source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DSGetNCChanges call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009-2010
   8    Copyright (C) Andrew Bartlett 2010-2016
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "rpc_server/dcerpc_server.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "param/param.h"
  28 #include "librpc/gen_ndr/ndr_drsblobs.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "libcli/security/security.h"
  32 #include "libcli/security/session.h"
  33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  34 #include "rpc_server/dcerpc_server_proto.h"
  35 #include "rpc_server/common/sid_helper.h"
  36 #include "../libcli/drsuapi/drsuapi.h"
  37 #include "lib/util/binsearch.h"
  38 #include "lib/util/tsort.h"
  39 #include "auth/session.h"
  40 #include "dsdb/common/util.h"
  41 #include "lib/dbwrap/dbwrap.h"
  42 #include "lib/dbwrap/dbwrap_rbt.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44
  45 #undef DBGC_CLASS
  46 #define DBGC_CLASS            DBGC_DRS_REPL
  47
  48 /* state of a partially completed getncchanges call */
  49 struct drsuapi_getncchanges_state {
  50         struct db_context *obj_cache;
  51         struct GUID *guids;
  52         uint32_t num_records;
  53         uint32_t num_processed;
  54         struct ldb_dn *ncRoot_dn;
  55         struct GUID ncRoot_guid;
  56         bool is_schema_nc;
  57         bool is_get_anc;
  58         uint64_t min_usn;
  59         uint64_t max_usn;
  60         struct drsuapi_DsReplicaHighWaterMark last_hwm;
  61         struct ldb_dn *last_dn;
  62         struct drsuapi_DsReplicaHighWaterMark final_hwm;
  63         struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
  64         struct drsuapi_DsReplicaLinkedAttribute *la_list;
  65         uint32_t la_count;
  66         struct la_for_sorting *la_sorted;
  67         uint32_t la_idx;
  68 };
  69
  70 /* We must keep the GUIDs in NDR form for sorting */
  71 struct la_for_sorting {
  72         const struct drsuapi_DsReplicaLinkedAttribute *link;
  73         uint8_t target_guid[16];
  74         uint8_t source_guid[16];
  75 };
  76
  77 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
  78                                               const struct drsuapi_DsReplicaHighWaterMark *h2)
  79 {
  80         if (h1->highest_usn < h2->highest_usn) {
  81                 return -1;
  82         } else if (h1->highest_usn > h2->highest_usn) {
  83                 return 1;
  84         } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
  85                 return -1;
  86         } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
  87                 return 1;
  88         } else if (h1->reserved_usn < h2->reserved_usn) {
  89                 return -1;
  90         } else if (h1->reserved_usn > h2->reserved_usn) {
  91                 return 1;
  92         }
  93
  94         return 0;
  95 }
  96
  97 /*
  98   build a DsReplicaObjectIdentifier from a ldb msg
  99  */
 100 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
 101                                                                        const struct ldb_message *msg)
 102 {
 103         struct drsuapi_DsReplicaObjectIdentifier *identifier;
 104         struct dom_sid *sid;
 105
 106         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 107         if (identifier == NULL) {
 108                 return NULL;
 109         }
 110
 111         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
 112         identifier->guid = samdb_result_guid(msg, "objectGUID");
 113
 114         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
 115         if (sid) {
 116                 identifier->sid = *sid;
 117         } else {
 118                 ZERO_STRUCT(identifier->sid);
 119         }
 120         return identifier;
 121 }
 122
 123 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
 124 {
 125         return GUID_compare(guid1, &guid2);
 126 }
 127
 128 /*
 129   see if we can filter an attribute using the uptodateness_vector
 130  */
 131 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
 132                        const struct GUID *originating_invocation_id,
 133                        uint64_t originating_usn)
 134 {
 135         const struct drsuapi_DsReplicaCursor *c;
 136         if (udv == NULL) return false;
 137         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
 138                             originating_invocation_id, udv_compare, c);
 139         if (c && originating_usn <= c->highest_usn) {
 140                 return true;
 141         }
 142         return false;
 143 }
 144
 145 static int uint32_t_cmp(uint32_t a1, uint32_t a2)
 146 {
 147         if (a1 == a2) return 0;
 148         return a1 > a2 ? 1 : -1;
 149 }
 150
 151 static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused)
 152 {
 153         if (*a1 == *a2) return 0;
 154         return *a1 > *a2 ? 1 : -1;
 155 }
 156
 157 static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema,
 158                                                  const struct dsdb_syntax_ctx *ctx,
 159                                                  enum drsuapi_DsAttributeId remote_attid_as_enum,
 160                                                  enum drsuapi_DsAttributeId *local_attid_as_enum,
 161                                                  const struct dsdb_attribute **_sa)
 162 {
 163         WERROR werr;
 164         const struct dsdb_attribute *sa = NULL;
 165
 166         if (ctx->pfm_remote == NULL) {
 167                 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
 168                 goto fail;
 169         }
 170
 171         werr = dsdb_attribute_drsuapi_remote_to_local(ctx,
 172                                                       remote_attid_as_enum,
 173                                                       local_attid_as_enum,
 174                                                       _sa);
 175         if (!W_ERROR_IS_OK(werr)) {
 176                 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
 177                 goto fail;
 178         }
 179
 180         return werr;
 181 fail:
 182
 183         sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum);
 184         if (sa == NULL) {
 185                 return WERR_DS_DRA_SCHEMA_MISMATCH;
 186         } else {
 187                 if (local_attid_as_enum != NULL) {
 188                         *local_attid_as_enum = sa->attributeID_id;
 189                 }
 190                 if (_sa != NULL) {
 191                         *_sa = sa;
 192                 }
 193                 return WERR_OK;
 194         }
 195 }
 196
 197 /*
 198  * Similar to function in repl_meta_data without the extra
 199  * dependencies.
 200  */
 201 static WERROR get_parsed_dns_trusted(TALLOC_CTX *mem_ctx, struct ldb_message_element *el,
 202                                   struct parsed_dn **pdn)
 203 {
 204         /* Here we get a list of 'struct parsed_dns' without the parsing */
 205         int i;
 206         *pdn = talloc_zero_array(mem_ctx, struct parsed_dn,
 207                                  el->num_values);
 208         if (!*pdn) {
 209                 return WERR_DS_DRA_INTERNAL_ERROR;
 210         }
 211
 212         for (i = 0; i < el->num_values; i++) {
 213                 (*pdn)[i].v = &el->values[i];
 214         }
 215
 216         return WERR_OK;
 217 }
 218
 219 static WERROR getncchanges_update_revealed_list(struct ldb_context *sam_ctx,
 220                                                 TALLOC_CTX *mem_ctx,
 221                                                 struct ldb_message **msg,
 222                                                 struct ldb_dn *object_dn,
 223                                                 const struct GUID *object_guid,
 224                                                 const struct dsdb_attribute *sa,
 225                                                 struct replPropertyMetaData1 *meta_data,
 226                                                 struct ldb_message *revealed_users)
 227 {
 228         enum ndr_err_code ndr_err;
 229         int ldb_err;
 230         char *attr_str = NULL;
 231         char *attr_hex = NULL;
 232         DATA_BLOB attr_blob;
 233         struct ldb_message_element *existing = NULL, *el_add = NULL, *el_del = NULL;
 234         const char * const * secret_attributes = ldb_get_opaque(sam_ctx, "LDB_SECRET_ATTRIBUTE_LIST");
 235
 236         if (!ldb_attr_in_list(secret_attributes,
 237                               sa->lDAPDisplayName)) {
 238                 return WERR_OK;
 239         }
 240
 241
 242         ndr_err = ndr_push_struct_blob(&attr_blob, mem_ctx, meta_data, (ndr_push_flags_fn_t)ndr_push_replPropertyMetaData1);
 243         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 244                 return WERR_DS_DRA_INTERNAL_ERROR;
 245         }
 246
 247         attr_hex = hex_encode_talloc(mem_ctx, attr_blob.data, attr_blob.length);
 248         if (attr_hex == NULL) {
 249                 return WERR_NOT_ENOUGH_MEMORY;
 250         }
 251
 252         attr_str = talloc_asprintf(mem_ctx, "B:%zd:%s:%s", attr_blob.length*2, attr_hex, ldb_dn_get_linearized(object_dn));
 253         if (attr_str == NULL) {
 254                 return WERR_NOT_ENOUGH_MEMORY;
 255         }
 256
 257         existing = ldb_msg_find_element(revealed_users, "msDS-RevealedUsers");
 258         if (existing != NULL) {
 259                 /* Replace the old value (if one exists) with the current one */
 260                 struct parsed_dn *link_dns;
 261                 struct parsed_dn *exact = NULL, *unused = NULL;
 262                 WERROR werr;
 263                 uint8_t attid[4];
 264                 DATA_BLOB partial_meta;
 265
 266                 werr = get_parsed_dns_trusted(mem_ctx, existing, &link_dns);
 267                 if (!W_ERROR_IS_OK(werr)) {
 268                         return werr;
 269                 }
 270
 271                 /* Construct a partial metadata blob to match on in the DB */
 272                 SIVAL(attid, 0, sa->attributeID_id);
 273                 partial_meta.length = 4;
 274                 partial_meta.data = attid;
 275
 276                 /* Binary search using GUID and attribute id for uniqueness */
 277                 ldb_err = parsed_dn_find(sam_ctx, link_dns, existing->num_values,
 278                                          object_guid, object_dn,
 279                                          partial_meta, 4,
 280                                          &exact, &unused,
 281                                          DSDB_SYNTAX_BINARY_DN, true);
 282
 283                 if (ldb_err != LDB_SUCCESS) {
 284                         DEBUG(0,(__location__ ": Failed parsed DN find - %s\n",
 285                                  ldb_errstring(sam_ctx)));
 286                         return WERR_DS_DRA_INTERNAL_ERROR;
 287                 }
 288
 289                 if (exact != NULL) {
 290                         /* Perform some verification of the blob */
 291                         struct replPropertyMetaData1 existing_meta_data;
 292                         ndr_err = ndr_pull_struct_blob_all_noalloc(&exact->dsdb_dn->extra_part,
 293                                                                    &existing_meta_data,
 294                                                                    (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaData1);
 295                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 296                                 return WERR_DS_DRA_INTERNAL_ERROR;
 297                         }
 298
 299                         if (existing_meta_data.attid == sa->attributeID_id) {
 300                                 ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_DELETE, &el_del);
 301                                 if (ldb_err != LDB_SUCCESS) {
 302                                         return WERR_DS_DRA_INTERNAL_ERROR;
 303                                 }
 304
 305                                 el_del->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 306                                 if (el_del->values == NULL) {
 307                                         return WERR_NOT_ENOUGH_MEMORY;
 308                                 }
 309                                 el_del->values[0] = *exact->v;
 310                                 el_del->num_values = 1;
 311                         } else {
 312                                 return WERR_DS_DRA_INTERNAL_ERROR;
 313                         }
 314                 }
 315         }
 316
 317         ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_ADD, &el_add);
 318         if (ldb_err != LDB_SUCCESS) {
 319                 return WERR_DS_DRA_INTERNAL_ERROR;
 320         }
 321
 322         el_add->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 323         if (el_add->values == NULL) {
 324                 return WERR_NOT_ENOUGH_MEMORY;
 325
 326         }
 327
 328         el_add->values[0] = data_blob_string_const(attr_str);
 329         el_add->num_values = 1;
 330
 331         return WERR_OK;
 332 }
 333
 334 /*
 335  * This function filter attributes for build_object based on the
 336  * uptodatenessvector and partial attribute set.
