#undef DBGC_CLASS
#define DBGC_CLASS DBGC_DRS_REPL
-/* state of a partially completed getncchanges call */
+#define DRS_GUID_SIZE 16
+#define DEFAULT_MAX_OBJECTS 1000
+#define DEFAULT_MAX_LINKS 1500
+
+/*
+ * state of a partially-completed replication cycle. This state persists
+ * over multiple calls to dcesrv_drsuapi_DsGetNCChanges()
+ */
struct drsuapi_getncchanges_state {
struct db_context *obj_cache;
struct GUID *guids;
struct GUID ncRoot_guid;
bool is_schema_nc;
bool is_get_anc;
+ bool is_get_tgt;
uint64_t min_usn;
uint64_t max_usn;
struct drsuapi_DsReplicaHighWaterMark last_hwm;
struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
struct drsuapi_DsReplicaLinkedAttribute *la_list;
uint32_t la_count;
- struct la_for_sorting *la_sorted;
uint32_t la_idx;
+
+ /* these are just used for debugging the replication's progress */
+ uint32_t links_given;
+ uint32_t total_links;
};
/* We must keep the GUIDs in NDR form for sorting */
struct la_for_sorting {
const struct drsuapi_DsReplicaLinkedAttribute *link;
- uint8_t target_guid[16];
- uint8_t source_guid[16];
+ uint8_t target_guid[DRS_GUID_SIZE];
+ uint8_t source_guid[DRS_GUID_SIZE];
+};
+
+/*
+ * stores the state for a chunk of replication data. This state information
+ * only exists for a single call to dcesrv_drsuapi_DsGetNCChanges()
+ */
+struct getncchanges_repl_chunk {
+ uint32_t max_objects;
+ uint32_t max_links;
+ uint32_t tgt_la_count;
+ bool immediate_link_sync;
+ time_t max_wait;
+ time_t start;
+
+ /* stores the objects to be sent in this chunk */
+ uint32_t object_count;
+ struct drsuapi_DsReplicaObjectListItemEx *object_list;
+
+ /* the last object added to this replication chunk */
+ struct drsuapi_DsReplicaObjectListItemEx *last_object;
};
static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
const struct ldb_message *msg,
struct ldb_context *sam_ctx,
- struct ldb_dn *ncRoot_dn,
- bool is_schema_nc,
+ struct drsuapi_getncchanges_state *getnc_state,
struct dsdb_schema *schema,
DATA_BLOB *session_key,
- uint64_t highest_usn,
- uint32_t replica_flags,
- struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
- struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
- enum drsuapi_DsExtendedOperation extended_op,
+ struct drsuapi_DsGetNCChangesRequest10 *req10,
bool force_object_return,
uint32_t *local_pas,
struct ldb_dn *machine_dn,
struct ldb_result *res = NULL;
WERROR werr;
int ret;
+ uint32_t replica_flags = req10->replica_flags;
+ struct drsuapi_DsPartialAttributeSet *partial_attribute_set =
+ req10->partial_attribute_set;
+ struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector =
+ req10->uptodateness_vector;
+ enum drsuapi_DsExtendedOperation extended_op = req10->extended_op;
+ bool is_schema_nc = getnc_state->is_schema_nc;
+ uint64_t highest_usn = getnc_state->min_usn;
/* make dsdb sytanx context for conversions */
dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
*/
static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
TALLOC_CTX *mem_ctx,
- struct ldb_dn *ncRoot_dn,
bool is_schema_nc,
struct dsdb_schema *schema,
uint64_t highest_usn,
const struct GUID *guid)
{
enum ndr_err_code ndr_err;
- uint8_t guid_buf[16] = { 0, };
+ uint8_t guid_buf[DRS_GUID_SIZE] = { 0, };
DATA_BLOB b = {
.data = guid_buf,
.length = sizeof(guid_buf),
const struct GUID *guid)
{
enum ndr_err_code ndr_err;
- uint8_t guid_buf[16] = { 0, };
+ uint8_t guid_buf[DRS_GUID_SIZE] = { 0, };
DATA_BLOB b = {
.data = guid_buf,
.length = sizeof(guid_buf),
werr = get_nc_changes_build_object(anc_obj, anc_msg,
sam_ctx,
- getnc_state->ncRoot_dn,
- getnc_state->is_schema_nc,
+ getnc_state,
schema, session_key,
- getnc_state->min_usn,
- req10->replica_flags,
- req10->partial_attribute_set,
- req10->uptodateness_vector,
- req10->extended_op,
+ req10,
false, /* force_object_return */
local_pas,
machine_dn,
return werr;
}
+/**
+ * Adds a list of new objects into the current chunk of replication data to send
+ */
+static void getncchanges_chunk_add_objects(struct getncchanges_repl_chunk *repl_chunk,
+ struct drsuapi_DsReplicaObjectListItemEx *obj_list)
+{
+ struct drsuapi_DsReplicaObjectListItemEx *obj;
+
+ /*
+ * We track the last object added to the replication chunk, so just add
+ * the new object-list onto the end
+ */
+ if (repl_chunk->object_list == NULL) {
+ repl_chunk->object_list = obj_list;
+ } else {
+ repl_chunk->last_object->next_object = obj_list;
+ }
+
+ for (obj = obj_list; obj != NULL; obj = obj->next_object) {
+ repl_chunk->object_count += 1;
+
+ /*
+ * Remember the last object in the response - we'll use this to
+ * link the next object(s) processed onto the existing list
+ */
+ if (obj->next_object == NULL) {
+ repl_chunk->last_object = obj;
+ }
+ }
+}
+
+/**
+ * Gets the object to send, packed into an RPC struct ready to send. This also
+ * adds the object to the object cache, and adds any ancestors (if needed).
