 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
4280 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
4282 DS_GUID_LOSTANDFOUND_CONTAINER,
4284 if (ret != LDB_SUCCESS) {
4285 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4286 "Unable to find LostAndFound Container for %s "
4287 "in partition %s: %s. "
4288 "We need to move this object because parent object %s "
4289 "is deleted, but this object is not.",
4290 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
4291 ldb_errstring(ldb_module_get_ctx(ar->module)),
4292 ldb_dn_get_linearized(parent_msg->dn));
4293 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
4295 ar->objs->objects[ar->index_current].last_known_parent
4296 = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
4300 = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
4303 ar->objs->objects[ar->index_current].local_parent_dn = parent_dn;
4305 comp_num = ldb_dn_get_comp_num(msg->dn);
4307 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
4309 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
4312 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
4314 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
4318 case LDB_REPLY_REFERRAL:
4319 /* we ignore referrals */
4322 case LDB_REPLY_DONE:
4324 if (ar->objs->objects[ar->index_current].local_parent_dn == NULL) {
4325 struct GUID_txt_buf str_buf;
4326 if (ar->search_msg != NULL) {
4327 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4328 "No parent with GUID %s found for object locally known as %s",
4329 GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid, &str_buf),
4330 ldb_dn_get_linearized(ar->search_msg->dn));
4332 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4333 "No parent with GUID %s found for object remotely known as %s",
4334 GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid, &str_buf),
4335 ldb_dn_get_linearized(ar->objs->objects[ar->index_current].msg->dn));
4339 * This error code is really important, as it
4340 * is the flag back to the callers to retry
4341 * this with DRSUAPI_DRS_GET_ANC, and so get
4342 * the parent objects before the child
4345 return ldb_module_done(ar->req, NULL, NULL,
4346 replmd_replicated_request_werror(ar, WERR_DS_DRA_MISSING_PARENT));
4349 if (ar->search_msg != NULL) {
4350 ret = replmd_replicated_apply_merge(ar);
4352 ret = replmd_replicated_apply_add(ar);
4354 if (ret != LDB_SUCCESS) {
4355 return ldb_module_done(ar->req, NULL, NULL, ret);
4364 * Look for the parent object, so we put the new object in the right
4365 * place This is akin to NameObject in MS-DRSR - this routine and the
4366 * callbacks find the right parent name, and correct name for this
4370 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
4372 struct ldb_context *ldb;
4376 struct ldb_request *search_req;
4377 static const char *attrs[] = {"isDeleted", NULL};
4378 struct GUID_txt_buf guid_str_buf;
4380 ldb = ldb_module_get_ctx(ar->module);
4382 if (ar->objs->objects[ar->index_current].parent_guid == NULL) {
4383 if (ar->search_msg != NULL) {
4384 return replmd_replicated_apply_merge(ar);
4386 return replmd_replicated_apply_add(ar);
4390 tmp_str = GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid,
4393 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4394 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4396 ret = ldb_build_search_req(&search_req,
4399 ar->objs->partition_dn,
4405 replmd_replicated_apply_search_for_parent_callback,
4407 LDB_REQ_SET_LOCATION(search_req);
4409 ret = dsdb_request_add_controls(search_req,
4410 DSDB_SEARCH_SHOW_RECYCLED|
4411 DSDB_SEARCH_SHOW_DELETED|
4412 DSDB_SEARCH_SHOW_EXTENDED_DN);
4413 if (ret != LDB_SUCCESS) {
4417 return ldb_next_request(ar->module, search_req);
4421 handle renames that come in over DRS replication
4423 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
4424 struct ldb_message *msg,
4425 struct ldb_request *parent,
4429 TALLOC_CTX *tmp_ctx = talloc_new(msg);
4430 struct ldb_result *res;
4431 struct ldb_dn *conflict_dn;
4432 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
4433 const struct ldb_val *omd_value;
4434 struct replPropertyMetaDataBlob omd, *rmd;
4435 enum ndr_err_code ndr_err;
4436 bool rename_incoming_record, rodc;
4437 struct replPropertyMetaData1 *rmd_name, *omd_name;
4438 struct ldb_dn *new_dn;
4441 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
4442 ldb_dn_get_linearized(ar->search_msg->dn),
4443 ldb_dn_get_linearized(msg->dn)));
4446 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, msg->dn,
4447 DSDB_FLAG_NEXT_MODULE, ar->req);
4448 if (ret == LDB_SUCCESS) {
4449 talloc_free(tmp_ctx);
4454 if (ret != LDB_ERR_ENTRY_ALREADY_EXISTS) {
4455 talloc_free(tmp_ctx);
4456 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to locally apply remote rename from %s to %s: %s",
4457 ldb_dn_get_linearized(ar->search_msg->dn),
4458 ldb_dn_get_linearized(msg->dn),
4459 ldb_errstring(ldb_module_get_ctx(ar->module)));
4463 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
4464 if (ret != LDB_SUCCESS) {
4465 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4466 "Failed to determine if we are an RODC when attempting to form conflict DN: %s",
4467 ldb_errstring(ldb_module_get_ctx(ar->module)));
4468 return LDB_ERR_OPERATIONS_ERROR;
4471 * we have a conflict, and need to decide if we will keep the
4472 * new record or the old record
4475 conflict_dn = msg->dn;
4479 * We are on an RODC, or were a GC for this
4480 * partition, so we have to fail this until
4481 * someone who owns the partition sorts it
4484 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4485 "Conflict adding object '%s' from incoming replication but we are read only for the partition. \n"
4486 " - We must fail the operation until a master for this partition resolves the conflict",
4487 ldb_dn_get_linearized(conflict_dn));
4492 * first we need the replPropertyMetaData attribute from the
4495 ret = dsdb_module_search_dn(ar->module, tmp_ctx, &res, conflict_dn,
4497 DSDB_FLAG_NEXT_MODULE |
4498 DSDB_SEARCH_SHOW_DELETED |
4499 DSDB_SEARCH_SHOW_RECYCLED, ar->req);
4500 if (ret != LDB_SUCCESS) {
4501 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
4502 ldb_dn_get_linearized(conflict_dn)));
4506 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
4507 if (omd_value == NULL) {
4508 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
4509 ldb_dn_get_linearized(conflict_dn)));
4513 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
4514 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4515 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4516 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
4517 ldb_dn_get_linearized(conflict_dn)));
4521 rmd = ar->objs->objects[ar->index_current].meta_data;
4524 * we decide which is newer based on the RPMD on the name
4525 * attribute. See [MS-DRSR] ResolveNameConflict.