 337  *
 338  * Any secret attributes are forced here for REPL_SECRET, and audited at this
 339  * point with msDS-RevealedUsers.
 340  */
 341 static WERROR get_nc_changes_filter_attrs(struct drsuapi_DsReplicaObjectListItemEx *obj,
 342                                           struct replPropertyMetaDataBlob md,
 343                                           struct ldb_context *sam_ctx,
 344                                           const struct ldb_message *msg,
 345                                           const struct GUID *guid,
 346                                           uint32_t *count,
 347                                           uint64_t highest_usn,
 348                                           const struct dsdb_attribute *rdn_sa,
 349                                           struct dsdb_schema *schema,
 350                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 351                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 352                                           uint32_t *local_pas,
 353                                           uint32_t *attids,
 354                                           bool exop_secret,
 355                                           struct ldb_message **revealed_list_msg,
 356                                           struct ldb_message *existing_revealed_list_msg)
 357 {
 358         uint32_t i, n;
 359         WERROR werr;
 360         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 361                 const struct dsdb_attribute *sa;
 362                 bool force_attribute = false;
 363
 364                 /* if the attribute has not changed, and it is not the
 365                    instanceType then don't include it */
 366                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 367                     !exop_secret &&
 368                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
 369
 370                 /* don't include the rDN */
 371                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 372
 373                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 374                 if (!sa) {
 375                         DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
 376                                  (unsigned int)md.ctr.ctr1.array[i].attid,
 377                                  ldb_dn_get_linearized(msg->dn)));
 378                         return WERR_DS_DRA_INTERNAL_ERROR;
 379                 }
 380
 381                 if (sa->linkID) {
 382                         struct ldb_message_element *el;
 383                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 384                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 385                                 /* don't send upgraded links inline */
 386                                 continue;
 387                         }
 388                 }
 389
 390                 if (exop_secret &&
 391                     !dsdb_attr_in_rodc_fas(sa)) {
 392                         force_attribute = true;
 393                         DEBUG(4,("Forcing attribute %s in %s\n",
 394                                  sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 395                         werr = getncchanges_update_revealed_list(sam_ctx, obj,
 396                                                                  revealed_list_msg,
 397                                                                  msg->dn, guid, sa,
 398                                                                  &md.ctr.ctr1.array[i],
 399                                                                  existing_revealed_list_msg);
 400                         if (!W_ERROR_IS_OK(werr)) {
 401                                 return werr;
 402                         }
 403                 }
 404
 405                 /* filter by uptodateness_vector */
 406                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
 407                     !force_attribute &&
 408                     udv_filter(uptodateness_vector,
 409                                &md.ctr.ctr1.array[i].originating_invocation_id,
 410                                md.ctr.ctr1.array[i].originating_usn)) {
 411                         continue;
 412                 }
 413
 414                 /* filter by partial_attribute_set */
 415                 if (partial_attribute_set && !force_attribute) {
 416                         uint32_t *result = NULL;
 417                         BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
 418                                               uint32_t_cmp, result);
 419                         if (result == NULL) {
 420                                 continue;
 421                         }
 422                 }
 423
 424                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 425                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 426                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 427                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 428                 attids[n] = md.ctr.ctr1.array[i].attid;
 429
 430                 n++;
 431         }
 432
 433         *count = n;
 434
 435         return WERR_OK;
 436 }
 437
 438 /*
 439   drsuapi_DsGetNCChanges for one object
 440 */
 441 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
 442                                           const struct ldb_message *msg,
 443                                           struct ldb_context *sam_ctx,
 444                                           struct ldb_dn *ncRoot_dn,
 445                                           bool   is_schema_nc,
 446                                           struct dsdb_schema *schema,
 447                                           DATA_BLOB *session_key,
 448                                           uint64_t highest_usn,
 449                                           uint32_t replica_flags,
 450                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 451                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 452                                           enum drsuapi_DsExtendedOperation extended_op,
 453                                           bool force_object_return,
 454                                           uint32_t *local_pas,
 455                                           struct ldb_dn *machine_dn,
 456                                           const struct GUID *guid)
 457 {
 458         const struct ldb_val *md_value;
 459         uint32_t i, n;
 460         struct replPropertyMetaDataBlob md;
 461         uint32_t rid = 0;
 462         int ldb_err;
 463         enum ndr_err_code ndr_err;
 464         uint32_t *attids;
 465         const char *rdn;
 466         const struct dsdb_attribute *rdn_sa;
 467         uint64_t uSNChanged;
 468         unsigned int instanceType;
 469         struct dsdb_syntax_ctx syntax_ctx;
 470         struct ldb_result *res = NULL;
 471         WERROR werr;
 472         int ret;
 473
 474         /* make dsdb sytanx context for conversions */
 475         dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
 476         syntax_ctx.is_schema_nc = is_schema_nc;
 477
 478         uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 479         instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
 480         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 481                 obj->is_nc_prefix = true;
 482                 obj->parent_object_guid = NULL;
 483         } else {
 484                 obj->is_nc_prefix = false;
 485                 obj->parent_object_guid = talloc(obj, struct GUID);
 486                 if (obj->parent_object_guid == NULL) {
 487                         return WERR_DS_DRA_INTERNAL_ERROR;
 488                 }
 489                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 490                 if (GUID_all_zero(obj->parent_object_guid)) {
 491                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 492                                  ldb_dn_get_linearized(msg->dn)));
 493                         return WERR_DS_DRA_INTERNAL_ERROR;
 494                 }
 495         }
 496         obj->next_object = NULL;
 497
 498         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 499         if (!md_value) {
 500                 /* nothing to send */
 501                 return WERR_OK;
 502         }
 503
 504         if (instanceType & INSTANCE_TYPE_UNINSTANT) {
 505                 /* don't send uninstantiated objects */
 506                 return WERR_OK;
 507         }
 508
 509         if (uSNChanged <= highest_usn) {
 510                 /* nothing to send */
 511                 return WERR_OK;
 512         }
 513
 514         ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
 515                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 516         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 517                 return WERR_DS_DRA_INTERNAL_ERROR;
 518         }
 519
 520         if (md.version != 1) {
 521                 return WERR_DS_DRA_INTERNAL_ERROR;
 522         }
 523
 524         rdn = ldb_dn_get_rdn_name(msg->dn);
 525         if (rdn == NULL) {
 526                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 527                 return WERR_DS_DRA_INTERNAL_ERROR;
 528         }
 529
 530         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 531         if (rdn_sa == NULL) {
 532                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 533                          rdn, ldb_dn_get_linearized(msg->dn)));
 534                 return WERR_DS_DRA_INTERNAL_ERROR;
 535         }
 536
 537         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 538         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 539
 540         obj->object.identifier = get_object_identifier(obj, msg);
 541         if (obj->object.identifier == NULL) {
 542                 return WERR_NOT_ENOUGH_MEMORY;
 543         }
 544         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 545
 546         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 547
 548         if (extended_op == DRSUAPI_EXOP_REPL_SECRET) {
 549                 /* Get the existing revealed users for the destination */
 550                 struct ldb_message *revealed_list_msg = NULL;
 551                 struct ldb_message *existing_revealed_list_msg = NULL;
 552                 const char *machine_attrs[] = {
 553                         "msDS-RevealedUsers",
 554                         NULL
 555                 };
 556
 557                 revealed_list_msg = ldb_msg_new(sam_ctx);
 558                 if (revealed_list_msg == NULL) {
 559                         return WERR_NOT_ENOUGH_MEMORY;
 560                 }
 561                 revealed_list_msg->dn = machine_dn;
 562
 563                 ret = ldb_transaction_start(sam_ctx);
 564                 if (ret != LDB_SUCCESS) {
 565                         DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 566                                  ldb_errstring(sam_ctx)));
 567                         return WERR_DS_DRA_INTERNAL_ERROR;
 568                 }
 569
 570                 ldb_err = dsdb_search_dn(sam_ctx, obj, &res, machine_dn, machine_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN);
 571                 if (ldb_err != LDB_SUCCESS || res->count != 1) {
 572                         ldb_transaction_cancel(sam_ctx);
 573                         return WERR_DS_DRA_INTERNAL_ERROR;
 574                 }
 575
 576                 existing_revealed_list_msg = res->msgs[0];
 577
 578                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg,
 579                                                    guid, &n, highest_usn,
 580                                                    rdn_sa, schema,
 581                                                    uptodateness_vector,
 582                                                    partial_attribute_set, local_pas,
 583                                                    attids,
 584                                                    true,
 585                                                    &revealed_list_msg,
 586                                                    existing_revealed_list_msg);
 587                 if (!W_ERROR_IS_OK(werr)) {
 588                         ldb_transaction_cancel(sam_ctx);
 589                         return werr;
 590                 }
 591
 592                 if (revealed_list_msg != NULL) {
 593                         ret = ldb_modify(sam_ctx, revealed_list_msg);
 594                         if (ret != LDB_SUCCESS) {
 595                                 DEBUG(0,(__location__ ": Failed to alter revealed links - %s\n",
 596                                          ldb_errstring(sam_ctx)));
 597                                 ldb_transaction_cancel(sam_ctx);
 598                                 return WERR_DS_DRA_INTERNAL_ERROR;
 599                         }
 600                 }
 601
 602                 ret = ldb_transaction_commit(sam_ctx);
 603                 if (ret != LDB_SUCCESS) {
 604                         DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 605                                  ldb_errstring(sam_ctx)));
 606                         return WERR_DS_DRA_INTERNAL_ERROR;
 607                 }
 608         } else {
 609                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg, guid,
 610                                                    &n, highest_usn, rdn_sa,
 611                                                    schema, uptodateness_vector,
 612                                                    partial_attribute_set, local_pas,
 613                                                    attids,
 614                                                    false,
 615                                                    NULL,
 616                                                    NULL);
 617                 if (!W_ERROR_IS_OK(werr)) {
 618                         return werr;
 619                 }
 620         }
 621
 622         /* ignore it if its an empty change. Note that renames always
 623          * change the 'name' attribute, so they won't be ignored by
 624          * this
 625
 626          * the force_object_return check is used to force an empty
 627          * object return when we timeout in the getncchanges loop.
