source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DSGetNCChanges call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009-2010
   8    Copyright (C) Andrew Bartlett 2010-2016
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "rpc_server/dcerpc_server.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "param/param.h"
  28 #include "librpc/gen_ndr/ndr_drsblobs.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "libcli/security/security.h"
  32 #include "libcli/security/session.h"
  33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  34 #include "rpc_server/dcerpc_server_proto.h"
  35 #include "rpc_server/common/sid_helper.h"
  36 #include "../libcli/drsuapi/drsuapi.h"
  37 #include "lib/util/binsearch.h"
  38 #include "lib/util/tsort.h"
  39 #include "auth/session.h"
  40 #include "dsdb/common/util.h"
  41 #include "lib/dbwrap/dbwrap.h"
  42 #include "lib/dbwrap/dbwrap_rbt.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44
  45 #undef DBGC_CLASS
  46 #define DBGC_CLASS            DBGC_DRS_REPL
  47
  48 #define DRS_GUID_SIZE       16
  49 #define DEFAULT_MAX_OBJECTS 1000
  50 #define DEFAULT_MAX_LINKS   1500
  51
  52 /*
  53  * state of a partially-completed replication cycle. This state persists
  54  * over multiple calls to dcesrv_drsuapi_DsGetNCChanges()
  55  */
  56 struct drsuapi_getncchanges_state {
  57         struct db_context *obj_cache;
  58         struct GUID *guids;
  59         uint32_t num_records;
  60         uint32_t num_processed;
  61         struct ldb_dn *ncRoot_dn;
  62         struct GUID ncRoot_guid;
  63         bool is_schema_nc;
  64         bool is_get_anc;
  65         bool is_get_tgt;
  66         uint64_t min_usn;
  67         uint64_t max_usn;
  68         struct drsuapi_DsReplicaHighWaterMark last_hwm;
  69         struct ldb_dn *last_dn;
  70         struct drsuapi_DsReplicaHighWaterMark final_hwm;
  71         struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
  72         struct drsuapi_DsReplicaLinkedAttribute *la_list;
  73         uint32_t la_count;
  74         uint32_t la_idx;
  75
  76         /* these are just used for debugging the replication's progress */
  77         uint32_t links_given;
  78         uint32_t total_links;
  79 };
  80
  81 /* We must keep the GUIDs in NDR form for sorting */
  82 struct la_for_sorting {
  83         const struct drsuapi_DsReplicaLinkedAttribute *link;
  84         uint8_t target_guid[DRS_GUID_SIZE];
  85         uint8_t source_guid[DRS_GUID_SIZE];
  86 };
  87
  88 /*
  89  * stores the state for a chunk of replication data. This state information
  90  * only exists for a single call to dcesrv_drsuapi_DsGetNCChanges()
  91  */
  92 struct getncchanges_repl_chunk {
  93         uint32_t max_objects;
  94         uint32_t max_links;
  95         uint32_t tgt_la_count;
  96         bool immediate_link_sync;
  97         time_t max_wait;
  98         time_t start;
  99
 100         /* stores the objects to be sent in this chunk */
 101         uint32_t object_count;
 102         struct drsuapi_DsReplicaObjectListItemEx *object_list;
 103
 104         /* the last object added to this replication chunk */
 105         struct drsuapi_DsReplicaObjectListItemEx *last_object;
 106 };
 107
 108 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
 109                                               const struct drsuapi_DsReplicaHighWaterMark *h2)
 110 {
 111         if (h1->highest_usn < h2->highest_usn) {
 112                 return -1;
 113         } else if (h1->highest_usn > h2->highest_usn) {
 114                 return 1;
 115         } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
 116                 return -1;
 117         } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
 118                 return 1;
 119         } else if (h1->reserved_usn < h2->reserved_usn) {
 120                 return -1;
 121         } else if (h1->reserved_usn > h2->reserved_usn) {
 122                 return 1;
 123         }
 124
 125         return 0;
 126 }
 127
 128 /*
 129   build a DsReplicaObjectIdentifier from a ldb msg
 130  */
 131 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
 132                                                                        const struct ldb_message *msg)
 133 {
 134         struct drsuapi_DsReplicaObjectIdentifier *identifier;
 135         struct dom_sid *sid;
 136
 137         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 138         if (identifier == NULL) {
 139                 return NULL;
 140         }
 141
 142         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
 143         identifier->guid = samdb_result_guid(msg, "objectGUID");
 144
 145         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
 146         if (sid) {
 147                 identifier->sid = *sid;
 148         } else {
 149                 ZERO_STRUCT(identifier->sid);
 150         }
 151         return identifier;
 152 }
 153
 154 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
 155 {
 156         return GUID_compare(guid1, &guid2);
 157 }
 158
 159 /*
 160   see if we can filter an attribute using the uptodateness_vector
 161  */
 162 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
 163                        const struct GUID *originating_invocation_id,
 164                        uint64_t originating_usn)
 165 {
 166         const struct drsuapi_DsReplicaCursor *c;
 167         if (udv == NULL) return false;
 168         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
 169                             originating_invocation_id, udv_compare, c);
 170         if (c && originating_usn <= c->highest_usn) {
 171                 return true;
 172         }
 173         return false;
 174 }
 175
 176 static int uint32_t_cmp(uint32_t a1, uint32_t a2)
 177 {
 178         if (a1 == a2) return 0;
 179         return a1 > a2 ? 1 : -1;
 180 }
 181
 182 static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused)
 183 {
 184         if (*a1 == *a2) return 0;
 185         return *a1 > *a2 ? 1 : -1;
 186 }
 187
 188 static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema,
 189                                                  const struct dsdb_syntax_ctx *ctx,
 190                                                  enum drsuapi_DsAttributeId remote_attid_as_enum,
 191                                                  enum drsuapi_DsAttributeId *local_attid_as_enum,
 192                                                  const struct dsdb_attribute **_sa)
 193 {
 194         WERROR werr;
 195         const struct dsdb_attribute *sa = NULL;
 196
 197         if (ctx->pfm_remote == NULL) {
 198                 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
 199                 goto fail;
 200         }
 201
 202         werr = dsdb_attribute_drsuapi_remote_to_local(ctx,
 203                                                       remote_attid_as_enum,
 204                                                       local_attid_as_enum,
 205                                                       _sa);
 206         if (!W_ERROR_IS_OK(werr)) {
 207                 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
 208                 goto fail;
 209         }
 210
 211         return werr;
 212 fail:
 213
 214         sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum);
 215         if (sa == NULL) {
 216                 return WERR_DS_DRA_SCHEMA_MISMATCH;
 217         } else {
 218                 if (local_attid_as_enum != NULL) {
 219                         *local_attid_as_enum = sa->attributeID_id;
 220                 }
 221                 if (_sa != NULL) {
 222                         *_sa = sa;
 223                 }
 224                 return WERR_OK;
 225         }
 226 }
 227
 228 /*
 229  * Similar to function in repl_meta_data without the extra
 230  * dependencies.
 231  */
 232 static WERROR get_parsed_dns_trusted(TALLOC_CTX *mem_ctx, struct ldb_message_element *el,
 233                                   struct parsed_dn **pdn)
 234 {
 235         /* Here we get a list of 'struct parsed_dns' without the parsing */
 236         int i;
 237         *pdn = talloc_zero_array(mem_ctx, struct parsed_dn,
 238                                  el->num_values);
 239         if (!*pdn) {
 240                 return WERR_DS_DRA_INTERNAL_ERROR;
 241         }
 242
 243         for (i = 0; i < el->num_values; i++) {
 244                 (*pdn)[i].v = &el->values[i];
 245         }
 246
 247         return WERR_OK;
 248 }
 249
 250 static WERROR getncchanges_update_revealed_list(struct ldb_context *sam_ctx,
 251                                                 TALLOC_CTX *mem_ctx,
 252                                                 struct ldb_message **msg,
 253                                                 struct ldb_dn *object_dn,
 254                                                 const struct GUID *object_guid,
 255                                                 const struct dsdb_attribute *sa,
 256                                                 struct replPropertyMetaData1 *meta_data,
 257                                                 struct ldb_message *revealed_users)
 258 {
 259         enum ndr_err_code ndr_err;
 260         int ldb_err;
 261         char *attr_str = NULL;
 262         char *attr_hex = NULL;
 263         DATA_BLOB attr_blob;
 264         struct ldb_message_element *existing = NULL, *el_add = NULL, *el_del = NULL;
 265         const char * const * secret_attributes = ldb_get_opaque(sam_ctx, "LDB_SECRET_ATTRIBUTE_LIST");
 266
 267         if (!ldb_attr_in_list(secret_attributes,
 268                               sa->lDAPDisplayName)) {
 269                 return WERR_OK;
 270         }
 271
 272
 273         ndr_err = ndr_push_struct_blob(&attr_blob, mem_ctx, meta_data, (ndr_push_flags_fn_t)ndr_push_replPropertyMetaData1);
 274         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 275                 return WERR_DS_DRA_INTERNAL_ERROR;
 276         }
 277
 278         attr_hex = hex_encode_talloc(mem_ctx, attr_blob.data, attr_blob.length);
 279         if (attr_hex == NULL) {
 280                 return WERR_NOT_ENOUGH_MEMORY;
 281         }
 282
 283         attr_str = talloc_asprintf(mem_ctx, "B:%zd:%s:%s", attr_blob.length*2, attr_hex, ldb_dn_get_linearized(object_dn));
 284         if (attr_str == NULL) {
 285                 return WERR_NOT_ENOUGH_MEMORY;
 286         }
 287
 288         existing = ldb_msg_find_element(revealed_users, "msDS-RevealedUsers");
 289         if (existing != NULL) {
 290                 /* Replace the old value (if one exists) with the current one */
 291                 struct parsed_dn *link_dns;
 292                 struct parsed_dn *exact = NULL, *unused = NULL;
 293                 WERROR werr;
 294                 uint8_t attid[4];
 295                 DATA_BLOB partial_meta;
 296
 297                 werr = get_parsed_dns_trusted(mem_ctx, existing, &link_dns);
 298                 if (!W_ERROR_IS_OK(werr)) {
 299                         return werr;
 300                 }
 301
 302                 /* Construct a partial metadata blob to match on in the DB */
 303                 SIVAL(attid, 0, sa->attributeID_id);
 304                 partial_meta.length = 4;
 305                 partial_meta.data = attid;
 306
 307                 /* Binary search using GUID and attribute id for uniqueness */
 308                 ldb_err = parsed_dn_find(sam_ctx, link_dns, existing->num_values,
 309                                          object_guid, object_dn,
 310                                          partial_meta, 4,
 311                                          &exact, &unused,
 312                                          DSDB_SYNTAX_BINARY_DN, true);
 313
 314                 if (ldb_err != LDB_SUCCESS) {
 315                         DEBUG(0,(__location__ ": Failed parsed DN find - %s\n",
 316                                  ldb_errstring(sam_ctx)));
 317                         return WERR_DS_DRA_INTERNAL_ERROR;
 318                 }
 319
 320                 if (exact != NULL) {
 321                         /* Perform some verification of the blob */
 322                         struct replPropertyMetaData1 existing_meta_data;
 323                         ndr_err = ndr_pull_struct_blob_all_noalloc(&exact->dsdb_dn->extra_part,
 324                                                                    &existing_meta_data,
 325                                                                    (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaData1);
 326                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 327                                 return WERR_DS_DRA_INTERNAL_ERROR;
 328                         }
 329
 330                         if (existing_meta_data.attid == sa->attributeID_id) {
 331                                 ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_DELETE, &el_del);
 332                                 if (ldb_err != LDB_SUCCESS) {
 333                                         return WERR_DS_DRA_INTERNAL_ERROR;
 334                                 }
 335
 336                                 el_del->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 337                                 if (el_del->values == NULL) {
 338                                         return WERR_NOT_ENOUGH_MEMORY;
 339                                 }
 340                                 el_del->values[0] = *exact->v;
 341                                 el_del->num_values = 1;
 342                         } else {
 343                                 return WERR_DS_DRA_INTERNAL_ERROR;
 344                         }
 345                 }
 346         }
 347
 348         ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_ADD, &el_add);
 349         if (ldb_err != LDB_SUCCESS) {
 350                 return WERR_DS_DRA_INTERNAL_ERROR;
 351         }
 352
 353         el_add->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 354         if (el_add->values == NULL) {
 355                 return WERR_NOT_ENOUGH_MEMORY;
 356
 357         }
 358
 359         el_add->values[0] = data_blob_string_const(attr_str);
 360         el_add->num_values = 1;
 361
 362         return WERR_OK;
 363 }
 364
 365 /*
 366  * This function filter attributes for build_object based on the
 367  * uptodatenessvector and partial attribute set.
 368  *
 369  * Any secret attributes are forced here for REPL_SECRET, and audited at this
 370  * point with msDS-RevealedUsers.