+ * @param msg - DB search result for the object to add
+ * @param guid - GUID of the object to add
+ * @param ret_obj_list - returns the object ready to be sent (in a list, along
+ * with any ancestors that might be needed). NULL if nothing to send.
+ */
+static WERROR getncchanges_get_obj_to_send(const struct ldb_message *msg,
+ TALLOC_CTX *mem_ctx,
+ struct ldb_context *sam_ctx,
+ struct drsuapi_getncchanges_state *getnc_state,
+ struct dsdb_schema *schema,
+ DATA_BLOB *session_key,
+ struct drsuapi_DsGetNCChangesRequest10 *req10,
+ bool force_object_return,
+ uint32_t *local_pas,
+ struct ldb_dn *machine_dn,
+ const struct GUID *guid,
+ struct drsuapi_DsReplicaObjectListItemEx **ret_obj_list)
+{
+ struct drsuapi_DsReplicaObjectListItemEx *obj;
+ WERROR werr;
+
+ *ret_obj_list = NULL;
+
+ obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
+ W_ERROR_HAVE_NO_MEMORY(obj);
+
+ werr = get_nc_changes_build_object(obj, msg, sam_ctx, getnc_state,
+ schema, session_key, req10,
+ force_object_return,
+ local_pas, machine_dn, guid);
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
+ }
+
+ /*
+ * The object may get filtered out by the UTDV's USN and not actually
+ * sent, in which case there's nothing more to do here
+ */
+ if (obj->meta_data_ctr == NULL) {
+ TALLOC_FREE(obj);
+ return WERR_OK;
+ }
+
+ if (getnc_state->obj_cache != NULL) {
+ werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
+ guid);
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
+ }
+ }
+
+ *ret_obj_list = obj;
+
+ /*
+ * If required, also add any ancestors that the client may need to know
+ * about before it can resolve this object. These get prepended to the
+ * ret_obj_list so the client adds them first.
+ */
+ if (getnc_state->is_get_anc) {
+ werr = getncchanges_add_ancestors(obj, msg->dn, mem_ctx,
+ sam_ctx, getnc_state,
+ schema, session_key,
+ req10, local_pas,
+ machine_dn, ret_obj_list);
+ }
+
+ return werr;
+}
+
+/**
+ * Returns the number of links that are waiting to be sent
+ */
+static uint32_t getncchanges_chunk_links_pending(struct getncchanges_repl_chunk *repl_chunk,
+ struct drsuapi_getncchanges_state *getnc_state)
+{
+ uint32_t links_to_send = 0;
+
+ if (getnc_state->is_get_tgt) {
+
+ /*
+ * when the GET_TGT flag is set, only include the linked
+ * attributes whose target object has already been checked
+ * (i.e. they're ready to send).
+ */
+ if (repl_chunk->tgt_la_count > getnc_state->la_idx) {
+ links_to_send = (repl_chunk->tgt_la_count -
+ getnc_state->la_idx);
+ }
+ } else {
+ links_to_send = getnc_state->la_count - getnc_state->la_idx;
+ }
+
+ return links_to_send;
+}
+
+/**
+ * Returns the max number of links that will fit in the current replication chunk
+ */
+static uint32_t getncchanges_chunk_max_links(struct getncchanges_repl_chunk *repl_chunk)
+{
+ uint32_t max_links = 0;
+
+ if (repl_chunk->max_links != DEFAULT_MAX_LINKS ||
+ repl_chunk->max_objects != DEFAULT_MAX_OBJECTS) {
+
+ /*
+ * We're using non-default settings, so don't try to adjust
+ * them, just trust the user has configured decent values
+ */
+ max_links = repl_chunk->max_links;
+
+ } else if (repl_chunk->max_links > repl_chunk->object_count) {
+
+ /*
+ * This is just an approximate guess to avoid overfilling the
+ * replication chunk. It's the logic we've used historically.
