source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DSGetNCChanges call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009-2010
   8    Copyright (C) Andrew Bartlett 2010-2016
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "rpc_server/dcerpc_server.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "param/param.h"
  28 #include "librpc/gen_ndr/ndr_drsblobs.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "libcli/security/security.h"
  32 #include "libcli/security/session.h"
  33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  34 #include "rpc_server/dcerpc_server_proto.h"
  35 #include "../libcli/drsuapi/drsuapi.h"
  36 #include "lib/util/binsearch.h"
  37 #include "lib/util/tsort.h"
  38 #include "auth/session.h"
  39 #include "dsdb/common/util.h"
  40
  41 /* state of a partially completed getncchanges call */
  42 struct drsuapi_getncchanges_state {
  43         struct GUID *guids;
  44         uint32_t num_records;
  45         uint32_t num_processed;
  46         struct ldb_dn *ncRoot_dn;
  47         struct GUID ncRoot_guid;
  48         bool is_schema_nc;
  49         uint64_t min_usn;
  50         uint64_t max_usn;
  51         struct drsuapi_DsReplicaHighWaterMark last_hwm;
  52         struct ldb_dn *last_dn;
  53         struct drsuapi_DsReplicaHighWaterMark final_hwm;
  54         struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
  55         struct drsuapi_DsReplicaLinkedAttribute *la_list;
  56         uint32_t la_count;
  57         struct la_for_sorting *la_sorted;
  58         uint32_t la_idx;
  59 };
  60
  61 /* We must keep the GUIDs in NDR form for sorting */
  62 struct la_for_sorting {
  63         struct drsuapi_DsReplicaLinkedAttribute *link;
  64         uint8_t target_guid[16];
  65         uint8_t source_guid[16];
  66 };
  67
  68 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
  69                                               const struct drsuapi_DsReplicaHighWaterMark *h2)
  70 {
  71         if (h1->highest_usn < h2->highest_usn) {
  72                 return -1;
  73         } else if (h1->highest_usn > h2->highest_usn) {
  74                 return 1;
  75         } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
  76                 return -1;
  77         } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
  78                 return 1;
  79         } else if (h1->reserved_usn < h2->reserved_usn) {
  80                 return -1;
  81         } else if (h1->reserved_usn > h2->reserved_usn) {
  82                 return 1;
  83         }
  84
  85         return 0;
  86 }
  87
  88 /*
  89   build a DsReplicaObjectIdentifier from a ldb msg
  90  */
  91 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
  92                                                                        const struct ldb_message *msg)
  93 {
  94         struct drsuapi_DsReplicaObjectIdentifier *identifier;
  95         struct dom_sid *sid;
  96
  97         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
  98         if (identifier == NULL) {
  99                 return NULL;
 100         }
 101
 102         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
 103         identifier->guid = samdb_result_guid(msg, "objectGUID");
 104
 105         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
 106         if (sid) {
 107                 identifier->sid = *sid;
 108         } else {
 109                 ZERO_STRUCT(identifier->sid);
 110         }
 111         return identifier;
 112 }
 113
 114 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
 115 {
 116         return GUID_compare(guid1, &guid2);
 117 }
 118
 119 /*
 120   see if we can filter an attribute using the uptodateness_vector
 121  */
 122 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
 123                        const struct GUID *originating_invocation_id,
 124                        uint64_t originating_usn)
 125 {
 126         const struct drsuapi_DsReplicaCursor *c;
 127         if (udv == NULL) return false;
 128         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
 129                             originating_invocation_id, udv_compare, c);
 130         if (c && originating_usn <= c->highest_usn) {
 131                 return true;
 132         }
 133         return false;
 134
 135 }
 136
 137 static int uint32_t_cmp(uint32_t a1, uint32_t a2)
 138 {
 139         if (a1 == a2) return 0;
 140         return a1 > a2 ? 1 : -1;
 141 }
 142
 143 static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused)
 144 {
 145         if (*a1 == *a2) return 0;
 146         return *a1 > *a2 ? 1 : -1;
 147 }
 148
 149 static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema,
 150                                                  const struct dsdb_syntax_ctx *ctx,
 151                                                  enum drsuapi_DsAttributeId remote_attid_as_enum,
 152                                                  enum drsuapi_DsAttributeId *local_attid_as_enum,
 153                                                  const struct dsdb_attribute **_sa)
 154 {
 155         WERROR werr;
 156         const struct dsdb_attribute *sa = NULL;
 157
 158         if (ctx->pfm_remote == NULL) {
 159                 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
 160                 goto fail;
 161         }
 162
 163         werr = dsdb_attribute_drsuapi_remote_to_local(ctx,
 164                                                       remote_attid_as_enum,
 165                                                       local_attid_as_enum,
 166                                                       _sa);
 167         if (!W_ERROR_IS_OK(werr)) {
 168                 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
 169                 goto fail;
 170         }
 171
 172         return werr;
 173 fail:
 174
 175         sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum);
 176         if (sa == NULL) {
 177                 return WERR_DS_DRA_SCHEMA_MISMATCH;
 178         } else {
 179                 if (local_attid_as_enum != NULL) {
 180                         *local_attid_as_enum = sa->attributeID_id;
 181                 }
 182                 if (_sa != NULL) {
 183                         *_sa = sa;
 184                 }
 185                 return WERR_OK;
 186         }
 187 }
 188
 189 /*
 190   drsuapi_DsGetNCChanges for one object
 191 */
 192 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
 193                                           const struct ldb_message *msg,
 194                                           struct ldb_context *sam_ctx,
 195                                           struct ldb_dn *ncRoot_dn,
 196                                           bool   is_schema_nc,
 197                                           struct dsdb_schema *schema,
 198                                           DATA_BLOB *session_key,
 199                                           uint64_t highest_usn,
 200                                           uint32_t replica_flags,
 201                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 202                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 203                                           enum drsuapi_DsExtendedOperation extended_op,
 204                                           bool force_object_return,
 205                                           uint32_t *local_pas)
 206 {
 207         const struct ldb_val *md_value;
 208         uint32_t i, n;
 209         struct replPropertyMetaDataBlob md;
 210         uint32_t rid = 0;
 211         enum ndr_err_code ndr_err;
 212         uint32_t *attids;
 213         const char *rdn;
 214         const struct dsdb_attribute *rdn_sa;
 215         unsigned int instanceType;
 216         struct dsdb_syntax_ctx syntax_ctx;
 217
 218         /* make dsdb sytanx context for conversions */
 219         dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
 220         syntax_ctx.is_schema_nc = is_schema_nc;
 221
 222         instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
 223         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 224                 obj->is_nc_prefix = true;
 225                 obj->parent_object_guid = NULL;
 226         } else {
 227                 obj->is_nc_prefix = false;
 228                 obj->parent_object_guid = talloc(obj, struct GUID);
 229                 if (obj->parent_object_guid == NULL) {
 230                         return WERR_DS_DRA_INTERNAL_ERROR;
 231                 }
 232                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 233                 if (GUID_all_zero(obj->parent_object_guid)) {
 234                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 235                                  ldb_dn_get_linearized(msg->dn)));
 236                         return WERR_DS_DRA_INTERNAL_ERROR;
 237                 }
 238         }
 239         obj->next_object = NULL;
 240
 241         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 242         if (!md_value) {
 243                 /* nothing to send */
 244                 return WERR_OK;
 245         }
 246
 247         if (instanceType & INSTANCE_TYPE_UNINSTANT) {
 248                 /* don't send uninstantiated objects */
 249                 return WERR_OK;
 250         }
 251
 252         ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
 253                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 254         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 255                 return WERR_DS_DRA_INTERNAL_ERROR;
 256         }
 257
 258         if (md.version != 1) {
 259                 return WERR_DS_DRA_INTERNAL_ERROR;
 260         }
 261
 262         rdn = ldb_dn_get_rdn_name(msg->dn);
 263         if (rdn == NULL) {
 264                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 265                 return WERR_DS_DRA_INTERNAL_ERROR;
 266         }
 267
 268         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 269         if (rdn_sa == NULL) {
 270                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 271                          rdn, ldb_dn_get_linearized(msg->dn)));
 272                 return WERR_DS_DRA_INTERNAL_ERROR;
 273         }
 274
 275         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 276         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 277
 278         obj->object.identifier = get_object_identifier(obj, msg);
 279         if (obj->object.identifier == NULL) {
 280                 return WERR_NOT_ENOUGH_MEMORY;
 281         }
 282         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 283
 284         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 285         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 286                 const struct dsdb_attribute *sa;
 287                 bool force_attribute = false;
 288
 289                 /* if the attribute has not changed, and it is not the
 290                    instanceType then don't include it */
 291                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 292                     extended_op != DRSUAPI_EXOP_REPL_SECRET &&
 293                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
 294
 295                 /* don't include the rDN */
 296                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 297
 298                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 299                 if (!sa) {
 300                         DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
 301                                  (unsigned int)md.ctr.ctr1.array[i].attid,
 302                                  ldb_dn_get_linearized(msg->dn)));
 303                         return WERR_DS_DRA_INTERNAL_ERROR;
 304                 }
 305
 306                 if (sa->linkID) {
 307                         struct ldb_message_element *el;
 308                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 309                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 310                                 /* don't send upgraded links inline */
 311                                 continue;
 312                         }
 313                 }
 314
 315                 if (extended_op == DRSUAPI_EXOP_REPL_SECRET &&
 316                     !dsdb_attr_in_rodc_fas(sa)) {
 317                         force_attribute = true;
 318                         DEBUG(4,("Forcing attribute %s in %s\n",
 319                                  sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 320                 }
 321
 322                 /* filter by uptodateness_vector */
 323                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
 324                     !force_attribute &&
 325                     udv_filter(uptodateness_vector,
 326                                &md.ctr.ctr1.array[i].originating_invocation_id,
 327                                md.ctr.ctr1.array[i].originating_usn)) {
 328                         continue;
 329                 }
 330
 331                 /* filter by partial_attribute_set */
 332                 if (partial_attribute_set) {
 333                         uint32_t *result = NULL;
 334                         BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
 335                                               uint32_t_cmp, result);
 336                         if (result == NULL) {
 337                                 continue;
 338                         }
 339                 }
 340
 341                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 342                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 343                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 344                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 345                 attids[n] = md.ctr.ctr1.array[i].attid;
 346                 n++;
 347         }
 348
 349         /* ignore it if its an empty change. Note that renames always
 350          * change the 'name' attribute, so they won't be ignored by
 351          * this
 352
 353          * the force_object_return check is used to force an empty
 354          * object return when we timeout in the getncchanges loop.