 628          * This allows us to return an empty object, which keeps the
 629          * client happy while preventing timeouts
 630          */
 631         if (n == 0 ||
 632             (n == 1 &&
 633              attids[0] == DRSUAPI_ATTID_instanceType &&
 634              !force_object_return)) {
 635                 talloc_free(obj->meta_data_ctr);
 636                 obj->meta_data_ctr = NULL;
 637                 return WERR_OK;
 638         }
 639
 640         obj->meta_data_ctr->count = n;
 641
 642         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 643         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 644         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 645                                                             obj->object.attribute_ctr.num_attributes);
 646         if (obj->object.attribute_ctr.attributes == NULL) {
 647                 return WERR_NOT_ENOUGH_MEMORY;
 648         }
 649
 650         /*
 651          * Note that the meta_data array and the attributes array must
 652          * be the same size and in the same order
 653          */
 654         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 655                 struct ldb_message_element *el;
 656                 const struct dsdb_attribute *sa;
 657
 658                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 659                 if (!sa) {
 660                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 661                         return WERR_DS_DRA_INTERNAL_ERROR;
 662                 }
 663
 664                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 665                 if (el == NULL) {
 666                         /* this happens for attributes that have been removed */
 667                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 668                                  sa->lDAPDisplayName, attids[i]));
 669                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 670                         obj->object.attribute_ctr.attributes[i].attid =
 671                                         dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
 672                 } else {
 673                         werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
 674                                                           &obj->object.attribute_ctr.attributes[i]);
 675                         if (!W_ERROR_IS_OK(werr)) {
 676                                 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
 677                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 678                                          win_errstr(werr)));
 679                                 return werr;
 680                         }
 681                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 682                          * check if attribute is secret and send a null value
 683                          */
 684                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 685                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 686                                                                  &obj->meta_data_ctr->meta_data[i]);
 687                         }
 688                         /* some attributes needs to be encrypted
 689                            before being sent */
 690                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 691                                                          &obj->object.attribute_ctr.attributes[i]);
 692                         if (!W_ERROR_IS_OK(werr)) {
 693                                 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
 694                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 695                                          win_errstr(werr)));
 696                                 return werr;
 697                         }
 698                 }
 699                 if (attids[i] != obj->object.attribute_ctr.attributes[i].attid) {
 700                         DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID:  "
 701                                   "0x%08x vs 0x%08x "
 702                                   "Run dbcheck!\n",
 703                                   sa->lDAPDisplayName,
 704                                   ldb_dn_get_linearized(msg->dn),
 705                                   attids[i],
 706                                   obj->object.attribute_ctr.attributes[i].attid));
 707                         return WERR_DS_DATABASE_ERROR;
 708                 }
 709         }
 710
 711         return WERR_OK;
 712 }
 713
 714 /*
 715   add one linked attribute from an object to the list of linked
 716   attributes in a getncchanges request
 717  */
 718 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 719                                     struct ldb_context *sam_ctx,
 720                                     const struct dsdb_schema *schema,
 721                                     const struct dsdb_attribute *sa,
 722                                     const struct ldb_message *msg,
 723                                     struct dsdb_dn *dsdb_dn,
 724                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 725                                     uint32_t *la_count,
 726                                     bool is_schema_nc)
 727 {
 728         struct drsuapi_DsReplicaLinkedAttribute *la;
 729         bool active;
 730         NTSTATUS status;
 731         WERROR werr;
 732
 733         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 734         W_ERROR_HAVE_NO_MEMORY(*la_list);
 735
 736         la = &(*la_list)[*la_count];
 737
 738         la->identifier = get_object_identifier(*la_list, msg);
 739         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 740
 741         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 742
 743         if (!active) {
 744                 /* We have to check that the inactive link still point to an existing object */
 745                 struct GUID guid;
 746                 struct ldb_dn *tdn;
 747                 int ret;
 748                 const char *v;
 749
 750                 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
 751                 if (strncmp(v, "TRUE", 4) == 0) {
 752                         /*
 753                           * Note: we skip the transmition of the deleted link even if the other part used to
 754                           * know about it because when we transmit the deletion of the object, the link will
 755                           * be deleted too due to deletion of object where link points and Windows do so.
 756                           */
 757                         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
 758                                 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
 759                                 /*
 760                                  * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
 761                                  * if it join an existing domain with deleted objets, it firsts impose to have a
 762                                  * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
 763                                  * either during initial replication or after the getNCChanges.
 764                                  * Behavior of samba has been changed to always have this attribute if it's present in the schema.
 765                                  *
 766                                  * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
 767                                  * If FL >=2K8R2 we are sure that this attribute will be here.
 768                                  * For this kind of forest level we do not return the link if the object is recycled
 769                                  * (isRecycled = true).
 770                                  */
 771                                 if (strncmp(v, "TRUE", 4) == 0) {
 772                                         DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
 773                                                                 ldb_dn_get_linearized(msg->dn)));
 774                                         return WERR_OK;
 775                                 }
 776                         } else {
 777                                 return WERR_OK;
 778                         }
 779                 }
 780                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
 781                 if (!NT_STATUS_IS_OK(status)) {
 782                         DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 783                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 784                         return ntstatus_to_werror(status);
 785                 }
 786                 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
 787                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 788                         DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 789                                                 GUID_string(mem_ctx, &guid)));
 790                         return WERR_OK;
 791                 } else if (ret != LDB_SUCCESS) {
 792                         DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 793                                                 GUID_string(mem_ctx, &guid),
 794                                                 ret));
 795                         return WERR_OK;
 796                 }
 797         }
 798         la->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
 799         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 800
 801         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 802         if (!NT_STATUS_IS_OK(status)) {
 803                 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
 804                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 805                 return ntstatus_to_werror(status);
 806         }
 807         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 808         if (!NT_STATUS_IS_OK(status)) {
 809                 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
 810                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 811                 return ntstatus_to_werror(status);
 812         }
 813         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 814         if (!NT_STATUS_IS_OK(status)) {
 815                 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
 816                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 817                 return ntstatus_to_werror(status);
 818         }
 819         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 820         if (!NT_STATUS_IS_OK(status)) {
 821                 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
 822                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 823                 return ntstatus_to_werror(status);
 824         }
 825
 826         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 827         if (!NT_STATUS_IS_OK(status)) {
 828                 /* this is possible for upgraded links */
 829                 la->originating_add_time = la->meta_data.originating_change_time;
 830         }
 831
 832         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 833         W_ERROR_NOT_OK_RETURN(werr);
 834
 835         (*la_count)++;
 836         return WERR_OK;
 837 }
 838
 839
 840 /*
 841   add linked attributes from an object to the list of linked
 842   attributes in a getncchanges request
 843  */
 844 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 845                                        TALLOC_CTX *mem_ctx,
 846                                        struct ldb_dn *ncRoot_dn,
 847                                        bool is_schema_nc,
 848                                        struct dsdb_schema *schema,
 849                                        uint64_t highest_usn,
 850                                        uint32_t replica_flags,
 851                                        const struct ldb_message *msg,
 852                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 853                                        uint32_t *la_count,
 854                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 855 {
 856         unsigned int i;
 857         TALLOC_CTX *tmp_ctx = NULL;
 858         uint64_t uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 859         bool is_critical = ldb_msg_find_attr_as_bool(msg, "isCriticalSystemObject", false);
 860
 861         if (replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
 862                 if (!is_critical) {
 863                         return WERR_OK;
 864                 }
 865         }
 866
 867         if (uSNChanged <= highest_usn) {
 868                 return WERR_OK;
 869         }
 870
 871         tmp_ctx = talloc_new(mem_ctx);
 872         if (tmp_ctx == NULL) {
 873                 return WERR_NOT_ENOUGH_MEMORY;
 874         }
 875
 876         for (i=0; i<msg->num_elements; i++) {
 877                 struct ldb_message_element *el = &msg->elements[i];
 878                 const struct dsdb_attribute *sa;
 879                 unsigned int j;
 880
 881                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 882