+ * E.g. if we've already sent 1000 objects, then send 1000 fewer
+ * links. For comparison, the max that Windows seems to send is
+ * ~2700 links and ~250 objects (although this may vary based
+ * on timeouts)
+ */
+ max_links = repl_chunk->max_links - repl_chunk->object_count;
+ }
+
+ return max_links;
+}
+
+/**
+ * Returns true if the current GetNCChanges() call has taken longer than its
+ * allotted time. This prevents the client from timing out.
+ */
+static bool getncchanges_chunk_timed_out(struct getncchanges_repl_chunk *repl_chunk)
+{
+ return (time(NULL) - repl_chunk->start > repl_chunk->max_wait);
+}
+
+/**
+ * Returns true if the current chunk of replication data has reached the
+ * max_objects and/or max_links thresholds.
+ */
+static bool getncchanges_chunk_is_full(struct getncchanges_repl_chunk *repl_chunk,
+ struct drsuapi_getncchanges_state *getnc_state)
+{
+ bool chunk_full = false;
+ uint32_t links_to_send;
+ uint32_t chunk_limit;
+
+ /* check if the current chunk is already full with objects */
+ if (repl_chunk->object_count >= repl_chunk->max_objects) {
+ chunk_full = true;
+
+ } else if (repl_chunk->object_count > 0 &&
+ getncchanges_chunk_timed_out(repl_chunk)) {
+
+ /*
+ * We've exceeded our allotted time building this chunk,
+ * and we have at least one object to send back to the client
+ */
+ chunk_full = true;
+
+ } else if (repl_chunk->immediate_link_sync) {
+
+ /* check if the chunk is already full with links */
+ links_to_send = getncchanges_chunk_links_pending(repl_chunk,
+ getnc_state);
+
+ chunk_limit = getncchanges_chunk_max_links(repl_chunk);
+
+ /*
+ * The chunk is full if we've got more links to send than will
+ * fit in one chunk
+ */
+ if (links_to_send > 0 && chunk_limit <= links_to_send) {
+ chunk_full = true;
+ }
+ }
+
+ return chunk_full;
+}
+
+/**
+ * Goes through any new linked attributes and checks that the target object
+ * will be known to the client, i.e. we've already sent it in an replication
+ * chunk. If not, then it adds the target object to the current replication
+ * chunk. This is only done when the client specifies DRS_GET_TGT.
+ */
+static WERROR getncchanges_chunk_add_la_targets(struct getncchanges_repl_chunk *repl_chunk,
+ struct drsuapi_getncchanges_state *getnc_state,
+ uint32_t start_la_index,
+ TALLOC_CTX *mem_ctx,
+ struct ldb_context *sam_ctx,
+ struct dsdb_schema *schema,
+ DATA_BLOB *session_key,
+ struct drsuapi_DsGetNCChangesRequest10 *req10,
+ uint32_t *local_pas,
+ struct ldb_dn *machine_dn)
+{
+ int ret;
+ uint32_t i;
+ uint32_t max_la_index;
+ uint32_t max_links;
+ uint32_t target_count = 0;
+ WERROR werr = WERR_OK;
+ static const char * const msg_attrs[] = {
+ "*",
+ "nTSecurityDescriptor",
+ "parentGUID",
+ "replPropertyMetaData",
+ DSDB_SECRET_ATTRIBUTES,
+ NULL };
+
+ /*
+ * A object can potentially link to thousands of targets. Only bother
+ * checking as many targets as will fit into the current response
+ */
+ max_links = getncchanges_chunk_max_links(repl_chunk);
+ max_la_index = MIN(getnc_state->la_count,
+ start_la_index + max_links);
+
+ /* loop through any linked attributes to check */
+ for (i = start_la_index;
+ (i < max_la_index &&
+ !getncchanges_chunk_is_full(repl_chunk, getnc_state));
+ i++) {
+
+ struct GUID target_guid;
+ struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
+ const struct drsuapi_DsReplicaLinkedAttribute *la;
+ struct ldb_result *msg_res;
+ struct ldb_dn *search_dn;
+ TALLOC_CTX *tmp_ctx;
+ struct dsdb_dn *dn;
+ const struct dsdb_attribute *schema_attrib;
+ NTSTATUS status;
+ bool same_nc;
+
+ la = &getnc_state->la_list[i];
+ tmp_ctx = talloc_new(mem_ctx);
+
+ /*
+ * Track what linked attribute targets we've checked. We might
+ * not have time to check them all, so we should only send back
+ * the ones we've actually checked.