 371  */
 372 static WERROR get_nc_changes_filter_attrs(struct drsuapi_DsReplicaObjectListItemEx *obj,
 373                                           struct replPropertyMetaDataBlob md,
 374                                           struct ldb_context *sam_ctx,
 375                                           const struct ldb_message *msg,
 376                                           const struct GUID *guid,
 377                                           uint32_t *count,
 378                                           uint64_t highest_usn,
 379                                           const struct dsdb_attribute *rdn_sa,
 380                                           struct dsdb_schema *schema,
 381                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 382                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 383                                           uint32_t *local_pas,
 384                                           uint32_t *attids,
 385                                           bool exop_secret,
 386                                           struct ldb_message **revealed_list_msg,
 387                                           struct ldb_message *existing_revealed_list_msg)
 388 {
 389         uint32_t i, n;
 390         WERROR werr;
 391         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 392                 const struct dsdb_attribute *sa;
 393                 bool force_attribute = false;
 394
 395                 /* if the attribute has not changed, and it is not the
 396                    instanceType then don't include it */
 397                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 398                     !exop_secret &&
 399                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
 400
 401                 /* don't include the rDN */
 402                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 403
 404                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 405                 if (!sa) {
 406                         DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
 407                                  (unsigned int)md.ctr.ctr1.array[i].attid,
 408                                  ldb_dn_get_linearized(msg->dn)));
 409                         return WERR_DS_DRA_INTERNAL_ERROR;
 410                 }
 411
 412                 if (sa->linkID) {
 413                         struct ldb_message_element *el;
 414                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 415                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 416                                 /* don't send upgraded links inline */
 417                                 continue;
 418                         }
 419                 }
 420
 421                 if (exop_secret &&
 422                     !dsdb_attr_in_rodc_fas(sa)) {
 423                         force_attribute = true;
 424                         DEBUG(4,("Forcing attribute %s in %s\n",
 425                                  sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 426                         werr = getncchanges_update_revealed_list(sam_ctx, obj,
 427                                                                  revealed_list_msg,
 428                                                                  msg->dn, guid, sa,
 429                                                                  &md.ctr.ctr1.array[i],
 430                                                                  existing_revealed_list_msg);
 431                         if (!W_ERROR_IS_OK(werr)) {
 432                                 return werr;
 433                         }
 434                 }
 435
 436                 /* filter by uptodateness_vector */
 437                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
 438                     !force_attribute &&
 439                     udv_filter(uptodateness_vector,
 440                                &md.ctr.ctr1.array[i].originating_invocation_id,
 441                                md.ctr.ctr1.array[i].originating_usn)) {
 442                         continue;
 443                 }
 444
 445                 /* filter by partial_attribute_set */
 446                 if (partial_attribute_set && !force_attribute) {
 447                         uint32_t *result = NULL;
 448                         BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
 449                                               uint32_t_cmp, result);
 450                         if (result == NULL) {
 451                                 continue;
 452                         }
 453                 }
 454
 455                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 456                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 457                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 458                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 459                 attids[n] = md.ctr.ctr1.array[i].attid;
 460
 461                 n++;
 462         }
 463
 464         *count = n;
 465
 466         return WERR_OK;
 467 }
 468
 469 /*
 470   drsuapi_DsGetNCChanges for one object
 471 */
 472 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
 473                                           const struct ldb_message *msg,
 474                                           struct ldb_context *sam_ctx,
 475                                           struct drsuapi_getncchanges_state *getnc_state,
 476                                           struct dsdb_schema *schema,
 477                                           DATA_BLOB *session_key,
 478                                           struct drsuapi_DsGetNCChangesRequest10 *req10,
 479                                           bool force_object_return,
 480                                           uint32_t *local_pas,
 481                                           struct ldb_dn *machine_dn,
 482                                           const struct GUID *guid)
 483 {
 484         const struct ldb_val *md_value;
 485         uint32_t i, n;
 486         struct replPropertyMetaDataBlob md;
 487         uint32_t rid = 0;
 488         int ldb_err;
 489         enum ndr_err_code ndr_err;
 490         uint32_t *attids;
 491         const char *rdn;
 492         const struct dsdb_attribute *rdn_sa;
 493         uint64_t uSNChanged;
 494         unsigned int instanceType;
 495         struct dsdb_syntax_ctx syntax_ctx;
 496         struct ldb_result *res = NULL;
 497         WERROR werr;
 498         int ret;
 499         uint32_t replica_flags = req10->replica_flags;
 500         struct drsuapi_DsPartialAttributeSet *partial_attribute_set =
 501                         req10->partial_attribute_set;
 502         struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector =
 503                         req10->uptodateness_vector;
 504         enum drsuapi_DsExtendedOperation extended_op = req10->extended_op;
 505         bool is_schema_nc = getnc_state->is_schema_nc;
 506         uint64_t highest_usn = getnc_state->min_usn;
 507
 508         /* make dsdb sytanx context for conversions */
 509         dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
 510         syntax_ctx.is_schema_nc = is_schema_nc;
 511
 512         uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 513         instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
 514         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 515                 obj->is_nc_prefix = true;
 516                 obj->parent_object_guid = NULL;
 517         } else {
 518                 obj->is_nc_prefix = false;
 519                 obj->parent_object_guid = talloc(obj, struct GUID);
 520                 if (obj->parent_object_guid == NULL) {
 521                         return WERR_DS_DRA_INTERNAL_ERROR;
 522                 }
 523                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 524                 if (GUID_all_zero(obj->parent_object_guid)) {
 525                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 526                                  ldb_dn_get_linearized(msg->dn)));
 527                         return WERR_DS_DRA_INTERNAL_ERROR;
 528                 }
 529         }
 530         obj->next_object = NULL;
 531
 532         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 533         if (!md_value) {
 534                 /* nothing to send */
 535                 return WERR_OK;
 536         }
 537
 538         if (instanceType & INSTANCE_TYPE_UNINSTANT) {
 539                 /* don't send uninstantiated objects */
 540                 return WERR_OK;
 541         }
 542
 543         if (uSNChanged <= highest_usn) {
 544                 /* nothing to send */
 545                 return WERR_OK;
 546         }
 547
 548         ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
 549                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 550         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 551                 return WERR_DS_DRA_INTERNAL_ERROR;
 552         }
 553
 554         if (md.version != 1) {
 555                 return WERR_DS_DRA_INTERNAL_ERROR;
 556         }
 557
 558         rdn = ldb_dn_get_rdn_name(msg->dn);
 559         if (rdn == NULL) {
 560                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 561                 return WERR_DS_DRA_INTERNAL_ERROR;
 562         }
 563
 564         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 565         if (rdn_sa == NULL) {
 566                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 567                          rdn, ldb_dn_get_linearized(msg->dn)));
 568                 return WERR_DS_DRA_INTERNAL_ERROR;
 569         }
 570
 571         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 572         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 573
 574         obj->object.identifier = get_object_identifier(obj, msg);
 575         if (obj->object.identifier == NULL) {
 576                 return WERR_NOT_ENOUGH_MEMORY;
 577         }
 578         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 579
 580         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 581
 582         if (extended_op == DRSUAPI_EXOP_REPL_SECRET) {
 583                 /* Get the existing revealed users for the destination */
 584                 struct ldb_message *revealed_list_msg = NULL;
 585                 struct ldb_message *existing_revealed_list_msg = NULL;
 586                 const char *machine_attrs[] = {
 587                         "msDS-RevealedUsers",
 588                         NULL
 589                 };
 590
 591                 revealed_list_msg = ldb_msg_new(sam_ctx);
 592                 if (revealed_list_msg == NULL) {
 593                         return WERR_NOT_ENOUGH_MEMORY;
 594                 }
 595                 revealed_list_msg->dn = machine_dn;
 596
 597                 ret = ldb_transaction_start(sam_ctx);
 598                 if (ret != LDB_SUCCESS) {
 599                         DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 600                                  ldb_errstring(sam_ctx)));
 601                         return WERR_DS_DRA_INTERNAL_ERROR;
 602                 }
 603
 604                 ldb_err = dsdb_search_dn(sam_ctx, obj, &res, machine_dn, machine_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN);
 605                 if (ldb_err != LDB_SUCCESS || res->count != 1) {
 606                         ldb_transaction_cancel(sam_ctx);
 607                         return WERR_DS_DRA_INTERNAL_ERROR;
 608                 }
 609
 610                 existing_revealed_list_msg = res->msgs[0];
 611
 612                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg,
 613                                                    guid, &n, highest_usn,
 614                                                    rdn_sa, schema,
 615                                                    uptodateness_vector,
 616                                                    partial_attribute_set, local_pas,
 617                                                    attids,
 618                                                    true,
 619                                                    &revealed_list_msg,
 620                                                    existing_revealed_list_msg);
 621                 if (!W_ERROR_IS_OK(werr)) {
 622                         ldb_transaction_cancel(sam_ctx);
 623                         return werr;
 624                 }
 625
 626                 if (revealed_list_msg != NULL) {
 627                         ret = ldb_modify(sam_ctx, revealed_list_msg);
 628                         if (ret != LDB_SUCCESS) {
 629                                 DEBUG(0,(__location__ ": Failed to alter revealed links - %s\n",
 630                                          ldb_errstring(sam_ctx)));
 631                                 ldb_transaction_cancel(sam_ctx);
 632                                 return WERR_DS_DRA_INTERNAL_ERROR;
 633                         }
 634                 }
 635
 636                 ret = ldb_transaction_commit(sam_ctx);
 637                 if (ret != LDB_SUCCESS) {
 638                         DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 639                                  ldb_errstring(sam_ctx)));
 640                         return WERR_DS_DRA_INTERNAL_ERROR;
 641                 }
 642         } else {
 643                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg, guid,
 644                                                    &n, highest_usn, rdn_sa,
 645                                                    schema, uptodateness_vector,
 646                                                    partial_attribute_set, local_pas,
 647                                                    attids,
 648                                                    false,
 649                                                    NULL,
 650                                                    NULL);
 651                 if (!W_ERROR_IS_OK(werr)) {
 652                         return werr;
 653                 }
 654         }
 655
 656         /* ignore it if its an empty change. Note that renames always
 657          * change the 'name' attribute, so they won't be ignored by
 658          * this
 659
 660          * the force_object_return check is used to force an empty
 661          * object return when we timeout in the getncchanges loop.
 662          * This allows us to return an empty object, which keeps the
 663          * client happy while preventing timeouts
 664          */
 665         if (n == 0 ||
 666             (n == 1 &&
 667              attids[0] == DRSUAPI_ATTID_instanceType &&
 668              !force_object_return)) {
 669                 talloc_free(obj->meta_data_ctr);
 670                 obj->meta_data_ctr = NULL;
 671                 return WERR_OK;
 672         }
 673
 674         obj->meta_data_ctr->count = n;
 675
 676         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 677         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 678         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 679                                                             obj->object.attribute_ctr.num_attributes);
 680         if (obj->object.attribute_ctr.attributes == NULL) {
 681                 return WERR_NOT_ENOUGH_MEMORY;
 682         }
 683
 684         /*
 685          * Note that the meta_data array and the attributes array must
 686          * be the same size and in the same order
 687          */
 688         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 689                 struct ldb_message_element *el;
 690                 const struct dsdb_attribute *sa;
 691
 692                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 693                 if (!sa) {
 694                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 695                         return WERR_DS_DRA_INTERNAL_ERROR;
 696                 }
 697
 698                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 699                 if (el == NULL) {
 700                         /* this happens for attributes that have been removed */
 701                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 702                                  sa->lDAPDisplayName, attids[i]));
 703                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 704                         obj->object.attribute_ctr.attributes[i].attid =
 705                                         dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
 706                 } else {
 707                         werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
 708                                                           &obj->object.attribute_ctr.attributes[i]);
 709                         if (!W_ERROR_IS_OK(werr)) {
 710                                 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
 711                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 712                                          win_errstr(werr)));
 713                                 return werr;
 714                         }
 715                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 716                          * check if attribute is secret and send a null value
 717                          */
 718                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 719                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 720                                                                  &obj->meta_data_ctr->meta_data[i]);
 721                         }
 722                         /* some attributes needs to be encrypted
 723                            before being sent */
 724                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 725                                                          &obj->object.attribute_ctr.attributes[i]);
 726                         if (!W_ERROR_IS_OK(werr)) {
 727                                 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
 728                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 729                                          win_errstr(werr)));
 730                                 return werr;
 731                         }
 732                 }
 733                 if (attids[i] != obj->object.attribute_ctr.attributes[i].attid) {
 734                         DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID:  "
 735                                   "0x%08x vs 0x%08x "
 736                                   "Run dbcheck!\n",
 737                                   sa->lDAPDisplayName,
 738                                   ldb_dn_get_linearized(msg->dn),
 739                                   attids[i],
 740                                   obj->object.attribute_ctr.attributes[i].attid));
 741                         return WERR_DS_DATABASE_ERROR;
 742                 }
 743         }
 744
 745         return WERR_OK;
 746 }
 747
 748 /*
 749   add one linked attribute from an object to the list of linked
 750   attributes in a getncchanges request
 751  */
 752 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 753                                     struct ldb_context *sam_ctx,
 754                                     const struct dsdb_schema *schema,
 755                                     const struct dsdb_attribute *sa,
 756                                     const struct ldb_message *msg,
 757                                     struct dsdb_dn *dsdb_dn,
 758                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 759                                     uint32_t *la_count,
 760                                     bool is_schema_nc)
 761 {
 762         struct drsuapi_DsReplicaLinkedAttribute *la;
 763         bool active;
 764         NTSTATUS status;
 765         WERROR werr;
 766
 767         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 768         W_ERROR_HAVE_NO_MEMORY(*la_list);
 769
 770         la = &(*la_list)[*la_count];
 771
 772         la->identifier = get_object_identifier(*la_list, msg);
 773         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 774
 775         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 776
 777         if (!active) {
 778                 /* We have to check that the inactive link still point to an existing object */
 779                 struct GUID guid;
 780                 struct ldb_dn *tdn;
 781                 int ret;
 782                 const char *v;
 783
 784                 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
 785                 if (strncmp(v, "TRUE", 4) == 0) {
 786                         /*
 787                           * Note: we skip the transmition of the deleted link even if the other part used to
 788                           * know about it because when we transmit the deletion of the object, the link will
 789                           * be deleted too due to deletion of object where link points and Windows do so.
 790                           */
 791                         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
 792                                 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
 793                                 /*
 794                                  * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
 795                                  * if it join an existing domain with deleted objets, it firsts impose to have a
 796                                  * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
 797                                  * either during initial replication or after the getNCChanges.
 798                                  * Behavior of samba has been changed to always have this attribute if it's present in the schema.
 799                                  *
 800                                  * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
 801                                  * If FL >=2K8R2 we are sure that this attribute will be here.
 802                                  * For this kind of forest level we do not return the link if the object is recycled
 803                                  * (isRecycled = true).