4527 * We expect omd_name to be present, as this is from a local
4528 * search, but while rmd_name should have been given to us by
4529 * the remote server, if it is missing we just prefer the
4531 * replmd_replPropertyMetaData1_new_should_be_taken()
4533 rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
4534 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
4536 DEBUG(0,(__location__ ": Failed to find name attribute in local LDB replPropertyMetaData for %s\n",
4537 ldb_dn_get_linearized(conflict_dn)));
4542 * Should we preserve the current record, and so rename the
4543 * incoming record to be a conflict?
4545 rename_incoming_record =
4546 !replmd_replPropertyMetaData1_new_should_be_taken(
4547 ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING,
4548 omd_name, rmd_name);
4550 if (rename_incoming_record) {
4552 new_dn = replmd_conflict_dn(msg, msg->dn,
4553 &ar->objs->objects[ar->index_current].object_guid);
4554 if (new_dn == NULL) {
4555 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4556 "Failed to form conflict DN for %s\n",
4557 ldb_dn_get_linearized(msg->dn));
4559 return replmd_replicated_request_werror(ar, WERR_NOMEM);
4562 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, new_dn,
4563 DSDB_FLAG_NEXT_MODULE, ar->req);
4564 if (ret != LDB_SUCCESS) {
4565 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4566 "Failed to rename incoming conflicting dn '%s' (was '%s') to '%s' - %s\n",
4567 ldb_dn_get_linearized(conflict_dn),
4568 ldb_dn_get_linearized(ar->search_msg->dn),
4569 ldb_dn_get_linearized(new_dn),
4570 ldb_errstring(ldb_module_get_ctx(ar->module)));
4571 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4579 /* we are renaming the existing record */
4581 guid = samdb_result_guid(res->msgs[0], "objectGUID");
4582 if (GUID_all_zero(&guid)) {
4583 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
4584 ldb_dn_get_linearized(conflict_dn)));
4588 new_dn = replmd_conflict_dn(tmp_ctx, conflict_dn, &guid);
4589 if (new_dn == NULL) {
4590 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
4591 ldb_dn_get_linearized(conflict_dn)));
4595 DEBUG(2,(__location__ ": Resolving conflict record via existing-record rename '%s' -> '%s'\n",
4596 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
4598 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
4599 DSDB_FLAG_OWN_MODULE, ar->req);
4600 if (ret != LDB_SUCCESS) {
4601 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
4602 ldb_dn_get_linearized(conflict_dn),
4603 ldb_dn_get_linearized(new_dn),
4604 ldb_errstring(ldb_module_get_ctx(ar->module))));
4609 * now we need to ensure that the rename is seen as an
4610 * originating update. We do that with a modify.
4612 ret = replmd_name_modify(ar, ar->req, new_dn);
4613 if (ret != LDB_SUCCESS) {
4617 DEBUG(2,(__location__ ": With conflicting record renamed, re-apply replicated rename '%s' -> '%s'\n",
4618 ldb_dn_get_linearized(ar->search_msg->dn),
4619 ldb_dn_get_linearized(msg->dn)));
4622 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, msg->dn,
4623 DSDB_FLAG_NEXT_MODULE, ar->req);
4624 if (ret != LDB_SUCCESS) {
4625 DEBUG(0,(__location__ ": After conflict resolution, failed to rename dn '%s' to '%s' - %s\n",
4626 ldb_dn_get_linearized(ar->search_msg->dn),
4627 ldb_dn_get_linearized(msg->dn),
4628 ldb_errstring(ldb_module_get_ctx(ar->module))));
4634 * On failure make the caller get the error
4635 * This means replication will stop with an error,
4636 * but there is not much else we can do. In the
4637 * LDB_ERR_ENTRY_ALREADY_EXISTS case this is exactly what is
4641 talloc_free(tmp_ctx);
4646 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
4648 struct ldb_context *ldb;
4649 struct ldb_request *change_req;
4650 enum ndr_err_code ndr_err;
4651 struct ldb_message *msg;
4652 struct replPropertyMetaDataBlob *rmd;
4653 struct replPropertyMetaDataBlob omd;
4654 const struct ldb_val *omd_value;
4655 struct replPropertyMetaDataBlob nmd;
4656 struct ldb_val nmd_value;
4657 struct GUID remote_parent_guid;
4660 unsigned int removed_attrs = 0;
4662 int (*callback)(struct ldb_request *req, struct ldb_reply *ares) = replmd_op_callback;
4663 bool isDeleted = false;
4664 bool local_isDeleted = false;
4665 bool remote_isDeleted = false;
4666 bool take_remote_isDeleted = false;
4667 bool sd_updated = false;
4668 bool renamed = false;
4669 bool is_schema_nc = false;
4671 const struct ldb_val *old_rdn, *new_rdn;
4672 struct replmd_private *replmd_private =
4673 talloc_get_type(ldb_module_get_private(ar->module),
4674 struct replmd_private);
4676 time_t t = time(NULL);
4677 unix_to_nt_time(&now, t);
4679 ldb = ldb_module_get_ctx(ar->module);
4680 msg = ar->objs->objects[ar->index_current].msg;
4682 is_schema_nc = ldb_dn_compare_base(replmd_private->schema_dn, msg->dn) == 0;
4684 rmd = ar->objs->objects[ar->index_current].meta_data;
4688 /* find existing meta data */
4689 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4691 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4692 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4693 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4694 nt_status = ndr_map_error2ntstatus(ndr_err);
4695 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4698 if (omd.version != 1) {
4699 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4704 struct GUID_txt_buf guid_txt;
4706 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4707 DEBUG(5, ("Initial DRS replication modify message of %s is:\n%s\n"
4710 GUID_buf_string(&ar->objs->objects[ar->index_current].object_guid, &guid_txt),
4712 ndr_print_struct_string(s,
4713 (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob,
4714 "existing replPropertyMetaData",
4716 ndr_print_struct_string(s,
4717 (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob,
4718 "incoming replPropertyMetaData",
4723 local_isDeleted = ldb_msg_find_attr_as_bool(ar->search_msg,
4724 "isDeleted", false);
4725 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
4726 "isDeleted", false);
4729 * Fill in the remote_parent_guid with the GUID or an all-zero
4732 if (ar->objs->objects[ar->index_current].parent_guid != NULL) {
4733 remote_parent_guid = *ar->objs->objects[ar->index_current].parent_guid;
4735 remote_parent_guid = GUID_zero();
4739 * To ensure we follow a complex rename chain around, we have
4740 * to confirm that the DN is the same (mostly to confirm the
4741 * RDN) and the parentGUID is the same.
4743 * This ensures we keep things under the correct parent, which
4744 * replmd_replicated_handle_rename() will do.