+ */
+ repl_chunk->tgt_la_count = i + 1;
+
+ /* get the GUID of the linked attribute's target object */
+ schema_attrib = dsdb_attribute_by_attributeID_id(schema,
+ la->attid);
+
+ werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema,
+ tmp_ctx, la->value.blob, &dn);
+
+ if (!W_ERROR_IS_OK(werr)) {
+ DEBUG(0,(__location__ ": Bad la blob\n"));
+ return werr;
+ }
+
+ status = dsdb_get_extended_dn_guid(dn->dn, &target_guid, "GUID");
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return ntstatus_to_werror(status);
+ }
+
+ /*
+ * if the target isn't in the cache, then the client
+ * might not know about it, so send the target now
+ */
+ werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
+ &target_guid);
+
+ if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
+
+ /* target already sent, nothing to do */
+ TALLOC_FREE(tmp_ctx);
+ continue;
+ }
+
+ same_nc = dsdb_objects_have_same_nc(sam_ctx, tmp_ctx, dn->dn,
+ getnc_state->ncRoot_dn);
+
+ /* don't try to fetch target objects from another partition */
+ if (!same_nc) {
+ TALLOC_FREE(tmp_ctx);
+ continue;
+ }
+
+ search_dn = ldb_dn_new_fmt(tmp_ctx, sam_ctx, "<GUID=%s>",
+ GUID_string(tmp_ctx, &target_guid));
+ W_ERROR_HAVE_NO_MEMORY(search_dn);
+
+ ret = drsuapi_search_with_extended_dn(sam_ctx, tmp_ctx,
+ &msg_res, search_dn,
+ LDB_SCOPE_BASE,
+ msg_attrs, NULL);
+
+ /*
+ * Don't fail the replication if we can't find the target.
+ * This could happen for a one-way linked attribute, if the
+ * target is deleted and then later expunged (thus, the source
+ * object can be left with a hanging link). Continue to send
+ * the the link (the client-side has already tried once with
+ * GET_TGT, so it should just end up ignoring it).
+ */
+ if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+ DBG_WARNING("Encountered unknown link target DN %s\n",
+ ldb_dn_get_extended_linearized(tmp_ctx, dn->dn, 1));
+ TALLOC_FREE(tmp_ctx);
+ continue;
+
+ } else if (ret != LDB_SUCCESS) {
+ DBG_ERR("Failed to fetch link target DN %s - %s\n",
+ ldb_dn_get_extended_linearized(tmp_ctx, dn->dn, 1),
+ ldb_errstring(sam_ctx));
+ return WERR_DS_DRA_INCONSISTENT_DIT;
+ }
+
+ /*
+ * Construct an object, ready to send (this will include
+ * the object's ancestors as well, if GET_ANC is set)
+ */
+ werr = getncchanges_get_obj_to_send(msg_res->msgs[0], mem_ctx,
+ sam_ctx, getnc_state,
+ schema, session_key, req10,
+ false, local_pas,
+ machine_dn, &target_guid,
+ &new_objs);
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
+ }
+
+ if (new_objs != NULL) {
+ target_count++;
+ getncchanges_chunk_add_objects(repl_chunk, new_objs);
+ }
+ TALLOC_FREE(tmp_ctx);
+ }
+
+ if (target_count > 0) {
+ DEBUG(3, ("GET_TGT: checked %u link-attrs, added %u target objs\n",
+ i - start_la_index, target_count));
+ }
+
+ return WERR_OK;
+}
+
+/**
+ * Creates a helper struct used for building a chunk of replication data,
+ * i.e. used over a single call to dcesrv_drsuapi_DsGetNCChanges().
+ */
+static struct getncchanges_repl_chunk * getncchanges_chunk_new(TALLOC_CTX *mem_ctx,
+ struct dcesrv_call_state *dce_call,
+ struct drsuapi_DsGetNCChangesRequest10 *req10)
+{
+ struct getncchanges_repl_chunk *repl_chunk;
+
+ repl_chunk = talloc_zero(mem_ctx, struct getncchanges_repl_chunk);
+
+ repl_chunk->start = time(NULL);
+
+ repl_chunk->max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL,
+ "drs", "max object sync",
+ DEFAULT_MAX_OBJECTS);
+
+ /*
+ * The client control here only applies in normal replication, not extended
+ * operations, which return a fixed set, even if the caller
+ * sets max_object_count == 0
+ */
+ if (req10->extended_op == DRSUAPI_EXOP_NONE) {
+
+ /*
+ * use this to force single objects at a time, which is useful
+ * for working out what object is giving problems
+ */
+ if (req10->max_object_count < repl_chunk->max_objects) {
+ repl_chunk->max_objects = req10->max_object_count;
+ }
+ }
+
+ repl_chunk->max_links =
+ lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL,
+ "drs", "max link sync",
+ DEFAULT_MAX_LINKS);
+
+ repl_chunk->immediate_link_sync =
+ lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL,
+ "drs", "immediate link sync", false);
+
+ /*
+ * Maximum time that we can spend in a getncchanges
+ * in order to avoid timeout of the other part.