 804                                  */
 805                                 if (strncmp(v, "TRUE", 4) == 0) {
 806                                         DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
 807                                                                 ldb_dn_get_linearized(msg->dn)));
 808                                         return WERR_OK;
 809                                 }
 810                         } else {
 811                                 return WERR_OK;
 812                         }
 813                 }
 814                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
 815                 if (!NT_STATUS_IS_OK(status)) {
 816                         DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 817                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 818                         return ntstatus_to_werror(status);
 819                 }
 820                 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
 821                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 822                         DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 823                                                 GUID_string(mem_ctx, &guid)));
 824                         return WERR_OK;
 825                 } else if (ret != LDB_SUCCESS) {
 826                         DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 827                                                 GUID_string(mem_ctx, &guid),
 828                                                 ret));
 829                         return WERR_OK;
 830                 }
 831         }
 832         la->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
 833         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 834
 835         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 836         if (!NT_STATUS_IS_OK(status)) {
 837                 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
 838                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 839                 return ntstatus_to_werror(status);
 840         }
 841         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 842         if (!NT_STATUS_IS_OK(status)) {
 843                 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
 844                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 845                 return ntstatus_to_werror(status);
 846         }
 847         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 848         if (!NT_STATUS_IS_OK(status)) {
 849                 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
 850                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 851                 return ntstatus_to_werror(status);
 852         }
 853         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 854         if (!NT_STATUS_IS_OK(status)) {
 855                 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
 856                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 857                 return ntstatus_to_werror(status);
 858         }
 859
 860         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 861         if (!NT_STATUS_IS_OK(status)) {
 862                 /* this is possible for upgraded links */
 863                 la->originating_add_time = la->meta_data.originating_change_time;
 864         }
 865
 866         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 867         W_ERROR_NOT_OK_RETURN(werr);
 868
 869         (*la_count)++;
 870         return WERR_OK;
 871 }
 872
 873
 874 /*
 875   add linked attributes from an object to the list of linked
 876   attributes in a getncchanges request
 877  */
 878 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 879                                        TALLOC_CTX *mem_ctx,
 880                                        bool is_schema_nc,
 881                                        struct dsdb_schema *schema,
 882                                        uint64_t highest_usn,
 883                                        uint32_t replica_flags,
 884                                        const struct ldb_message *msg,
 885                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 886                                        uint32_t *la_count,
 887                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 888 {
 889         unsigned int i;
 890         TALLOC_CTX *tmp_ctx = NULL;
 891         uint64_t uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 892         bool is_critical = ldb_msg_find_attr_as_bool(msg, "isCriticalSystemObject", false);
 893
 894         if (replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
 895                 if (!is_critical) {
 896                         return WERR_OK;
 897                 }
 898         }
 899
 900         if (uSNChanged <= highest_usn) {
 901                 return WERR_OK;
 902         }
 903
 904         tmp_ctx = talloc_new(mem_ctx);
 905         if (tmp_ctx == NULL) {
 906                 return WERR_NOT_ENOUGH_MEMORY;
 907         }
 908
 909         for (i=0; i<msg->num_elements; i++) {
 910                 struct ldb_message_element *el = &msg->elements[i];
 911                 const struct dsdb_attribute *sa;
 912                 unsigned int j;
 913
 914                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 915
 916                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 917                         /* we only want forward links */
 918                         continue;
 919                 }
 920
 921                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 922                         /* its an old style link, it will have been
 923                          * sent in the main replication data */
 924                         continue;
 925                 }
 926
 927                 for (j=0; j<el->num_values; j++) {
 928                         struct dsdb_dn *dsdb_dn;
 929                         uint64_t local_usn;
 930                         uint64_t originating_usn;
 931                         NTSTATUS status, status2;
 932                         WERROR werr;
 933                         struct GUID originating_invocation_id;
 934
 935                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 936                         if (dsdb_dn == NULL) {
 937                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 938                                          el->name, ldb_dn_get_linearized(msg->dn)));
 939                                 talloc_free(tmp_ctx);
 940                                 return WERR_DS_DRA_INTERNAL_ERROR;
 941                         }
 942
 943                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 944                         if (!NT_STATUS_IS_OK(status)) {
 945                                 /* this can happen for attributes
 946                                    given to us with old style meta
 947                                    data */
 948                                 continue;
 949                         }
 950
 951                         if (local_usn > uSNChanged) {
 952                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 953                                          el->name, ldb_dn_get_linearized(msg->dn)));
 954                                 talloc_free(tmp_ctx);
 955                                 return WERR_DS_DRA_INTERNAL_ERROR;
 956                         }
 957
 958                         if (local_usn <= highest_usn) {
 959                                 continue;
 960                         }
 961
 962                         status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
 963                                                            &originating_invocation_id,
 964                                                            "RMD_INVOCID");
 965                         status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
 966                                                               &originating_usn,
 967                                                               "RMD_ORIGINATING_USN");
 968
 969                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
 970                                 if (udv_filter(uptodateness_vector,
 971                                                &originating_invocation_id,
 972                                                originating_usn)) {
 973                                         continue;
 974                                 }
 975                         }
 976
 977                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
 978                                                      sa, msg, dsdb_dn, la_list,
 979                                                      la_count, is_schema_nc);
 980                         if (!W_ERROR_IS_OK(werr)) {
 981                                 talloc_free(tmp_ctx);
 982                                 return werr;
 983                         }
 984                 }
 985         }
 986
 987         talloc_free(tmp_ctx);
 988         return WERR_OK;
 989 }
 990
 991 /*
 992   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 993  */
 994 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 995                                  struct ldb_dn *ncRoot_dn,
 996                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 997 {
 998         int ret;
 999
1000         udv->version = 2;
1001         udv->reserved1 = 0;
1002         udv->reserved2 = 0;
1003
1004         ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
1005         if (ret != LDB_SUCCESS) {
1006                 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
1007                          ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
1008                 return WERR_DS_DRA_INTERNAL_ERROR;
1009         }
1010
1011         return WERR_OK;
1012 }
1013
1014
1015 /* comparison function for linked attributes - see CompareLinks() in
1016  * MS-DRSR section 4.1.10.5.17 */
1017 static int linked_attribute_compare(const struct la_for_sorting *la1,
1018                                     const struct la_for_sorting *la2,
1019                                     void *opaque)
1020 {
1021         int c;
1022         c = memcmp(la1->source_guid,
1023                    la2->source_guid, sizeof(la2->source_guid));
1024         if (c != 0) {
1025                 return c;
1026         }
1027
1028         if (la1->link->attid != la2->link->attid) {
1029                 return la1->link->attid < la2->link->attid? -1:1;
1030         }
1031
1032         if ((la1->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
1033             (la2->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
1034                 return (la1->link->flags &
1035                         DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
1036         }
1037
1038         return memcmp(la1->target_guid,
1039                       la2->target_guid, sizeof(la2->target_guid));
1040 }
1041
1042 struct drsuapi_changed_objects {
1043         struct ldb_dn *dn;
1044         struct GUID guid;
1045         uint64_t usn;
1046 };
1047
1048 /*
1049   sort the objects we send first by uSNChanged
1050  */
1051 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
1052                                   struct drsuapi_changed_objects *m2,
1053                                   struct drsuapi_getncchanges_state *getnc_state)
1054 {
1055         int ret;
1056
1057         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
1058         if (ret == 0) {
1059                 return -1;
1060         }
1061
1062         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
1063         if (ret == 0) {
1064                 return 1;
1065         }
1066
1067         if (m1->usn == m2->usn) {
1068                 return ldb_dn_compare(m2->dn, m1->dn);
1069         }
1070
1071         if (m1->usn < m2->usn) {
1072                 return -1;
1073         }
1074
1075         return 1;
1076 }
1077
1078
1079 /*
1080   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
1081  */
1082 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
1083                                      TALLOC_CTX *mem_ctx,
1084                                      struct drsuapi_DsGetNCChangesRequest10 *req10,
1085                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1086                                      struct ldb_dn **rid_manager_dn)
1087 {
1088         struct ldb_dn *req_dn, *ntds_dn = NULL;
1089         int ret;
1090         struct ldb_context *ldb = b_state->sam_ctx;
1091         struct ldb_result *ext_res;
1092         struct dsdb_fsmo_extended_op *exop;
1093         bool is_us;
1094
1095         /*
1096           steps:
1097             - verify that the DN being asked for is the RID Manager DN
1098             - verify that we are the RID Manager
1099          */
1100
1101         /* work out who is the RID Manager, also return to caller */
1102         ret = samdb_rid_manager_dn(ldb, mem_ctx, rid_manager_dn);
1103         if (ret != LDB_SUCCESS) {
1104                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
1105                 return WERR_DS_DRA_INTERNAL_ERROR;
1106         }
1107
1108         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1109         if (!ldb_dn_validate(req_dn) ||
1110             ldb_dn_compare(req_dn, *rid_manager_dn) != 0) {
1111                 /* that isn't the RID Manager DN */
1112                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
1113                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1114                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1115                 return WERR_OK;
1116         }
1117
1118         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1119         ret = dsdb_find_dn_by_guid(ldb, mem_ctx, &req10->destination_dsa_guid, 0, &ntds_dn);
1120         if (ret != LDB_SUCCESS) {
1121                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1122                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1123                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1124                 return WERR_OK;
1125         }
1126
1127         /* find the DN of the RID Manager */
1128         ret = samdb_reference_dn_is_our_ntdsa(ldb, *rid_manager_dn, "fSMORoleOwner", &is_us);
1129         if (ret != LDB_SUCCESS) {
1130                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1131                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1132                 return WERR_DS_DRA_INTERNAL_ERROR;
1133         }
1134
1135         if (!is_us) {
1136                 /* we're not the RID Manager - go away */
1137                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
1138                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1139                 return WERR_OK;
1140         }
1141
1142         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
1143         W_ERROR_HAVE_NO_MEMORY(exop);
1144
1145         exop->fsmo_info = req10->fsmo_info;
1146         exop->destination_dsa_guid = req10->destination_dsa_guid;
1147
1148         ret = ldb_transaction_start(ldb);
1149         if (ret != LDB_SUCCESS) {
1150                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1151                          ldb_errstring(ldb)));
1152                 return WERR_DS_DRA_INTERNAL_ERROR;
1153         }
1154
1155         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
1156         if (ret != LDB_SUCCESS) {
1157                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
1158                          ldb_errstring(ldb)));
1159                 ldb_transaction_cancel(ldb);
1160                 return WERR_DS_DRA_INTERNAL_ERROR;
1161         }
1162
1163         ret = ldb_transaction_commit(ldb);
1164         if (ret != LDB_SUCCESS) {
1165                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1166                          ldb_errstring(ldb)));
1167                 return WERR_DS_DRA_INTERNAL_ERROR;
1168         }
1169
1170         talloc_free(ext_res);
1171
1172         DEBUG(2,("Allocated RID pool for server %s\n",
1173                  GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1174
1175         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1176
1177         return WERR_OK;
1178 }
1179
1180 /*
1181   handle a DRSUAPI_EXOP_REPL_SECRET call
1182  */
1183 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
1184                                        TALLOC_CTX *mem_ctx,
1185                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1186                                        struct dom_sid *user_sid,
1187                                        struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1188                                        bool has_get_all_changes,
1189                                        struct ldb_dn **machine_dn)
1190 {
1191         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1192         struct ldb_dn *obj_dn = NULL;
1193         struct ldb_dn *ntds_dn = NULL, *server_dn = NULL;
1194         struct ldb_dn *rodc_dn, *krbtgt_link_dn;
1195         int ret;
1196         const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", "objectGUID", NULL };
1197         const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
1198         struct ldb_result *rodc_res = NULL, *obj_res = NULL;
1199         const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
1200         const struct dom_sid *object_sid = NULL;
1201         WERROR werr;
1202         const struct dom_sid *additional_sids[] = { NULL, NULL };
1203
1204         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
1205                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1206
1207         /*
1208          * we need to work out if we will allow this DC to
1209          * replicate the secrets for this object
1210          *
1211          * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
1212          * of this function
1213          */
1214
1215         if (b_state->sam_ctx_system == NULL) {
1216                 /* this operation needs system level access */
1217                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
1218                 return WERR_DS_DRA_ACCESS_DENIED;
1219         }
1220
1221         /*
1222          * Before we accept or deny, fetch the machine DN for the destination
1223          * DSA GUID.
1224          *
1225          * If we are the RODC, we will check that this matches the SID.
1226          */
1227         ret = dsdb_find_dn_by_guid(b_state->sam_ctx_system, mem_ctx,
1228                                    &req10->destination_dsa_guid, 0,
1229                                    &ntds_dn);
1230         if (ret != LDB_SUCCESS) {
1231                 goto failed;
1232         }
1233
1234         server_dn = ldb_dn_get_parent(mem_ctx, ntds_dn);
1235         if (server_dn == NULL) {
1236                 goto failed;
1237         }
1238
1239         ret = samdb_reference_dn(b_state->sam_ctx_system, mem_ctx, server_dn,
1240                                  "serverReference", machine_dn);
1241
1242         if (ret != LDB_SUCCESS) {
1243                 goto failed;
1244         }
1245
1246         /*
1247          * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1248          *
1249          * The pseudo code indicate
1250          * revealsecrets = true
1251          * if IsRevealSecretRequest(msgIn) then
1252          *   if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1253          *   then
1254          *     if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1255          *     <... check if this account is ok to be replicated on this DC ...>
1256          *     <... and if not reveal secrets = no ...>
1257          *     else
1258          *       reveal secrets = false
1259          *     endif
1260          *   endif
1261          * endif
1262          *
1263          * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1264          * then you can do EXOP_REPL_SECRETS
1265          */
1266         obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
1267         if (!ldb_dn_validate(obj_dn)) goto failed;
1268
1269         if (has_get_all_changes) {
1270                 goto allowed;
1271         }
1272
1273         rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
1274                                  dom_sid_string(mem_ctx, user_sid));
1275         if (!ldb_dn_validate(rodc_dn)) goto failed;
1276
1277         /* do the two searches we need */
1278         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
1279                              DSDB_SEARCH_SHOW_EXTENDED_DN);
1280         if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
1281
1282         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1283         if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1284
1285         /* if the object SID is equal to the user_sid, allow */
1286         object_sid = samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid");
1287         if (dom_sid_equal(user_sid, object_sid)) {
1288                 goto allowed;
1289         }
1290
1291         additional_sids[0] = object_sid;
1292
1293         /*
1294          * Must be an RODC account at this point, verify machine DN matches the
1295          * SID account
1296          */
1297         if (ldb_dn_compare(rodc_res->msgs[0]->dn, *machine_dn) != 0) {
1298                 goto denied;
1299         }
1300
1301         /* an RODC is allowed to get its own krbtgt account secrets */
1302         krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1303                                          rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1304         if (krbtgt_link_dn != NULL &&
1305             ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1306                 goto allowed;
1307         }
1308
1309         /* but it isn't allowed to get anyone elses krbtgt secrets */
1310         if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1311                             obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1312                 goto denied;
1313         }
1314
1315         if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1316                                       "userAccountControl", 0) &
1317             UF_INTERDOMAIN_TRUST_ACCOUNT) {
1318                 goto denied;
1319         }
1320
1321         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1322                                          mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1323         if (!W_ERROR_IS_OK(werr)) {
1324                 goto denied;
1325         }
1326
1327         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1328                                          mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1329         if (!W_ERROR_IS_OK(werr)) {
1330                 goto denied;
1331         }
1332
1333         /*
1334          * The SID list needs to include itself as well as the tokenGroups.