4747 if (strcmp(ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ar->search_msg->dn)) == 0
4748 && GUID_equal(&remote_parent_guid, &ar->local_parent_guid)) {
4752 * handle renames, even just by case that come in over
4753 * DRS. Changes in the parent DN don't hit us here,
4754 * because the search for a parent will clean up those
4757 * We also have already filtered out the case where
4758 * the peer has an older name to what we have (see
4759 * replmd_replicated_apply_search_callback())
4761 ret = replmd_replicated_handle_rename(ar, msg, ar->req, &renamed);
4764 if (ret != LDB_SUCCESS) {
4765 ldb_debug(ldb, LDB_DEBUG_FATAL,
4766 "replmd_replicated_request rename %s => %s failed - %s\n",
4767 ldb_dn_get_linearized(ar->search_msg->dn),
4768 ldb_dn_get_linearized(msg->dn),
4769 ldb_errstring(ldb));
4770 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4773 if (renamed == true) {
4775 * Set the callback to one that will fix up the name
4776 * metadata on the new conflict DN
4778 callback = replmd_op_name_modify_callback;
4783 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
4784 nmd.ctr.ctr1.array = talloc_array(ar,
4785 struct replPropertyMetaData1,
4786 nmd.ctr.ctr1.count);
4787 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4789 /* first copy the old meta data */
4790 for (i=0; i < omd.ctr.ctr1.count; i++) {
4791 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
4796 /* now merge in the new meta data */
4797 for (i=0; i < rmd->ctr.ctr1.count; i++) {
4800 for (j=0; j < ni; j++) {
4803 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
4807 cmp = replmd_replPropertyMetaData1_new_should_be_taken(
4808 ar->objs->dsdb_repl_flags,
4809 &nmd.ctr.ctr1.array[j],
4810 &rmd->ctr.ctr1.array[i]);
4812 /* replace the entry */
4813 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4814 if (ar->seq_num == 0) {
4815 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4816 if (ret != LDB_SUCCESS) {
4817 return replmd_replicated_request_error(ar, ret);
4820 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4821 switch (nmd.ctr.ctr1.array[j].attid) {
4822 case DRSUAPI_ATTID_ntSecurityDescriptor:
4825 case DRSUAPI_ATTID_isDeleted:
4826 take_remote_isDeleted = true;
4835 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4836 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4837 msg->elements[i-removed_attrs].name,
4838 ldb_dn_get_linearized(msg->dn),
4839 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4842 /* we don't want to apply this change so remove the attribute */
4843 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4850 if (found) continue;
4852 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4853 if (ar->seq_num == 0) {
4854 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4855 if (ret != LDB_SUCCESS) {
4856 return replmd_replicated_request_error(ar, ret);
4859 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4860 switch (nmd.ctr.ctr1.array[ni].attid) {
4861 case DRSUAPI_ATTID_ntSecurityDescriptor:
4864 case DRSUAPI_ATTID_isDeleted:
4865 take_remote_isDeleted = true;
4874 * finally correct the size of the meta_data array
4876 nmd.ctr.ctr1.count = ni;
4878 new_rdn = ldb_dn_get_rdn_val(msg->dn);
4879 old_rdn = ldb_dn_get_rdn_val(ar->search_msg->dn);
4882 ret = replmd_update_rpmd_rdn_attr(ldb, msg, new_rdn, old_rdn,
4883 &nmd, ar, now, is_schema_nc);
4884 if (ret != LDB_SUCCESS) {
4885 ldb_asprintf_errstring(ldb, "%s: error during DRS repl merge: %s", __func__, ldb_errstring(ldb));
4886 return replmd_replicated_request_error(ar, ret);
4890 * sort the new meta data array
4892 ret = replmd_replPropertyMetaDataCtr1_sort_and_verify(ldb, &nmd.ctr.ctr1, msg->dn);
4893 if (ret != LDB_SUCCESS) {
4894 ldb_asprintf_errstring(ldb, "%s: error during DRS repl merge: %s", __func__, ldb_errstring(ldb));
4899 * Work out if this object is deleted, so we can prune any extra attributes. See MS-DRSR 4.1.10.6.9
4902 * This also controls SD propagation below
4904 if (take_remote_isDeleted) {
4905 isDeleted = remote_isDeleted;
4907 isDeleted = local_isDeleted;
4910 ar->isDeleted = isDeleted;
4913 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4915 if (msg->num_elements == 0) {
4916 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4919 return replmd_replicated_apply_isDeleted(ar);
4922 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4923 ar->index_current, msg->num_elements);
4929 if (sd_updated && !isDeleted) {
4930 ret = dsdb_module_schedule_sd_propagation(ar->module,
4931 ar->objs->partition_dn,
4933 if (ret != LDB_SUCCESS) {
4934 return ldb_operr(ldb);
4938 /* create the meta data value */
4939 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4940 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4941 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4942 nt_status = ndr_map_error2ntstatus(ndr_err);
4943 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4947 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4948 * and replPopertyMetaData attributes
4950 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4951 if (ret != LDB_SUCCESS) {
4952 return replmd_replicated_request_error(ar, ret);
4954 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4955 if (ret != LDB_SUCCESS) {
4956 return replmd_replicated_request_error(ar, ret);
4958 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4959 if (ret != LDB_SUCCESS) {
4960 return replmd_replicated_request_error(ar, ret);
4963 replmd_ldb_message_sort(msg, ar->schema);
4965 /* we want to replace the old values */
4966 for (i=0; i < msg->num_elements; i++) {
4967 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4968 if (ldb_attr_cmp(msg->elements[i].name, "objectClass") == 0) {
4969 if (msg->elements[i].num_values == 0) {
4970 ldb_asprintf_errstring(ldb, __location__
4971 ": objectClass removed on %s, aborting replication\n",
4972 ldb_dn_get_linearized(msg->dn));
4973 return replmd_replicated_request_error(ar, LDB_ERR_OBJECT_CLASS_VIOLATION);
4979 struct GUID_txt_buf guid_txt;
4981 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4982 DEBUG(4, ("Final DRS replication modify message of %s:\n%s\n",
4983 GUID_buf_string(&ar->objs->objects[ar->index_current].object_guid, &guid_txt),
4988 ret = ldb_build_mod_req(&change_req,
4996 LDB_REQ_SET_LOCATION(change_req);
4997 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4999 /* current partition control needed by "repmd_op_callback" */
5000 ret = ldb_request_add_control(change_req,
5001 DSDB_CONTROL_CURRENT_PARTITION_OID,
5003 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5005 return ldb_next_request(ar->module, change_req);
5008 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
5009 struct ldb_reply *ares)
5011 struct replmd_replicated_request *ar = talloc_get_type(req->context,
5012 struct replmd_replicated_request);