+ * 10 seconds by default.
+ */
+ repl_chunk->max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx,
+ NULL, "drs", "max work time", 10);
+
+ return repl_chunk;
+}
+
/*
drsuapi_DsGetNCChanges
WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct drsuapi_DsGetNCChanges *r)
{
+ struct auth_session_info *session_info =
+ dcesrv_call_session_info(dce_call);
struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
int ret;
uint32_t i, k;
struct dsdb_schema *schema;
struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
- struct drsuapi_DsReplicaObjectListItemEx **currentObject;
+ struct getncchanges_repl_chunk *repl_chunk;
NTSTATUS status;
DATA_BLOB session_key;
WERROR werr;
struct drsuapi_getncchanges_state *getnc_state;
struct drsuapi_DsGetNCChangesRequest10 *req10;
uint32_t options;
- uint32_t max_objects;
- uint32_t max_links;
uint32_t link_count = 0;
- uint32_t link_total = 0;
- uint32_t link_given = 0;
struct ldb_dn *search_dn = NULL;
bool am_rodc;
enum security_user_level security_level;
bool is_secret_request;
bool is_gc_pas_request;
struct drsuapi_changed_objects *changes;
- time_t max_wait;
- time_t start = time(NULL);
- bool max_wait_reached = false;
bool has_get_all_changes = false;
struct GUID invocation_id;
static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
*r->out.level_out = 6;
- /* TODO: linked attributes*/
+
r->out.ctr->ctr6.linked_attributes_count = 0;
r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
r->out.ctr->ctr6.first_object = NULL;
- /* a RODC doesn't allow for any replication */
- ret = samdb_rodc(sam_ctx, &am_rodc);
- if (ret == LDB_SUCCESS && am_rodc) {
- DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
- return WERR_DS_DRA_SOURCE_DISABLED;
- }
-
/* Check request revision.
*/
switch (r->in.level) {
return WERR_REVISION_MISMATCH;
}
+ repl_chunk = getncchanges_chunk_new(mem_ctx, dce_call, req10);
+
+ if (repl_chunk == NULL) {
+ return WERR_NOT_ENOUGH_MEMORY;
+ }
+
+ /* a RODC doesn't allow for any replication */
+ ret = samdb_rodc(sam_ctx, &am_rodc);
+ if (ret == LDB_SUCCESS && am_rodc) {
+ DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
+ return WERR_DS_DRA_SOURCE_DISABLED;
+ }
/* Perform access checks. */
/* TODO: we need to support a sync on a specific non-root
return WERR_DS_DRA_SOURCE_DISABLED;
}
- user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
+ user_sid = &session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
/* all clients must have GUID_DRS_GET_CHANGES */
werr = drs_security_access_check_nc_root(sam_ctx,
mem_ctx,
- dce_call->conn->auth_state.session_info->security_token,
+ session_info->security_token,
req10->naming_context,
GUID_DRS_GET_CHANGES);
if (!W_ERROR_IS_OK(werr)) {
if (is_gc_pas_request) {
werr = drs_security_access_check_nc_root(sam_ctx,
mem_ctx,
- dce_call->conn->auth_state.session_info->security_token,
+ session_info->security_token,
req10->naming_context,
GUID_DRS_GET_FILTERED_ATTRIBUTES);
if (W_ERROR_IS_OK(werr)) {
if (is_secret_request) {
werr = drs_security_access_check_nc_root(sam_ctx,
mem_ctx,
- dce_call->conn->auth_state.session_info->security_token,
+ session_info->security_token,
req10->naming_context,
GUID_DRS_GET_ALL_CHANGES);
if (!W_ERROR_IS_OK(werr)) {
allowed:
/* for non-administrator replications, check that they have
given the correct source_dsa_invocation_id */
- security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
+ security_level = security_session_user_level(session_info,
samdb_domain_sid(sam_ctx));
if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
talloc_free(search_res);