 883                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 884                         /* we only want forward links */
 885                         continue;
 886                 }
 887
 888                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 889                         /* its an old style link, it will have been
 890                          * sent in the main replication data */
 891                         continue;
 892                 }
 893
 894                 for (j=0; j<el->num_values; j++) {
 895                         struct dsdb_dn *dsdb_dn;
 896                         uint64_t local_usn;
 897                         uint64_t originating_usn;
 898                         NTSTATUS status, status2;
 899                         WERROR werr;
 900                         struct GUID originating_invocation_id;
 901
 902                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 903                         if (dsdb_dn == NULL) {
 904                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 905                                          el->name, ldb_dn_get_linearized(msg->dn)));
 906                                 talloc_free(tmp_ctx);
 907                                 return WERR_DS_DRA_INTERNAL_ERROR;
 908                         }
 909
 910                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 911                         if (!NT_STATUS_IS_OK(status)) {
 912                                 /* this can happen for attributes
 913                                    given to us with old style meta
 914                                    data */
 915                                 continue;
 916                         }
 917
 918                         if (local_usn > uSNChanged) {
 919                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 920                                          el->name, ldb_dn_get_linearized(msg->dn)));
 921                                 talloc_free(tmp_ctx);
 922                                 return WERR_DS_DRA_INTERNAL_ERROR;
 923                         }
 924
 925                         if (local_usn <= highest_usn) {
 926                                 continue;
 927                         }
 928
 929                         status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
 930                                                            &originating_invocation_id,
 931                                                            "RMD_INVOCID");
 932                         status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
 933                                                               &originating_usn,
 934                                                               "RMD_ORIGINATING_USN");
 935
 936                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
 937                                 if (udv_filter(uptodateness_vector,
 938                                                &originating_invocation_id,
 939                                                originating_usn)) {
 940                                         continue;
 941                                 }
 942                         }
 943
 944                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
 945                                                      sa, msg, dsdb_dn, la_list,
 946                                                      la_count, is_schema_nc);
 947                         if (!W_ERROR_IS_OK(werr)) {
 948                                 talloc_free(tmp_ctx);
 949                                 return werr;
 950                         }
 951                 }
 952         }
 953
 954         talloc_free(tmp_ctx);
 955         return WERR_OK;
 956 }
 957
 958 /*
 959   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 960  */
 961 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 962                                  struct ldb_dn *ncRoot_dn,
 963                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 964 {
 965         int ret;
 966
 967         udv->version = 2;
 968         udv->reserved1 = 0;
 969         udv->reserved2 = 0;
 970
 971         ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
 972         if (ret != LDB_SUCCESS) {
 973                 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
 974                          ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
 975                 return WERR_DS_DRA_INTERNAL_ERROR;
 976         }
 977
 978         return WERR_OK;
 979 }
 980
 981
 982 /* comparison function for linked attributes - see CompareLinks() in
 983  * MS-DRSR section 4.1.10.5.17 */
 984 static int linked_attribute_compare(const struct la_for_sorting *la1,
 985                                     const struct la_for_sorting *la2,
 986                                     void *opaque)
 987 {
 988         int c;
 989         c = memcmp(la1->source_guid,
 990                    la2->source_guid, sizeof(la2->source_guid));
 991         if (c != 0) {
 992                 return c;
 993         }
 994
 995         if (la1->link->attid != la2->link->attid) {
 996                 return la1->link->attid < la2->link->attid? -1:1;
 997         }
 998
 999         if ((la1->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
1000             (la2->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
1001                 return (la1->link->flags &
1002                         DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
1003         }
1004
1005         return memcmp(la1->target_guid,
1006                       la2->target_guid, sizeof(la2->target_guid));
1007 }
1008
1009 struct drsuapi_changed_objects {
1010         struct ldb_dn *dn;
1011         struct GUID guid;
1012         uint64_t usn;
1013 };
1014
1015 /*
1016   sort the objects we send first by uSNChanged
1017  */
1018 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
1019                                   struct drsuapi_changed_objects *m2,
1020                                   struct drsuapi_getncchanges_state *getnc_state)
1021 {
1022         int ret;
1023
1024         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
1025         if (ret == 0) {
1026                 return -1;
1027         }
1028
1029         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
1030         if (ret == 0) {
1031                 return 1;
1032         }
1033
1034         if (m1->usn == m2->usn) {
1035                 return ldb_dn_compare(m2->dn, m1->dn);
1036         }
1037
1038         if (m1->usn < m2->usn) {
1039                 return -1;
1040         }
1041
1042         return 1;
1043 }
1044
1045
1046 /*
1047   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
1048  */
1049 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
1050                                      TALLOC_CTX *mem_ctx,
1051                                      struct drsuapi_DsGetNCChangesRequest10 *req10,
1052                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1053                                      struct ldb_dn **rid_manager_dn)
1054 {
1055         struct ldb_dn *req_dn, *ntds_dn = NULL;
1056         int ret;
1057         struct ldb_context *ldb = b_state->sam_ctx;
1058         struct ldb_result *ext_res;
1059         struct dsdb_fsmo_extended_op *exop;
1060         bool is_us;
1061
1062         /*
1063           steps:
1064             - verify that the DN being asked for is the RID Manager DN
1065             - verify that we are the RID Manager
1066          */
1067
1068         /* work out who is the RID Manager, also return to caller */
1069         ret = samdb_rid_manager_dn(ldb, mem_ctx, rid_manager_dn);
1070         if (ret != LDB_SUCCESS) {
1071                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
1072                 return WERR_DS_DRA_INTERNAL_ERROR;
1073         }
1074
1075         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1076         if (!ldb_dn_validate(req_dn) ||
1077             ldb_dn_compare(req_dn, *rid_manager_dn) != 0) {
1078                 /* that isn't the RID Manager DN */
1079                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
1080                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1081                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1082                 return WERR_OK;
1083         }
1084
1085         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1086         ret = dsdb_find_dn_by_guid(ldb, mem_ctx, &req10->destination_dsa_guid, 0, &ntds_dn);
1087         if (ret != LDB_SUCCESS) {
1088                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1089                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1090                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1091                 return WERR_OK;
1092         }
1093
1094         /* find the DN of the RID Manager */
1095         ret = samdb_reference_dn_is_our_ntdsa(ldb, *rid_manager_dn, "fSMORoleOwner", &is_us);
1096         if (ret != LDB_SUCCESS) {
1097                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1098                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1099                 return WERR_DS_DRA_INTERNAL_ERROR;
1100         }
1101
1102         if (!is_us) {
1103                 /* we're not the RID Manager - go away */
1104                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
1105                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1106                 return WERR_OK;
1107         }
1108
1109         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
1110         W_ERROR_HAVE_NO_MEMORY(exop);
1111
1112         exop->fsmo_info = req10->fsmo_info;
1113         exop->destination_dsa_guid = req10->destination_dsa_guid;
1114
1115         ret = ldb_transaction_start(ldb);
1116         if (ret != LDB_SUCCESS) {
1117                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1118                          ldb_errstring(ldb)));
1119                 return WERR_DS_DRA_INTERNAL_ERROR;
1120         }
1121
1122         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
1123         if (ret != LDB_SUCCESS) {
1124                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
1125                          ldb_errstring(ldb)));
1126                 ldb_transaction_cancel(ldb);
1127                 return WERR_DS_DRA_INTERNAL_ERROR;
1128         }
1129
1130         ret = ldb_transaction_commit(ldb);
1131         if (ret != LDB_SUCCESS) {
1132                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1133                          ldb_errstring(ldb)));
1134                 return WERR_DS_DRA_INTERNAL_ERROR;
1135         }
1136
1137         talloc_free(ext_res);
1138
1139         DEBUG(2,("Allocated RID pool for server %s\n",
1140                  GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1141
1142         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1143
1144         return WERR_OK;
1145 }
1146
1147 /*
1148   handle a DRSUAPI_EXOP_REPL_SECRET call
1149  */
1150 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
1151                                        TALLOC_CTX *mem_ctx,
1152                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1153                                        struct dom_sid *user_sid,
1154                                        struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1155                                        bool has_get_all_changes,
1156                                        struct ldb_dn **machine_dn)
1157 {
1158         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1159         struct ldb_dn *obj_dn = NULL;
1160         struct ldb_dn *ntds_dn = NULL, *server_dn = NULL;
1161         struct ldb_dn *rodc_dn, *krbtgt_link_dn;
1162         int ret;
1163         const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", "objectGUID", NULL };
1164         const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
1165         struct ldb_result *rodc_res = NULL, *obj_res = NULL;
1166         const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
1167         const struct dom_sid *object_sid = NULL;
1168         WERROR werr;
1169         const struct dom_sid *additional_sids[] = { NULL, NULL };
1170
1171         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
1172                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1173
1174         /*
1175          * we need to work out if we will allow this DC to
1176          * replicate the secrets for this object
1177          *
1178          * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
1179          * of this function
1180          */
1181
1182         if (b_state->sam_ctx_system == NULL) {
1183                 /* this operation needs system level access */
1184                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
1185                 return WERR_DS_DRA_ACCESS_DENIED;
1186         }
1187
1188         /*
1189          * Before we accept or deny, fetch the machine DN for the destination
1190          * DSA GUID.
1191          *
1192          * If we are the RODC, we will check that this matches the SID.