 355          * This allows us to return an empty object, which keeps the
 356          * client happy while preventing timeouts
 357          */
 358         if (n == 0 ||
 359             (n == 1 &&
 360              attids[0] == DRSUAPI_ATTID_instanceType &&
 361              !force_object_return)) {
 362                 talloc_free(obj->meta_data_ctr);
 363                 obj->meta_data_ctr = NULL;
 364                 return WERR_OK;
 365         }
 366
 367         obj->meta_data_ctr->count = n;
 368
 369         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 370         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 371         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 372                                                             obj->object.attribute_ctr.num_attributes);
 373         if (obj->object.attribute_ctr.attributes == NULL) {
 374                 return WERR_NOT_ENOUGH_MEMORY;
 375         }
 376
 377         /*
 378          * Note that the meta_data array and the attributes array must
 379          * be the same size and in the same order
 380          */
 381         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 382                 struct ldb_message_element *el;
 383                 WERROR werr;
 384                 const struct dsdb_attribute *sa;
 385
 386                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 387                 if (!sa) {
 388                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 389                         return WERR_DS_DRA_INTERNAL_ERROR;
 390                 }
 391
 392                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 393                 if (el == NULL) {
 394                         /* this happens for attributes that have been removed */
 395                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 396                                  sa->lDAPDisplayName, attids[i]));
 397                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 398                         obj->object.attribute_ctr.attributes[i].attid =
 399                                         dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
 400                 } else {
 401                         werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
 402                                                           &obj->object.attribute_ctr.attributes[i]);
 403                         if (!W_ERROR_IS_OK(werr)) {
 404                                 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
 405                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 406                                          win_errstr(werr)));
 407                                 return werr;
 408                         }
 409                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 410                          * check if attribute is secret and send a null value
 411                          */
 412                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 413                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 414                                                                  &obj->meta_data_ctr->meta_data[i]);
 415                         }
 416                         /* some attributes needs to be encrypted
 417                            before being sent */
 418                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 419                                                          &obj->object.attribute_ctr.attributes[i]);
 420                         if (!W_ERROR_IS_OK(werr)) {
 421                                 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
 422                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 423                                          win_errstr(werr)));
 424                                 return werr;
 425                         }
 426                 }
 427                 if (attids[i] != obj->object.attribute_ctr.attributes[i].attid) {
 428                         DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID:  "
 429                                   "0x%08x vs 0x%08x "
 430                                   "Run dbcheck!\n",
 431                                   sa->lDAPDisplayName,
 432                                   ldb_dn_get_linearized(msg->dn),
 433                                   attids[i],
 434                                   obj->object.attribute_ctr.attributes[i].attid));
 435                         return WERR_DS_DATABASE_ERROR;
 436                 }
 437         }
 438
 439         return WERR_OK;
 440 }
 441
 442 /*
 443   add one linked attribute from an object to the list of linked
 444   attributes in a getncchanges request
 445  */
 446 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 447                                     struct ldb_context *sam_ctx,
 448                                     const struct dsdb_schema *schema,
 449                                     const struct dsdb_attribute *sa,
 450                                     const struct ldb_message *msg,
 451                                     struct dsdb_dn *dsdb_dn,
 452                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 453                                     uint32_t *la_count,
 454                                     bool is_schema_nc)
 455 {
 456         struct drsuapi_DsReplicaLinkedAttribute *la;
 457         bool active;
 458         NTSTATUS status;
 459         WERROR werr;
 460
 461         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 462         W_ERROR_HAVE_NO_MEMORY(*la_list);
 463
 464         la = &(*la_list)[*la_count];
 465
 466         la->identifier = get_object_identifier(*la_list, msg);
 467         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 468
 469         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 470
 471         if (!active) {
 472                 /* We have to check that the inactive link still point to an existing object */
 473                 struct GUID guid;
 474                 struct ldb_dn *tdn;
 475                 int ret;
 476                 const char *v;
 477
 478                 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
 479                 if (strncmp(v, "TRUE", 4) == 0) {
 480                         /*
 481                           * Note: we skip the transmition of the deleted link even if the other part used to
 482                           * know about it because when we transmit the deletion of the object, the link will
 483                           * be deleted too due to deletion of object where link points and Windows do so.
 484                           */
 485                         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
 486                                 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
 487                                 /*
 488                                  * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
 489                                  * if it join an existing domain with deleted objets, it firsts impose to have a
 490                                  * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
 491                                  * either during initial replication or after the getNCChanges.
 492                                  * Behavior of samba has been changed to always have this attribute if it's present in the schema.
 493                                  *
 494                                  * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
 495                                  * If FL >=2K8R2 we are sure that this attribute will be here.
 496                                  * For this kind of forest level we do not return the link if the object is recycled
 497                                  * (isRecycled = true).
 498                                  */
 499                                 if (strncmp(v, "TRUE", 4) == 0) {
 500                                         DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
 501                                                                 ldb_dn_get_linearized(msg->dn)));
 502                                         return WERR_OK;
 503                                 }
 504                         } else {
 505                                 return WERR_OK;
 506                         }
 507                 }
 508                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
 509                 if (!NT_STATUS_IS_OK(status)) {
 510                         DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 511                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 512                         return ntstatus_to_werror(status);
 513                 }
 514                 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
 515                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 516                         DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 517                                                 GUID_string(mem_ctx, &guid)));
 518                         return WERR_OK;
 519                 } else if (ret != LDB_SUCCESS) {
 520                         DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 521                                                 GUID_string(mem_ctx, &guid),
 522                                                 ret));
 523                         return WERR_OK;
 524                 }
 525         }
 526         la->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
 527         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 528
 529         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 530         if (!NT_STATUS_IS_OK(status)) {
 531                 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
 532                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 533                 return ntstatus_to_werror(status);
 534         }
 535         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 536         if (!NT_STATUS_IS_OK(status)) {
 537                 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
 538                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 539                 return ntstatus_to_werror(status);
 540         }
 541         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 542         if (!NT_STATUS_IS_OK(status)) {
 543                 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
 544                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 545                 return ntstatus_to_werror(status);
 546         }
 547         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 548         if (!NT_STATUS_IS_OK(status)) {
 549                 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
 550                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 551                 return ntstatus_to_werror(status);
 552         }
 553
 554         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 555         if (!NT_STATUS_IS_OK(status)) {
 556                 /* this is possible for upgraded links */
 557                 la->originating_add_time = la->meta_data.originating_change_time;
 558         }
 559
 560         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 561         W_ERROR_NOT_OK_RETURN(werr);
 562
 563         (*la_count)++;
 564         return WERR_OK;
 565 }
 566
 567
 568 /*
 569   add linked attributes from an object to the list of linked
 570   attributes in a getncchanges request
 571  */
 572 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 573                                        TALLOC_CTX *mem_ctx,
 574                                        struct ldb_dn *ncRoot_dn,
 575                                        bool is_schema_nc,
 576                                        struct dsdb_schema *schema,
 577                                        uint64_t highest_usn,
 578                                        uint32_t replica_flags,
 579                                        const struct ldb_message *msg,
 580                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 581                                        uint32_t *la_count,
 582                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 583 {
 584         unsigned int i;
 585         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 586         uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
 587
 588         for (i=0; i<msg->num_elements; i++) {
 589                 struct ldb_message_element *el = &msg->elements[i];
 590                 const struct dsdb_attribute *sa;
 591                 unsigned int j;
 592
 593                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 594
 595                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 596                         /* we only want forward links */
 597                         continue;
 598                 }
 599
 600                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 601                         /* its an old style link, it will have been
 602                          * sent in the main replication data */
 603                         continue;
 604                 }
 605
 606                 for (j=0; j<el->num_values; j++) {
 607                         struct dsdb_dn *dsdb_dn;
 608                         uint64_t local_usn;
 609                         uint64_t originating_usn;
 610                         NTSTATUS status, status2;
 611                         WERROR werr;
 612                         struct GUID originating_invocation_id;
 613
 614                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 615                         if (dsdb_dn == NULL) {
 616                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 617                                          el->name, ldb_dn_get_linearized(msg->dn)));
 618                                 talloc_free(tmp_ctx);
 619                                 return WERR_DS_DRA_INTERNAL_ERROR;
 620                         }
 621
 622                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 623                         if (!NT_STATUS_IS_OK(status)) {
 624                                 /* this can happen for attributes
 625                                    given to us with old style meta
 626                                    data */
 627                                 continue;
 628                         }
 629
 630                         if (local_usn > uSNChanged) {
 631                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 632                                          el->name, ldb_dn_get_linearized(msg->dn)));
 633                                 talloc_free(tmp_ctx);
 634                                 return WERR_DS_DRA_INTERNAL_ERROR;
 635                         }
 636
 637                         if (local_usn < highest_usn) {
 638                                 continue;
 639                         }
 640
 641                         status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
 642                                                            &originating_invocation_id,
 643                                                            "RMD_INVOCID");
 644                         status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
 645                                                               &originating_usn,
 646                                                               "RMD_ORIGINATING_USN");
 647
 648                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
 649                                 if (udv_filter(uptodateness_vector,
 650                                                &originating_invocation_id,
 651                                                originating_usn)) {
 652                                         continue;
 653                                 }
 654                         }
 655
 656                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
 657                                                      sa, msg, dsdb_dn, la_list,
 658                                                      la_count, is_schema_nc);
 659                         if (!W_ERROR_IS_OK(werr)) {
 660                                 talloc_free(tmp_ctx);
 661                                 return werr;
 662                         }
 663                 }
 664         }
 665