1335          *
1336          * TODO determine if sIDHistory is required for this check
1337          */
1338         werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1339                                           mem_ctx, "tokenGroups", &token_sids,
1340                                           additional_sids, 1);
1341         if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1342                 goto denied;
1343         }
1344
1345         if (never_reveal_sids &&
1346             sid_list_match(token_sids, never_reveal_sids)) {
1347                 goto denied;
1348         }
1349
1350         if (reveal_sids &&
1351             sid_list_match(token_sids, reveal_sids)) {
1352                 goto allowed;
1353         }
1354
1355         /* default deny */
1356 denied:
1357         DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1358                  ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1359         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1360         return WERR_DS_DRA_SECRETS_DENIED;
1361
1362 allowed:
1363         DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1364                  ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1365                  ldb_dn_get_linearized(*machine_dn)));
1366         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1367         req10->highwatermark.highest_usn = 0;
1368         return WERR_OK;
1369
1370 failed:
1371         DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1372                  ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1373         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1374         return WERR_DS_DRA_BAD_DN;
1375 }
1376
1377 /*
1378   handle a DRSUAPI_EXOP_REPL_OBJ call
1379  */
1380 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1381                                     TALLOC_CTX *mem_ctx,
1382                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
1383                                     struct dom_sid *user_sid,
1384                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1385 {
1386         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1387
1388         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1389                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1390
1391         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1392         return WERR_OK;
1393 }
1394
1395
1396 /*
1397   handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1398   DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1399   and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1400  */
1401 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1402                                          TALLOC_CTX *mem_ctx,
1403                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
1404                                          struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1405 {
1406         struct ldb_dn *req_dn, *ntds_dn;
1407         int ret;
1408         unsigned int i;
1409         struct ldb_context *ldb = b_state->sam_ctx;
1410         struct ldb_message *msg;
1411         bool is_us;
1412
1413         /*
1414           steps:
1415             - verify that the client dn exists
1416             - verify that we are the current master
1417          */
1418
1419         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1420         if (!ldb_dn_validate(req_dn)) {
1421                 /* that is not a valid dn */
1422                 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1423                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1424                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1425                 return WERR_OK;
1426         }
1427
1428         /* find the DN of the current role owner */
1429         ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1430         if (ret != LDB_SUCCESS) {
1431                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1432                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1433                 return WERR_DS_DRA_INTERNAL_ERROR;
1434         }
1435
1436         if (!is_us) {
1437                 /* we're not the RID Manager or role owner - go away */
1438                 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1439                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1440                 return WERR_OK;
1441         }
1442
1443         /* change the current master */
1444         msg = ldb_msg_new(ldb);
1445         W_ERROR_HAVE_NO_MEMORY(msg);
1446         msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1447         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1448
1449         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1450         ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1451         if (ret != LDB_SUCCESS) {
1452                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1453                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1454                 talloc_free(msg);
1455                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1456                 return WERR_OK;
1457         }
1458
1459         ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1460         if (ret != 0) {
1461                 talloc_free(msg);
1462                 return WERR_DS_DRA_INTERNAL_ERROR;
1463         }
1464
1465         for (i=0;i<msg->num_elements;i++) {
1466                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1467         }
1468
1469         ret = ldb_transaction_start(ldb);
1470         if (ret != LDB_SUCCESS) {
1471                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1472                          ldb_errstring(ldb)));
1473                 return WERR_DS_DRA_INTERNAL_ERROR;
1474         }
1475
1476         ret = ldb_modify(ldb, msg);
1477         if (ret != LDB_SUCCESS) {
1478                 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1479                          ldb_errstring(ldb)));
1480                 ldb_transaction_cancel(ldb);
1481                 return WERR_DS_DRA_INTERNAL_ERROR;
1482         }
1483
1484         ret = ldb_transaction_commit(ldb);
1485         if (ret != LDB_SUCCESS) {
1486                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1487                          ldb_errstring(ldb)));
1488                 return WERR_DS_DRA_INTERNAL_ERROR;
1489         }
1490
1491         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1492
1493         return WERR_OK;
1494 }
1495
1496 /*
1497   see if this getncchanges request includes a request to reveal secret information
1498  */
1499 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1500                                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1501                                                        struct dsdb_schema_prefixmap *pfm_remote,
1502                                                        bool *is_secret_request)
1503 {
1504         enum drsuapi_DsExtendedOperation exop;
1505         uint32_t i;
1506         struct dsdb_schema *schema;
1507         struct dsdb_syntax_ctx syntax_ctx;
1508
1509         *is_secret_request = true;
1510
1511         exop = req10->extended_op;
1512
1513         switch (exop) {
1514         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1515         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1516         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1517         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1518         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1519                 /* FSMO exops can reveal secrets */
1520                 *is_secret_request = true;
1521                 return WERR_OK;
1522         case DRSUAPI_EXOP_REPL_SECRET:
1523         case DRSUAPI_EXOP_REPL_OBJ:
1524         case DRSUAPI_EXOP_NONE:
1525                 break;
1526         }
1527
1528         if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1529                 *is_secret_request = false;
1530                 return WERR_OK;
1531         }
1532
1533         if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1534             req10->partial_attribute_set == NULL) {
1535                 /* they want secrets */
1536                 *is_secret_request = true;
1537                 return WERR_OK;
1538         }
1539
1540         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1541         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1542         syntax_ctx.pfm_remote = pfm_remote;
1543
1544         /* check the attributes they asked for */
1545         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1546                 const struct dsdb_attribute *sa;
1547                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1548                                                                  &syntax_ctx,
1549                                                                  req10->partial_attribute_set->attids[i],
1550                                                                  NULL,
1551                                                                  &sa);
1552
1553                 if (!W_ERROR_IS_OK(werr)) {
1554                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1555                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1556                         return werr;
1557                 }
1558
1559                 if (!dsdb_attr_in_rodc_fas(sa)) {
1560                         *is_secret_request = true;
1561                         return WERR_OK;
1562                 }
1563         }
1564
1565         if (req10->partial_attribute_set_ex) {
1566                 /* check the extended attributes they asked for */
1567                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1568                         const struct dsdb_attribute *sa;
1569                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1570                                                                          &syntax_ctx,
1571                                                                          req10->partial_attribute_set_ex->attids[i],
1572                                                                          NULL,
1573                                                                          &sa);
1574
1575                         if (!W_ERROR_IS_OK(werr)) {
1576                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1577                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1578                                 return werr;
1579                         }
1580
1581                         if (!dsdb_attr_in_rodc_fas(sa)) {
1582                                 *is_secret_request = true;
1583                                 return WERR_OK;
1584                         }
1585                 }
1586         }
1587
1588         *is_secret_request = false;
1589         return WERR_OK;
1590 }
1591
1592 /*
1593   see if this getncchanges request is only for attributes in the GC
1594   partial attribute set
1595  */
1596 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1597                                                struct drsuapi_DsGetNCChangesRequest10 *req10,
1598                                                struct dsdb_schema_prefixmap *pfm_remote,
1599                                                bool *is_gc_pas_request)
1600 {
1601         enum drsuapi_DsExtendedOperation exop;
1602         uint32_t i;
1603         struct dsdb_schema *schema;
1604         struct dsdb_syntax_ctx syntax_ctx;
1605
1606         exop = req10->extended_op;
1607
1608         switch (exop) {
1609         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1610         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1611         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1612         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1613         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1614         case DRSUAPI_EXOP_REPL_SECRET:
1615                 *is_gc_pas_request = false;
1616                 return WERR_OK;
1617         case DRSUAPI_EXOP_REPL_OBJ:
1618         case DRSUAPI_EXOP_NONE:
1619                 break;
1620         }
1621
1622         if (req10->partial_attribute_set == NULL) {
1623                 /* they want it all */
1624                 *is_gc_pas_request = false;
1625                 return WERR_OK;
1626         }
1627
1628         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1629         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1630         syntax_ctx.pfm_remote = pfm_remote;
1631
1632         /* check the attributes they asked for */
1633         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1634                 const struct dsdb_attribute *sa;
1635                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1636                                                                  &syntax_ctx,
1637                                                                  req10->partial_attribute_set->attids[i],
1638                                                                  NULL,
1639                                                                  &sa);
1640
1641                 if (!W_ERROR_IS_OK(werr)) {
1642                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1643                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1644                         return werr;
1645                 }
1646
1647                 if (!sa->isMemberOfPartialAttributeSet) {
1648                         *is_gc_pas_request = false;
1649                         return WERR_OK;
1650                 }
1651         }
1652
1653         if (req10->partial_attribute_set_ex) {
1654                 /* check the extended attributes they asked for */
1655                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1656                         const struct dsdb_attribute *sa;
1657                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1658                                                                          &syntax_ctx,
1659                                                                          req10->partial_attribute_set_ex->attids[i],
1660                                                                          NULL,
1661                                                                          &sa);
1662
1663                         if (!W_ERROR_IS_OK(werr)) {
1664                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1665                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1666                                 return werr;
1667                         }
1668
1669                         if (!sa->isMemberOfPartialAttributeSet) {
1670                                 *is_gc_pas_request = false;
1671                                 return WERR_OK;
1672                         }
1673                 }
1674         }
1675
1676         *is_gc_pas_request = true;
1677         return WERR_OK;
1678 }
1679
1680
1681 /*
1682   map from req8 to req10
1683  */
1684 static struct drsuapi_DsGetNCChangesRequest10 *
1685 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1686                       struct drsuapi_DsGetNCChangesRequest8 *req8)
1687 {
1688         struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1689                                                                     struct drsuapi_DsGetNCChangesRequest10);
1690         if (req10 == NULL) {
1691                 return NULL;
1692         }
1693
1694         req10->destination_dsa_guid = req8->destination_dsa_guid;
1695         req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1696         req10->naming_context = req8->naming_context;
1697         req10->highwatermark = req8->highwatermark;
1698         req10->uptodateness_vector = req8->uptodateness_vector;
1699         req10->replica_flags = req8->replica_flags;
1700         req10->max_object_count = req8->max_object_count;
1701         req10->max_ndr_size = req8->max_ndr_size;
1702         req10->extended_op = req8->extended_op;
1703         req10->fsmo_info = req8->fsmo_info;
1704         req10->partial_attribute_set = req8->partial_attribute_set;
1705         req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1706         req10->mapping_ctr = req8->mapping_ctr;
1707
1708         return req10;
1709 }
1710
1711 static const char *collect_objects_attrs[] = { "uSNChanged",
1712                                                "objectGUID" ,
1713                                                NULL };
1714
1715 /**
1716  * Collects object for normal replication cycle.
1717  */
1718 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1719                                            TALLOC_CTX *mem_ctx,
1720                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
1721                                            struct ldb_dn *search_dn,
1722                                            const char *extra_filter,
1723                                            struct ldb_result **search_res)
1724 {
1725         int ret;
1726         char* search_filter;
1727         enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1728         struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1729         bool critical_only = false;
1730
1731         if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1732                 critical_only = true;
1733         }
1734
1735         if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1736             req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1737                 scope = LDB_SCOPE_BASE;
1738                 critical_only = false;
1739         }
1740
1741         /* Construct response. */
1742         search_filter = talloc_asprintf(mem_ctx,
1743                                         "(uSNChanged>=%llu)",
1744                                         (unsigned long long)(getnc_state->min_usn+1));
1745
1746         if (extra_filter) {
1747                 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1748         }
1749
1750         if (critical_only) {
1751                 search_filter = talloc_asprintf(mem_ctx,
1752                                                 "(&%s(isCriticalSystemObject=TRUE))",
1753                                                 search_filter);
1754         }
1755
1756         if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1757                 scope = LDB_SCOPE_BASE;
1758         }
1759
1760         if (!search_dn) {
1761                 search_dn = getnc_state->ncRoot_dn;
1762         }
1763
1764         DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1765                  ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1766         ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1767                                               search_dn, scope,
1768                                               collect_objects_attrs,
1769                                               search_filter);
1770         if (ret != LDB_SUCCESS) {
1771                 return WERR_DS_DRA_INTERNAL_ERROR;
1772         }
1773
1774         return WERR_OK;
1775 }
1776
1777 /**
1778  * Collects object for normal replication cycle.
1779  */
1780 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1781                                                 TALLOC_CTX *mem_ctx,
1782                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
1783                                                 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1784                                                 struct ldb_dn *search_dn,
1785                                                 const char *extra_filter,
1786                                                 struct ldb_result **search_res)
1787 {
1788         /* we have nothing to do in case of ex-op failure */
1789         if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1790                 return WERR_OK;
1791         }
1792
1793         switch (req10->extended_op) {
1794         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1795         {
1796                 int ret;
1797                 struct ldb_dn *ntds_dn = NULL;
1798                 struct ldb_dn *server_dn = NULL;
1799                 struct ldb_dn *machine_dn = NULL;
1800                 struct ldb_dn *rid_set_dn = NULL;
1801                 struct ldb_result *search_res2 = NULL;
1802                 struct ldb_result *search_res3 = NULL;
1803                 TALLOC_CTX *frame = talloc_stackframe();
1804                 /* get RID manager, RID set and server DN (in that order) */
1805
1806                 /* This first search will get the RID Manager */
1807                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1808                                                       search_res,
1809                                                       search_dn, LDB_SCOPE_BASE,
1810                                                       collect_objects_attrs,
1811                                                       NULL);
1812                 if (ret != LDB_SUCCESS) {
1813                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1814                                   ldb_dn_get_linearized(search_dn),
1815                                   ldb_errstring(b_state->sam_ctx)));
1816                         TALLOC_FREE(frame);
1817                         return WERR_DS_DRA_INTERNAL_ERROR;
1818                 }
1819
1820                 if ((*search_res)->count != 1) {
1821                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1822                                   ldb_dn_get_linearized(search_dn),
1823                                   (*search_res)->count));
1824                         TALLOC_FREE(frame);
1825                         return WERR_DS_DRA_INTERNAL_ERROR;
1826                 }
1827
1828                 /* Now extend it to the RID set */
1829
1830                 /* Find the computer account DN for the destination
1831                  * dsa GUID specified */
1832
1833                 ret = dsdb_find_dn_by_guid(b_state->sam_ctx, frame,
1834                                            &req10->destination_dsa_guid, 0,
1835                                            &ntds_dn);
1836                 if (ret != LDB_SUCCESS) {
1837                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1838                                   GUID_string(frame,
1839                                               &req10->destination_dsa_guid),
1840                                   ldb_errstring(b_state->sam_ctx)));
1841                         TALLOC_FREE(frame);
1842                         return WERR_DS_DRA_INTERNAL_ERROR;
1843                 }
1844
1845                 server_dn = ldb_dn_get_parent(frame, ntds_dn);
1846                 if (!server_dn) {
1847                         TALLOC_FREE(frame);
1848                         return WERR_DS_DRA_INTERNAL_ERROR;
1849                 }
1850
1851                 ret = samdb_reference_dn(b_state->sam_ctx, frame, server_dn,
1852                                          "serverReference", &machine_dn);
1853                 if (ret != LDB_SUCCESS) {
1854                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1855                                   ldb_dn_get_linearized(server_dn),
1856                                   ldb_errstring(b_state->sam_ctx)));
1857                         TALLOC_FREE(frame);
1858                         return WERR_DS_DRA_INTERNAL_ERROR;
1859                 }
1860
1861                 ret = samdb_reference_dn(b_state->sam_ctx, frame, machine_dn,
1862                                          "rIDSetReferences", &rid_set_dn);
1863                 if (ret != LDB_SUCCESS) {
1864                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1865                                   ldb_dn_get_linearized(server_dn),
1866                                   ldb_errstring(b_state->sam_ctx)));
1867                         TALLOC_FREE(frame);
1868                         return WERR_DS_DRA_INTERNAL_ERROR;
1869                 }
1870
1871
1872                 /* This first search will get the RID Manager, now get the RID set */
1873                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1874                                                       &search_res2,
1875                                                       rid_set_dn, LDB_SCOPE_BASE,
1876                                                       collect_objects_attrs,
1877                                                       NULL);
1878                 if (ret != LDB_SUCCESS) {
1879                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1880                                   ldb_dn_get_linearized(rid_set_dn),
1881                                   ldb_errstring(b_state->sam_ctx)));
1882                         TALLOC_FREE(frame);
1883                         return WERR_DS_DRA_INTERNAL_ERROR;
1884                 }
1885
1886                 if (search_res2->count != 1) {
1887                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1888                                   ldb_dn_get_linearized(rid_set_dn),
1889                                   search_res2->count));
1890                         TALLOC_FREE(frame);
1891                         return WERR_DS_DRA_INTERNAL_ERROR;
1892                 }
1893
1894                 /* Finally get the server DN */
1895                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1896                                                       &search_res3,
1897                                                       machine_dn, LDB_SCOPE_BASE,
1898                                                       collect_objects_attrs,
1899                                                       NULL);
1900                 if (ret != LDB_SUCCESS) {
1901                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1902                                   ldb_dn_get_linearized(server_dn),
1903                                   ldb_errstring(b_state->sam_ctx)));
1904                         TALLOC_FREE(frame);
1905                         return WERR_DS_DRA_INTERNAL_ERROR;
1906                 }
1907
1908                 if (search_res3->count != 1) {
1909                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1910                                   ldb_dn_get_linearized(server_dn),
1911                                   search_res3->count));
1912                         TALLOC_FREE(frame);
1913                         return WERR_DS_DRA_INTERNAL_ERROR;
1914                 }
1915
1916                 /* Now extend the original search_res with these answers */
1917                 (*search_res)->count = 3;
1918
1919                 (*search_res)->msgs = talloc_realloc(frame, (*search_res)->msgs,
1920                                                      struct ldb_message *,
1921                                                      (*search_res)->count);
1922                 if ((*search_res)->msgs == NULL) {
1923                         TALLOC_FREE(frame);
1924                         return WERR_NOT_ENOUGH_MEMORY;
1925                 }
1926
1927
1928                 talloc_steal(mem_ctx, *search_res);
1929                 (*search_res)->msgs[1] =
1930                         talloc_steal((*search_res)->msgs, search_res2->msgs[0]);
1931                 (*search_res)->msgs[2] =
1932                         talloc_steal((*search_res)->msgs, search_res3->msgs[0]);
1933
1934                 TALLOC_FREE(frame);
1935                 return WERR_OK;
1936         }
1937         default:
1938                 /* TODO: implement extended op specific collection
1939                  * of objects. Right now we just normal procedure
1940                  * for collecting objects */
1941                 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1942         }
1943 }
1944
1945 static void dcesrv_drsuapi_update_highwatermark(const struct ldb_message *msg,
1946                                                 uint64_t max_usn,
1947                                                 struct drsuapi_DsReplicaHighWaterMark *hwm)
1948 {
1949         uint64_t uSN = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
1950
1951         if (uSN > max_usn) {
1952                 /*
1953                  * Only report the max_usn we had at the start
1954                  * of the replication cycle.