5016 return ldb_module_done(ar->req, NULL, NULL,
5017 LDB_ERR_OPERATIONS_ERROR);
5019 if (ares->error != LDB_SUCCESS &&
5020 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
5021 return ldb_module_done(ar->req, ares->controls,
5022 ares->response, ares->error);
5025 switch (ares->type) {
5026 case LDB_REPLY_ENTRY:
5027 ar->search_msg = talloc_steal(ar, ares->message);
5030 case LDB_REPLY_REFERRAL:
5031 /* we ignore referrals */
5034 case LDB_REPLY_DONE:
5036 struct replPropertyMetaData1 *md_remote;
5037 struct replPropertyMetaData1 *md_local;
5039 struct replPropertyMetaDataBlob omd;
5040 const struct ldb_val *omd_value;
5041 struct replPropertyMetaDataBlob *rmd;
5042 struct ldb_message *msg;
5044 ar->objs->objects[ar->index_current].local_parent_dn = NULL;
5045 ar->objs->objects[ar->index_current].last_known_parent = NULL;
5048 * This is the ADD case, find the appropriate parent,
5049 * as this object doesn't exist locally:
5051 if (ar->search_msg == NULL) {
5052 ret = replmd_replicated_apply_search_for_parent(ar);
5053 if (ret != LDB_SUCCESS) {
5054 return ldb_module_done(ar->req, NULL, NULL, ret);
5061 * Otherwise, in the MERGE case, work out if we are
5062 * attempting a rename, and if so find the parent the
5063 * newly renamed object wants to belong under (which
5064 * may not be the parent in it's attached string DN
5066 rmd = ar->objs->objects[ar->index_current].meta_data;
5070 /* find existing meta data */
5071 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
5073 enum ndr_err_code ndr_err;
5074 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
5075 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
5076 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5077 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
5078 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
5081 if (omd.version != 1) {
5082 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
5086 ar->local_parent_guid = samdb_result_guid(ar->search_msg, "parentGUID");
5088 instanceType = ldb_msg_find_attr_as_int(ar->search_msg, "instanceType", 0);
5089 if (((instanceType & INSTANCE_TYPE_IS_NC_HEAD) == 0)
5090 && GUID_all_zero(&ar->local_parent_guid)) {
5091 DEBUG(0, ("Refusing to replicate new version of %s "
5092 "as local object has an all-zero parentGUID attribute, "
5093 "despite not being an NC root\n",
5094 ldb_dn_get_linearized(ar->search_msg->dn)));
5095 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
5099 * now we need to check for double renames. We could have a
5100 * local rename pending which our replication partner hasn't
5101 * received yet. We choose which one wins by looking at the
5102 * attribute stamps on the two objects, the newer one wins.
5104 * This also simply applies the correct algorithms for
5105 * determining if a change was made to name at all, or
5106 * if the object has just been renamed under the same
5109 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
5110 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
5112 DEBUG(0,(__location__ ": Failed to find name attribute in local LDB replPropertyMetaData for %s\n",
5113 ldb_dn_get_linearized(ar->search_msg->dn)));
5114 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
5118 * if there is no name attribute given then we have to assume the
5119 * object we've received has the older name
5121 if (replmd_replPropertyMetaData1_new_should_be_taken(
5122 ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING,
5123 md_local, md_remote)) {
5124 struct GUID_txt_buf p_guid_local;
5125 struct GUID_txt_buf p_guid_remote;
5126 msg = ar->objs->objects[ar->index_current].msg;
5128 /* Merge on the existing object, with rename */
5130 DEBUG(4,(__location__ ": Looking for new parent for object %s currently under %s "
5131 "as incoming object changing to %s under %s\n",
5132 ldb_dn_get_linearized(ar->search_msg->dn),
5133 GUID_buf_string(&ar->local_parent_guid, &p_guid_local),
5134 ldb_dn_get_linearized(msg->dn),
5135 GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid,
5137 ret = replmd_replicated_apply_search_for_parent(ar);
5139 struct GUID_txt_buf p_guid_local;
5140 struct GUID_txt_buf p_guid_remote;
5141 msg = ar->objs->objects[ar->index_current].msg;
5144 * Merge on the existing object, force no
5145 * rename (code below just to explain why in
5149 if (strcmp(ldb_dn_get_linearized(ar->search_msg->dn),
5150 ldb_dn_get_linearized(msg->dn)) == 0) {
5151 if (ar->objs->objects[ar->index_current].parent_guid != NULL &&
5152 GUID_equal(&ar->local_parent_guid,
5153 ar->objs->objects[ar->index_current].parent_guid)
5155 DEBUG(4,(__location__ ": Keeping object %s at under %s "
5156 "despite incoming object changing parent to %s\n",
5157 ldb_dn_get_linearized(ar->search_msg->dn),
5158 GUID_buf_string(&ar->local_parent_guid, &p_guid_local),
5159 GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid,
5163 DEBUG(4,(__location__ ": Keeping object %s at under %s "
5164 " and rejecting older rename to %s under %s\n",
5165 ldb_dn_get_linearized(ar->search_msg->dn),
5166 GUID_buf_string(&ar->local_parent_guid, &p_guid_local),
5167 ldb_dn_get_linearized(msg->dn),
5168 GUID_buf_string(ar->objs->objects[ar->index_current].parent_guid,
5172 * This assignment ensures that the strcmp()
5173 * and GUID_equal() calls in
5174 * replmd_replicated_apply_merge() avoids the
5177 ar->objs->objects[ar->index_current].parent_guid =
5178 &ar->local_parent_guid;
5180 msg->dn = ar->search_msg->dn;
5181 ret = replmd_replicated_apply_merge(ar);
5183 if (ret != LDB_SUCCESS) {
5184 return ldb_module_done(ar->req, NULL, NULL, ret);
5193 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
5195 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
5197 struct ldb_context *ldb;
5201 struct ldb_request *search_req;
5202 static const char *attrs[] = { "*", "parentGUID", "instanceType",
5203 "replPropertyMetaData", "nTSecurityDescriptor",
5205 struct GUID_txt_buf guid_str_buf;
5207 if (ar->index_current >= ar->objs->num_objects) {
5208 /* done with it, go to next stage */
5209 return replmd_replicated_uptodate_vector(ar);
5212 ldb = ldb_module_get_ctx(ar->module);
5213 ar->search_msg = NULL;
5214 ar->isDeleted = false;
5216 tmp_str = GUID_buf_string(&ar->objs->objects[ar->index_current].object_guid,
5219 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
5220 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5222 ret = ldb_build_search_req(&search_req,
5225 ar->objs->partition_dn,
5231 replmd_replicated_apply_search_callback,
5233 LDB_REQ_SET_LOCATION(search_req);
5235 ret = dsdb_request_add_controls(search_req, DSDB_SEARCH_SHOW_RECYCLED);
5237 if (ret != LDB_SUCCESS) {
5241 return ldb_next_request(ar->module, search_req);
5245 * This is essentially a wrapper for replmd_replicated_apply_next()
5247 * This is needed to ensure that both codepaths call this handler.