 666         talloc_free(tmp_ctx);
 667         return WERR_OK;
 668 }
 669
 670 /*
 671   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 672  */
 673 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 674                                  struct ldb_dn *ncRoot_dn,
 675                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 676 {
 677         int ret;
 678
 679         udv->version = 2;
 680         udv->reserved1 = 0;
 681         udv->reserved2 = 0;
 682
 683         ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
 684         if (ret != LDB_SUCCESS) {
 685                 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
 686                          ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
 687                 return WERR_DS_DRA_INTERNAL_ERROR;
 688         }
 689
 690         return WERR_OK;
 691 }
 692
 693
 694 /* comparison function for linked attributes - see CompareLinks() in
 695  * MS-DRSR section 4.1.10.5.17 */
 696 static int linked_attribute_compare(const struct la_for_sorting *la1,
 697                                     const struct la_for_sorting *la2,
 698                                     void *opaque)
 699 {
 700         int c;
 701         c = memcmp(la1->source_guid,
 702                    la2->source_guid, sizeof(la2->source_guid));
 703         if (c != 0) {
 704                 return c;
 705         }
 706
 707         if (la1->link->attid != la2->link->attid) {
 708                 return la1->link->attid < la2->link->attid? -1:1;
 709         }
 710
 711         if ((la1->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
 712             (la2->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
 713                 return (la1->link->flags &
 714                         DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
 715         }
 716
 717         return memcmp(la1->target_guid,
 718                       la2->target_guid, sizeof(la2->target_guid));
 719 }
 720
 721 struct drsuapi_changed_objects {
 722         struct ldb_dn *dn;
 723         struct GUID guid;
 724         uint64_t usn;
 725 };
 726
 727 /*
 728   sort the objects we send by tree order
 729  */
 730 static int site_res_cmp_anc_order(struct drsuapi_changed_objects *m1,
 731                                   struct drsuapi_changed_objects *m2,
 732                                   struct drsuapi_getncchanges_state *getnc_state)
 733 {
 734         return ldb_dn_compare(m2->dn, m1->dn);
 735 }
 736
 737 /*
 738   sort the objects we send first by uSNChanged
 739  */
 740 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
 741                                   struct drsuapi_changed_objects *m2,
 742                                   struct drsuapi_getncchanges_state *getnc_state)
 743 {
 744         int ret;
 745
 746         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
 747         if (ret == 0) {
 748                 return -1;
 749         }
 750
 751         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
 752         if (ret == 0) {
 753                 return 1;
 754         }
 755
 756         if (m1->usn == m2->usn) {
 757                 return ldb_dn_compare(m2->dn, m1->dn);
 758         }
 759
 760         if (m1->usn < m2->usn) {
 761                 return -1;
 762         }
 763
 764         return 1;
 765 }
 766
 767
 768 /*
 769   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
 770  */
 771 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
 772                                      TALLOC_CTX *mem_ctx,
 773                                      struct drsuapi_DsGetNCChangesRequest10 *req10,
 774                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6,
 775                                      struct ldb_dn **rid_manager_dn)
 776 {
 777         struct ldb_dn *req_dn, *ntds_dn = NULL;
 778         int ret;
 779         struct ldb_context *ldb = b_state->sam_ctx;
 780         struct ldb_result *ext_res;
 781         struct dsdb_fsmo_extended_op *exop;
 782         bool is_us;
 783
 784         /*
 785           steps:
 786             - verify that the DN being asked for is the RID Manager DN
 787             - verify that we are the RID Manager
 788          */
 789
 790         /* work out who is the RID Manager, also return to caller */
 791         ret = samdb_rid_manager_dn(ldb, mem_ctx, rid_manager_dn);
 792         if (ret != LDB_SUCCESS) {
 793                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
 794                 return WERR_DS_DRA_INTERNAL_ERROR;
 795         }
 796
 797         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
 798         if (!ldb_dn_validate(req_dn) ||
 799             ldb_dn_compare(req_dn, *rid_manager_dn) != 0) {
 800                 /* that isn't the RID Manager DN */
 801                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
 802                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
 803                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
 804                 return WERR_OK;
 805         }
 806
 807         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
 808         ret = dsdb_find_dn_by_guid(ldb, mem_ctx, &req10->destination_dsa_guid, 0, &ntds_dn);
 809         if (ret != LDB_SUCCESS) {
 810                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
 811                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
 812                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
 813                 return WERR_OK;
 814         }
 815
 816         /* find the DN of the RID Manager */
 817         ret = samdb_reference_dn_is_our_ntdsa(ldb, *rid_manager_dn, "fSMORoleOwner", &is_us);
 818         if (ret != LDB_SUCCESS) {
 819                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
 820                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
 821                 return WERR_DS_DRA_INTERNAL_ERROR;
 822         }
 823
 824         if (!is_us) {
 825                 /* we're not the RID Manager - go away */
 826                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
 827                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
 828                 return WERR_OK;
 829         }
 830
 831         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
 832         W_ERROR_HAVE_NO_MEMORY(exop);
 833
 834         exop->fsmo_info = req10->fsmo_info;
 835         exop->destination_dsa_guid = req10->destination_dsa_guid;
 836
 837         ret = ldb_transaction_start(ldb);
 838         if (ret != LDB_SUCCESS) {
 839                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 840                          ldb_errstring(ldb)));
 841                 return WERR_DS_DRA_INTERNAL_ERROR;
 842         }
 843
 844         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
 845         if (ret != LDB_SUCCESS) {
 846                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
 847                          ldb_errstring(ldb)));
 848                 ldb_transaction_cancel(ldb);
 849                 return WERR_DS_DRA_INTERNAL_ERROR;
 850         }
 851
 852         ret = ldb_transaction_commit(ldb);
 853         if (ret != LDB_SUCCESS) {
 854                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 855                          ldb_errstring(ldb)));
 856                 return WERR_DS_DRA_INTERNAL_ERROR;
 857         }
 858
 859         talloc_free(ext_res);
 860
 861         DEBUG(2,("Allocated RID pool for server %s\n",
 862                  GUID_string(mem_ctx, &req10->destination_dsa_guid)));
 863
 864         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
 865
 866         return WERR_OK;
 867 }
 868
 869 /*
 870   return an array of SIDs from a ldb_message given an attribute name
 871   assumes the SIDs are in extended DN format
 872  */
 873 static WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
 874                                         struct ldb_message *msg,
 875                                         TALLOC_CTX *mem_ctx,
 876                                         const char *attr,
 877                                         const struct dom_sid ***sids)
 878 {
 879         struct ldb_message_element *el;
 880         unsigned int i;
 881
 882         el = ldb_msg_find_element(msg, attr);
 883         if (!el) {
 884                 *sids = NULL;
 885                 return WERR_OK;
 886         }
 887
 888         (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
 889         W_ERROR_HAVE_NO_MEMORY(*sids);
 890
 891         for (i=0; i<el->num_values; i++) {
 892                 struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, sam_ctx, &el->values[i]);
 893                 NTSTATUS status;
 894                 struct dom_sid *sid;
 895
 896                 sid = talloc(*sids, struct dom_sid);
 897                 W_ERROR_HAVE_NO_MEMORY(sid);
 898                 status = dsdb_get_extended_dn_sid(dn, sid, "SID");
 899                 if (!NT_STATUS_IS_OK(status)) {
 900                         return WERR_INTERNAL_DB_CORRUPTION;
 901                 }
 902                 (*sids)[i] = sid;
 903         }
 904         (*sids)[i] = NULL;
 905
 906         return WERR_OK;
 907 }
 908
 909
 910 /*
 911   return an array of SIDs from a ldb_message given an attribute name
 912   assumes the SIDs are in NDR form
 913  */
 914 static WERROR samdb_result_sid_array_ndr(struct ldb_context *sam_ctx,
 915                                          struct ldb_message *msg,
 916                                          TALLOC_CTX *mem_ctx,
 917                                          const char *attr,
 918                                          const struct dom_sid ***sids)
 919 {
 920         struct ldb_message_element *el;
 921         unsigned int i;
 922
 923         el = ldb_msg_find_element(msg, attr);
 924         if (!el) {
 925                 *sids = NULL;
 926                 return WERR_OK;
 927         }
 928
 929         (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
 930         W_ERROR_HAVE_NO_MEMORY(*sids);
 931
 932         for (i=0; i<el->num_values; i++) {
 933                 enum ndr_err_code ndr_err;
 934                 struct dom_sid *sid;
 935
 936                 sid = talloc(*sids, struct dom_sid);
 937                 W_ERROR_HAVE_NO_MEMORY(sid);
 938
 939                 ndr_err = ndr_pull_struct_blob(&el->values[i], sid, sid,
 940                                                (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
 941                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 942                         return WERR_INTERNAL_DB_CORRUPTION;
 943                 }
 944                 (*sids)[i] = sid;
 945         }
 946         (*sids)[i] = NULL;
 947
 948         return WERR_OK;
 949 }
 950
 951 /*
 952   see if any SIDs in list1 are in list2
 953  */
 954 static bool sid_list_match(const struct dom_sid **list1, const struct dom_sid **list2)
 955 {
 956         unsigned int i, j;
 957         /* do we ever have enough SIDs here to worry about O(n^2) ? */
 958         for (i=0; list1[i]; i++) {
 959                 for (j=0; list2[j]; j++) {
 960                         if (dom_sid_equal(list1[i], list2[j])) {
 961                                 return true;
 962                         }
 963                 }
 964         }
 965         return false;
 966 }
 967
 968 /*
 969   handle a DRSUAPI_EXOP_REPL_SECRET call
 970  */
 971 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
 972                                        TALLOC_CTX *mem_ctx,
 973                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
 974                                        struct dom_sid *user_sid,
 975                                        struct drsuapi_DsGetNCChangesCtr6 *ctr6,
 976                                        bool has_get_all_changes)
 977 {
 978         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
 979         struct ldb_dn *obj_dn = NULL;
 980         struct ldb_dn *rodc_dn, *krbtgt_link_dn;
 981         int ret;
 982         const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", NULL };
 983         const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
 984         struct ldb_result *rodc_res, *obj_res;
 985         const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
 986         WERROR werr;
 987
 988         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
 989                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
 990
 991         /*
 992          * we need to work out if we will allow this DC to
 993          * replicate the secrets for this object
 994          *
 995          * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
 996          * of this function
 997          */
 998
 999         if (b_state->sam_ctx_system == NULL) {
1000                 /* this operation needs system level access */
1001                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
1002                 return WERR_DS_DRA_SOURCE_DISABLED;
1003         }
1004
1005         /*
1006          * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1007          *
1008          * The pseudo code indicate
1009          * revealsecrets = true
1010          * if IsRevealSecretRequest(msgIn) then
1011          *   if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1012          *   then
1013          *     if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1014          *     <... check if this account is ok to be replicated on this DC ...>
1015          *     <... and if not reveal secrets = no ...>
1016          *     else
1017          *       reveal secrets = false
1018          *     endif
1019          *   endif
1020          * endif
1021          *
1022          * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1023          * then you can do EXOP_REPL_SECRETS
1024          */
1025         if (has_get_all_changes) {
1026                 goto allowed;
1027         }
1028
1029         obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
1030         if (!ldb_dn_validate(obj_dn)) goto failed;
1031
1032         rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
1033                                  dom_sid_string(mem_ctx, user_sid));
1034         if (!ldb_dn_validate(rodc_dn)) goto failed;
1035
1036         /* do the two searches we need */
1037         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
1038                              DSDB_SEARCH_SHOW_EXTENDED_DN);
1039         if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
1040
1041         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1042         if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1043
1044         /* if the object SID is equal to the user_sid, allow */
1045         if (dom_sid_equal(user_sid,
1046                           samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid"))) {
1047                 goto allowed;
1048         }
1049
1050         /* an RODC is allowed to get its own krbtgt account secrets */
1051         krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1052                                          rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1053         if (krbtgt_link_dn != NULL &&
1054             ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1055                 goto allowed;
1056         }
1057
1058         /* but it isn't allowed to get anyone elses krbtgt secrets */
1059         if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1060                             obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1061                 goto denied;
1062         }
1063
1064         if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1065                                       "userAccountControl", 0) &
1066             UF_INTERDOMAIN_TRUST_ACCOUNT) {
1067                 goto denied;
1068         }
1069
1070         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1071                                          mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1072         if (!W_ERROR_IS_OK(werr)) {
1073                 goto denied;
1074         }
1075
1076         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1077                                          mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1078         if (!W_ERROR_IS_OK(werr)) {
1079                 goto denied;
1080         }
1081