1955                  *
1956                  * If this object has changed lately we better
1957                  * let the destination dsa refetch the change.
1958                  * This is better than the risk of loosing some
1959                  * objects or linked attributes.
1960                  */
1961                 return;
1962         }
1963
1964         if (uSN <= hwm->tmp_highest_usn) {
1965                 return;
1966         }
1967
1968         hwm->tmp_highest_usn = uSN;
1969         hwm->reserved_usn = 0;
1970 }
1971
1972 /**
1973  * Adds an object's GUID to the cache of objects already sent.
1974  * This avoids us sending the same object multiple times when
1975  * the GetNCChanges request uses a flag like GET_ANC.
1976  */
1977 static WERROR dcesrv_drsuapi_obj_cache_add(struct db_context *obj_cache,
1978                                            const struct GUID *guid)
1979 {
1980         enum ndr_err_code ndr_err;
1981         uint8_t guid_buf[DRS_GUID_SIZE] = { 0, };
1982         DATA_BLOB b = {
1983                 .data = guid_buf,
1984                 .length = sizeof(guid_buf),
1985         };
1986         TDB_DATA key = {
1987                 .dptr = b.data,
1988                 .dsize = b.length,
1989         };
1990         TDB_DATA val = {
1991                 .dptr = NULL,
1992                 .dsize = 0,
1993         };
1994         NTSTATUS status;
1995
1996         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1997                         (ndr_push_flags_fn_t)ndr_push_GUID);
1998         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1999                 return WERR_DS_DRA_INTERNAL_ERROR;
2000         }
2001
2002         status = dbwrap_store(obj_cache, key, val, TDB_REPLACE);
2003         if (!NT_STATUS_IS_OK(status)) {
2004                 return WERR_DS_DRA_INTERNAL_ERROR;
2005         }
2006
2007         return WERR_OK;
2008 }
2009
2010 /**
2011  * Checks if the object with the GUID specified already exists in the
2012  * object cache, i.e. it's already been sent in a GetNCChanges response.
2013  */
2014 static WERROR dcesrv_drsuapi_obj_cache_exists(struct db_context *obj_cache,
2015                                               const struct GUID *guid)
2016 {
2017         enum ndr_err_code ndr_err;
2018         uint8_t guid_buf[DRS_GUID_SIZE] = { 0, };
2019         DATA_BLOB b = {
2020                 .data = guid_buf,
2021                 .length = sizeof(guid_buf),
2022         };
2023         TDB_DATA key = {
2024                 .dptr = b.data,
2025                 .dsize = b.length,
2026         };
2027         bool exists;
2028
2029         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
2030                         (ndr_push_flags_fn_t)ndr_push_GUID);
2031         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2032                 return WERR_DS_DRA_INTERNAL_ERROR;
2033         }
2034
2035         exists = dbwrap_exists(obj_cache, key);
2036         if (!exists) {
2037                 return WERR_OBJECT_NOT_FOUND;
2038         }
2039
2040         return WERR_OBJECT_NAME_EXISTS;
2041 }
2042
2043 /**
2044  * Copies the la_list specified into a sorted array, ready to be sent in a
2045  * GetNCChanges response.
2046  */
2047 static WERROR getncchanges_get_sorted_array(const struct drsuapi_DsReplicaLinkedAttribute *la_list,
2048                                             const uint32_t link_count,
2049                                             struct ldb_context *sam_ctx,
2050                                             TALLOC_CTX *mem_ctx,
2051                                             const struct dsdb_schema *schema,
2052                                             struct la_for_sorting **ret_array)
2053 {
2054         int j;
2055         struct la_for_sorting *guid_array;
2056         WERROR werr = WERR_OK;
2057
2058         *ret_array = NULL;
2059         guid_array = talloc_array(mem_ctx, struct la_for_sorting, link_count);
2060         if (guid_array == NULL) {
2061                 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", link_count));
2062                 return WERR_NOT_ENOUGH_MEMORY;
2063         }
2064
2065         for (j = 0; j < link_count; j++) {
2066
2067                 /* we need to get the target GUIDs to compare */
2068                 struct dsdb_dn *dn;
2069                 const struct drsuapi_DsReplicaLinkedAttribute *la = &la_list[j];
2070                 const struct dsdb_attribute *schema_attrib;
2071                 const struct ldb_val *target_guid;
2072                 DATA_BLOB source_guid;
2073                 TALLOC_CTX *frame = talloc_stackframe();
2074                 NTSTATUS status;
2075
2076                 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la->attid);
2077
2078                 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, frame, la->value.blob, &dn);
2079                 if (!W_ERROR_IS_OK(werr)) {
2080                         DEBUG(0,(__location__ ": Bad la blob in sort\n"));
2081                         TALLOC_FREE(frame);
2082                         return werr;
2083                 }
2084
2085                 /* Extract the target GUID in NDR form */
2086                 target_guid = ldb_dn_get_extended_component(dn->dn, "GUID");
2087                 if (target_guid == NULL
2088                                 || target_guid->length != sizeof(guid_array[0].target_guid)) {
2089                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2090                 } else {
2091                         /* Repack the source GUID as NDR for sorting */
2092                         status = GUID_to_ndr_blob(&la->identifier->guid,
2093                                                   frame,
2094                                                   &source_guid);
2095                 }
2096
2097                 if (!NT_STATUS_IS_OK(status)
2098                                 || source_guid.length != sizeof(guid_array[0].source_guid)) {
2099                         DEBUG(0,(__location__ ": Bad la guid in sort\n"));
2100                         TALLOC_FREE(frame);
2101                         return ntstatus_to_werror(status);
2102                 }
2103
2104                 guid_array[j].link = &la_list[j];
2105                 memcpy(guid_array[j].target_guid, target_guid->data,
2106                        sizeof(guid_array[j].target_guid));
2107                 memcpy(guid_array[j].source_guid, source_guid.data,
2108                        sizeof(guid_array[j].source_guid));
2109                 TALLOC_FREE(frame);
2110         }
2111
2112         LDB_TYPESAFE_QSORT(guid_array, link_count, NULL, linked_attribute_compare);
2113
2114         *ret_array = guid_array;
2115
2116         return werr;
2117 }
2118
2119
2120 /**
2121  * Adds any ancestor/parent objects of the child_obj specified.
2122  * This is needed when the GET_ANC flag is specified in the request.
2123  * @param new_objs if parents are added, this gets updated to point to a chain
2124  * of parent objects (with the parents first and the child last)
2125  */
2126 static WERROR getncchanges_add_ancestors(struct drsuapi_DsReplicaObjectListItemEx *child_obj,
2127                                          struct ldb_dn *child_dn,
2128                                          TALLOC_CTX *mem_ctx,
2129                                          struct ldb_context *sam_ctx,
2130                                          struct drsuapi_getncchanges_state *getnc_state,
2131                                          struct dsdb_schema *schema,
2132                                          DATA_BLOB *session_key,
2133                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
2134                                          uint32_t *local_pas,
2135                                          struct ldb_dn *machine_dn,
2136                                          struct drsuapi_DsReplicaObjectListItemEx **new_objs)
2137 {
2138         int ret;
2139         const struct GUID *next_anc_guid = NULL;
2140         WERROR werr = WERR_OK;
2141         static const char * const msg_attrs[] = {
2142                                             "*",
2143                                             "nTSecurityDescriptor",
2144                                             "parentGUID",
2145                                             "replPropertyMetaData",
2146                                             DSDB_SECRET_ATTRIBUTES,
2147                                             NULL };
2148
2149         next_anc_guid = child_obj->parent_object_guid;
2150
2151         while (next_anc_guid != NULL) {
2152                 struct drsuapi_DsReplicaObjectListItemEx *anc_obj = NULL;
2153                 struct ldb_message *anc_msg = NULL;
2154                 struct ldb_result *anc_res = NULL;
2155                 struct ldb_dn *anc_dn = NULL;
2156
2157                 /*
2158                  * Don't send an object twice. (If we've sent the object, then
2159                  * we've also sent all its parents as well)
2160                  */
2161                 werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
2162                                                        next_anc_guid);
2163                 if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2164                         return WERR_OK;
2165                 }
2166                 if (W_ERROR_IS_OK(werr)) {
2167                         return WERR_INTERNAL_ERROR;
2168                 }
2169                 if (!W_ERROR_EQUAL(werr, WERR_OBJECT_NOT_FOUND)) {
2170                         return werr;
2171                 }
2172
2173                 anc_obj = talloc_zero(mem_ctx,
2174                                       struct drsuapi_DsReplicaObjectListItemEx);
2175                 if (anc_obj == NULL) {
2176                         return WERR_NOT_ENOUGH_MEMORY;
2177                 }
2178
2179                 anc_dn = ldb_dn_new_fmt(anc_obj, sam_ctx, "<GUID=%s>",
2180                                         GUID_string(anc_obj, next_anc_guid));
2181                 if (anc_dn == NULL) {
2182                         return WERR_NOT_ENOUGH_MEMORY;
2183                 }
2184
2185                 ret = drsuapi_search_with_extended_dn(sam_ctx, anc_obj,
2186                                                       &anc_res, anc_dn,
2187                                                       LDB_SCOPE_BASE,
2188                                                       msg_attrs, NULL);
2189                 if (ret != LDB_SUCCESS) {
2190                         const char *anc_str = NULL;
2191                         const char *obj_str = NULL;
2192
2193                         anc_str = ldb_dn_get_extended_linearized(anc_obj,
2194                                                                  anc_dn,
2195                                                                  1);
2196                         obj_str = ldb_dn_get_extended_linearized(anc_obj,
2197                                                                  child_dn,
2198                                                                  1);
2199
2200                         DBG_ERR("getncchanges: failed to fetch ANC "
2201                                 "DN %s for DN %s - %s\n",
2202                                 anc_str, obj_str, ldb_errstring(sam_ctx));
2203                         return WERR_DS_DRA_INCONSISTENT_DIT;
2204                 }
2205
2206                 anc_msg = anc_res->msgs[0];
2207
2208                 werr = get_nc_changes_build_object(anc_obj, anc_msg,
2209                                                    sam_ctx,
2210                                                    getnc_state,
2211                                                    schema, session_key,
2212                                                    req10,
2213                                                    false, /* force_object_return */
2214                                                    local_pas,
2215                                                    machine_dn,
2216                                                    next_anc_guid);
2217                 if (!W_ERROR_IS_OK(werr)) {
2218                         return werr;
2219                 }
2220
2221                 /*
2222                  * Regardless of whether we actually use it or not,
2223                  * we add it to the cache so we don't look at it again
2224                  */
2225                 werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
2226                                                     next_anc_guid);
2227                 if (!W_ERROR_IS_OK(werr)) {
2228                         return werr;
2229                 }
2230
2231                 /*
2232                  * Any ancestors which are below the highwatermark
2233                  * or uptodateness_vector shouldn't be added,
2234                  * but we still look further up the
2235                  * tree for ones which have been changed recently.
2236                  */
2237                 if (anc_obj->meta_data_ctr != NULL) {
2238
2239                         /*
2240                          * prepend the parent to the list so that the client-side
2241                          * adds the parent object before it adds the children
2242                          */
2243                         anc_obj->next_object = *new_objs;
2244                         *new_objs = anc_obj;
2245                 }
2246
2247                 anc_msg = NULL;
2248                 TALLOC_FREE(anc_res);
2249                 TALLOC_FREE(anc_dn);
2250
2251                 /*
2252                  * We may need to resolve more parents...
2253                  */
2254                 next_anc_guid = anc_obj->parent_object_guid;
2255         }
2256         return werr;
2257 }
2258
2259 /**
2260  * Adds a list of new objects into the current chunk of replication data to send
2261  */
2262 static void getncchanges_chunk_add_objects(struct getncchanges_repl_chunk *repl_chunk,
2263                                            struct drsuapi_DsReplicaObjectListItemEx *obj_list)
2264 {
2265         struct drsuapi_DsReplicaObjectListItemEx *obj;
2266
2267         /*
2268          * We track the last object added to the replication chunk, so just add
2269          * the new object-list onto the end
2270          */
2271         if (repl_chunk->object_list == NULL) {
2272                 repl_chunk->object_list = obj_list;
2273         } else {
2274                 repl_chunk->last_object->next_object = obj_list;
2275         }
2276
2277         for (obj = obj_list; obj != NULL; obj = obj->next_object) {
2278                 repl_chunk->object_count += 1;
2279
2280                 /*
2281                  * Remember the last object in the response - we'll use this to
2282                  * link the next object(s) processed onto the existing list
2283                  */
2284                 if (obj->next_object == NULL) {
2285                         repl_chunk->last_object = obj;
2286                 }
2287         }
2288 }
2289
2290 /**
2291  * Gets the object to send, packed into an RPC struct ready to send. This also
2292  * adds the object to the object cache, and adds any ancestors (if needed).
2293  * @param msg - DB search result for the object to add
2294  * @param guid - GUID of the object to add
2295  * @param ret_obj_list - returns the object ready to be sent (in a list, along
2296  * with any ancestors that might be needed). NULL if nothing to send.
2297  */
2298 static WERROR getncchanges_get_obj_to_send(const struct ldb_message *msg,
2299                                            TALLOC_CTX *mem_ctx,
2300                                            struct ldb_context *sam_ctx,
2301                                            struct drsuapi_getncchanges_state *getnc_state,
2302                                            struct dsdb_schema *schema,
2303                                            DATA_BLOB *session_key,
2304                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
2305                                            bool force_object_return,
2306                                            uint32_t *local_pas,
2307                                            struct ldb_dn *machine_dn,
2308                                            const struct GUID *guid,
2309                                            struct drsuapi_DsReplicaObjectListItemEx **ret_obj_list)
2310 {
2311         struct drsuapi_DsReplicaObjectListItemEx *obj;
2312         WERROR werr;
2313
2314         *ret_obj_list = NULL;
2315
2316         obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
2317         W_ERROR_HAVE_NO_MEMORY(obj);
2318
2319         werr = get_nc_changes_build_object(obj, msg, sam_ctx, getnc_state,
2320                                            schema, session_key, req10,
2321                                            force_object_return,
2322                                            local_pas, machine_dn, guid);
2323         if (!W_ERROR_IS_OK(werr)) {
2324                 return werr;
2325         }
2326
2327         /*
2328          * The object may get filtered out by the UTDV's USN and not actually
2329          * sent, in which case there's nothing more to do here
2330          */
2331         if (obj->meta_data_ctr == NULL) {
2332                 TALLOC_FREE(obj);
2333                 return WERR_OK;
2334         }
2335
2336         if (getnc_state->obj_cache != NULL) {
2337                 werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
2338                                                     guid);
2339                 if (!W_ERROR_IS_OK(werr)) {
2340                         return werr;
2341                 }
2342         }
2343
2344         *ret_obj_list = obj;
2345
2346         /*
2347          * If required, also add any ancestors that the client may need to know
2348          * about before it can resolve this object. These get prepended to the
2349          * ret_obj_list so the client adds them first.