5249 static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar)
5251 struct ldb_dn *deleted_objects_dn;
5252 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
5253 int ret = dsdb_get_deleted_objects_dn(ldb_module_get_ctx(ar->module), msg, msg->dn,
5254 &deleted_objects_dn);
5255 if (ar->isDeleted && (ret != LDB_SUCCESS || ldb_dn_compare(msg->dn, deleted_objects_dn) != 0)) {
5257 * Do a delete here again, so that if there is
5258 * anything local that conflicts with this
5259 * object being deleted, it is removed. This
5260 * includes links. See MS-DRSR 4.1.10.6.9
5263 * If the object is already deleted, and there
5264 * is no more work required, it doesn't do
5268 /* This has been updated to point to the DN we eventually did the modify on */
5270 struct ldb_request *del_req;
5271 struct ldb_result *res;
5273 TALLOC_CTX *tmp_ctx = talloc_new(ar);
5275 ret = ldb_oom(ldb_module_get_ctx(ar->module));
5279 res = talloc_zero(tmp_ctx, struct ldb_result);
5281 ret = ldb_oom(ldb_module_get_ctx(ar->module));
5282 talloc_free(tmp_ctx);
5286 /* Build a delete request, which hopefully will artually turn into nothing */
5287 ret = ldb_build_del_req(&del_req, ldb_module_get_ctx(ar->module), tmp_ctx,
5291 ldb_modify_default_callback,
5293 LDB_REQ_SET_LOCATION(del_req);
5294 if (ret != LDB_SUCCESS) {
5295 talloc_free(tmp_ctx);
5300 * This is the guts of the call, call back
5301 * into our delete code, but setting the
5302 * re_delete flag so we delete anything that
5303 * shouldn't be there on a deleted or recycled
5306 ret = replmd_delete_internals(ar->module, del_req, true);
5307 if (ret == LDB_SUCCESS) {
5308 ret = ldb_wait(del_req->handle, LDB_WAIT_ALL);
5311 talloc_free(tmp_ctx);
5312 if (ret != LDB_SUCCESS) {
5317 ar->index_current++;
5318 return replmd_replicated_apply_next(ar);
5321 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
5322 struct ldb_reply *ares)
5324 struct ldb_context *ldb;
5325 struct replmd_replicated_request *ar = talloc_get_type(req->context,
5326 struct replmd_replicated_request);
5327 ldb = ldb_module_get_ctx(ar->module);
5330 return ldb_module_done(ar->req, NULL, NULL,
5331 LDB_ERR_OPERATIONS_ERROR);
5333 if (ares->error != LDB_SUCCESS) {
5334 return ldb_module_done(ar->req, ares->controls,
5335 ares->response, ares->error);
5338 if (ares->type != LDB_REPLY_DONE) {
5339 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
5340 return ldb_module_done(ar->req, NULL, NULL,
5341 LDB_ERR_OPERATIONS_ERROR);
5346 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
5349 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
5351 struct ldb_context *ldb;
5352 struct ldb_request *change_req;
5353 enum ndr_err_code ndr_err;
5354 struct ldb_message *msg;
5355 struct replUpToDateVectorBlob ouv;
5356 const struct ldb_val *ouv_value;
5357 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
5358 struct replUpToDateVectorBlob nuv;
5359 struct ldb_val nuv_value;
5360 struct ldb_message_element *nuv_el = NULL;
5361 struct ldb_message_element *orf_el = NULL;
5362 struct repsFromToBlob nrf;
5363 struct ldb_val *nrf_value = NULL;
5364 struct ldb_message_element *nrf_el = NULL;
5368 time_t t = time(NULL);
5371 uint32_t instanceType;
5373 ldb = ldb_module_get_ctx(ar->module);
5374 ruv = ar->objs->uptodateness_vector;
5380 unix_to_nt_time(&now, t);
5382 if (ar->search_msg == NULL) {
5383 /* this happens for a REPL_OBJ call where we are
5384 creating the target object by replicating it. The
5385 subdomain join code does this for the partition DN
5387 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
5388 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
5391 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
5392 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
5393 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
5394 ldb_dn_get_linearized(ar->search_msg->dn)));
5395 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
5399 * first create the new replUpToDateVector
5401 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
5403 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
5404 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
5405 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5406 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
5407 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
5410 if (ouv.version != 2) {
5411 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
5416 * the new uptodateness vector will at least
5417 * contain 1 entry, one for the source_dsa
5419 * plus optional values from our old vector and the one from the source_dsa
5421 nuv.ctr.ctr2.count = ouv.ctr.ctr2.count;
5422 if (ruv) nuv.ctr.ctr2.count += ruv->count;
5423 nuv.ctr.ctr2.cursors = talloc_array(ar,
5424 struct drsuapi_DsReplicaCursor2,
5425 nuv.ctr.ctr2.count);
5426 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5428 /* first copy the old vector */
5429 for (i=0; i < ouv.ctr.ctr2.count; i++) {
5430 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
5434 /* merge in the source_dsa vector is available */
5435 for (i=0; (ruv && i < ruv->count); i++) {
5438 if (GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
5439 &ar->our_invocation_id)) {
5443 for (j=0; j < ni; j++) {
5444 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
5445 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
5451 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
5452 nuv.ctr.ctr2.cursors[j] = ruv->cursors[i];
5457 if (found) continue;
5459 /* if it's not there yet, add it */
5460 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
5465 * finally correct the size of the cursors array
5467 nuv.ctr.ctr2.count = ni;
5472 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
5475 * create the change ldb_message
5477 msg = ldb_msg_new(ar);
5478 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5479 msg->dn = ar->search_msg->dn;
5481 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
5482 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
5483 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5484 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
5485 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
5487 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
5488 if (ret != LDB_SUCCESS) {
5489 return replmd_replicated_request_error(ar, ret);
5491 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
5494 * now create the new repsFrom value from the given repsFromTo1 structure
5498 nrf.ctr.ctr1 = *ar->objs->source_dsa;
5499 nrf.ctr.ctr1.last_attempt = now;
5500 nrf.ctr.ctr1.last_success = now;
5501 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
5504 * first see if we already have a repsFrom value for the current source dsa
5505 * if so we'll later replace this value
5507 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
5509 for (i=0; i < orf_el->num_values; i++) {
5510 struct repsFromToBlob *trf;
5512 trf = talloc(ar, struct repsFromToBlob);
5513 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5515 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
5516 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