1082         werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1083                                          mem_ctx, "tokenGroups", &token_sids);
1084         if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1085                 goto denied;
1086         }
1087
1088         if (never_reveal_sids &&
1089             sid_list_match(token_sids, never_reveal_sids)) {
1090                 goto denied;
1091         }
1092
1093         if (reveal_sids &&
1094             sid_list_match(token_sids, reveal_sids)) {
1095                 goto allowed;
1096         }
1097
1098         /* default deny */
1099 denied:
1100         DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1101                  ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1102         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1103         return WERR_DS_DRA_ACCESS_DENIED;
1104
1105 allowed:
1106         DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1107                  ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1108                  ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1109         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1110         req10->highwatermark.highest_usn = 0;
1111         return WERR_OK;
1112
1113 failed:
1114         DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1115                  ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1116         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1117         return WERR_DS_DRA_BAD_DN;
1118 }
1119
1120
1121 /*
1122   handle a DRSUAPI_EXOP_REPL_OBJ call
1123  */
1124 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1125                                     TALLOC_CTX *mem_ctx,
1126                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
1127                                     struct dom_sid *user_sid,
1128                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1129 {
1130         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1131
1132         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1133                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1134
1135         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1136         return WERR_OK;
1137 }
1138
1139
1140 /*
1141   handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1142   DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1143   and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1144  */
1145 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1146                                          TALLOC_CTX *mem_ctx,
1147                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
1148                                          struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1149 {
1150         struct ldb_dn *req_dn, *ntds_dn;
1151         int ret;
1152         unsigned int i;
1153         struct ldb_context *ldb = b_state->sam_ctx;
1154         struct ldb_message *msg;
1155         bool is_us;
1156
1157         /*
1158           steps:
1159             - verify that the client dn exists
1160             - verify that we are the current master
1161          */
1162
1163         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1164         if (!ldb_dn_validate(req_dn)) {
1165                 /* that is not a valid dn */
1166                 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1167                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1168                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1169                 return WERR_OK;
1170         }
1171
1172         /* find the DN of the current role owner */
1173         ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1174         if (ret != LDB_SUCCESS) {
1175                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1176                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1177                 return WERR_DS_DRA_INTERNAL_ERROR;
1178         }
1179
1180         if (!is_us) {
1181                 /* we're not the RID Manager or role owner - go away */
1182                 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1183                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1184                 return WERR_OK;
1185         }
1186
1187         /* change the current master */
1188         msg = ldb_msg_new(ldb);
1189         W_ERROR_HAVE_NO_MEMORY(msg);
1190         msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1191         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1192
1193         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1194         ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1195         if (ret != LDB_SUCCESS) {
1196                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1197                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1198                 talloc_free(msg);
1199                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1200                 return WERR_OK;
1201         }
1202
1203         ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1204         if (ret != 0) {
1205                 talloc_free(msg);
1206                 return WERR_DS_DRA_INTERNAL_ERROR;
1207         }
1208
1209         for (i=0;i<msg->num_elements;i++) {
1210                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1211         }
1212
1213         ret = ldb_transaction_start(ldb);
1214         if (ret != LDB_SUCCESS) {
1215                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1216                          ldb_errstring(ldb)));
1217                 return WERR_DS_DRA_INTERNAL_ERROR;
1218         }
1219
1220         ret = ldb_modify(ldb, msg);
1221         if (ret != LDB_SUCCESS) {
1222                 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1223                          ldb_errstring(ldb)));
1224                 ldb_transaction_cancel(ldb);
1225                 return WERR_DS_DRA_INTERNAL_ERROR;
1226         }
1227
1228         ret = ldb_transaction_commit(ldb);
1229         if (ret != LDB_SUCCESS) {
1230                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1231                          ldb_errstring(ldb)));
1232                 return WERR_DS_DRA_INTERNAL_ERROR;
1233         }
1234
1235         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1236
1237         return WERR_OK;
1238 }
1239
1240 /*
1241   see if this getncchanges request includes a request to reveal secret information
1242  */
1243 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1244                                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1245                                                        struct dsdb_schema_prefixmap *pfm_remote,
1246                                                        bool *is_secret_request)
1247 {
1248         enum drsuapi_DsExtendedOperation exop;
1249         uint32_t i;
1250         struct dsdb_schema *schema;
1251         struct dsdb_syntax_ctx syntax_ctx;
1252
1253         *is_secret_request = true;
1254
1255         exop = req10->extended_op;
1256
1257         switch (exop) {
1258         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1259         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1260         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1261         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1262         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1263                 /* FSMO exops can reveal secrets */
1264                 *is_secret_request = true;
1265                 return WERR_OK;
1266         case DRSUAPI_EXOP_REPL_SECRET:
1267         case DRSUAPI_EXOP_REPL_OBJ:
1268         case DRSUAPI_EXOP_NONE:
1269                 break;
1270         }
1271
1272         if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1273                 *is_secret_request = false;
1274                 return WERR_OK;
1275         }
1276
1277         if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1278             req10->partial_attribute_set == NULL) {
1279                 /* they want secrets */
1280                 *is_secret_request = true;
1281                 return WERR_OK;
1282         }
1283
1284         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1285         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1286         syntax_ctx.pfm_remote = pfm_remote;
1287
1288         /* check the attributes they asked for */
1289         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1290                 const struct dsdb_attribute *sa;
1291                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1292                                                                  &syntax_ctx,
1293                                                                  req10->partial_attribute_set->attids[i],
1294                                                                  NULL,
1295                                                                  &sa);
1296
1297                 if (!W_ERROR_IS_OK(werr)) {
1298                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1299                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1300                         return werr;
1301                 }
1302
1303                 if (!dsdb_attr_in_rodc_fas(sa)) {
1304                         *is_secret_request = true;
1305                         return WERR_OK;
1306                 }
1307         }
1308
1309         if (req10->partial_attribute_set_ex) {
1310                 /* check the extended attributes they asked for */
1311                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1312                         const struct dsdb_attribute *sa;
1313                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1314                                                                          &syntax_ctx,
1315                                                                          req10->partial_attribute_set_ex->attids[i],
1316                                                                          NULL,
1317                                                                          &sa);
1318
1319                         if (!W_ERROR_IS_OK(werr)) {
1320                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1321                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1322                                 return werr;
1323                         }
1324
1325                         if (!dsdb_attr_in_rodc_fas(sa)) {
1326                                 *is_secret_request = true;
1327                                 return WERR_OK;
1328                         }
1329                 }
1330         }
1331
1332         *is_secret_request = false;
1333         return WERR_OK;
1334 }
1335
1336 /*
1337   see if this getncchanges request is only for attributes in the GC
1338   partial attribute set
1339  */
1340 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1341                                                struct drsuapi_DsGetNCChangesRequest10 *req10,
1342                                                struct dsdb_schema_prefixmap *pfm_remote,
1343                                                bool *is_gc_pas_request)
1344 {
1345         enum drsuapi_DsExtendedOperation exop;
1346         uint32_t i;
1347         struct dsdb_schema *schema;
1348         struct dsdb_syntax_ctx syntax_ctx;
1349
1350         exop = req10->extended_op;
1351
1352         switch (exop) {
1353         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1354         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1355         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1356         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1357         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1358         case DRSUAPI_EXOP_REPL_SECRET:
1359                 *is_gc_pas_request = false;
1360                 return WERR_OK;
1361         case DRSUAPI_EXOP_REPL_OBJ:
1362         case DRSUAPI_EXOP_NONE:
1363                 break;
1364         }
1365
1366         if (req10->partial_attribute_set == NULL) {
1367                 /* they want it all */
1368                 *is_gc_pas_request = false;
1369                 return WERR_OK;
1370         }
1371
1372         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1373         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1374         syntax_ctx.pfm_remote = pfm_remote;
1375
1376         /* check the attributes they asked for */
1377         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1378                 const struct dsdb_attribute *sa;
1379                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1380                                                                  &syntax_ctx,
1381                                                                  req10->partial_attribute_set->attids[i],
1382                                                                  NULL,
1383                                                                  &sa);
1384
1385                 if (!W_ERROR_IS_OK(werr)) {
1386                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1387                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1388                         return werr;
1389                 }
1390
1391                 if (!sa->isMemberOfPartialAttributeSet) {
1392                         *is_gc_pas_request = false;
1393                         return WERR_OK;
1394                 }
1395         }
1396
1397         if (req10->partial_attribute_set_ex) {
1398                 /* check the extended attributes they asked for */
1399                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1400                         const struct dsdb_attribute *sa;
1401                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1402                                                                          &syntax_ctx,
1403                                                                          req10->partial_attribute_set_ex->attids[i],
1404                                                                          NULL,
1405                                                                          &sa);
1406
1407                         if (!W_ERROR_IS_OK(werr)) {
1408                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1409                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1410                                 return werr;
1411                         }
1412
1413                         if (!sa->isMemberOfPartialAttributeSet) {
1414                                 *is_gc_pas_request = false;
1415                                 return WERR_OK;
1416                         }
1417                 }
1418         }
1419
1420         *is_gc_pas_request = true;
1421         return WERR_OK;
1422 }
1423
1424
1425 /*
1426   map from req8 to req10
1427  */
1428 static struct drsuapi_DsGetNCChangesRequest10 *
1429 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1430                       struct drsuapi_DsGetNCChangesRequest8 *req8)
1431 {
1432         struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1433                                                                     struct drsuapi_DsGetNCChangesRequest10);
1434         if (req10 == NULL) {
1435                 return NULL;
1436         }
1437
1438         req10->destination_dsa_guid = req8->destination_dsa_guid;
1439         req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1440         req10->naming_context = req8->naming_context;
1441         req10->highwatermark = req8->highwatermark;
1442         req10->uptodateness_vector = req8->uptodateness_vector;
1443         req10->replica_flags = req8->replica_flags;
1444         req10->max_object_count = req8->max_object_count;
1445         req10->max_ndr_size = req8->max_ndr_size;
1446         req10->extended_op = req8->extended_op;
1447         req10->fsmo_info = req8->fsmo_info;
1448         req10->partial_attribute_set = req8->partial_attribute_set;
1449         req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1450         req10->mapping_ctr = req8->mapping_ctr;
1451
1452         return req10;
1453 }
1454
1455 static const char *collect_objects_attrs[] = { "uSNChanged",
1456                                                "objectGUID" ,
1457                                                NULL };
1458
1459 /**
1460  * Collects object for normal replication cycle.