2350          */
2351         if (getnc_state->is_get_anc) {
2352                 werr = getncchanges_add_ancestors(obj, msg->dn, mem_ctx,
2353                                                   sam_ctx, getnc_state,
2354                                                   schema, session_key,
2355                                                   req10, local_pas,
2356                                                   machine_dn, ret_obj_list);
2357         }
2358
2359         return werr;
2360 }
2361
2362 /**
2363  * Returns the number of links that are waiting to be sent
2364  */
2365 static uint32_t getncchanges_chunk_links_pending(struct getncchanges_repl_chunk *repl_chunk,
2366                                                  struct drsuapi_getncchanges_state *getnc_state)
2367 {
2368         uint32_t links_to_send = 0;
2369
2370         if (getnc_state->is_get_tgt) {
2371
2372                 /*
2373                  * when the GET_TGT flag is set, only include the linked
2374                  * attributes whose target object has already been checked
2375                  * (i.e. they're ready to send).
2376                  */
2377                 if (repl_chunk->tgt_la_count > getnc_state->la_idx) {
2378                         links_to_send = (repl_chunk->tgt_la_count -
2379                                          getnc_state->la_idx);
2380                 }
2381         } else {
2382                 links_to_send = getnc_state->la_count - getnc_state->la_idx;
2383         }
2384
2385         return links_to_send;
2386 }
2387
2388 /**
2389  * Returns the max number of links that will fit in the current replication chunk
2390  */
2391 static uint32_t getncchanges_chunk_max_links(struct getncchanges_repl_chunk *repl_chunk)
2392 {
2393         uint32_t max_links = 0;
2394
2395         if (repl_chunk->max_links != DEFAULT_MAX_LINKS ||
2396             repl_chunk->max_objects != DEFAULT_MAX_OBJECTS) {
2397
2398                 /*
2399                  * We're using non-default settings, so don't try to adjust
2400                  * them, just trust the user has configured decent values
2401                  */
2402                 max_links = repl_chunk->max_links;
2403
2404         } else if (repl_chunk->max_links > repl_chunk->object_count) {
2405
2406                 /*
2407                  * This is just an approximate guess to avoid overfilling the
2408                  * replication chunk. It's the logic we've used historically.
2409                  * E.g. if we've already sent 1000 objects, then send 1000 fewer
2410                  * links. For comparison, the max that Windows seems to send is
2411                  * ~2700 links and ~250 objects (although this may vary based
2412                  * on timeouts)
2413                  */
2414                 max_links = repl_chunk->max_links - repl_chunk->object_count;
2415         }
2416
2417         return max_links;
2418 }
2419
2420 /**
2421  * Returns true if the current GetNCChanges() call has taken longer than its
2422  * allotted time. This prevents the client from timing out.
2423  */
2424 static bool getncchanges_chunk_timed_out(struct getncchanges_repl_chunk *repl_chunk)
2425 {
2426         return (time(NULL) - repl_chunk->start > repl_chunk->max_wait);
2427 }
2428
2429 /**
2430  * Returns true if the current chunk of replication data has reached the
2431  * max_objects and/or max_links thresholds.
2432  */
2433 static bool getncchanges_chunk_is_full(struct getncchanges_repl_chunk *repl_chunk,
2434                                        struct drsuapi_getncchanges_state *getnc_state)
2435 {
2436         bool chunk_full = false;
2437         uint32_t links_to_send;
2438         uint32_t chunk_limit;
2439
2440         /* check if the current chunk is already full with objects */
2441         if (repl_chunk->object_count >= repl_chunk->max_objects) {
2442                 chunk_full = true;
2443
2444         } else if (repl_chunk->object_count > 0 &&
2445                    getncchanges_chunk_timed_out(repl_chunk)) {
2446
2447                 /*
2448                  * We've exceeded our allotted time building this chunk,
2449                  * and we have at least one object to send back to the client
2450                  */
2451                 chunk_full = true;
2452
2453         } else if (repl_chunk->immediate_link_sync) {
2454
2455                 /* check if the chunk is already full with links */
2456                 links_to_send = getncchanges_chunk_links_pending(repl_chunk,
2457                                                                  getnc_state);
2458
2459                 chunk_limit = getncchanges_chunk_max_links(repl_chunk);
2460
2461                 /*
2462                  * The chunk is full if we've got more links to send than will
2463                  * fit in one chunk
2464                  */
2465                 if (links_to_send > 0 && chunk_limit <= links_to_send) {
2466                         chunk_full = true;
2467                 }
2468         }
2469
2470         return chunk_full;
2471 }
2472
2473 /**
2474  * Goes through any new linked attributes and checks that the target object
2475  * will be known to the client, i.e. we've already sent it in an replication
2476  * chunk. If not, then it adds the target object to the current replication
2477  * chunk. This is only done when the client specifies DRS_GET_TGT.
2478  */
2479 static WERROR getncchanges_chunk_add_la_targets(struct getncchanges_repl_chunk *repl_chunk,
2480                                                 struct drsuapi_getncchanges_state *getnc_state,
2481                                                 uint32_t start_la_index,
2482                                                 TALLOC_CTX *mem_ctx,
2483                                                 struct ldb_context *sam_ctx,
2484                                                 struct dsdb_schema *schema,
2485                                                 DATA_BLOB *session_key,
2486                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
2487                                                 uint32_t *local_pas,
2488                                                 struct ldb_dn *machine_dn)
2489 {
2490         int ret;
2491         uint32_t i;
2492         uint32_t max_la_index;
2493         uint32_t max_links;
2494         uint32_t target_count = 0;
2495         WERROR werr = WERR_OK;
2496         static const char * const msg_attrs[] = {
2497                                             "*",
2498                                             "nTSecurityDescriptor",
2499                                             "parentGUID",
2500                                             "replPropertyMetaData",
2501                                             DSDB_SECRET_ATTRIBUTES,
2502                                             NULL };
2503
2504         /*
2505          * A object can potentially link to thousands of targets. Only bother
2506          * checking as many targets as will fit into the current response
2507          */
2508         max_links = getncchanges_chunk_max_links(repl_chunk);
2509         max_la_index = MIN(getnc_state->la_count,
2510                            start_la_index + max_links);
2511
2512         /* loop through any linked attributes to check */
2513         for (i = start_la_index;
2514              (i < max_la_index &&
2515               !getncchanges_chunk_is_full(repl_chunk, getnc_state));
2516              i++) {
2517
2518                 struct GUID target_guid;
2519                 struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
2520                 const struct drsuapi_DsReplicaLinkedAttribute *la;
2521                 struct ldb_result *msg_res;
2522                 struct ldb_dn *search_dn;
2523                 TALLOC_CTX *tmp_ctx;
2524                 struct dsdb_dn *dn;
2525                 const struct dsdb_attribute *schema_attrib;
2526                 NTSTATUS status;
2527                 bool same_nc;
2528
2529                 la = &getnc_state->la_list[i];
2530                 tmp_ctx = talloc_new(mem_ctx);
2531
2532                 /*
2533                  * Track what linked attribute targets we've checked. We might
2534                  * not have time to check them all, so we should only send back
2535                  * the ones we've actually checked.
2536                  */
2537                 repl_chunk->tgt_la_count = i + 1;
2538
2539                 /* get the GUID of the linked attribute's target object */
2540                 schema_attrib = dsdb_attribute_by_attributeID_id(schema,
2541                                                                  la->attid);
2542
2543                 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema,
2544                                             tmp_ctx, la->value.blob, &dn);
2545
2546                 if (!W_ERROR_IS_OK(werr)) {
2547                         DEBUG(0,(__location__ ": Bad la blob\n"));
2548                         return werr;
2549                 }
2550
2551                 status = dsdb_get_extended_dn_guid(dn->dn, &target_guid, "GUID");
2552
2553                 if (!NT_STATUS_IS_OK(status)) {
2554                         return ntstatus_to_werror(status);
2555                 }
2556
2557                 /*
2558                  * if the target isn't in the cache, then the client
2559                  * might not know about it, so send the target now
2560                  */
2561                 werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
2562                                                        &target_guid);
2563
2564                 if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2565
2566                         /* target already sent, nothing to do */
2567                         TALLOC_FREE(tmp_ctx);
2568                         continue;
2569                 }
2570
2571                 same_nc = dsdb_objects_have_same_nc(sam_ctx, tmp_ctx, dn->dn,
2572                                                     getnc_state->ncRoot_dn);
2573
2574                 /* don't try to fetch target objects from another partition */
2575                 if (!same_nc) {
2576                         TALLOC_FREE(tmp_ctx);
2577                         continue;
2578                 }
2579
2580                 search_dn = ldb_dn_new_fmt(tmp_ctx, sam_ctx, "<GUID=%s>",
2581                                            GUID_string(tmp_ctx, &target_guid));
2582                 W_ERROR_HAVE_NO_MEMORY(search_dn);
2583
2584                 ret = drsuapi_search_with_extended_dn(sam_ctx, tmp_ctx,
2585                                                       &msg_res, search_dn,
2586                                                       LDB_SCOPE_BASE,
2587                                                       msg_attrs, NULL);
2588
2589                 /*
2590                  * Don't fail the replication if we can't find the target.
2591                  * This could happen for a one-way linked attribute, if the
2592                  * target is deleted and then later expunged (thus, the source
2593                  * object can be left with a hanging link). Continue to send
2594                  * the the link (the client-side has already tried once with
2595                  * GET_TGT, so it should just end up ignoring it).
2596                  */
2597                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2598                         DBG_WARNING("Encountered unknown link target DN %s\n",
2599                                     ldb_dn_get_extended_linearized(tmp_ctx, dn->dn, 1));
2600                         TALLOC_FREE(tmp_ctx);
2601                         continue;
2602
2603                 } else if (ret != LDB_SUCCESS) {
2604                         DBG_ERR("Failed to fetch link target DN %s - %s\n",
2605                                 ldb_dn_get_extended_linearized(tmp_ctx, dn->dn, 1),
2606                                 ldb_errstring(sam_ctx));
2607                         return WERR_DS_DRA_INCONSISTENT_DIT;
2608                 }
2609
2610                 /*
2611                  * Construct an object, ready to send (this will include
2612                  * the object's ancestors as well, if GET_ANC is set)
2613                  */
2614                 werr = getncchanges_get_obj_to_send(msg_res->msgs[0], mem_ctx,
2615                                                     sam_ctx, getnc_state,
2616                                                     schema, session_key, req10,
2617                                                     false, local_pas,
2618                                                     machine_dn, &target_guid,
2619                                                     &new_objs);
2620                 if (!W_ERROR_IS_OK(werr)) {
2621                         return werr;
2622                 }
2623
2624                 if (new_objs != NULL) {
2625                         target_count++;
2626                         getncchanges_chunk_add_objects(repl_chunk, new_objs);
2627                 }
2628                 TALLOC_FREE(tmp_ctx);
2629         }
2630
2631         if (target_count > 0) {
2632                 DEBUG(3, ("GET_TGT: checked %u link-attrs, added %u target objs\n",
2633                           i - start_la_index, target_count));
2634         }
2635
2636         return WERR_OK;
2637 }
2638
2639 /**
2640  * Creates a helper struct used for building a chunk of replication data,
2641  * i.e. used over a single call to dcesrv_drsuapi_DsGetNCChanges().
2642  */
2643 static struct getncchanges_repl_chunk * getncchanges_chunk_new(TALLOC_CTX *mem_ctx,
2644                                                                struct dcesrv_call_state *dce_call,
2645                                                                struct drsuapi_DsGetNCChangesRequest10 *req10)
2646 {
2647         struct getncchanges_repl_chunk *repl_chunk;
2648
2649         repl_chunk = talloc_zero(mem_ctx, struct getncchanges_repl_chunk);
2650
2651         repl_chunk->start = time(NULL);
2652
2653         repl_chunk->max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL,
2654                                                  "drs", "max object sync",
2655                                                  DEFAULT_MAX_OBJECTS);
2656
2657         /*
2658          * The client control here only applies in normal replication, not extended
2659          * operations, which return a fixed set, even if the caller
2660          * sets max_object_count == 0
2661          */
2662         if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2663
2664                 /*
2665                  * use this to force single objects at a time, which is useful
2666                  * for working out what object is giving problems
2667                  */
2668                 if (req10->max_object_count < repl_chunk->max_objects) {
2669                         repl_chunk->max_objects = req10->max_object_count;
2670                 }
2671         }
2672
2673         repl_chunk->max_links =
2674                         lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL,
2675                                        "drs", "max link sync",
2676                                         DEFAULT_MAX_LINKS);
2677
2678         repl_chunk->immediate_link_sync =
2679                         lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL,
2680                                         "drs", "immediate link sync", false);
2681
2682         /*
2683          * Maximum time that we can spend in a getncchanges
2684          * in order to avoid timeout of the other part.
2685          * 10 seconds by default.
2686          */
2687         repl_chunk->max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx,
2688                                               NULL, "drs", "max work time", 10);
2689
2690         return repl_chunk;
2691 }
2692
2693 /*
2694   drsuapi_DsGetNCChanges
2695
2696   see MS-DRSR 4.1.10.5.2 for basic logic of this function
2697 */
2698 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2699                                      struct drsuapi_DsGetNCChanges *r)
2700 {
2701         struct auth_session_info *session_info =
2702                 dcesrv_call_session_info(dce_call);
2703         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
2704         int ret;
2705         uint32_t i, k;
2706         struct dsdb_schema *schema;
2707         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
2708         struct getncchanges_repl_chunk *repl_chunk;
2709         NTSTATUS status;
2710         DATA_BLOB session_key;
2711         WERROR werr;
2712         struct dcesrv_handle *h;
2713         struct drsuapi_bind_state *b_state;
2714         struct drsuapi_getncchanges_state *getnc_state;
2715         struct drsuapi_DsGetNCChangesRequest10 *req10;
2716         uint32_t options;
2717         uint32_t link_count = 0;
2718         struct ldb_dn *search_dn = NULL;
2719         bool am_rodc;
2720         enum security_user_level security_level;
2721         struct ldb_context *sam_ctx;
2722         struct dom_sid *user_sid;
2723         bool is_secret_request;
2724         bool is_gc_pas_request;
2725         struct drsuapi_changed_objects *changes;
2726         bool has_get_all_changes = false;
2727         struct GUID invocation_id;
2728         static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
2729         struct dsdb_schema_prefixmap *pfm_remote = NULL;
2730         bool full = true;
2731         uint32_t *local_pas = NULL;
2732         struct ldb_dn *machine_dn = NULL; /* Only used for REPL SECRET EXOP */
2733
2734         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
2735         b_state = h->data;
2736
2737         /* sam_ctx_system is not present for non-administrator users */
2738         sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
2739
2740         invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2741
2742         *r->out.level_out = 6;
2743
2744         r->out.ctr->ctr6.linked_attributes_count = 0;
2745         r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
2746
2747         r->out.ctr->ctr6.object_count = 0;
2748         r->out.ctr->ctr6.nc_object_count = 0;
2749         r->out.ctr->ctr6.more_data = false;
2750         r->out.ctr->ctr6.uptodateness_vector = NULL;
2751         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2752         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2753         r->out.ctr->ctr6.first_object = NULL;
2754
2755         /* Check request revision.