talloc_free(changes);
- if (req10->extended_op != DRSUAPI_EXOP_NONE) {
- /* Do nothing */
- } else if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
+ if (req10->extended_op == DRSUAPI_EXOP_NONE) {
+ getnc_state->is_get_anc =
+ ((req10->replica_flags & DRSUAPI_DRS_GET_ANC) != 0);
+ getnc_state->is_get_tgt =
+ ((req10->more_flags & DRSUAPI_DRS_GET_TGT) != 0);
+ }
+
+ /*
+ * when using GET_ANC or GET_TGT, cache the objects that have
+ * been already sent, to avoid sending them multiple times
+ */
+ if (getnc_state->is_get_anc || getnc_state->is_get_tgt) {
+ DEBUG(3,("Using object cache, GET_ANC %u, GET_TGT %u\n",
+ getnc_state->is_get_anc,
+ getnc_state->is_get_tgt));
+
getnc_state->obj_cache = db_open_rbt(getnc_state);
if (getnc_state->obj_cache == NULL) {
return WERR_NOT_ENOUGH_MEMORY;
}
- getnc_state->is_get_anc = true;
}
}
r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
- currentObject = &r->out.ctr->ctr6.first_object;
-
- max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
/*
- * The client control here only applies in normal replication, not extended
- * operations, which return a fixed set, even if the caller
- * sets max_object_count == 0
+ * If the client has already set GET_TGT then we know they can handle
+ * receiving the linked attributes interleaved with the source objects
*/
- if (req10->extended_op == DRSUAPI_EXOP_NONE) {
- /* use this to force single objects at a time, which is useful
- * for working out what object is giving problems
- */
- if (req10->max_object_count < max_objects) {
- max_objects = req10->max_object_count;
- }
+ if (getnc_state->is_get_tgt) {
+ repl_chunk->immediate_link_sync = true;
}
- /*
- * TODO: work out how the maximum should be calculated
- */
- max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
-
- /*
- * Maximum time that we can spend in a getncchanges
- * in order to avoid timeout of the other part.
- * 10 seconds by default.
- */
- max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
if (req10->partial_attribute_set != NULL) {
struct dsdb_syntax_ctx syntax_ctx;
uint32_t_ptr_cmp);
}
+ /*
+ * Check in case we're still processing the links from an object in the
+ * previous chunk. We want to send the links (and any targets needed)
+ * before moving on to the next object.
+ */
+ if (getnc_state->is_get_tgt) {
+ werr = getncchanges_chunk_add_la_targets(repl_chunk,
+ getnc_state,
+ getnc_state->la_idx,
+ mem_ctx, sam_ctx,
+ schema, &session_key,
+ req10, local_pas,
+ machine_dn);
+
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
+ }
+ }
+
for (i=getnc_state->num_processed;
i<getnc_state->num_records &&
- (r->out.ctr->ctr6.object_count < max_objects)
- && !max_wait_reached;
+ !getncchanges_chunk_is_full(repl_chunk, getnc_state);
i++) {
struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
- struct drsuapi_DsReplicaObjectListItemEx *obj;
struct ldb_message *msg;
static const char * const msg_attrs[] = {
"*",
NULL };
struct ldb_result *msg_res;
struct ldb_dn *msg_dn;
+ bool obj_already_sent = false;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ uint32_t old_la_index;
- obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
- W_ERROR_HAVE_NO_MEMORY(obj);
-
- msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
+ msg_dn = ldb_dn_new_fmt(tmp_ctx, sam_ctx, "<GUID=%s>",
+ GUID_string(tmp_ctx, &getnc_state->guids[i]));
W_ERROR_HAVE_NO_MEMORY(msg_dn);
-
/*
* by re-searching here we avoid having a lot of full
* records in memory between calls to getncchanges.
* (tombstone expunge) between the first and second
* check.