1461  */
1462 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1463                                            TALLOC_CTX *mem_ctx,
1464                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
1465                                            struct ldb_dn *search_dn,
1466                                            const char *extra_filter,
1467                                            struct ldb_result **search_res)
1468 {
1469         int ret;
1470         char* search_filter;
1471         enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1472         //const char *extra_filter;
1473         struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1474         bool critical_only = false;
1475
1476         if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1477                 critical_only = true;
1478         }
1479
1480         if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1481             req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1482                 scope = LDB_SCOPE_BASE;
1483                 critical_only = false;
1484         }
1485
1486         //extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1487
1488         //getnc_state->min_usn = req10->highwatermark.highest_usn;
1489
1490         /* Construct response. */
1491         search_filter = talloc_asprintf(mem_ctx,
1492                                         "(uSNChanged>=%llu)",
1493                                         (unsigned long long)(getnc_state->min_usn+1));
1494
1495         if (extra_filter) {
1496                 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1497         }
1498
1499         if (critical_only) {
1500                 search_filter = talloc_asprintf(mem_ctx,
1501                                                 "(&%s(isCriticalSystemObject=TRUE))",
1502                                                 search_filter);
1503         }
1504
1505         if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1506                 scope = LDB_SCOPE_BASE;
1507         }
1508
1509         if (!search_dn) {
1510                 search_dn = getnc_state->ncRoot_dn;
1511         }
1512
1513         DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1514                  ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1515         ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1516                                               search_dn, scope,
1517                                               collect_objects_attrs,
1518                                               search_filter);
1519         if (ret != LDB_SUCCESS) {
1520                 return WERR_DS_DRA_INTERNAL_ERROR;
1521         }
1522
1523         return WERR_OK;
1524 }
1525
1526 /**
1527  * Collects object for normal replication cycle.
1528  */
1529 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1530                                                 TALLOC_CTX *mem_ctx,
1531                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
1532                                                 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1533                                                 struct ldb_dn *search_dn,
1534                                                 const char *extra_filter,
1535                                                 struct ldb_result **search_res)
1536 {
1537         /* we have nothing to do in case of ex-op failure */
1538         if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1539                 return WERR_OK;
1540         }
1541
1542         switch (req10->extended_op) {
1543         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1544         {
1545                 int ret;
1546                 struct ldb_dn *ntds_dn = NULL;
1547                 struct ldb_dn *server_dn = NULL;
1548                 struct ldb_dn *machine_dn = NULL;
1549                 struct ldb_dn *rid_set_dn = NULL;
1550                 struct ldb_result *search_res2 = NULL;
1551                 struct ldb_result *search_res3 = NULL;
1552                 TALLOC_CTX *frame = talloc_stackframe();
1553                 /* get RID manager, RID set and server DN (in that order) */
1554
1555                 /* This first search will get the RID Manager */
1556                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1557                                                       search_res,
1558                                                       search_dn, LDB_SCOPE_BASE,
1559                                                       collect_objects_attrs,
1560                                                       NULL);
1561                 if (ret != LDB_SUCCESS) {
1562                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1563                                   ldb_dn_get_linearized(search_dn),
1564                                   ldb_errstring(b_state->sam_ctx)));
1565                         TALLOC_FREE(frame);
1566                         return WERR_DS_DRA_INTERNAL_ERROR;
1567                 }
1568
1569                 if ((*search_res)->count != 1) {
1570                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1571                                   ldb_dn_get_linearized(search_dn),
1572                                   (*search_res)->count));
1573                         TALLOC_FREE(frame);
1574                         return WERR_DS_DRA_INTERNAL_ERROR;
1575                 }
1576
1577                 /* Now extend it to the RID set */
1578
1579                 /* Find the computer account DN for the destination
1580                  * dsa GUID specified */
1581
1582                 ret = dsdb_find_dn_by_guid(b_state->sam_ctx, frame,
1583                                            &req10->destination_dsa_guid, 0,
1584                                            &ntds_dn);
1585                 if (ret != LDB_SUCCESS) {
1586                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1587                                   GUID_string(frame,
1588                                               &req10->destination_dsa_guid),
1589                                   ldb_errstring(b_state->sam_ctx)));
1590                         TALLOC_FREE(frame);
1591                         return WERR_DS_DRA_INTERNAL_ERROR;
1592                 }
1593
1594                 server_dn = ldb_dn_get_parent(frame, ntds_dn);
1595                 if (!server_dn) {
1596                         TALLOC_FREE(frame);
1597                         return WERR_DS_DRA_INTERNAL_ERROR;
1598                 }
1599
1600                 ret = samdb_reference_dn(b_state->sam_ctx, frame, server_dn,
1601                                          "serverReference", &machine_dn);
1602                 if (ret != LDB_SUCCESS) {
1603                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1604                                   ldb_dn_get_linearized(server_dn),
1605                                   ldb_errstring(b_state->sam_ctx)));
1606                         TALLOC_FREE(frame);
1607                         return WERR_DS_DRA_INTERNAL_ERROR;
1608                 }
1609
1610                 ret = samdb_reference_dn(b_state->sam_ctx, frame, machine_dn,
1611                                          "rIDSetReferences", &rid_set_dn);
1612                 if (ret != LDB_SUCCESS) {
1613                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1614                                   ldb_dn_get_linearized(server_dn),
1615                                   ldb_errstring(b_state->sam_ctx)));
1616                         TALLOC_FREE(frame);
1617                         return WERR_DS_DRA_INTERNAL_ERROR;
1618                 }
1619
1620
1621                 /* This first search will get the RID Manager, now get the RID set */
1622                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1623                                                       &search_res2,
1624                                                       rid_set_dn, LDB_SCOPE_BASE,
1625                                                       collect_objects_attrs,
1626                                                       NULL);
1627                 if (ret != LDB_SUCCESS) {
1628                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1629                                   ldb_dn_get_linearized(rid_set_dn),
1630                                   ldb_errstring(b_state->sam_ctx)));
1631                         TALLOC_FREE(frame);
1632                         return WERR_DS_DRA_INTERNAL_ERROR;
1633                 }
1634
1635                 if (search_res2->count != 1) {
1636                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1637                                   ldb_dn_get_linearized(rid_set_dn),
1638                                   search_res2->count));
1639                         TALLOC_FREE(frame);
1640                         return WERR_DS_DRA_INTERNAL_ERROR;
1641                 }
1642
1643                 /* Finally get the server DN */
1644                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1645                                                       &search_res3,
1646                                                       machine_dn, LDB_SCOPE_BASE,
1647                                                       collect_objects_attrs,
1648                                                       NULL);
1649                 if (ret != LDB_SUCCESS) {
1650                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1651                                   ldb_dn_get_linearized(server_dn),
1652                                   ldb_errstring(b_state->sam_ctx)));
1653                         TALLOC_FREE(frame);
1654                         return WERR_DS_DRA_INTERNAL_ERROR;
1655                 }
1656
1657                 if (search_res3->count != 1) {
1658                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1659                                   ldb_dn_get_linearized(server_dn),
1660                                   search_res3->count));
1661                         TALLOC_FREE(frame);
1662                         return WERR_DS_DRA_INTERNAL_ERROR;
1663                 }
1664
1665                 /* Now extend the original search_res with these answers */
1666                 (*search_res)->count = 3;
1667
1668                 (*search_res)->msgs = talloc_realloc(frame, (*search_res)->msgs,
1669                                                      struct ldb_message *,
1670                                                      (*search_res)->count);