5517 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5518 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
5519 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
5522 if (trf->version != 1) {
5523 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
5527 * we compare the source dsa objectGUID not the invocation_id
5528 * because we want only one repsFrom value per source dsa
5529 * and when the invocation_id of the source dsa has changed we don't need
5530 * the old repsFrom with the old invocation_id
5532 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
5533 &ar->objs->source_dsa->source_dsa_obj_guid)) {
5539 nrf_value = &orf_el->values[i];
5544 * copy over all old values to the new ldb_message
5546 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
5547 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5552 * if we haven't found an old repsFrom value for the current source dsa
5553 * we'll add a new value
5556 struct ldb_val zero_value;
5557 ZERO_STRUCT(zero_value);
5558 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
5559 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5561 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
5564 /* we now fill the value which is already attached to ldb_message */
5565 ndr_err = ndr_push_struct_blob(nrf_value, msg,
5567 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
5568 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
5569 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
5570 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
5574 * the ldb_message_element for the attribute, has all the old values and the new one
5575 * so we'll replace the whole attribute with all values
5577 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
5579 if (CHECK_DEBUGLVL(4)) {
5580 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
5581 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
5585 /* prepare the ldb_modify() request */
5586 ret = ldb_build_mod_req(&change_req,
5592 replmd_replicated_uptodate_modify_callback,
5594 LDB_REQ_SET_LOCATION(change_req);
5595 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5597 return ldb_next_request(ar->module, change_req);
5600 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
5601 struct ldb_reply *ares)
5603 struct replmd_replicated_request *ar = talloc_get_type(req->context,
5604 struct replmd_replicated_request);
5608 return ldb_module_done(ar->req, NULL, NULL,
5609 LDB_ERR_OPERATIONS_ERROR);
5611 if (ares->error != LDB_SUCCESS &&
5612 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
5613 return ldb_module_done(ar->req, ares->controls,
5614 ares->response, ares->error);
5617 switch (ares->type) {
5618 case LDB_REPLY_ENTRY:
5619 ar->search_msg = talloc_steal(ar, ares->message);
5622 case LDB_REPLY_REFERRAL:
5623 /* we ignore referrals */
5626 case LDB_REPLY_DONE:
5627 ret = replmd_replicated_uptodate_modify(ar);
5628 if (ret != LDB_SUCCESS) {
5629 return ldb_module_done(ar->req, NULL, NULL, ret);
5638 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
5640 struct ldb_context *ldb;
5642 static const char *attrs[] = {
5643 "replUpToDateVector",
5648 struct ldb_request *search_req;
5650 ldb = ldb_module_get_ctx(ar->module);
5651 ar->search_msg = NULL;
5653 ret = ldb_build_search_req(&search_req,
5656 ar->objs->partition_dn,
5662 replmd_replicated_uptodate_search_callback,
5664 LDB_REQ_SET_LOCATION(search_req);
5665 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5667 return ldb_next_request(ar->module, search_req);
5672 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
5674 struct ldb_context *ldb;
5675 struct dsdb_extended_replicated_objects *objs;
5676 struct replmd_replicated_request *ar;
5677 struct ldb_control **ctrls;
5680 struct replmd_private *replmd_private =
5681 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5682 struct dsdb_control_replicated_update *rep_update;
5684 ldb = ldb_module_get_ctx(module);
5686 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
5688 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
5690 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
5691 return LDB_ERR_PROTOCOL_ERROR;
5694 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
5695 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
5696 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
5697 return LDB_ERR_PROTOCOL_ERROR;
5700 ar = replmd_ctx_init(module, req);
5702 return LDB_ERR_OPERATIONS_ERROR;
5704 /* Set the flags to have the replmd_op_callback run over the full set of objects */
5705 ar->apply_mode = true;
5707 ar->schema = dsdb_get_schema(ldb, ar);
5709 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
5711 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
5712 return LDB_ERR_CONSTRAINT_VIOLATION;
5715 ctrls = req->controls;
5717 if (req->controls) {
5718 req->controls = talloc_memdup(ar, req->controls,
5719 talloc_get_size(req->controls));
5720 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5723 /* This allows layers further down to know if a change came in
5724 over replication and what the replication flags were */
5725 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
5726 if (rep_update == NULL) {
5727 return ldb_module_oom(module);
5729 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
5731 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
5732 if (ret != LDB_SUCCESS) {
5736 /* If this change contained linked attributes in the body
5737 * (rather than in the links section) we need to update
5738 * backlinks in linked_attributes */
5739 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
5740 if (ret != LDB_SUCCESS) {
5744 ar->controls = req->controls;
5745 req->controls = ctrls;
5747 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
5749 /* save away the linked attributes for the end of the
5751 for (i=0; i<ar->objs->linked_attributes_count; i++) {
5752 struct la_entry *la_entry;
5754 if (replmd_private->la_ctx == NULL) {
5755 replmd_private->la_ctx = talloc_new(replmd_private);
5757 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
5758 if (la_entry == NULL) {
5760 return LDB_ERR_OPERATIONS_ERROR;
5762 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
5763 if (la_entry->la == NULL) {
5764 talloc_free(la_entry);
5766 return LDB_ERR_OPERATIONS_ERROR;
5768 *la_entry->la = ar->objs->linked_attributes[i];
5770 /* we need to steal the non-scalars so they stay
5771 around until the end of the transaction */
5772 talloc_steal(la_entry->la, la_entry->la->identifier);
5773 talloc_steal(la_entry->la, la_entry->la->value.blob);
5775 DLIST_ADD(replmd_private->la_list, la_entry);
5778 return replmd_replicated_apply_next(ar);
5782 process one linked attribute structure
5784 static int replmd_process_linked_attribute(struct ldb_module *module,
5785 struct la_entry *la_entry,
5786 struct ldb_request *parent)
5788 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
5789 struct ldb_context *ldb = ldb_module_get_ctx(module);
5790 struct ldb_message *msg;
5791 struct ldb_message *target_msg = NULL;
5792 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