2756          */
2757         switch (r->in.level) {
2758         case 8:
2759                 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
2760                 if (req10 == NULL) {
2761                         return WERR_NOT_ENOUGH_MEMORY;
2762                 }
2763                 break;
2764         case 10:
2765                 req10 = &r->in.req->req10;
2766                 break;
2767         default:
2768                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
2769                          r->in.level));
2770                 return WERR_REVISION_MISMATCH;
2771         }
2772
2773         repl_chunk = getncchanges_chunk_new(mem_ctx, dce_call, req10);
2774
2775         if (repl_chunk == NULL) {
2776                 return WERR_NOT_ENOUGH_MEMORY;
2777         }
2778
2779         /* a RODC doesn't allow for any replication */
2780         ret = samdb_rodc(sam_ctx, &am_rodc);
2781         if (ret == LDB_SUCCESS && am_rodc) {
2782                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
2783                 return WERR_DS_DRA_SOURCE_DISABLED;
2784         }
2785
2786         /* Perform access checks. */
2787         /* TODO: we need to support a sync on a specific non-root
2788          * DN. We'll need to find the real partition root here */
2789         ncRoot = req10->naming_context;
2790         if (ncRoot == NULL) {
2791                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
2792                 return WERR_DS_DRA_INVALID_PARAMETER;
2793         }
2794
2795         if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
2796                 return WERR_DS_DRA_INTERNAL_ERROR;
2797         }
2798
2799         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
2800             !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
2801                 return WERR_DS_DRA_SOURCE_DISABLED;
2802         }
2803
2804         user_sid = &session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
2805
2806         /* all clients must have GUID_DRS_GET_CHANGES */
2807         werr = drs_security_access_check_nc_root(sam_ctx,
2808                                                  mem_ctx,
2809                                                  session_info->security_token,
2810                                                  req10->naming_context,
2811                                                  GUID_DRS_GET_CHANGES);
2812         if (!W_ERROR_IS_OK(werr)) {
2813                 return werr;
2814         }
2815
2816         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) {
2817                 full = req10->partial_attribute_set == NULL &&
2818                        req10->partial_attribute_set_ex == NULL;
2819         } else {
2820                 full = (options & DRSUAPI_DRS_WRIT_REP) != 0;
2821         }
2822
2823         werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true,
2824                                                 mem_ctx, &pfm_remote, NULL);
2825
2826         /* We were supplied a partial attribute set, without the prefix map! */
2827         if (!full && !W_ERROR_IS_OK(werr)) {
2828                 if (req10->mapping_ctr.num_mappings == 0) {
2829                         /*
2830                          * Despite the fact MS-DRSR specifies that this shouldn't
2831                          * happen, Windows RODCs will in fact not provide a prefixMap.
2832                          */
2833                         DEBUG(5,(__location__ ": Failed to provide a remote prefixMap,"
2834                                  " falling back to local prefixMap\n"));
2835                 } else {
2836                         DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n",
2837                                  win_errstr(werr)));
2838                         return werr;
2839                 }
2840         }
2841
2842         /* allowed if the GC PAS and client has
2843            GUID_DRS_GET_FILTERED_ATTRIBUTES */
2844         werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request);
2845         if (!W_ERROR_IS_OK(werr)) {
2846                 return werr;
2847         }
2848         if (is_gc_pas_request) {
2849                 werr = drs_security_access_check_nc_root(sam_ctx,
2850                                                          mem_ctx,
2851                                                          session_info->security_token,
2852                                                          req10->naming_context,
2853                                                          GUID_DRS_GET_FILTERED_ATTRIBUTES);
2854                 if (W_ERROR_IS_OK(werr)) {
2855                         goto allowed;
2856                 }
2857         }
2858
2859         werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10,
2860                                                         pfm_remote,
2861                                                         &is_secret_request);
2862         if (!W_ERROR_IS_OK(werr)) {
2863                 return werr;
2864         }
2865         if (is_secret_request) {
2866                 werr = drs_security_access_check_nc_root(sam_ctx,
2867                                                          mem_ctx,
2868                                                          session_info->security_token,
2869                                                          req10->naming_context,
2870                                                          GUID_DRS_GET_ALL_CHANGES);
2871                 if (!W_ERROR_IS_OK(werr)) {
2872                         /* Only bail if this is not a EXOP_REPL_SECRET */
2873                         if (req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
2874                                 return werr;
2875                         }
2876                 } else {
2877                         has_get_all_changes = true;
2878                 }
2879         }
2880
2881 allowed:
2882         /* for non-administrator replications, check that they have
2883            given the correct source_dsa_invocation_id */
2884         security_level = security_session_user_level(session_info,
2885                                                      samdb_domain_sid(sam_ctx));
2886         if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
2887                 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
2888                         /* we rely on this flag being unset for RODC requests */
2889                         req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2890                 }
2891         }
2892
2893         if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
2894                 /* Ignore the _in_ uptpdateness vector*/
2895                 req10->uptodateness_vector = NULL;
2896         }
2897
2898         if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
2899                 req10->source_dsa_invocation_id = invocation_id;
2900         }
2901
2902         if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
2903                 /*
2904                  * The given highwatermark is only valid relative to the
2905                  * specified source_dsa_invocation_id.
2906                  */
2907                 ZERO_STRUCT(req10->highwatermark);
2908         }
2909
2910         getnc_state = b_state->getncchanges_state;
2911
2912         /* see if a previous replication has been abandoned */
2913         if (getnc_state) {
2914                 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
2915                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
2916                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
2917                                  ldb_dn_get_linearized(new_dn),
2918                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2919                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2920                         TALLOC_FREE(getnc_state);
2921                         b_state->getncchanges_state = NULL;
2922                 }
2923         }
2924
2925         if (getnc_state) {
2926                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
2927                                                          &req10->highwatermark);
2928                 if (ret != 0) {
2929                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
2930                                  "on DN %s %s highwatermark (last_dn %s)\n",
2931                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2932                                  (ret > 0) ? "older" : "newer",
2933                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2934                         TALLOC_FREE(getnc_state);
2935                         b_state->getncchanges_state = NULL;
2936                 }
2937         }
2938
2939         if (getnc_state == NULL) {
2940                 struct ldb_result *res = NULL;
2941                 const char *attrs[] = {
2942                         "instanceType",
2943                         "objectGuID",
2944                         NULL
2945                 };
2946                 uint32_t nc_instanceType;
2947                 struct ldb_dn *ncRoot_dn;
2948
2949                 ncRoot_dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, ncRoot);
2950                 if (ncRoot_dn == NULL) {
2951                         return WERR_NOT_ENOUGH_MEMORY;
2952                 }
2953
2954                 ret = dsdb_search_dn(sam_ctx, mem_ctx, &res,
2955                                      ncRoot_dn, attrs,
2956                                      DSDB_SEARCH_SHOW_DELETED |
2957                                      DSDB_SEARCH_SHOW_RECYCLED);
2958                 if (ret != LDB_SUCCESS) {
2959                         DBG_WARNING("Failed to find ncRoot_dn %s\n",
2960                                     ldb_dn_get_linearized(ncRoot_dn));
2961                         return WERR_DS_DRA_BAD_DN;
2962                 }
2963                 nc_instanceType = ldb_msg_find_attr_as_int(res->msgs[0],
2964                                                            "instanceType",
2965                                                            0);
2966
2967                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2968                         r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
2969                 }
2970
2971                 /*
2972                  * This is the first replication cycle and it is
2973                  * a good place to handle extended operations
2974                  *
2975                  * FIXME: we don't fully support extended operations yet
2976                  */
2977                 switch (req10->extended_op) {
2978                 case DRSUAPI_EXOP_NONE:
2979                         if ((nc_instanceType & INSTANCE_TYPE_IS_NC_HEAD) == 0) {
2980                                 const char *dn_str
2981                                         = ldb_dn_get_linearized(ncRoot_dn);
2982
2983                                 DBG_NOTICE("Rejecting full replication on "
2984                                            "not NC %s", dn_str);
2985
2986                                 return WERR_DS_CANT_FIND_EXPECTED_NC;
2987                         }
2988
2989                         break;
2990                 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
2991                         werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6, &search_dn);
2992                         W_ERROR_NOT_OK_RETURN(werr);
2993                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2994                                 return WERR_OK;
2995                         }
2996                         break;
2997                 case DRSUAPI_EXOP_REPL_SECRET:
2998                         werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
2999                                                         user_sid,
3000                                                         &r->out.ctr->ctr6,
3001                                                         has_get_all_changes,
3002                                                         &machine_dn);
3003                         r->out.result = werr;
3004                         W_ERROR_NOT_OK_RETURN(werr);
3005                         break;
3006                 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
3007                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
3008                         W_ERROR_NOT_OK_RETURN(werr);
3009                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
3010                                 return WERR_OK;
3011                         }
3012                         break;
3013                 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
3014                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
3015                         W_ERROR_NOT_OK_RETURN(werr);
3016                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
3017                                 return WERR_OK;
3018                         }
3019                         break;
3020                 case DRSUAPI_EXOP_FSMO_REQ_PDC:
3021                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
3022                         W_ERROR_NOT_OK_RETURN(werr);
3023                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
3024                                 return WERR_OK;
3025                         }
3026                         break;
3027                 case DRSUAPI_EXOP_REPL_OBJ:
3028                         werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
3029                         r->out.result = werr;
3030                         W_ERROR_NOT_OK_RETURN(werr);
3031                         break;
3032
3033                 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
3034
3035                         DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
3036                                  (unsigned)req10->extended_op));
3037                         return WERR_DS_DRA_NOT_SUPPORTED;
3038                 }
3039
3040                 /* Initialize the state we'll store over the replication cycle */
3041                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
3042                 if (getnc_state == NULL) {
3043                         return WERR_NOT_ENOUGH_MEMORY;
3044                 }
3045                 b_state->getncchanges_state = getnc_state;
3046
3047                 getnc_state->ncRoot_dn = ncRoot_dn;
3048                 talloc_steal(getnc_state, ncRoot_dn);
3049
3050                 getnc_state->ncRoot_guid = samdb_result_guid(res->msgs[0],
3051                                                              "objectGUID");
3052                 ncRoot->guid = getnc_state->ncRoot_guid;
3053
3054                 /* find out if we are to replicate Schema NC */
3055                 ret = ldb_dn_compare_base(ldb_get_schema_basedn(sam_ctx),
3056                                           ncRoot_dn);
3057                 getnc_state->is_schema_nc = (0 == ret);
3058
3059                 TALLOC_FREE(res);
3060         }
3061
3062         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
3063             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
3064                 DEBUG(0,(__location__ ": Bad DN '%s'\n",
3065                          drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
3066                 return WERR_DS_DRA_INVALID_PARAMETER;
3067         }
3068
3069         ncRoot->guid = getnc_state->ncRoot_guid;
3070
3071         /* we need the session key for encrypting password attributes */
3072         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
3073         if (!NT_STATUS_IS_OK(status)) {
3074                 DEBUG(0,(__location__ ": Failed to get session key\n"));
3075                 return WERR_DS_DRA_INTERNAL_ERROR;
3076         }
3077
3078         /*
3079            TODO: MS-DRSR section 4.1.10.1.1
3080            Work out if this is the start of a new cycle */
3081
3082         if (getnc_state->guids == NULL) {
3083                 const char *extra_filter;
3084                 struct ldb_result *search_res = NULL;
3085                 static const struct drsuapi_DsReplicaCursorCtrEx empty_udv;
3086                 const struct drsuapi_DsReplicaCursorCtrEx *udv = NULL;
3087
3088                 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
3089
3090                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
3091                         if (req10->uptodateness_vector != NULL) {
3092                                 udv = req10->uptodateness_vector;
3093                         } else {
3094                                 udv = &empty_udv;
3095                         }
3096
3097                         getnc_state->min_usn = req10->highwatermark.highest_usn;
3098                         for (i = 0; i < udv->count; i++) {
3099                                 bool match;
3100                                 const struct drsuapi_DsReplicaCursor *cur =
3101                                         &udv->cursors[i];
3102
3103                                 match = GUID_equal(&invocation_id,
3104                                                    &cur->source_dsa_invocation_id);
3105                                 if (!match) {
3106                                         continue;
3107                                 }
3108                                 if (cur->highest_usn > getnc_state->min_usn) {
3109                                         getnc_state->min_usn = cur->highest_usn;
3110                                 }
3111                                 break;
3112                         }
3113                 } else {
3114                         /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
3115                         udv = &empty_udv;
3116                         getnc_state->min_usn = 0;
3117                 }
3118
3119                 getnc_state->max_usn = getnc_state->min_usn;
3120
3121                 getnc_state->final_udv = talloc_zero(getnc_state,
3122                                         struct drsuapi_DsReplicaCursor2CtrEx);
3123                 if (getnc_state->final_udv == NULL) {
3124                         return WERR_NOT_ENOUGH_MEMORY;
3125                 }
3126                 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
3127                                           getnc_state->final_udv);
3128                 if (!W_ERROR_IS_OK(werr)) {
3129                         return werr;
3130                 }
3131
3132                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
3133                         werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
3134                                                             search_dn, extra_filter,
3135                                                             &search_res);
3136                 } else {
3137                         werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
3138                                                                  &r->out.ctr->ctr6,
3139                                                                  search_dn, extra_filter,
3140                                                                  &search_res);
3141                 }
3142                 W_ERROR_NOT_OK_RETURN(werr);
3143
3144                 /* extract out the GUIDs list */
3145                 getnc_state->num_records = search_res ? search_res->count : 0;
3146                 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
3147                 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
3148
3149                 changes = talloc_array(getnc_state,
3150                                        struct drsuapi_changed_objects,
3151                                        getnc_state->num_records);
3152                 W_ERROR_HAVE_NO_MEMORY(changes);
3153
3154                 for (i=0; i<getnc_state->num_records; i++) {
3155                         changes[i].dn = search_res->msgs[i]->dn;
3156                         changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
3157                         changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
3158
3159                         if (changes[i].usn > getnc_state->max_usn) {
3160                                 getnc_state->max_usn = changes[i].usn;
3161                         }
3162                 }
3163
3164                 /* RID_ALLOC returns 3 objects in a fixed order */
3165                 if (req10->extended_op == DRSUAPI_EXOP_FSMO_RID_ALLOC) {
3166                         /* Do nothing */
3167                 } else {
3168                         LDB_TYPESAFE_QSORT(changes,
3169                                            getnc_state->num_records,
3170                                            getnc_state,
3171                                            site_res_cmp_usn_order);
3172                 }
3173
3174                 for (i=0; i < getnc_state->num_records; i++) {
3175                         getnc_state->guids[i] = changes[i].guid;
3176                         if (GUID_all_zero(&getnc_state->guids[i])) {
3177                                 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
3178                                          ldb_dn_get_linearized(search_res->msgs[i]->dn)));
3179                                 return WERR_DS_DRA_INTERNAL_ERROR;
3180                         }
3181                 }
3182
3183                 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
3184                 getnc_state->final_hwm.reserved_usn = 0;
3185                 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
3186
3187                 talloc_free(search_res);
3188                 talloc_free(changes);
3189
3190                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
3191                         getnc_state->is_get_anc =
3192                                 ((req10->replica_flags & DRSUAPI_DRS_GET_ANC) != 0);
3193                         getnc_state->is_get_tgt =
3194                                 ((req10->more_flags & DRSUAPI_DRS_GET_TGT) != 0);
3195                 }
3196
3197                 /*
3198                  * when using GET_ANC or GET_TGT, cache the objects that have
3199                  * been already sent, to avoid sending them multiple times
3200                  */
3201                 if (getnc_state->is_get_anc || getnc_state->is_get_tgt) {
3202                         DEBUG(3,("Using object cache, GET_ANC %u, GET_TGT %u\n",
3203                                  getnc_state->is_get_anc,
3204                                  getnc_state->is_get_tgt));
3205
3206                         getnc_state->obj_cache = db_open_rbt(getnc_state);
3207                         if (getnc_state->obj_cache == NULL) {
3208                                 return WERR_NOT_ENOUGH_MEMORY;
3209                         }
3210                 }
3211         }
3212
3213         if (req10->uptodateness_vector) {
3214                 /* make sure its sorted */
3215                 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
3216                                req10->uptodateness_vector->count,
3217                                drsuapi_DsReplicaCursor_compare);
3218         }
3219
3220         /* Prefix mapping */
3221         schema = dsdb_get_schema(sam_ctx, mem_ctx);
3222         if (!schema) {
3223                 DEBUG(0,("No schema in sam_ctx\n"));
3224                 return WERR_DS_DRA_INTERNAL_ERROR;
3225         }
3226
3227         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
3228         if (r->out.ctr->ctr6.naming_context == NULL) {
3229                 return WERR_NOT_ENOUGH_MEMORY;
3230         }
3231         *r->out.ctr->ctr6.naming_context = *ncRoot;
3232
3233         /* find the SID if there is one */
3234         dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
3235
3236         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
3237         r->out.ctr->ctr6.mapping_ctr = *ctr;
3238
3239         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
3240         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
3241
3242         r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
3243         r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
3244
3245         /*
3246          * If the client has already set GET_TGT then we know they can handle
3247          * receiving the linked attributes interleaved with the source objects
3248          */
3249         if (getnc_state->is_get_tgt) {
3250                 repl_chunk->immediate_link_sync = true;
3251         }
3252
3253         if (req10->partial_attribute_set != NULL) {
3254                 struct dsdb_syntax_ctx syntax_ctx;
3255                 uint32_t j = 0;
3256
3257                 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
3258                 syntax_ctx.pfm_remote = pfm_remote;
3259
3260                 local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids);
3261
3262                 for (j = 0; j < req10->partial_attribute_set->num_attids; j++) {
3263                         getncchanges_attid_remote_to_local(schema,
3264                                                            &syntax_ctx,
3265                                                            req10->partial_attribute_set->attids[j],
3266                                                            (enum drsuapi_DsAttributeId *)&local_pas[j],
3267                                                            NULL);
3268                 }
3269
3270                 LDB_TYPESAFE_QSORT(local_pas,
3271                                    req10->partial_attribute_set->num_attids,
3272                                    NULL,
3273                                    uint32_t_ptr_cmp);
3274         }
3275
3276         /*
3277          * Check in case we're still processing the links from an object in the
3278          * previous chunk. We want to send the links (and any targets needed)
3279          * before moving on to the next object.