1193          */
1194         ret = dsdb_find_dn_by_guid(b_state->sam_ctx_system, mem_ctx,
1195                                    &req10->destination_dsa_guid, 0,
1196                                    &ntds_dn);
1197         if (ret != LDB_SUCCESS) {
1198                 goto failed;
1199         }
1200
1201         server_dn = ldb_dn_get_parent(mem_ctx, ntds_dn);
1202         if (server_dn == NULL) {
1203                 goto failed;
1204         }
1205
1206         ret = samdb_reference_dn(b_state->sam_ctx_system, mem_ctx, server_dn,
1207                                  "serverReference", machine_dn);
1208
1209         if (ret != LDB_SUCCESS) {
1210                 goto failed;
1211         }
1212
1213         /*
1214          * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1215          *
1216          * The pseudo code indicate
1217          * revealsecrets = true
1218          * if IsRevealSecretRequest(msgIn) then
1219          *   if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1220          *   then
1221          *     if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1222          *     <... check if this account is ok to be replicated on this DC ...>
1223          *     <... and if not reveal secrets = no ...>
1224          *     else
1225          *       reveal secrets = false
1226          *     endif
1227          *   endif
1228          * endif
1229          *
1230          * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1231          * then you can do EXOP_REPL_SECRETS
1232          */
1233         obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
1234         if (!ldb_dn_validate(obj_dn)) goto failed;
1235
1236         if (has_get_all_changes) {
1237                 goto allowed;
1238         }
1239
1240         rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
1241                                  dom_sid_string(mem_ctx, user_sid));
1242         if (!ldb_dn_validate(rodc_dn)) goto failed;
1243
1244         /* do the two searches we need */
1245         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
1246                              DSDB_SEARCH_SHOW_EXTENDED_DN);
1247         if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
1248
1249         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1250         if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1251
1252         /* if the object SID is equal to the user_sid, allow */
1253         object_sid = samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid");
1254         if (dom_sid_equal(user_sid, object_sid)) {
1255                 goto allowed;
1256         }
1257
1258         additional_sids[0] = object_sid;
1259
1260         /*
1261          * Must be an RODC account at this point, verify machine DN matches the
1262          * SID account
1263          */
1264         if (ldb_dn_compare(rodc_res->msgs[0]->dn, *machine_dn) != 0) {
1265                 goto denied;
1266         }
1267
1268         /* an RODC is allowed to get its own krbtgt account secrets */
1269         krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1270                                          rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1271         if (krbtgt_link_dn != NULL &&
1272             ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1273                 goto allowed;
1274         }
1275
1276         /* but it isn't allowed to get anyone elses krbtgt secrets */
1277         if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1278                             obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1279                 goto denied;
1280         }
1281
1282         if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1283                                       "userAccountControl", 0) &
1284             UF_INTERDOMAIN_TRUST_ACCOUNT) {
1285                 goto denied;
1286         }
1287
1288         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1289                                          mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1290         if (!W_ERROR_IS_OK(werr)) {
1291                 goto denied;
1292         }
1293
1294         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1295                                          mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1296         if (!W_ERROR_IS_OK(werr)) {
1297                 goto denied;
1298         }
1299
1300         /*
1301          * The SID list needs to include itself as well as the tokenGroups.
1302          *
1303          * TODO determine if sIDHistory is required for this check
1304          */
1305         werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1306                                           mem_ctx, "tokenGroups", &token_sids,
1307                                           additional_sids, 1);
1308         if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1309                 goto denied;
1310         }
1311
1312         if (never_reveal_sids &&
1313             sid_list_match(token_sids, never_reveal_sids)) {
1314                 goto denied;
1315         }
1316
1317         if (reveal_sids &&
1318             sid_list_match(token_sids, reveal_sids)) {
1319                 goto allowed;
1320         }
1321
1322         /* default deny */
1323 denied:
1324         DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1325                  ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1326         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1327         return WERR_DS_DRA_SECRETS_DENIED;
1328
1329 allowed:
1330         DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1331                  ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1332                  ldb_dn_get_linearized(*machine_dn)));
1333         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1334         req10->highwatermark.highest_usn = 0;
1335         return WERR_OK;
1336
1337 failed:
1338         DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1339                  ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1340         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1341         return WERR_DS_DRA_BAD_DN;
1342 }
1343
1344 /*
1345   handle a DRSUAPI_EXOP_REPL_OBJ call
1346  */
1347 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1348                                     TALLOC_CTX *mem_ctx,
1349                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
1350                                     struct dom_sid *user_sid,
1351                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1352 {
1353         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1354
1355         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1356                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1357
1358         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1359         return WERR_OK;
1360 }
1361
1362
1363 /*
1364   handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1365   DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1366   and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1367  */
1368 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1369                                          TALLOC_CTX *mem_ctx,
1370                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
1371                                          struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1372 {
1373         struct ldb_dn *req_dn, *ntds_dn;
1374         int ret;
1375         unsigned int i;
1376         struct ldb_context *ldb = b_state->sam_ctx;
1377         struct ldb_message *msg;
1378         bool is_us;
1379
1380         /*
1381           steps:
1382             - verify that the client dn exists
1383             - verify that we are the current master
1384          */
1385
1386         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1387         if (!ldb_dn_validate(req_dn)) {
1388                 /* that is not a valid dn */
1389                 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1390                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1391                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1392                 return WERR_OK;
1393         }
1394
1395         /* find the DN of the current role owner */
1396         ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1397         if (ret != LDB_SUCCESS) {
1398                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1399                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1400                 return WERR_DS_DRA_INTERNAL_ERROR;
1401         }
1402
1403         if (!is_us) {
1404                 /* we're not the RID Manager or role owner - go away */
1405                 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1406                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1407                 return WERR_OK;
1408         }
1409
1410         /* change the current master */
1411         msg = ldb_msg_new(ldb);
1412         W_ERROR_HAVE_NO_MEMORY(msg);
1413         msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1414         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1415
1416         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1417         ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1418         if (ret != LDB_SUCCESS) {
1419                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1420                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1421                 talloc_free(msg);
1422                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1423                 return WERR_OK;
1424         }
1425
1426         ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1427         if (ret != 0) {
1428                 talloc_free(msg);
1429                 return WERR_DS_DRA_INTERNAL_ERROR;
1430         }
1431
1432         for (i=0;i<msg->num_elements;i++) {
1433                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1434         }
1435
1436         ret = ldb_transaction_start(ldb);
1437         if (ret != LDB_SUCCESS) {
1438                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1439                          ldb_errstring(ldb)));
1440                 return WERR_DS_DRA_INTERNAL_ERROR;
1441         }
1442
1443         ret = ldb_modify(ldb, msg);
1444         if (ret != LDB_SUCCESS) {
1445                 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1446                          ldb_errstring(ldb)));
1447                 ldb_transaction_cancel(ldb);
1448                 return WERR_DS_DRA_INTERNAL_ERROR;
1449         }
1450
1451         ret = ldb_transaction_commit(ldb);
1452         if (ret != LDB_SUCCESS) {
1453                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1454                          ldb_errstring(ldb)));
1455                 return WERR_DS_DRA_INTERNAL_ERROR;
1456         }
1457
1458         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1459
1460         return WERR_OK;
1461 }
1462
1463 /*
1464   see if this getncchanges request includes a request to reveal secret information
1465  */
1466 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1467                                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1468                                                        struct dsdb_schema_prefixmap *pfm_remote,
1469                                                        bool *is_secret_request)
1470 {
1471         enum drsuapi_DsExtendedOperation exop;
1472         uint32_t i;
1473         struct dsdb_schema *schema;
1474         struct dsdb_syntax_ctx syntax_ctx;
1475
1476         *is_secret_request = true;
1477
1478         exop = req10->extended_op;
1479
1480         switch (exop) {
1481         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1482         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1483         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1484         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1485         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1486                 /* FSMO exops can reveal secrets */
1487                 *is_secret_request = true;
1488                 return WERR_OK;
1489         case DRSUAPI_EXOP_REPL_SECRET:
1490         case DRSUAPI_EXOP_REPL_OBJ:
1491         case DRSUAPI_EXOP_NONE:
1492                 break;
1493         }
1494
1495         if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1496                 *is_secret_request = false;
1497                 return WERR_OK;
1498         }
1499
1500         if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1501             req10->partial_attribute_set == NULL) {
1502                 /* they want secrets */
1503                 *is_secret_request = true;
1504                 return WERR_OK;
1505         }
1506
1507         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1508         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1509         syntax_ctx.pfm_remote = pfm_remote;
1510
1511         /* check the attributes they asked for */
1512         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1513                 const struct dsdb_attribute *sa;
1514                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1515                                                                  &syntax_ctx,
1516                                                                  req10->partial_attribute_set->attids[i],
1517                                                                  NULL,
1518                                                                  &sa);
1519
1520                 if (!W_ERROR_IS_OK(werr)) {
1521                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1522                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1523                         return werr;
1524                 }
1525
1526                 if (!dsdb_attr_in_rodc_fas(sa)) {
1527                         *is_secret_request = true;
1528                         return WERR_OK;
1529                 }
1530         }
1531
1532         if (req10->partial_attribute_set_ex) {
1533                 /* check the extended attributes they asked for */
1534                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1535                         const struct dsdb_attribute *sa;
1536                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1537                                                                          &syntax_ctx,
1538                                                                          req10->partial_attribute_set_ex->attids[i],
1539                                                                          NULL,
1540                                                                          &sa);
1541
1542                         if (!W_ERROR_IS_OK(werr)) {
1543                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1544                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1545                                 return werr;
1546                         }
1547
1548                         if (!dsdb_attr_in_rodc_fas(sa)) {
1549                                 *is_secret_request = true;
1550                                 return WERR_OK;
1551                         }
1552                 }
1553         }
1554
1555         *is_secret_request = false;
1556         return WERR_OK;
1557 }
1558
1559 /*
1560   see if this getncchanges request is only for attributes in the GC
1561   partial attribute set
1562  */
1563 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1564                                                struct drsuapi_DsGetNCChangesRequest10 *req10,
1565                                                struct dsdb_schema_prefixmap *pfm_remote,
1566                                                bool *is_gc_pas_request)
1567 {
1568         enum drsuapi_DsExtendedOperation exop;
1569         uint32_t i;
1570         struct dsdb_schema *schema;
1571         struct dsdb_syntax_ctx syntax_ctx;
1572
1573         exop = req10->extended_op;
1574
1575         switch (exop) {
1576         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1577         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1578         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1579         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1580         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1581         case DRSUAPI_EXOP_REPL_SECRET:
1582                 *is_gc_pas_request = false;
1583                 return WERR_OK;
1584         case DRSUAPI_EXOP_REPL_OBJ:
1585         case DRSUAPI_EXOP_NONE:
1586                 break;
1587         }
1588
1589         if (req10->partial_attribute_set == NULL) {
1590                 /* they want it all */
1591                 *is_gc_pas_request = false;
1592                 return WERR_OK;
1593         }
1594
1595         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1596         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1597         syntax_ctx.pfm_remote = pfm_remote;
1598
1599         /* check the attributes they asked for */
1600         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1601                 const struct dsdb_attribute *sa;
1602                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1603                                                                  &syntax_ctx,
1604                                                                  req10->partial_attribute_set->attids[i],
1605                                                                  NULL,
1606                                                                  &sa);
1607
1608                 if (!W_ERROR_IS_OK(werr)) {
1609                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1610                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1611                         return werr;
1612                 }
1613
1614                 if (!sa->isMemberOfPartialAttributeSet) {
1615                         *is_gc_pas_request = false;
1616                         return WERR_OK;
1617                 }
1618         }
1619
1620         if (req10->partial_attribute_set_ex) {
1621                 /* check the extended attributes they asked for */
1622                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1623                         const struct dsdb_attribute *sa;
1624                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1625                                                                          &syntax_ctx,
1626                                                                          req10->partial_attribute_set_ex->attids[i],
1627                                                                          NULL,
1628                                                                          &sa);
1629
1630                         if (!W_ERROR_IS_OK(werr)) {
1631                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1632                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1633                                 return werr;
1634                         }
1635
1636                         if (!sa->isMemberOfPartialAttributeSet) {
1637                                 *is_gc_pas_request = false;
1638                                 return WERR_OK;
1639                         }
1640                 }
1641         }
1642
1643         *is_gc_pas_request = true;
1644         return WERR_OK;
1645 }
1646
1647
1648 /*
1649   map from req8 to req10
1650  */
1651 static struct drsuapi_DsGetNCChangesRequest10 *
1652 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1653                       struct drsuapi_DsGetNCChangesRequest8 *req8)
1654 {
1655         struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1656                                                                     struct drsuapi_DsGetNCChangesRequest10);
1657         if (req10 == NULL) {
1658                 return NULL;
1659         }
1660
1661         req10->destination_dsa_guid = req8->destination_dsa_guid;
1662         req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1663         req10->naming_context = req8->naming_context;
1664         req10->highwatermark = req8->highwatermark;
1665         req10->uptodateness_vector = req8->uptodateness_vector;
1666         req10->replica_flags = req8->replica_flags;
1667         req10->max_object_count = req8->max_object_count;
1668         req10->max_ndr_size = req8->max_ndr_size;
1669         req10->extended_op = req8->extended_op;
1670         req10->fsmo_info = req8->fsmo_info;
1671         req10->partial_attribute_set = req8->partial_attribute_set;
1672         req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1673         req10->mapping_ctr = req8->mapping_ctr;
1674
1675         return req10;
1676 }
1677
1678 static const char *collect_objects_attrs[] = { "uSNChanged",
1679                                                "objectGUID" ,
1680                                                NULL };
1681
1682 /**
1683  * Collects object for normal replication cycle.