5793 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
5795 const struct dsdb_attribute *attr;
5796 struct dsdb_dn *dsdb_dn;
5797 uint64_t seq_num = 0;
5798 struct ldb_message_element *old_el;
5800 time_t t = time(NULL);
5801 struct ldb_result *res;
5802 struct ldb_result *target_res;
5803 const char *attrs[4];
5804 const char *attrs2[] = { "isDeleted", "isRecycled", NULL };
5805 struct parsed_dn *pdn_list, *pdn;
5806 struct GUID guid = GUID_zero();
5808 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
5809 const struct GUID *our_invocation_id;
5811 enum deletion_state deletion_state = OBJECT_NOT_DELETED;
5812 enum deletion_state target_deletion_state = OBJECT_NOT_DELETED;
5815 linked_attributes[0]:
5816 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
5818 identifier: struct drsuapi_DsReplicaObjectIdentifier
5819 __ndr_size : 0x0000003a (58)
5820 __ndr_size_sid : 0x00000000 (0)
5821 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
5823 __ndr_size_dn : 0x00000000 (0)
5825 attid : DRSUAPI_ATTID_member (0x1F)
5826 value: struct drsuapi_DsAttributeValue
5827 __ndr_size : 0x0000007e (126)
5829 blob : DATA_BLOB length=126
5830 flags : 0x00000001 (1)
5831 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
5832 originating_add_time : Wed Sep 2 22:20:01 2009 EST
5833 meta_data: struct drsuapi_DsReplicaMetaData
5834 version : 0x00000015 (21)
5835 originating_change_time : Wed Sep 2 23:39:07 2009 EST
5836 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
5837 originating_usn : 0x000000000001e19c (123292)
5839 (for cases where the link is to a normal DN)
5840 &target: struct drsuapi_DsReplicaObjectIdentifier3
5841 __ndr_size : 0x0000007e (126)
5842 __ndr_size_sid : 0x0000001c (28)
5843 guid : 7639e594-db75-4086-b0d4-67890ae46031
5844 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
5845 __ndr_size_dn : 0x00000022 (34)
5846 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
5849 /* find the attribute being modified */
5850 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
5852 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
5853 talloc_free(tmp_ctx);
5854 return LDB_ERR_OPERATIONS_ERROR;
5857 attrs[0] = attr->lDAPDisplayName;
5858 attrs[1] = "isDeleted";
5859 attrs[2] = "isRecycled";
5862 /* get the existing message from the db for the object with
5863 this GUID, returning attribute being modified. We will then
5864 use this msg as the basis for a modify call */
5865 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
5866 DSDB_FLAG_NEXT_MODULE |
5867 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5868 DSDB_SEARCH_SHOW_RECYCLED |
5869 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
5870 DSDB_SEARCH_REVEAL_INTERNALS,
5872 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
5873 if (ret != LDB_SUCCESS) {
5874 talloc_free(tmp_ctx);
5877 if (res->count != 1) {
5878 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
5879 GUID_string(tmp_ctx, &la->identifier->guid));
5880 talloc_free(tmp_ctx);
5881 return LDB_ERR_NO_SUCH_OBJECT;
5886 * Check for deleted objects per MS-DRSR 4.1.10.6.13
5887 * ProcessLinkValue, because link updates are not applied to
5888 * recycled and tombstone objects. We don't have to delete
5889 * any existing link, that should have happened when the
5890 * object deletion was replicated or initiated.
5893 replmd_deletion_state(module, msg, &deletion_state, NULL);
5895 if (deletion_state >= OBJECT_RECYCLED) {
5896 talloc_free(tmp_ctx);
5900 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5901 if (old_el == NULL) {
5902 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
5903 if (ret != LDB_SUCCESS) {
5904 ldb_module_oom(module);
5905 talloc_free(tmp_ctx);
5906 return LDB_ERR_OPERATIONS_ERROR;
5909 old_el->flags = LDB_FLAG_MOD_REPLACE;
5912 /* parse the existing links */
5913 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
5914 if (ret != LDB_SUCCESS) {
5915 talloc_free(tmp_ctx);
5919 /* get our invocationId */
5920 our_invocation_id = samdb_ntds_invocation_id(ldb);
5921 if (!our_invocation_id) {
5922 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
5923 talloc_free(tmp_ctx);
5924 return LDB_ERR_OPERATIONS_ERROR;
5927 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
5928 if (ret != LDB_SUCCESS) {
5929 talloc_free(tmp_ctx);
5933 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
5934 if (!W_ERROR_IS_OK(status)) {
5935 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
5936 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
5937 talloc_free(tmp_ctx);
5938 return LDB_ERR_OPERATIONS_ERROR;
5941 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
5942 if (!NT_STATUS_IS_OK(ntstatus) && !active) {
5944 * This strange behaviour (allowing a NULL/missing
5945 * GUID) originally comes from:
5947 * commit e3054ce0fe0f8f62d2f5b2a77893e7a1479128bd
5948 * Author: Andrew Tridgell <tridge@samba.org>
5949 * Date: Mon Dec 21 21:21:55 2009 +1100
5951 * s4-drs: cope better with NULL GUIDS from DRS
5953 * It is valid to get a NULL GUID over DRS for a deleted forward link. We
5954 * need to match by DN if possible when seeing if we should update an
5957 * Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
5960 ret = dsdb_module_search_dn(module, tmp_ctx, &target_res,
5961 dsdb_dn->dn, attrs2,
5962 DSDB_FLAG_NEXT_MODULE |
5963 DSDB_SEARCH_SHOW_RECYCLED |
5964 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5965 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
5967 } else if (!NT_STATUS_IS_OK(ntstatus)) {
5968 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
5970 ldb_dn_get_linearized(dsdb_dn->dn),
5971 ldb_dn_get_linearized(msg->dn));
5972 talloc_free(tmp_ctx);
5973 return LDB_ERR_OPERATIONS_ERROR;
5975 ret = dsdb_module_search(module, tmp_ctx, &target_res,
5976 NULL, LDB_SCOPE_SUBTREE,
5978 DSDB_FLAG_NEXT_MODULE |
5979 DSDB_SEARCH_SHOW_RECYCLED |
5980 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5981 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
5984 GUID_string(tmp_ctx, &guid));
5987 if (ret != LDB_SUCCESS) {
5988 ldb_asprintf_errstring(ldb_module_get_ctx(module), "Failed to re-resolve GUID %s: %s\n",
5989 GUID_string(tmp_ctx, &guid),
5990 ldb_errstring(ldb_module_get_ctx(module)));
5991 talloc_free(tmp_ctx);
5995 if (target_res->count == 0) {
5996 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
5997 GUID_string(tmp_ctx, &guid),
5998 ldb_dn_get_linearized(dsdb_dn->dn)));
5999 } else if (target_res->count != 1) {
6000 ldb_asprintf_errstring(ldb_module_get_ctx(module), "More than one object found matching objectGUID %s\n",
6001 GUID_string(tmp_ctx, &guid));
6002 talloc_free(tmp_ctx);
6003 return LDB_ERR_OPERATIONS_ERROR;
6005 target_msg = target_res->msgs[0];
6006 dsdb_dn->dn = talloc_steal(dsdb_dn, target_msg->dn);
6010 * Check for deleted objects per MS-DRSR 4.1.10.6.13
6011 * ProcessLinkValue, because link updates are not applied to
6012 * recycled and tombstone objects. We don't have to delete
6013 * any existing link, that should have happened when the
6014 * object deletion was replicated or initiated.