3280          */
3281         if (getnc_state->is_get_tgt) {
3282                 werr = getncchanges_chunk_add_la_targets(repl_chunk,
3283                                                          getnc_state,
3284                                                          getnc_state->la_idx,
3285                                                          mem_ctx, sam_ctx,
3286                                                          schema, &session_key,
3287                                                          req10, local_pas,
3288                                                          machine_dn);
3289
3290                 if (!W_ERROR_IS_OK(werr)) {
3291                         return werr;
3292                 }
3293         }
3294
3295         for (i=getnc_state->num_processed;
3296              i<getnc_state->num_records &&
3297                      !getncchanges_chunk_is_full(repl_chunk, getnc_state);
3298             i++) {
3299                 struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
3300                 struct ldb_message *msg;
3301                 static const char * const msg_attrs[] = {
3302                                             "*",
3303                                             "nTSecurityDescriptor",
3304                                             "parentGUID",
3305                                             "replPropertyMetaData",
3306                                             DSDB_SECRET_ATTRIBUTES,
3307                                             NULL };
3308                 struct ldb_result *msg_res;
3309                 struct ldb_dn *msg_dn;
3310                 bool obj_already_sent = false;
3311                 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
3312                 uint32_t old_la_index;
3313
3314                 msg_dn = ldb_dn_new_fmt(tmp_ctx, sam_ctx, "<GUID=%s>",
3315                                         GUID_string(tmp_ctx, &getnc_state->guids[i]));
3316                 W_ERROR_HAVE_NO_MEMORY(msg_dn);
3317
3318                 /*
3319                  * by re-searching here we avoid having a lot of full
3320                  * records in memory between calls to getncchanges.
3321                  *
3322                  * We expect that we may get some objects that vanish
3323                  * (tombstone expunge) between the first and second
3324                  * check.
3325                  */
3326                 ret = drsuapi_search_with_extended_dn(sam_ctx, tmp_ctx, &msg_res,
3327                                                       msg_dn,
3328                                                       LDB_SCOPE_BASE, msg_attrs, NULL);
3329                 if (ret != LDB_SUCCESS) {
3330                         if (ret != LDB_ERR_NO_SUCH_OBJECT) {
3331                                 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
3332                                          ldb_dn_get_extended_linearized(tmp_ctx, msg_dn, 1),
3333                                          ldb_errstring(sam_ctx)));
3334                         }
3335                         TALLOC_FREE(tmp_ctx);
3336                         continue;
3337                 }
3338
3339                 if (msg_res->count == 0) {
3340                         DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
3341                                  "to get any results in fetch of DN "
3342                                  "%s (race with tombstone expunge?)\n",
3343                                  ldb_dn_get_extended_linearized(tmp_ctx,
3344                                                                 msg_dn, 1)));
3345                         TALLOC_FREE(tmp_ctx);
3346                         continue;
3347                 }
3348
3349                 msg = msg_res->msgs[0];
3350
3351                 /*
3352                  * Check if we've already sent the object as an ancestor of
3353                  * another object. If so, we don't need to send it again
3354                  */
3355                 if (getnc_state->obj_cache != NULL) {
3356                         werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
3357                                                                &getnc_state->guids[i]);
3358                         if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
3359                                 obj_already_sent = true;
3360                         }
3361                 }
3362
3363                 if (!obj_already_sent) {
3364                         bool max_wait_reached;
3365
3366                         max_wait_reached = getncchanges_chunk_timed_out(repl_chunk);
3367
3368                         /*
3369                          * Construct an object, ready to send (this will include
3370                          * the object's ancestors as well, if needed)
3371                          */
3372                         werr = getncchanges_get_obj_to_send(msg, mem_ctx, sam_ctx,
3373                                                             getnc_state, schema,
3374                                                             &session_key, req10,
3375                                                             max_wait_reached,
3376                                                             local_pas, machine_dn,
3377                                                             &getnc_state->guids[i],
3378                                                             &new_objs);
3379                         if (!W_ERROR_IS_OK(werr)) {
3380                                 return werr;
3381                         }
3382                 }
3383
3384                 old_la_index = getnc_state->la_count;
3385
3386                 /*
3387                  * We've reached the USN where this object naturally occurs.
3388                  * Regardless of whether we've already sent the object (as an
3389                  * ancestor), we add its links and update the HWM at this point
3390                  */
3391                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
3392                                                 getnc_state->is_schema_nc,
3393                                                 schema, getnc_state->min_usn,
3394                                                 req10->replica_flags,
3395                                                 msg,
3396                                                 &getnc_state->la_list,
3397                                                 &getnc_state->la_count,
3398                                                 req10->uptodateness_vector);
3399                 if (!W_ERROR_IS_OK(werr)) {
3400                         return werr;
3401                 }
3402
3403                 dcesrv_drsuapi_update_highwatermark(msg,
3404                                         getnc_state->max_usn,
3405                                         &r->out.ctr->ctr6.new_highwatermark);
3406
3407                 if (new_objs != NULL) {
3408
3409                         /*
3410                          * Add the object (and, if GET_ANC, any parents it may
3411                          * have) into the current chunk of replication data
3412                          */
3413                         getncchanges_chunk_add_objects(repl_chunk, new_objs);
3414
3415                         talloc_free(getnc_state->last_dn);
3416                         getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
3417                 }
3418
3419                 DEBUG(8,(__location__ ": %s object %s\n",
3420                          new_objs ? "replicating" : "skipping send of",
3421                          ldb_dn_get_linearized(msg->dn)));
3422
3423                 getnc_state->total_links += (getnc_state->la_count - old_la_index);
3424
3425                 /*
3426                  * If the GET_TGT flag was set, check any new links added to
3427                  * make sure the client knows about the link target object
3428                  */
3429                 if (getnc_state->is_get_tgt) {
3430                         werr = getncchanges_chunk_add_la_targets(repl_chunk,
3431                                                                  getnc_state,
3432                                                                  old_la_index,
3433                                                                  mem_ctx, sam_ctx,
3434                                                                  schema, &session_key,
3435                                                                  req10, local_pas,
3436                                                                  machine_dn);
3437
3438                         if (!W_ERROR_IS_OK(werr)) {
3439                                 return werr;
3440                         }
3441                 }
3442
3443                 TALLOC_FREE(tmp_ctx);
3444         }
3445
3446         /* copy the constructed object list into the response message */
3447         r->out.ctr->ctr6.object_count = repl_chunk->object_count;
3448         r->out.ctr->ctr6.first_object = repl_chunk->object_list;
3449
3450         getnc_state->num_processed = i;
3451
3452         if (i < getnc_state->num_records) {
3453                 r->out.ctr->ctr6.more_data = true;
3454         }
3455
3456         /* the client can us to call UpdateRefs on its behalf to
3457            re-establish monitoring of the NC */
3458         if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
3459             !GUID_all_zero(&req10->destination_dsa_guid)) {
3460                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
3461                 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
3462                          GUID_string(mem_ctx, &req10->destination_dsa_guid)));
3463                 ureq.naming_context = ncRoot;
3464                 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(sam_ctx, mem_ctx,
3465                                                                    &req10->destination_dsa_guid);
3466                 if (!ureq.dest_dsa_dns_name) {
3467                         return WERR_NOT_ENOUGH_MEMORY;
3468                 }
3469                 ureq.dest_dsa_guid = req10->destination_dsa_guid;
3470                 ureq.options = DRSUAPI_DRS_ADD_REF |
3471                         DRSUAPI_DRS_ASYNC_OP |
3472                         DRSUAPI_DRS_GETCHG_CHECK;
3473
3474                 /* we also need to pass through the
3475                    DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
3476                    to send notifies using the GC SPN */
3477                 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
3478
3479                 werr = drsuapi_UpdateRefs(dce_call->msg_ctx,
3480                                           dce_call->event_ctx, b_state,
3481                                           mem_ctx, &ureq);
3482                 if (!W_ERROR_IS_OK(werr)) {
3483                         DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
3484                                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
3485                                  win_errstr(werr)));
3486                 }
3487         }
3488
3489         /*
3490          * Work out how many links we can send in this chunk. The default is to
3491          * send all the links last, but there is a config option to send them
3492          * immediately, in the same chunk as their source object
3493          */
3494         if (!r->out.ctr->ctr6.more_data || repl_chunk->immediate_link_sync) {
3495                 link_count = getncchanges_chunk_links_pending(repl_chunk,
3496                                                               getnc_state);
3497                 link_count = MIN(link_count,
3498                                  getncchanges_chunk_max_links(repl_chunk));
3499         }
3500
3501         /* If we've got linked attributes to send, add them now */
3502         if (link_count > 0) {
3503                 struct la_for_sorting *la_sorted;
3504
3505                 /*
3506                  * Grab a chunk of linked attributes off the list and put them
3507                  * in sorted array, ready to send
3508                  */
3509                 werr = getncchanges_get_sorted_array(&getnc_state->la_list[getnc_state->la_idx],
3510                                                      link_count,
3511                                                      sam_ctx, getnc_state,
3512                                                      schema,
3513                                                      &la_sorted);
3514                 if (!W_ERROR_IS_OK(werr)) {
3515                         return werr;
3516                 }
3517
3518                 r->out.ctr->ctr6.linked_attributes_count = link_count;
3519                 r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
3520                 if (r->out.ctr->ctr6.linked_attributes == NULL) {
3521                         DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count));
3522                         return WERR_NOT_ENOUGH_MEMORY;
3523                 }
3524
3525                 for (k = 0; k < link_count; k++) {
3526                         r->out.ctr->ctr6.linked_attributes[k] = *la_sorted[k].link;
3527                 }
3528
3529                 getnc_state->la_idx += link_count;
3530                 getnc_state->links_given += link_count;
3531
3532                 if (getnc_state->la_idx < getnc_state->la_count) {
3533                         r->out.ctr->ctr6.more_data = true;
3534                 } else {
3535
3536                         /*
3537                          * We've now sent all the links seen so far, so we can
3538                          * reset la_list back to an empty list again. Note that
3539                          * the steal means the linked attribute memory gets
3540                          * freed after this RPC message is sent on the wire.
3541                          */
3542                         talloc_steal(mem_ctx, getnc_state->la_list);
3543                         getnc_state->la_list = NULL;
3544                         getnc_state->la_idx = 0;
3545                         getnc_state->la_count = 0;
3546                 }
3547
3548                 TALLOC_FREE(la_sorted);
3549         }
3550
3551         if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
3552                 /*
3553                  * TODO: This implementation is wrong
3554                  * we should find out the total number of
3555                  * objects and links in the whole naming context
3556                  * at the start of the cycle and return these
3557                  * values in each message.
3558                  *
3559                  * For now we keep our current strategy and return
3560                  * the number of objects for this cycle and the number
3561                  * of links we found so far during the cycle.
3562                  */
3563                 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
3564                 r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->total_links;
3565         }
3566
3567         if (!r->out.ctr->ctr6.more_data) {
3568
3569                 /* this is the last response in the replication cycle */
3570                 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
3571                 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
3572                                                         &getnc_state->final_udv);
3573
3574                 /*
3575                  * Free the state info stored for the replication cycle. Note
3576                  * that the RPC message we're sending contains links stored in
3577                  * getnc_state. mem_ctx is local to this RPC call, so the memory
3578                  * will get freed after the RPC message is sent on the wire.
3579                  */
3580                 talloc_steal(mem_ctx, getnc_state);
3581                 b_state->getncchanges_state = NULL;
3582         } else {
3583                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
3584                                                          &r->out.ctr->ctr6.new_highwatermark);
3585                 if (ret == 0) {
3586                         /*
3587                          * We need to make sure that we never return the
3588                          * same highwatermark within the same replication
3589                          * cycle more than once. Otherwise we cannot detect
3590                          * when the client uses an unexptected highwatermark.
3591                          *
3592                          * This is a HACK which is needed because our
3593                          * object ordering is wrong and set tmp_highest_usn
3594                          * to a value that is higher than what we already
3595                          * sent to the client (destination dsa).
3596                          */
3597                         r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
3598                 }
3599
3600                 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
3601         }
3602
3603         if (req10->extended_op != DRSUAPI_EXOP_NONE) {
3604                 r->out.ctr->ctr6.uptodateness_vector = NULL;
3605                 r->out.ctr->ctr6.nc_object_count = 0;
3606                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
3607         }
3608
3609         TALLOC_FREE(repl_chunk);
3610
3611         DEBUG(r->out.ctr->ctr6.more_data?4:2,
3612               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
3613                (unsigned long long)(req10->highwatermark.highest_usn+1),
3614                req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
3615                r->out.ctr->ctr6.object_count,
3616                i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
3617                r->out.ctr->ctr6.linked_attributes_count,
3618                getnc_state->links_given, getnc_state->total_links,
3619                dom_sid_string(mem_ctx, user_sid)));
3620
3621 #if 0
3622         if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
3623                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
3624         }
3625 #endif
3626
3627         return WERR_OK;
3628 }
3629