1671                 if ((*search_res)->msgs == NULL) {
1672                         TALLOC_FREE(frame);
1673                         return WERR_NOT_ENOUGH_MEMORY;
1674                 }
1675
1676
1677                 talloc_steal(mem_ctx, *search_res);
1678                 (*search_res)->msgs[1] =
1679                         talloc_steal((*search_res)->msgs, search_res2->msgs[0]);
1680                 (*search_res)->msgs[2] =
1681                         talloc_steal((*search_res)->msgs, search_res3->msgs[0]);
1682
1683                 TALLOC_FREE(frame);
1684                 return WERR_OK;
1685         }
1686         default:
1687                 /* TODO: implement extended op specific collection
1688                  * of objects. Right now we just normal procedure
1689                  * for collecting objects */
1690                 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1691         }
1692 }
1693
1694 /*
1695   drsuapi_DsGetNCChanges
1696
1697   see MS-DRSR 4.1.10.5.2 for basic logic of this function
1698 */
1699 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1700                                      struct drsuapi_DsGetNCChanges *r)
1701 {
1702         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
1703         int ret;
1704         uint32_t i, k;
1705         struct dsdb_schema *schema;
1706         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
1707         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
1708         NTSTATUS status;
1709         DATA_BLOB session_key;
1710         WERROR werr;
1711         struct dcesrv_handle *h;
1712         struct drsuapi_bind_state *b_state;
1713         struct drsuapi_getncchanges_state *getnc_state;
1714         struct drsuapi_DsGetNCChangesRequest10 *req10;
1715         uint32_t options;
1716         uint32_t max_objects;
1717         uint32_t max_links;
1718         uint32_t link_count = 0;
1719         uint32_t link_total = 0;
1720         uint32_t link_given = 0;
1721         struct ldb_dn *search_dn = NULL;
1722         bool am_rodc, null_scope=false;
1723         enum security_user_level security_level;
1724         struct ldb_context *sam_ctx;
1725         struct dom_sid *user_sid;
1726         bool is_secret_request;
1727         bool is_gc_pas_request;
1728         struct drsuapi_changed_objects *changes;
1729         time_t max_wait;
1730         time_t start = time(NULL);
1731         bool max_wait_reached = false;
1732         bool has_get_all_changes = false;
1733         struct GUID invocation_id;
1734         static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
1735         struct dsdb_schema_prefixmap *pfm_remote = NULL;
1736         bool full = true;
1737         uint32_t *local_pas = NULL;
1738
1739         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
1740         b_state = h->data;
1741
1742         sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
1743
1744         invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1745
1746         *r->out.level_out = 6;
1747         /* TODO: linked attributes*/
1748         r->out.ctr->ctr6.linked_attributes_count = 0;
1749         r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
1750
1751         r->out.ctr->ctr6.object_count = 0;
1752         r->out.ctr->ctr6.nc_object_count = 0;
1753         r->out.ctr->ctr6.more_data = false;
1754         r->out.ctr->ctr6.uptodateness_vector = NULL;
1755         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
1756         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1757         r->out.ctr->ctr6.first_object = NULL;
1758
1759         /* a RODC doesn't allow for any replication */
1760         ret = samdb_rodc(sam_ctx, &am_rodc);
1761         if (ret == LDB_SUCCESS && am_rodc) {
1762                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
1763                 return WERR_DS_DRA_SOURCE_DISABLED;
1764         }
1765
1766         /* Check request revision.
1767          */
1768         switch (r->in.level) {
1769         case 8:
1770                 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
1771                 if (req10 == NULL) {
1772                         return WERR_NOT_ENOUGH_MEMORY;
1773                 }
1774                 break;
1775         case 10:
1776                 req10 = &r->in.req->req10;
1777                 break;
1778         default:
1779                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
1780                          r->in.level));
1781                 return WERR_REVISION_MISMATCH;
1782         }
1783
1784
1785         /* Perform access checks. */
1786         /* TODO: we need to support a sync on a specific non-root
1787          * DN. We'll need to find the real partition root here */
1788         ncRoot = req10->naming_context;
1789         if (ncRoot == NULL) {
1790                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
1791                 return WERR_DS_DRA_INVALID_PARAMETER;
1792         }
1793
1794         if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
1795                 return WERR_DS_DRA_INTERNAL_ERROR;
1796         }
1797
1798         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
1799             !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
1800                 return WERR_DS_DRA_SOURCE_DISABLED;
1801         }
1802
1803         user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
1804
1805         /* all clients must have GUID_DRS_GET_CHANGES */
1806         werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1807                                                  mem_ctx,
1808                                                  dce_call->conn->auth_state.session_info->security_token,
1809                                                  req10->naming_context,
1810                                                  GUID_DRS_GET_CHANGES);
1811         if (!W_ERROR_IS_OK(werr)) {
1812                 return werr;
1813         }
1814
1815         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) {
1816                 full = req10->partial_attribute_set == NULL &&
1817                        req10->partial_attribute_set_ex == NULL;
1818         } else {
1819                 full = (options & DRSUAPI_DRS_WRIT_REP) != 0;
1820         }
1821
1822         werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true,
1823                                                 mem_ctx, &pfm_remote, NULL);
1824
1825         /* We were supplied a partial attribute set, without the prefix map! */
1826         if (!full && !W_ERROR_IS_OK(werr)) {
1827                 if (req10->mapping_ctr.num_mappings == 0) {
1828                         /*
1829                          * Despite the fact MS-DRSR specifies that this shouldn't
1830                          * happen, Windows RODCs will in fact not provide a prefixMap.
1831                          */
1832                         DEBUG(5,(__location__ ": Failed to provide a remote prefixMap,"
1833                                  " falling back to local prefixMap\n"));
1834                 } else {
1835                         DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n",
1836                                  win_errstr(werr)));
1837                         return werr;
1838                 }
1839         }
1840
1841         /* allowed if the GC PAS and client has
1842            GUID_DRS_GET_FILTERED_ATTRIBUTES */
1843         werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request);
1844         if (!W_ERROR_IS_OK(werr)) {
1845                 return werr;
1846         }
1847         if (is_gc_pas_request) {
1848                 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1849                                                          mem_ctx,
1850                                                          dce_call->conn->auth_state.session_info->security_token,
1851                                                          req10->naming_context,
1852                                                          GUID_DRS_GET_FILTERED_ATTRIBUTES);
1853                 if (W_ERROR_IS_OK(werr)) {
1854                         goto allowed;
1855                 }
1856         }
1857
1858         werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10,
1859                                                         pfm_remote,
1860                                                         &is_secret_request);
1861         if (!W_ERROR_IS_OK(werr)) {
1862                 return werr;
1863         }
1864         if (is_secret_request && req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
1865                 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1866                                                          mem_ctx,
1867                                                          dce_call->conn->auth_state.session_info->security_token,
1868                                                          req10->naming_context,
1869                                                          GUID_DRS_GET_ALL_CHANGES);
1870                 if (!W_ERROR_IS_OK(werr)) {
1871                         return werr;
1872                 } else {
1873                         has_get_all_changes = true;
1874                 }
1875         }
1876
1877 allowed:
1878         /* for non-administrator replications, check that they have
1879            given the correct source_dsa_invocation_id */
1880         security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
1881                                                      samdb_domain_sid(sam_ctx));
1882         if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
1883                 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
1884                         /* we rely on this flag being unset for RODC requests */
1885                         req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
1886                 }
1887         }
1888
1889         if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
1890                 /* Ignore the _in_ uptpdateness vector*/
1891                 req10->uptodateness_vector = NULL;
1892         }
1893
1894         if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
1895                 req10->source_dsa_invocation_id = invocation_id;
1896         }
1897
1898         if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
1899                 /*
1900                  * The given highwatermark is only valid relative to the
1901                  * specified source_dsa_invocation_id.