*/
- ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
+ ret = drsuapi_search_with_extended_dn(sam_ctx, tmp_ctx, &msg_res,
msg_dn,
LDB_SCOPE_BASE, msg_attrs, NULL);
if (ret != LDB_SUCCESS) {
if (ret != LDB_ERR_NO_SUCH_OBJECT) {
DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
- ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
+ ldb_dn_get_extended_linearized(tmp_ctx, msg_dn, 1),
+ ldb_errstring(sam_ctx)));
}
- talloc_free(obj);
+ TALLOC_FREE(tmp_ctx);
continue;
}
DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
"to get any results in fetch of DN "
"%s (race with tombstone expunge?)\n",
- ldb_dn_get_extended_linearized(obj,
+ ldb_dn_get_extended_linearized(tmp_ctx,
msg_dn, 1)));
- talloc_free(obj);
+ TALLOC_FREE(tmp_ctx);
continue;
}
msg = msg_res->msgs[0];
/*
- * If it has already been added as an ancestor of
- * an object, we don't need to do anything more
+ * Check if we've already sent the object as an ancestor of
+ * another object. If so, we don't need to send it again
*/
if (getnc_state->obj_cache != NULL) {
werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
&getnc_state->guids[i]);
if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
- dcesrv_drsuapi_update_highwatermark(msg,
- getnc_state->max_usn,
- &r->out.ctr->ctr6.new_highwatermark);
-
- werr = get_nc_changes_add_links(sam_ctx, getnc_state,
- getnc_state->ncRoot_dn,
- getnc_state->is_schema_nc,
- schema, getnc_state->min_usn,
- req10->replica_flags,
- msg,
- &getnc_state->la_list,
- &getnc_state->la_count,
- req10->uptodateness_vector);
-
- if (!W_ERROR_IS_OK(werr)) {
- return werr;
- }
-
- /* no attributes to send */
- talloc_free(obj);
- continue;
+ obj_already_sent = true;
}
}
- max_wait_reached = (time(NULL) - start > max_wait);
+ if (!obj_already_sent) {
+ bool max_wait_reached;
- werr = get_nc_changes_build_object(obj, msg,
- sam_ctx, getnc_state->ncRoot_dn,
- getnc_state->is_schema_nc,
- schema, &session_key, getnc_state->min_usn,
- req10->replica_flags,
- req10->partial_attribute_set,
- req10->uptodateness_vector,
- req10->extended_op,
- max_wait_reached,
- local_pas, machine_dn,
- &getnc_state->guids[i]);
- if (!W_ERROR_IS_OK(werr)) {
- return werr;
+ max_wait_reached = getncchanges_chunk_timed_out(repl_chunk);
+
+ /*
+ * Construct an object, ready to send (this will include
+ * the object's ancestors as well, if needed)
+ */
+ werr = getncchanges_get_obj_to_send(msg, mem_ctx, sam_ctx,
+ getnc_state, schema,
+ &session_key, req10,
+ max_wait_reached,
+ local_pas, machine_dn,
+ &getnc_state->guids[i],
+ &new_objs);
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
+ }
}
+ old_la_index = getnc_state->la_count;
+
+ /*
+ * We've reached the USN where this object naturally occurs.
+ * Regardless of whether we've already sent the object (as an
+ * ancestor), we add its links and update the HWM at this point
+ */
werr = get_nc_changes_add_links(sam_ctx, getnc_state,
- getnc_state->ncRoot_dn,
getnc_state->is_schema_nc,
schema, getnc_state->min_usn,
req10->replica_flags,
getnc_state->max_usn,
&r->out.ctr->ctr6.new_highwatermark);
- if (obj->meta_data_ctr == NULL) {
- DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
- ldb_dn_get_linearized(msg->dn)));
- /* no attributes to send */
- talloc_free(obj);
- continue;
- }
+ if (new_objs != NULL) {
- new_objs = obj;
+ /*
+ * Add the object (and, if GET_ANC, any parents it may
+ * have) into the current chunk of replication data
+ */
+ getncchanges_chunk_add_objects(repl_chunk, new_objs);
- if (getnc_state->obj_cache != NULL) {
- werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
- &getnc_state->guids[i]);
- if (!W_ERROR_IS_OK(werr)) {
- return werr;
- }
+ talloc_free(getnc_state->last_dn);
+ getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
}
+ DEBUG(8,(__location__ ": %s object %s\n",
+ new_objs ? "replicating" : "skipping send of",
+ ldb_dn_get_linearized(msg->dn)));
+
+ getnc_state->total_links += (getnc_state->la_count - old_la_index);
+
/*
- * For GET_ANC, prepend any parents that the client needs
- * to know about before it can add this object
+ * If the GET_TGT flag was set, check any new links added to
+ * make sure the client knows about the link target object
*/
- if (getnc_state->is_get_anc) {
- werr = getncchanges_add_ancestors(obj, msg->dn, mem_ctx,
- sam_ctx, getnc_state,
- schema, &session_key,
- req10, local_pas,
- machine_dn,
- &new_objs);
+ if (getnc_state->is_get_tgt) {
+ werr = getncchanges_chunk_add_la_targets(repl_chunk,
+ getnc_state,
+ old_la_index,
+ mem_ctx, sam_ctx,
+ schema, &session_key,
+ req10, local_pas,
+ machine_dn);
+
if (!W_ERROR_IS_OK(werr)) {
return werr;
}
}
- *currentObject = new_objs;
- while (new_objs != NULL) {
- r->out.ctr->ctr6.object_count += 1;
- if (new_objs->next_object == NULL) {
- currentObject = &new_objs->next_object;
- }
- new_objs = new_objs->next_object;
- }
+ TALLOC_FREE(tmp_ctx);
+ }
- DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
+ /* copy the constructed object list into the response message */
+ r->out.ctr->ctr6.object_count = repl_chunk->object_count;
+ r->out.ctr->ctr6.first_object = repl_chunk->object_list;
- talloc_free(getnc_state->last_dn);
- getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
+ getnc_state->num_processed = i;
- talloc_free(msg_res);
- talloc_free(msg_dn);
+ if (i < getnc_state->num_records) {
+ r->out.ctr->ctr6.more_data = true;
}
- getnc_state->num_processed = i;
-
/* the client can us to call UpdateRefs on its behalf to
re-establish monitoring of the NC */
if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
}
/*
- * TODO:
- * This is just a guess, how to calculate the
- * number of linked attributes to send, we need to
- * find out how to do this right.