6016 replmd_deletion_state(module, target_msg,
6017 &target_deletion_state, NULL);
6019 if (target_deletion_state >= OBJECT_RECYCLED) {
6020 talloc_free(tmp_ctx);
6024 /* see if this link already exists */
6025 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
6027 /* see if this update is newer than what we have already */
6028 struct GUID invocation_id = GUID_zero();
6029 uint32_t version = 0;
6030 uint32_t originating_usn = 0;
6031 NTTIME change_time = 0;
6032 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
6034 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
6035 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
6036 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
6037 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
6039 if (!replmd_update_is_newer(&invocation_id,
6040 &la->meta_data.originating_invocation_id,
6042 la->meta_data.version,
6044 la->meta_data.originating_change_time)) {
6045 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
6046 old_el->name, ldb_dn_get_linearized(msg->dn),
6047 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
6048 talloc_free(tmp_ctx);
6052 /* get a seq_num for this change */
6053 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
6054 if (ret != LDB_SUCCESS) {
6055 talloc_free(tmp_ctx);
6059 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
6060 /* remove the existing backlink */
6061 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, true);
6062 if (ret != LDB_SUCCESS) {
6063 talloc_free(tmp_ctx);
6068 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
6069 &la->meta_data.originating_invocation_id,
6070 la->meta_data.originating_usn, seq_num,
6071 la->meta_data.originating_change_time,
6072 la->meta_data.version,
6074 if (ret != LDB_SUCCESS) {
6075 talloc_free(tmp_ctx);
6080 /* add the new backlink */
6081 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, true);
6082 if (ret != LDB_SUCCESS) {
6083 talloc_free(tmp_ctx);
6088 /* get a seq_num for this change */
6089 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
6090 if (ret != LDB_SUCCESS) {
6091 talloc_free(tmp_ctx);
6095 old_el->values = talloc_realloc(msg->elements, old_el->values,
6096 struct ldb_val, old_el->num_values+1);
6097 if (!old_el->values) {
6098 ldb_module_oom(module);
6099 return LDB_ERR_OPERATIONS_ERROR;
6101 old_el->num_values++;
6103 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
6104 &la->meta_data.originating_invocation_id,
6105 la->meta_data.originating_usn, seq_num,
6106 la->meta_data.originating_change_time,
6107 la->meta_data.version,
6108 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
6109 if (ret != LDB_SUCCESS) {
6110 talloc_free(tmp_ctx);
6115 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
6117 if (ret != LDB_SUCCESS) {
6118 talloc_free(tmp_ctx);
6124 /* we only change whenChanged and uSNChanged if the seq_num
6126 ret = add_time_element(msg, "whenChanged", t);
6127 if (ret != LDB_SUCCESS) {
6128 talloc_free(tmp_ctx);
6133 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
6134 if (ret != LDB_SUCCESS) {
6135 talloc_free(tmp_ctx);
6140 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
6141 if (old_el == NULL) {
6142 talloc_free(tmp_ctx);
6143 return ldb_operr(ldb);
6146 ret = dsdb_check_single_valued_link(attr, old_el);
6147 if (ret != LDB_SUCCESS) {
6148 talloc_free(tmp_ctx);
6152 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
6154 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
6155 if (ret != LDB_SUCCESS) {
6156 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
6158 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
6159 talloc_free(tmp_ctx);
6163 talloc_free(tmp_ctx);
6168 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
6170 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
6171 return replmd_extended_replicated_objects(module, req);
6174 return ldb_next_request(module, req);
6179 we hook into the transaction operations to allow us to
6180 perform the linked attribute updates at the end of the whole
6181 transaction. This allows a forward linked attribute to be created
6182 before the object is created. During a vampire, w2k8 sends us linked
6183 attributes before the objects they are part of.
6185 static int replmd_start_transaction(struct ldb_module *module)
6187 /* create our private structure for this transaction */
6188 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
6189 struct replmd_private);
6190 replmd_txn_cleanup(replmd_private);
6192 /* free any leftover mod_usn records from cancelled
6194 while (replmd_private->ncs) {
6195 struct nc_entry *e = replmd_private->ncs;
6196 DLIST_REMOVE(replmd_private->ncs, e);
6200 return ldb_next_start_trans(module);
6204 on prepare commit we loop over our queued la_context structures and
6207 static int replmd_prepare_commit(struct ldb_module *module)
6209 struct replmd_private *replmd_private =
6210 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
6211 struct la_entry *la, *prev;
6212 struct la_backlink *bl;
6215 /* walk the list backwards, to do the first entry first, as we
6216 * added the entries with DLIST_ADD() which puts them at the
6217 * start of the list */
6218 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
6219 prev = DLIST_PREV(la);
6220 DLIST_REMOVE(replmd_private->la_list, la);
6221 ret = replmd_process_linked_attribute(module, la, NULL);
6222 if (ret != LDB_SUCCESS) {
6223 replmd_txn_cleanup(replmd_private);
6228 /* process our backlink list, creating and deleting backlinks
6230 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
6231 ret = replmd_process_backlink(module, bl, NULL);
6232 if (ret != LDB_SUCCESS) {
6233 replmd_txn_cleanup(replmd_private);
6238 replmd_txn_cleanup(replmd_private);
6240 /* possibly change @REPLCHANGED */
6241 ret = replmd_notify_store(module, NULL);
6242 if (ret != LDB_SUCCESS) {
6246 return ldb_next_prepare_commit(module);
6249 static int replmd_del_transaction(struct ldb_module *module)
6251 struct replmd_private *replmd_private =
6252 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
6253 replmd_txn_cleanup(replmd_private);
6255 return ldb_next_del_trans(module);
6259 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
6260 .name = "repl_meta_data",
6261 .init_context = replmd_init,
6263 .modify = replmd_modify,
6264 .rename = replmd_rename,
6265 .del = replmd_delete,
6266 .extended = replmd_extended,
6267 .start_transaction = replmd_start_transaction,
6268 .prepare_commit = replmd_prepare_commit,
6269 .del_transaction = replmd_del_transaction,
6272 int ldb_repl_meta_data_module_init(const char *version)
6274 LDB_MODULE_CHECK_VERSION(version);
6275 return ldb_register_module(&ldb_repl_meta_data_module_ops);