1902                  */
1903                 ZERO_STRUCT(req10->highwatermark);
1904         }
1905
1906         getnc_state = b_state->getncchanges_state;
1907
1908         /* see if a previous replication has been abandoned */
1909         if (getnc_state) {
1910                 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1911                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
1912                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
1913                                  ldb_dn_get_linearized(new_dn),
1914                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1915                                  ldb_dn_get_linearized(getnc_state->last_dn)));
1916                         talloc_free(getnc_state);
1917                         getnc_state = NULL;
1918                 }
1919         }
1920
1921         if (getnc_state) {
1922                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
1923                                                          &req10->highwatermark);
1924                 if (ret != 0) {
1925                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
1926                                  "on DN %s %s highwatermark (last_dn %s)\n",
1927                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1928                                  (ret > 0) ? "older" : "newer",
1929                                  ldb_dn_get_linearized(getnc_state->last_dn)));
1930                         talloc_free(getnc_state);
1931                         getnc_state = NULL;
1932                 }
1933         }
1934
1935         if (getnc_state == NULL) {
1936                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
1937                 if (getnc_state == NULL) {
1938                         return WERR_NOT_ENOUGH_MEMORY;
1939                 }
1940                 b_state->getncchanges_state = getnc_state;
1941                 getnc_state->ncRoot_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1942                 if (getnc_state->ncRoot_dn == NULL) {
1943                         return WERR_NOT_ENOUGH_MEMORY;
1944                 }
1945
1946                 ret = dsdb_find_guid_by_dn(b_state->sam_ctx_system,
1947                                            getnc_state->ncRoot_dn,
1948                                            &getnc_state->ncRoot_guid);
1949                 if (ret != LDB_SUCCESS) {
1950                         DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
1951                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
1952                         return WERR_DS_DRA_INTERNAL_ERROR;
1953                 }
1954                 ncRoot->guid = getnc_state->ncRoot_guid;
1955
1956                 /* find out if we are to replicate Schema NC */
1957                 ret = ldb_dn_compare_base(ldb_get_schema_basedn(b_state->sam_ctx),
1958                                           getnc_state->ncRoot_dn);
1959
1960                 getnc_state->is_schema_nc = (0 == ret);
1961
1962                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
1963                         r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1964                 }
1965
1966                 /*
1967                  * This is the first replication cycle and it is
1968                  * a good place to handle extended operations
1969                  *
1970                  * FIXME: we don't fully support extended operations yet
1971                  */
1972                 switch (req10->extended_op) {
1973                 case DRSUAPI_EXOP_NONE:
1974                         break;
1975                 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1976                         werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6, &search_dn);
1977                         W_ERROR_NOT_OK_RETURN(werr);
1978                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1979                                 return WERR_OK;
1980                         }
1981                         break;
1982                 case DRSUAPI_EXOP_REPL_SECRET:
1983                         werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
1984                                                         user_sid,
1985                                                         &r->out.ctr->ctr6,
1986                                                         has_get_all_changes);
1987                         r->out.result = werr;
1988                         W_ERROR_NOT_OK_RETURN(werr);
1989                         break;
1990                 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1991                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1992                         W_ERROR_NOT_OK_RETURN(werr);
1993                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1994                                 return WERR_OK;
1995                         }
1996                         break;
1997                 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1998                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1999                         W_ERROR_NOT_OK_RETURN(werr);
2000                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2001                                 return WERR_OK;
2002                         }
2003                         break;
2004                 case DRSUAPI_EXOP_FSMO_REQ_PDC:
2005                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2006                         W_ERROR_NOT_OK_RETURN(werr);
2007                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2008                                 return WERR_OK;
2009                         }
2010                         break;
2011                 case DRSUAPI_EXOP_REPL_OBJ:
2012                         werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
2013                         r->out.result = werr;
2014                         W_ERROR_NOT_OK_RETURN(werr);
2015                         break;
2016
2017                 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
2018
2019                         DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
2020                                  (unsigned)req10->extended_op));
2021                         return WERR_DS_DRA_NOT_SUPPORTED;
2022                 }
2023         }
2024
2025         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
2026             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
2027                 DEBUG(0,(__location__ ": Bad DN '%s'\n",
2028                          drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
2029                 return WERR_DS_DRA_INVALID_PARAMETER;
2030         }
2031
2032         ncRoot->guid = getnc_state->ncRoot_guid;
2033
2034         /* we need the session key for encrypting password attributes */
2035         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
2036         if (!NT_STATUS_IS_OK(status)) {
2037                 DEBUG(0,(__location__ ": Failed to get session key\n"));
2038                 return WERR_DS_DRA_INTERNAL_ERROR;
2039         }
2040
2041         /*
2042            TODO: MS-DRSR section 4.1.10.1.1
2043            Work out if this is the start of a new cycle */
2044
2045         if (getnc_state->guids == NULL) {
2046                 const char *extra_filter;
2047                 struct ldb_result *search_res = NULL;
2048
2049                 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
2050
2051                 getnc_state->min_usn = req10->highwatermark.highest_usn;
2052                 getnc_state->max_usn = getnc_state->min_usn;
2053
2054                 getnc_state->final_udv = talloc_zero(getnc_state,
2055                                         struct drsuapi_DsReplicaCursor2CtrEx);
2056                 if (getnc_state->final_udv == NULL) {
2057                         return WERR_NOT_ENOUGH_MEMORY;
2058                 }
2059                 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
2060                                           getnc_state->final_udv);
2061                 if (!W_ERROR_IS_OK(werr)) {
2062                         return werr;
2063                 }
2064
2065                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2066                         werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
2067                                                             search_dn, extra_filter,
2068                                                             &search_res);
2069                 } else {
2070                         werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
2071                                                                  &r->out.ctr->ctr6,
2072                                                                  search_dn, extra_filter,
2073                                                                  &search_res);
2074                 }
2075                 W_ERROR_NOT_OK_RETURN(werr);
2076
2077                 /* extract out the GUIDs list */
2078                 getnc_state->num_records = search_res ? search_res->count : 0;
2079                 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
2080                 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
2081
2082                 changes = talloc_array(getnc_state,
2083                                        struct drsuapi_changed_objects,
2084                                        getnc_state->num_records);
2085                 W_ERROR_HAVE_NO_MEMORY(changes);
2086
2087                 for (i=0; i<getnc_state->num_records; i++) {
2088                         changes[i].dn = search_res->msgs[i]->dn;
2089                         changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
2090                         changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
2091
2092                         if (changes[i].usn > getnc_state->max_usn) {
2093                                 getnc_state->max_usn = changes[i].usn;
2094                         }
2095                 }
2096
2097                 /* RID_ALLOC returns 3 objects in a fixed order */
2098                 if (req10->extended_op == DRSUAPI_EXOP_FSMO_RID_ALLOC) {
2099                         /* Do nothing */
2100                 } else if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
2101                         LDB_TYPESAFE_QSORT(changes,
2102                                            getnc_state->num_records,
2103                                            getnc_state,
2104                                            site_res_cmp_anc_order);
2105                 } else {
2106                         LDB_TYPESAFE_QSORT(changes,
2107                                            getnc_state->num_records,
2108                                            getnc_state,
2109                                            site_res_cmp_usn_order);
2110                 }
2111
2112                 for (i=0; i < getnc_state->num_records; i++) {
2113                         getnc_state->guids[i] = changes[i].guid;
2114                         if (GUID_all_zero(&getnc_state->guids[i])) {
2115                                 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
2116                                          ldb_dn_get_linearized(search_res->msgs[i]->dn)));
2117                                 return WERR_DS_DRA_INTERNAL_ERROR;
2118                         }
2119                 }
2120
2121                 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
2122                 getnc_state->final_hwm.reserved_usn = 0;
2123                 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
2124
2125                 talloc_free(search_res);
2126                 talloc_free(changes);
2127         }
2128
2129         if (req10->uptodateness_vector) {
2130                 /* make sure its sorted */
2131                 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
2132                                req10->uptodateness_vector->count,
2133                                drsuapi_DsReplicaCursor_compare);
2134         }
2135
2136         /* Prefix mapping */
2137         schema = dsdb_get_schema(sam_ctx, mem_ctx);
2138         if (!schema) {
2139                 DEBUG(0,("No schema in sam_ctx\n"));
2140                 return WERR_DS_DRA_INTERNAL_ERROR;
2141         }
2142
2143         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
2144         if (r->out.ctr->ctr6.naming_context == NULL) {
2145                 return WERR_NOT_ENOUGH_MEMORY;
2146         }
2147         *r->out.ctr->ctr6.naming_context = *ncRoot;
2148
2149         /* find the SID if there is one */
2150         dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
2151
2152         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
2153         r->out.ctr->ctr6.mapping_ctr = *ctr;
2154
2155         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2156         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2157
2158         r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
2159         r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
2160
2161         currentObject = &r->out.ctr->ctr6.first_object;
2162
2163         max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
2164         /*
2165          * The client control here only applies in normal replication, not extended
2166          * operations, which return a fixed set, even if the caller
2167          * sets max_object_count == 0
2168          */
2169         if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2170                 /* use this to force single objects at a time, which is useful
2171                  * for working out what object is giving problems
2172                  */
2173                 if (req10->max_object_count < max_objects) {
2174                         max_objects = req10->max_object_count;
2175                 }
2176         }
2177         /*
2178          * TODO: work out how the maximum should be calculated
2179          */
2180         max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
2181
2182         /*
2183          * Maximum time that we can spend in a getncchanges
2184          * in order to avoid timeout of the other part.
2185          * 10 seconds by default.
2186          */
2187         max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
2188
2189         if (req10->partial_attribute_set != NULL) {
2190                 struct dsdb_syntax_ctx syntax_ctx;
2191                 uint32_t j = 0;
2192
2193                 dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
2194                 syntax_ctx.pfm_remote = pfm_remote;
2195
2196                 local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids);
2197
2198                 for (j = 0; j < req10->partial_attribute_set->num_attids; j++) {
2199                         getncchanges_attid_remote_to_local(schema,
2200                                                            &syntax_ctx,
2201                                                            req10->partial_attribute_set->attids[j],
2202                                                            (enum drsuapi_DsAttributeId *)&local_pas[j],
2203                                                            NULL);
2204                 }
2205
2206                 LDB_TYPESAFE_QSORT(local_pas,
2207                                    req10->partial_attribute_set->num_attids,
2208                                    NULL,
2209                                    uint32_t_ptr_cmp);
2210         }
2211
2212         for (i=getnc_state->num_processed;
2213              i<getnc_state->num_records &&
2214                      !null_scope &&
2215                      (r->out.ctr->ctr6.object_count < max_objects)
2216                      && !max_wait_reached;
2217             i++) {
2218                 int uSN;
2219                 struct drsuapi_DsReplicaObjectListItemEx *obj;
2220                 struct ldb_message *msg;
2221                 static const char * const msg_attrs[] = {
2222                                             "*",
2223                                             "nTSecurityDescriptor",
2224                                             "parentGUID",
2225                                             "replPropertyMetaData",
2226                                             DSDB_SECRET_ATTRIBUTES,
2227                                             NULL };
2228                 struct ldb_result *msg_res;
2229                 struct ldb_dn *msg_dn;
2230
2231                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
2232                 W_ERROR_HAVE_NO_MEMORY(obj);
2233
2234                 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
2235                 W_ERROR_HAVE_NO_MEMORY(msg_dn);
2236
2237
2238                 /* by re-searching here we avoid having a lot of full
2239                  * records in memory between calls to getncchanges
2240                  */
2241                 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
2242                                                       msg_dn,
2243                                                       LDB_SCOPE_BASE, msg_attrs, NULL);
2244                 if (ret != LDB_SUCCESS) {
2245                         if (ret != LDB_ERR_NO_SUCH_OBJECT) {
2246                                 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
2247                                          ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
2248                         }
2249                         talloc_free(obj);
2250                         continue;
2251                 }
2252
2253                 msg = msg_res->msgs[0];
2254
2255                 max_wait_reached = (time(NULL) - start > max_wait);
2256
2257                 werr = get_nc_changes_build_object(obj, msg,
2258                                                    sam_ctx, getnc_state->ncRoot_dn,
2259                                                    getnc_state->is_schema_nc,
2260                                                    schema, &session_key, getnc_state->min_usn,
2261                                                    req10->replica_flags,
2262                                                    req10->partial_attribute_set,
2263                                                    req10->uptodateness_vector,
2264                                                    req10->extended_op,
2265                                                    max_wait_reached,
2266                                                    local_pas);
2267                 if (!W_ERROR_IS_OK(werr)) {
2268                         return werr;
2269                 }
2270
2271                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2272                                                 getnc_state->ncRoot_dn,
2273                                                 getnc_state->is_schema_nc,
2274                                                 schema, getnc_state->min_usn,
2275                                                 req10->replica_flags,
2276                                                 msg,
2277                                                 &getnc_state->la_list,
2278                                                 &getnc_state->la_count,
2279                                                 req10->uptodateness_vector);
2280                 if (!W_ERROR_IS_OK(werr)) {
2281                         return werr;
2282                 }
2283
2284                 uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
2285                 if (uSN > getnc_state->max_usn) {
2286                         /*
2287                          * Only report the max_usn we had at the start
2288                          * of the replication cycle.