1684  */
1685 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1686                                            TALLOC_CTX *mem_ctx,
1687                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
1688                                            struct ldb_dn *search_dn,
1689                                            const char *extra_filter,
1690                                            struct ldb_result **search_res)
1691 {
1692         int ret;
1693         char* search_filter;
1694         enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1695         struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1696         bool critical_only = false;
1697
1698         if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1699                 critical_only = true;
1700         }
1701
1702         if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1703             req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1704                 scope = LDB_SCOPE_BASE;
1705                 critical_only = false;
1706         }
1707
1708         /* Construct response. */
1709         search_filter = talloc_asprintf(mem_ctx,
1710                                         "(uSNChanged>=%llu)",
1711                                         (unsigned long long)(getnc_state->min_usn+1));
1712
1713         if (extra_filter) {
1714                 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1715         }
1716
1717         if (critical_only) {
1718                 search_filter = talloc_asprintf(mem_ctx,
1719                                                 "(&%s(isCriticalSystemObject=TRUE))",
1720                                                 search_filter);
1721         }
1722
1723         if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1724                 scope = LDB_SCOPE_BASE;
1725         }
1726
1727         if (!search_dn) {
1728                 search_dn = getnc_state->ncRoot_dn;
1729         }
1730
1731         DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1732                  ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1733         ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1734                                               search_dn, scope,
1735                                               collect_objects_attrs,
1736                                               search_filter);
1737         if (ret != LDB_SUCCESS) {
1738                 return WERR_DS_DRA_INTERNAL_ERROR;
1739         }
1740
1741         return WERR_OK;
1742 }
1743
1744 /**
1745  * Collects object for normal replication cycle.
1746  */
1747 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1748                                                 TALLOC_CTX *mem_ctx,
1749                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
1750                                                 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1751                                                 struct ldb_dn *search_dn,
1752                                                 const char *extra_filter,
1753                                                 struct ldb_result **search_res)
1754 {
1755         /* we have nothing to do in case of ex-op failure */
1756         if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1757                 return WERR_OK;
1758         }
1759
1760         switch (req10->extended_op) {
1761         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1762         {
1763                 int ret;
1764                 struct ldb_dn *ntds_dn = NULL;
1765                 struct ldb_dn *server_dn = NULL;
1766                 struct ldb_dn *machine_dn = NULL;
1767                 struct ldb_dn *rid_set_dn = NULL;
1768                 struct ldb_result *search_res2 = NULL;
1769                 struct ldb_result *search_res3 = NULL;
1770                 TALLOC_CTX *frame = talloc_stackframe();
1771                 /* get RID manager, RID set and server DN (in that order) */
1772
1773                 /* This first search will get the RID Manager */
1774                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1775                                                       search_res,
1776                                                       search_dn, LDB_SCOPE_BASE,
1777                                                       collect_objects_attrs,
1778                                                       NULL);
1779                 if (ret != LDB_SUCCESS) {
1780                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1781                                   ldb_dn_get_linearized(search_dn),
1782                                   ldb_errstring(b_state->sam_ctx)));
1783                         TALLOC_FREE(frame);
1784                         return WERR_DS_DRA_INTERNAL_ERROR;
1785                 }
1786
1787                 if ((*search_res)->count != 1) {
1788                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1789                                   ldb_dn_get_linearized(search_dn),
1790                                   (*search_res)->count));
1791                         TALLOC_FREE(frame);
1792                         return WERR_DS_DRA_INTERNAL_ERROR;
1793                 }
1794
1795                 /* Now extend it to the RID set */
1796
1797                 /* Find the computer account DN for the destination
1798                  * dsa GUID specified */
1799
1800                 ret = dsdb_find_dn_by_guid(b_state->sam_ctx, frame,
1801                                            &req10->destination_dsa_guid, 0,
1802                                            &ntds_dn);
1803                 if (ret != LDB_SUCCESS) {
1804                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1805                                   GUID_string(frame,
1806                                               &req10->destination_dsa_guid),
1807                                   ldb_errstring(b_state->sam_ctx)));
1808                         TALLOC_FREE(frame);
1809                         return WERR_DS_DRA_INTERNAL_ERROR;
1810                 }
1811
1812                 server_dn = ldb_dn_get_parent(frame, ntds_dn);
1813                 if (!server_dn) {
1814                         TALLOC_FREE(frame);
1815                         return WERR_DS_DRA_INTERNAL_ERROR;
1816                 }
1817
1818                 ret = samdb_reference_dn(b_state->sam_ctx, frame, server_dn,
1819                                          "serverReference", &machine_dn);
1820                 if (ret != LDB_SUCCESS) {
1821                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1822                                   ldb_dn_get_linearized(server_dn),
1823                                   ldb_errstring(b_state->sam_ctx)));
1824                         TALLOC_FREE(frame);
1825                         return WERR_DS_DRA_INTERNAL_ERROR;
1826                 }
1827
1828                 ret = samdb_reference_dn(b_state->sam_ctx, frame, machine_dn,
1829                                          "rIDSetReferences", &rid_set_dn);
1830                 if (ret != LDB_SUCCESS) {
1831                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1832                                   ldb_dn_get_linearized(server_dn),
1833                                   ldb_errstring(b_state->sam_ctx)));
1834                         TALLOC_FREE(frame);
1835                         return WERR_DS_DRA_INTERNAL_ERROR;
1836                 }
1837
1838
1839                 /* This first search will get the RID Manager, now get the RID set */
1840                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1841                                                       &search_res2,
1842                                                       rid_set_dn, LDB_SCOPE_BASE,
1843                                                       collect_objects_attrs,
1844                                                       NULL);
1845                 if (ret != LDB_SUCCESS) {
1846                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1847                                   ldb_dn_get_linearized(rid_set_dn),
1848                                   ldb_errstring(b_state->sam_ctx)));
1849                         TALLOC_FREE(frame);
1850                         return WERR_DS_DRA_INTERNAL_ERROR;
1851                 }
1852
1853                 if (search_res2->count != 1) {
1854                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1855                                   ldb_dn_get_linearized(rid_set_dn),
1856                                   search_res2->count));
1857                         TALLOC_FREE(frame);
1858                         return WERR_DS_DRA_INTERNAL_ERROR;
1859                 }
1860
1861                 /* Finally get the server DN */
1862                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1863                                                       &search_res3,
1864                                                       machine_dn, LDB_SCOPE_BASE,
1865                                                       collect_objects_attrs,
1866                                                       NULL);
1867                 if (ret != LDB_SUCCESS) {
1868                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1869                                   ldb_dn_get_linearized(server_dn),
1870                                   ldb_errstring(b_state->sam_ctx)));
1871                         TALLOC_FREE(frame);
1872                         return WERR_DS_DRA_INTERNAL_ERROR;
1873                 }
1874
1875                 if (search_res3->count != 1) {
1876                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1877                                   ldb_dn_get_linearized(server_dn),
1878                                   search_res3->count));
1879                         TALLOC_FREE(frame);
1880                         return WERR_DS_DRA_INTERNAL_ERROR;
1881                 }
1882
1883                 /* Now extend the original search_res with these answers */
1884                 (*search_res)->count = 3;
1885
1886                 (*search_res)->msgs = talloc_realloc(frame, (*search_res)->msgs,
1887                                                      struct ldb_message *,
1888                                                      (*search_res)->count);
1889                 if ((*search_res)->msgs == NULL) {
1890                         TALLOC_FREE(frame);
1891                         return WERR_NOT_ENOUGH_MEMORY;
1892                 }
1893
1894
1895                 talloc_steal(mem_ctx, *search_res);
1896                 (*search_res)->msgs[1] =
1897                         talloc_steal((*search_res)->msgs, search_res2->msgs[0]);
1898                 (*search_res)->msgs[2] =
1899                         talloc_steal((*search_res)->msgs, search_res3->msgs[0]);
1900
1901                 TALLOC_FREE(frame);
1902                 return WERR_OK;
1903         }
1904         default:
1905                 /* TODO: implement extended op specific collection
1906                  * of objects. Right now we just normal procedure
1907                  * for collecting objects */
1908                 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1909         }
1910 }
1911
1912 static void dcesrv_drsuapi_update_highwatermark(const struct ldb_message *msg,
1913                                                 uint64_t max_usn,
1914                                                 struct drsuapi_DsReplicaHighWaterMark *hwm)
1915 {
1916         uint64_t uSN = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
1917
1918         if (uSN > max_usn) {
1919                 /*
1920                  * Only report the max_usn we had at the start
1921                  * of the replication cycle.