+ * Work out how many links we can send in this chunk. The default is to
+ * send all the links last, but there is a config option to send them
+ * immediately, in the same chunk as their source object
*/
- if (r->out.ctr->ctr6.object_count >= max_links) {
- max_links = 0;
- } else {
- max_links -= r->out.ctr->ctr6.object_count;
+ if (!r->out.ctr->ctr6.more_data || repl_chunk->immediate_link_sync) {
+ link_count = getncchanges_chunk_links_pending(repl_chunk,
+ getnc_state);
+ link_count = MIN(link_count,
+ getncchanges_chunk_max_links(repl_chunk));
}
- link_total = getnc_state->la_count;
+ /* If we've got linked attributes to send, add them now */
+ if (link_count > 0) {
+ struct la_for_sorting *la_sorted;
- if (i < getnc_state->num_records) {
- r->out.ctr->ctr6.more_data = true;
- } else {
- /* sort the whole array the first time */
- if (getnc_state->la_sorted == NULL) {
- werr = getncchanges_get_sorted_array(getnc_state->la_list,
- getnc_state->la_count,
- sam_ctx, getnc_state,
- schema,
- &getnc_state->la_sorted);
- if (!W_ERROR_IS_OK(werr)) {
- return werr;
- }
+ /*
+ * Grab a chunk of linked attributes off the list and put them
+ * in sorted array, ready to send
+ */
+ werr = getncchanges_get_sorted_array(&getnc_state->la_list[getnc_state->la_idx],
+ link_count,
+ sam_ctx, getnc_state,
+ schema,
+ &la_sorted);
+ if (!W_ERROR_IS_OK(werr)) {
+ return werr;
}
- link_count = getnc_state->la_count - getnc_state->la_idx;
- link_count = MIN(max_links, link_count);
-
r->out.ctr->ctr6.linked_attributes_count = link_count;
r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
if (r->out.ctr->ctr6.linked_attributes == NULL) {
}
for (k = 0; k < link_count; k++) {
- r->out.ctr->ctr6.linked_attributes[k]
- = *getnc_state->la_sorted[getnc_state->la_idx + k].link;
+ r->out.ctr->ctr6.linked_attributes[k] = *la_sorted[k].link;
}
getnc_state->la_idx += link_count;
- link_given = getnc_state->la_idx;
+ getnc_state->links_given += link_count;
if (getnc_state->la_idx < getnc_state->la_count) {
r->out.ctr->ctr6.more_data = true;
+ } else {
+
+ /*
+ * We've now sent all the links seen so far, so we can
+ * reset la_list back to an empty list again. Note that
+ * the steal means the linked attribute memory gets
+ * freed after this RPC message is sent on the wire.
+ */
+ talloc_steal(mem_ctx, getnc_state->la_list);
+ getnc_state->la_list = NULL;
+ getnc_state->la_idx = 0;
+ getnc_state->la_count = 0;
}
+
+ TALLOC_FREE(la_sorted);
}
if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
* of links we found so far during the cycle.
*/
r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
- r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->la_count;
+ r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->total_links;
}
if (!r->out.ctr->ctr6.more_data) {
- talloc_steal(mem_ctx, getnc_state->la_list);
+ /* this is the last response in the replication cycle */
r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
&getnc_state->final_udv);
- talloc_free(getnc_state);
+ /*
+ * Free the state info stored for the replication cycle. Note
+ * that the RPC message we're sending contains links stored in
+ * getnc_state. mem_ctx is local to this RPC call, so the memory
+ * will get freed after the RPC message is sent on the wire.
+ */
+ talloc_steal(mem_ctx, getnc_state);
b_state->getncchanges_state = NULL;
} else {
ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
}
+ TALLOC_FREE(repl_chunk);
+
DEBUG(r->out.ctr->ctr6.more_data?4:2,
("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
(unsigned long long)(req10->highwatermark.highest_usn+1),
r->out.ctr->ctr6.object_count,
i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
r->out.ctr->ctr6.linked_attributes_count,
- link_given, link_total,
+ getnc_state->links_given, getnc_state->total_links,
dom_sid_string(mem_ctx, user_sid)));
#if 0
return WERR_OK;
}
+
git.samba.org / samba.git / blobdiff