2289                          *
2290                          * If this object has changed lately we better
2291                          * let the destination dsa refetch the change.
2292                          * This is better than the risk of loosing some
2293                          * objects or linked attributes.
2294                          */
2295                         uSN = 0;
2296                 }
2297                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
2298                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
2299                         r->out.ctr->ctr6.new_highwatermark.reserved_usn = 0;
2300                 }
2301
2302                 if (obj->meta_data_ctr == NULL) {
2303                         DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
2304                                  ldb_dn_get_linearized(msg->dn)));
2305                         /* no attributes to send */
2306                         talloc_free(obj);
2307                         continue;
2308                 }
2309
2310                 r->out.ctr->ctr6.object_count++;
2311
2312                 *currentObject = obj;
2313                 currentObject = &obj->next_object;
2314
2315                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
2316
2317                 talloc_free(getnc_state->last_dn);
2318                 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
2319
2320                 talloc_free(msg_res);
2321                 talloc_free(msg_dn);
2322         }
2323
2324         getnc_state->num_processed = i;
2325
2326         /* the client can us to call UpdateRefs on its behalf to
2327            re-establish monitoring of the NC */
2328         if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
2329             !GUID_all_zero(&req10->destination_dsa_guid)) {
2330                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
2331                 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
2332                          GUID_string(mem_ctx, &req10->destination_dsa_guid)));
2333                 ureq.naming_context = ncRoot;
2334                 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(b_state->sam_ctx, mem_ctx,
2335                                                                    &req10->destination_dsa_guid);
2336                 if (!ureq.dest_dsa_dns_name) {
2337                         return WERR_NOT_ENOUGH_MEMORY;
2338                 }
2339                 ureq.dest_dsa_guid = req10->destination_dsa_guid;
2340                 ureq.options = DRSUAPI_DRS_ADD_REF |
2341                         DRSUAPI_DRS_ASYNC_OP |
2342                         DRSUAPI_DRS_GETCHG_CHECK;
2343
2344                 /* we also need to pass through the
2345                    DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
2346                    to send notifies using the GC SPN */
2347                 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
2348
2349                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
2350                 if (!W_ERROR_IS_OK(werr)) {
2351                         DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
2352                                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
2353                                  win_errstr(werr)));
2354                 }
2355         }
2356
2357         /*
2358          * TODO:
2359          * This is just a guess, how to calculate the
2360          * number of linked attributes to send, we need to
2361          * find out how to do this right.
2362          */
2363         if (r->out.ctr->ctr6.object_count >= max_links) {
2364                 max_links = 0;
2365         } else {
2366                 max_links -= r->out.ctr->ctr6.object_count;
2367         }
2368
2369         link_total = getnc_state->la_count;
2370
2371         if (i < getnc_state->num_records) {
2372                 r->out.ctr->ctr6.more_data = true;
2373         } else {
2374                 /* sort the whole array the first time */
2375                 if (getnc_state->la_sorted == NULL) {
2376                         int j;
2377                         struct la_for_sorting *guid_array = talloc_array(getnc_state, struct la_for_sorting, getnc_state->la_count);
2378                         if (guid_array == NULL) {
2379                                 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", getnc_state->la_count));
2380                                 return WERR_NOT_ENOUGH_MEMORY;
2381                         }
2382                         for (j = 0; j < getnc_state->la_count; j++) {
2383                                 /* we need to get the target GUIDs to compare */
2384                                 struct dsdb_dn *dn;
2385                                 const struct drsuapi_DsReplicaLinkedAttribute *la = &getnc_state->la_list[j];
2386                                 const struct dsdb_attribute *schema_attrib;
2387                                 const struct ldb_val *target_guid;
2388                                 DATA_BLOB source_guid;
2389                                 TALLOC_CTX *frame = talloc_stackframe();
2390
2391                                 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la->attid);
2392
2393                                 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, frame, la->value.blob, &dn);
2394                                 if (!W_ERROR_IS_OK(werr)) {
2395                                         DEBUG(0,(__location__ ": Bad la blob in sort\n"));
2396                                         TALLOC_FREE(frame);
2397                                         return werr;
2398                                 }
2399
2400                                 /* Extract the target GUID in NDR form */
2401                                 target_guid = ldb_dn_get_extended_component(dn->dn, "GUID");
2402                                 if (target_guid == NULL
2403                                     || target_guid->length != sizeof(guid_array[0].target_guid)) {
2404                                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2405                                 } else {
2406                                         /* Repack the source GUID as NDR for sorting */
2407                                         status = GUID_to_ndr_blob(&la->identifier->guid,
2408                                                                   frame,
2409                                                                   &source_guid);
2410                                 }
2411
2412                                 if (!NT_STATUS_IS_OK(status)
2413                                     || source_guid.length != sizeof(guid_array[0].source_guid)) {
2414                                         DEBUG(0,(__location__ ": Bad la guid in sort\n"));
2415                                         TALLOC_FREE(frame);
2416                                         return ntstatus_to_werror(status);
2417                                 }
2418
2419                                 guid_array[j].link = &getnc_state->la_list[j];
2420                                 memcpy(guid_array[j].target_guid, target_guid->data,
2421                                        sizeof(guid_array[j].target_guid));
2422                                 memcpy(guid_array[j].source_guid, source_guid.data,
2423                                        sizeof(guid_array[j].source_guid));
2424                                 TALLOC_FREE(frame);
2425                         }
2426
2427                         LDB_TYPESAFE_QSORT(guid_array, getnc_state->la_count, NULL, linked_attribute_compare);
2428                         getnc_state->la_sorted = guid_array;
2429                 }
2430
2431                 link_count = getnc_state->la_count - getnc_state->la_idx;
2432                 link_count = MIN(max_links, link_count);
2433
2434                 r->out.ctr->ctr6.linked_attributes_count = link_count;
2435                 r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
2436                 if (r->out.ctr->ctr6.linked_attributes == NULL) {
2437                         DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count));
2438                         return WERR_NOT_ENOUGH_MEMORY;
2439                 }
2440
2441                 for (k = 0; k < link_count; k++) {
2442                         r->out.ctr->ctr6.linked_attributes[k]
2443                                 = *getnc_state->la_sorted[getnc_state->la_idx + k].link;
2444                 }
2445
2446                 getnc_state->la_idx += link_count;
2447                 link_given = getnc_state->la_idx;
2448
2449                 if (getnc_state->la_idx < getnc_state->la_count) {
2450                         r->out.ctr->ctr6.more_data = true;
2451                 }
2452         }
2453
2454         if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
2455                 /*
2456                  * TODO: This implementation is wrong
2457                  * we should find out the total number of
2458                  * objects and links in the whole naming context
2459                  * at the start of the cycle and return these
2460                  * values in each message.
2461                  *
2462                  * For now we keep our current strategy and return
2463                  * the number of objects for this cycle and the number
2464                  * of links we found so far during the cycle.
2465                  */
2466                 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
2467                 r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->la_count;
2468         }
2469
2470         if (!r->out.ctr->ctr6.more_data) {
2471                 talloc_steal(mem_ctx, getnc_state->la_list);
2472
2473                 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
2474                 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
2475                                                         &getnc_state->final_udv);
2476
2477                 talloc_free(getnc_state);
2478                 b_state->getncchanges_state = NULL;
2479         } else {
2480                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
2481                                                          &r->out.ctr->ctr6.new_highwatermark);
2482                 if (ret == 0) {
2483                         /*
2484                          * We need to make sure that we never return the
2485                          * same highwatermark within the same replication
2486                          * cycle more than once. Otherwise we cannot detect
2487                          * when the client uses an unexptected highwatermark.
2488                          *
2489                          * This is a HACK which is needed because our
2490                          * object ordering is wrong and set tmp_highest_usn
2491                          * to a value that is higher than what we already
2492                          * sent to the client (destination dsa).
2493                          */
2494                         r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
2495                 }
2496
2497                 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
2498         }
2499
2500         if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2501                 r->out.ctr->ctr6.uptodateness_vector = NULL;
2502                 r->out.ctr->ctr6.nc_object_count = 0;
2503                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
2504         }
2505
2506         DEBUG(r->out.ctr->ctr6.more_data?4:2,
2507               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
2508                (unsigned long long)(req10->highwatermark.highest_usn+1),
2509                req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
2510                r->out.ctr->ctr6.object_count,
2511                i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
2512                r->out.ctr->ctr6.linked_attributes_count,
2513                link_given, link_total,
2514                dom_sid_string(mem_ctx, user_sid)));
2515
2516 #if 0
2517         if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
2518                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
2519         }
2520 #endif
2521
2522         return WERR_OK;
2523 }