1922                  *
1923                  * If this object has changed lately we better
1924                  * let the destination dsa refetch the change.
1925                  * This is better than the risk of loosing some
1926                  * objects or linked attributes.
1927                  */
1928                 return;
1929         }
1930
1931         if (uSN <= hwm->tmp_highest_usn) {
1932                 return;
1933         }
1934
1935         hwm->tmp_highest_usn = uSN;
1936         hwm->reserved_usn = 0;
1937 }
1938
1939 /**
1940  * Adds an object's GUID to the cache of objects already sent.
1941  * This avoids us sending the same object multiple times when
1942  * the GetNCChanges request uses a flag like GET_ANC.
1943  */
1944 static WERROR dcesrv_drsuapi_obj_cache_add(struct db_context *obj_cache,
1945                                            const struct GUID *guid)
1946 {
1947         enum ndr_err_code ndr_err;
1948         uint8_t guid_buf[16] = { 0, };
1949         DATA_BLOB b = {
1950                 .data = guid_buf,
1951                 .length = sizeof(guid_buf),
1952         };
1953         TDB_DATA key = {
1954                 .dptr = b.data,
1955                 .dsize = b.length,
1956         };
1957         TDB_DATA val = {
1958                 .dptr = NULL,
1959                 .dsize = 0,
1960         };
1961         NTSTATUS status;
1962
1963         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1964                         (ndr_push_flags_fn_t)ndr_push_GUID);
1965         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1966                 return WERR_DS_DRA_INTERNAL_ERROR;
1967         }
1968
1969         status = dbwrap_store(obj_cache, key, val, TDB_REPLACE);
1970         if (!NT_STATUS_IS_OK(status)) {
1971                 return WERR_DS_DRA_INTERNAL_ERROR;
1972         }
1973
1974         return WERR_OK;
1975 }
1976
1977 /**
1978  * Checks if the object with the GUID specified already exists in the
1979  * object cache, i.e. it's already been sent in a GetNCChanges response.
1980  */
1981 static WERROR dcesrv_drsuapi_obj_cache_exists(struct db_context *obj_cache,
1982                                               const struct GUID *guid)
1983 {
1984         enum ndr_err_code ndr_err;
1985         uint8_t guid_buf[16] = { 0, };
1986         DATA_BLOB b = {
1987                 .data = guid_buf,
1988                 .length = sizeof(guid_buf),
1989         };
1990         TDB_DATA key = {
1991                 .dptr = b.data,
1992                 .dsize = b.length,
1993         };
1994         bool exists;
1995
1996         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1997                         (ndr_push_flags_fn_t)ndr_push_GUID);
1998         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1999                 return WERR_DS_DRA_INTERNAL_ERROR;
2000         }
2001
2002         exists = dbwrap_exists(obj_cache, key);
2003         if (!exists) {
2004                 return WERR_OBJECT_NOT_FOUND;
2005         }
2006
2007         return WERR_OBJECT_NAME_EXISTS;
2008 }
2009
2010 /**
2011  * Copies the la_list specified into a sorted array, ready to be sent in a
2012  * GetNCChanges response.
2013  */
2014 static WERROR getncchanges_get_sorted_array(const struct drsuapi_DsReplicaLinkedAttribute *la_list,
2015                                             const uint32_t link_count,
2016                                             struct ldb_context *sam_ctx,
2017                                             TALLOC_CTX *mem_ctx,
2018                                             const struct dsdb_schema *schema,
2019                                             struct la_for_sorting **ret_array)
2020 {
2021         int j;
2022         struct la_for_sorting *guid_array;
2023         WERROR werr = WERR_OK;
2024
2025         *ret_array = NULL;
2026         guid_array = talloc_array(mem_ctx, struct la_for_sorting, link_count);
2027         if (guid_array == NULL) {
2028                 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", link_count));
2029                 return WERR_NOT_ENOUGH_MEMORY;
2030         }
2031
2032         for (j = 0; j < link_count; j++) {
2033
2034                 /* we need to get the target GUIDs to compare */
2035                 struct dsdb_dn *dn;
2036                 const struct drsuapi_DsReplicaLinkedAttribute *la = &la_list[j];
2037                 const struct dsdb_attribute *schema_attrib;
2038                 const struct ldb_val *target_guid;
2039                 DATA_BLOB source_guid;
2040                 TALLOC_CTX *frame = talloc_stackframe();
2041                 NTSTATUS status;
2042
2043                 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la->attid);
2044
2045                 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, frame, la->value.blob, &dn);
2046                 if (!W_ERROR_IS_OK(werr)) {
2047                         DEBUG(0,(__location__ ": Bad la blob in sort\n"));
2048                         TALLOC_FREE(frame);
2049                         return werr;
2050                 }
2051
2052                 /* Extract the target GUID in NDR form */
2053                 target_guid = ldb_dn_get_extended_component(dn->dn, "GUID");
2054                 if (target_guid == NULL
2055                                 || target_guid->length != sizeof(guid_array[0].target_guid)) {
2056                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2057                 } else {
2058                         /* Repack the source GUID as NDR for sorting */
2059                         status = GUID_to_ndr_blob(&la->identifier->guid,
2060                                                   frame,
2061                                                   &source_guid);
2062                 }
2063
2064                 if (!NT_STATUS_IS_OK(status)
2065                                 || source_guid.length != sizeof(guid_array[0].source_guid)) {
2066                         DEBUG(0,(__location__ ": Bad la guid in sort\n"));
2067                         TALLOC_FREE(frame);
2068                         return ntstatus_to_werror(status);
2069                 }
2070
2071                 guid_array[j].link = &la_list[j];
2072                 memcpy(guid_array[j].target_guid, target_guid->data,
2073                        sizeof(guid_array[j].target_guid));
2074                 memcpy(guid_array[j].source_guid, source_guid.data,
2075                        sizeof(guid_array[j].source_guid));
2076                 TALLOC_FREE(frame);
2077         }
2078
2079         LDB_TYPESAFE_QSORT(guid_array, link_count, NULL, linked_attribute_compare);
2080
2081         *ret_array = guid_array;
2082
2083         return werr;
2084 }
2085
2086
2087 /**
2088  * Adds any ancestor/parent objects of the child_obj specified.
2089  * This is needed when the GET_ANC flag is specified in the request.
2090  * @param new_objs if parents are added, this gets updated to point to a chain
2091  * of parent objects (with the parents first and the child last)
2092  */
2093 static WERROR getncchanges_add_ancestors(struct drsuapi_DsReplicaObjectListItemEx *child_obj,
2094                                          struct ldb_dn *child_dn,
2095                                          TALLOC_CTX *mem_ctx,
2096                                          struct ldb_context *sam_ctx,
2097                                          struct drsuapi_getncchanges_state *getnc_state,
2098                                          struct dsdb_schema *schema,
2099                                          DATA_BLOB *session_key,
2100                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
2101                                          uint32_t *local_pas,
2102                                          struct ldb_dn *machine_dn,
2103                                          struct drsuapi_DsReplicaObjectListItemEx **new_objs)
2104 {
2105         int ret;
2106         const struct GUID *next_anc_guid = NULL;
2107         WERROR werr = WERR_OK;
2108         static const char * const msg_attrs[] = {
2109                                             "*",
2110                                             "nTSecurityDescriptor",
2111                                             "parentGUID",
2112                                             "replPropertyMetaData",
2113                                             DSDB_SECRET_ATTRIBUTES,
2114                                             NULL };
2115
2116         next_anc_guid = child_obj->parent_object_guid;
2117
2118         while (next_anc_guid != NULL) {
2119                 struct drsuapi_DsReplicaObjectListItemEx *anc_obj = NULL;
2120                 struct ldb_message *anc_msg = NULL;
2121                 struct ldb_result *anc_res = NULL;
2122                 struct ldb_dn *anc_dn = NULL;
2123
2124                 /*
2125                  * Don't send an object twice. (If we've sent the object, then
2126                  * we've also sent all its parents as well)
2127                  */
2128                 werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
2129                                                        next_anc_guid);
2130                 if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2131                         return WERR_OK;
2132                 }
2133                 if (W_ERROR_IS_OK(werr)) {
2134                         return WERR_INTERNAL_ERROR;
2135                 }
2136                 if (!W_ERROR_EQUAL(werr, WERR_OBJECT_NOT_FOUND)) {
2137                         return werr;
2138                 }
2139
2140                 anc_obj = talloc_zero(mem_ctx,
2141                                       struct drsuapi_DsReplicaObjectListItemEx);
2142                 if (anc_obj == NULL) {
2143                         return WERR_NOT_ENOUGH_MEMORY;
2144                 }
2145
2146                 anc_dn = ldb_dn_new_fmt(anc_obj, sam_ctx, "<GUID=%s>",
2147                                         GUID_string(anc_obj, next_anc_guid));
2148                 if (anc_dn == NULL) {
2149                         return WERR_NOT_ENOUGH_MEMORY;
2150                 }
2151
2152                 ret = drsuapi_search_with_extended_dn(sam_ctx, anc_obj,
2153                                                       &anc_res, anc_dn,
2154                                                       LDB_SCOPE_BASE,
2155                                                       msg_attrs, NULL);
2156                 if (ret != LDB_SUCCESS) {
2157                         const char *anc_str = NULL;
2158                         const char *obj_str = NULL;
2159
2160                         anc_str = ldb_dn_get_extended_linearized(anc_obj,
2161                                                                  anc_dn,
2162                                                                  1);
2163                         obj_str = ldb_dn_get_extended_linearized(anc_obj,
2164                                                                  child_dn,
2165                                                                  1);
2166
2167                         DBG_ERR("getncchanges: failed to fetch ANC "
2168                                 "DN %s for DN %s - %s\n",
2169                                 anc_str, obj_str, ldb_errstring(sam_ctx));
2170                         return WERR_DS_DRA_INCONSISTENT_DIT;
2171                 }
2172
2173                 anc_msg = anc_res->msgs[0];
2174
2175                 werr = get_nc_changes_build_object(anc_obj, anc_msg,
2176                                                    sam_ctx,
2177                                                    getnc_state->ncRoot_dn,
2178                                                    getnc_state->is_schema_nc,
2179                                                    schema, session_key,
2180                                                    getnc_state->min_usn,
2181                                                    req10->replica_flags,
2182                                                    req10->partial_attribute_set,
2183                                                    req10->uptodateness_vector,
2184                                                    req10->extended_op,
2185                                                    false, /* force_object_return */
2186                                                    local_pas,
2187                                                    machine_dn,
2188                                                    next_anc_guid);
2189                 if (!W_ERROR_IS_OK(werr)) {
2190                         return werr;
2191                 }
2192
2193                 /*
2194                  * Regardless of whether we actually use it or not,
2195                  * we add it to the cache so we don't look at it again
2196                  */
2197                 werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
2198                                                     next_anc_guid);
2199                 if (!W_ERROR_IS_OK(werr)) {
2200                         return werr;
2201                 }
2202
2203                 /*
2204                  * Any ancestors which are below the highwatermark
2205                  * or uptodateness_vector shouldn't be added,
2206                  * but we still look further up the
2207                  * tree for ones which have been changed recently.
2208                  */
2209                 if (anc_obj->meta_data_ctr != NULL) {
2210
2211                         /*
2212                          * prepend the parent to the list so that the client-side
2213                          * adds the parent object before it adds the children
2214                          */
2215                         anc_obj->next_object = *new_objs;
2216                         *new_objs = anc_obj;
2217                 }
2218
2219                 anc_msg = NULL;
2220                 TALLOC_FREE(anc_res);
2221                 TALLOC_FREE(anc_dn);
2222
2223                 /*
2224                  * We may need to resolve more parents...
2225                  */
2226                 next_anc_guid = anc_obj->parent_object_guid;
2227         }
2228         return werr;
2229 }
2230
2231 /*
2232   drsuapi_DsGetNCChanges
2233
2234   see MS-DRSR 4.1.10.5.2 for basic logic of this function
2235 */
2236 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2237                                      struct drsuapi_DsGetNCChanges *r)
2238 {
2239         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
2240         int ret;
2241         uint32_t i, k;
2242         struct dsdb_schema *schema;
2243         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
2244         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
2245         NTSTATUS status;
2246         DATA_BLOB session_key;
2247         WERROR werr;
2248         struct dcesrv_handle *h;
2249         struct drsuapi_bind_state *b_state;
2250         struct drsuapi_getncchanges_state *getnc_state;
2251         struct drsuapi_DsGetNCChangesRequest10 *req10;
2252         uint32_t options;
2253         uint32_t max_objects;
2254         uint32_t max_links;
2255         uint32_t link_count = 0;
2256         uint32_t link_total = 0;
2257         uint32_t link_given = 0;
2258         struct ldb_dn *search_dn = NULL;
2259         bool am_rodc;
2260         enum security_user_level security_level;
2261         struct ldb_context *sam_ctx;
2262         struct dom_sid *user_sid;
2263         bool is_secret_request;
2264         bool is_gc_pas_request;
2265         struct drsuapi_changed_objects *changes;
2266         time_t max_wait;
2267         time_t start = time(NULL);
2268         bool max_wait_reached = false;
2269         bool has_get_all_changes = false;
2270         struct GUID invocation_id;
2271         static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
2272         struct dsdb_schema_prefixmap *pfm_remote = NULL;
2273         bool full = true;
2274         uint32_t *local_pas = NULL;
2275         struct ldb_dn *machine_dn = NULL; /* Only used for REPL SECRET EXOP */
2276
2277         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
2278         b_state = h->data;
2279
2280         /* sam_ctx_system is not present for non-administrator users */
2281         sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
2282
2283         invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2284
2285         *r->out.level_out = 6;
2286         /* TODO: linked attributes*/
2287         r->out.ctr->ctr6.linked_attributes_count = 0;
2288         r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
2289
2290         r->out.ctr->ctr6.object_count = 0;
2291         r->out.ctr->ctr6.nc_object_count = 0;
2292         r->out.ctr->ctr6.more_data = false;
2293         r->out.ctr->ctr6.uptodateness_vector = NULL;
2294         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2295         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2296         r->out.ctr->ctr6.first_object = NULL;
2297
2298         /* a RODC doesn't allow for any replication */
2299         ret = samdb_rodc(sam_ctx, &am_rodc);
2300         if (ret == LDB_SUCCESS && am_rodc) {
2301                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
2302                 return WERR_DS_DRA_SOURCE_DISABLED;
2303         }
2304
2305         /* Check request revision.
2306          */
2307         switch (r->in.level) {
2308         case 8:
2309                 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
2310                 if (req10 == NULL) {
2311                         return WERR_NOT_ENOUGH_MEMORY;
2312                 }
2313                 break;
2314         case 10:
2315                 req10 = &r->in.req->req10;
2316                 break;
2317         default:
2318                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
2319                          r->in.level));
2320                 return WERR_REVISION_MISMATCH;
2321         }
2322
2323
2324         /* Perform access checks. */
2325         /* TODO: we need to support a sync on a specific non-root
2326          * DN. We'll need to find the real partition root here */
2327         ncRoot = req10->naming_context;
2328         if (ncRoot == NULL) {
2329                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
2330                 return WERR_DS_DRA_INVALID_PARAMETER;
2331         }
2332
2333         if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
2334                 return WERR_DS_DRA_INTERNAL_ERROR;
2335         }
2336
2337         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
2338             !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
2339                 return WERR_DS_DRA_SOURCE_DISABLED;
2340         }
2341
2342         user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
2343
2344         /* all clients must have GUID_DRS_GET_CHANGES */
2345         werr = drs_security_access_check_nc_root(sam_ctx,
2346                                                  mem_ctx,
2347                                                  dce_call->conn->auth_state.session_info->security_token,
2348                                                  req10->naming_context,
2349                                                  GUID_DRS_GET_CHANGES);
2350         if (!W_ERROR_IS_OK(werr)) {
2351                 return werr;
2352         }
2353
2354         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) {
2355                 full = req10->partial_attribute_set == NULL &&
2356                        req10->partial_attribute_set_ex == NULL;
2357         } else {
2358                 full = (options & DRSUAPI_DRS_WRIT_REP) != 0;
2359         }
2360
2361         werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true,
2362                                                 mem_ctx, &pfm_remote, NULL);
2363
2364         /* We were supplied a partial attribute set, without the prefix map! */
2365         if (!full && !W_ERROR_IS_OK(werr)) {
2366                 if (req10->mapping_ctr.num_mappings == 0) {
2367                         /*
2368                          * Despite the fact MS-DRSR specifies that this shouldn't
2369                          * happen, Windows RODCs will in fact not provide a prefixMap.
2370                          */
2371                         DEBUG(5,(__location__ ": Failed to provide a remote prefixMap,"
2372                                  " falling back to local prefixMap\n"));
2373                 } else {
2374                         DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n",
2375                                  win_errstr(werr)));
2376                         return werr;
2377                 }
2378         }
2379
2380         /* allowed if the GC PAS and client has
2381            GUID_DRS_GET_FILTERED_ATTRIBUTES */
2382         werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request);
2383         if (!W_ERROR_IS_OK(werr)) {
2384                 return werr;
2385         }
2386         if (is_gc_pas_request) {
2387                 werr = drs_security_access_check_nc_root(sam_ctx,
2388                                                          mem_ctx,
2389                                                          dce_call->conn->auth_state.session_info->security_token,
2390                                                          req10->naming_context,
2391                                                          GUID_DRS_GET_FILTERED_ATTRIBUTES);
2392                 if (W_ERROR_IS_OK(werr)) {
2393                         goto allowed;
2394                 }
2395         }
2396
2397         werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10,
2398                                                         pfm_remote,
2399                                                         &is_secret_request);
2400         if (!W_ERROR_IS_OK(werr)) {
2401                 return werr;
2402         }
2403         if (is_secret_request) {
2404                 werr = drs_security_access_check_nc_root(sam_ctx,
2405                                                          mem_ctx,
2406                                                          dce_call->conn->auth_state.session_info->security_token,
2407                                                          req10->naming_context,
2408                                                          GUID_DRS_GET_ALL_CHANGES);
2409                 if (!W_ERROR_IS_OK(werr)) {
2410                         /* Only bail if this is not a EXOP_REPL_SECRET */
2411                         if (req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
2412                                 return werr;
2413                         }
2414                 } else {
2415                         has_get_all_changes = true;
2416                 }
2417         }
2418
2419 allowed:
2420         /* for non-administrator replications, check that they have
2421            given the correct source_dsa_invocation_id */
2422         security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
2423                                                      samdb_domain_sid(sam_ctx));
2424         if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
2425                 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
2426                         /* we rely on this flag being unset for RODC requests */
2427                         req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2428                 }
2429         }
2430
2431         if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
2432                 /* Ignore the _in_ uptpdateness vector*/
2433                 req10->uptodateness_vector = NULL;
2434         }
2435
2436         if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
2437                 req10->source_dsa_invocation_id = invocation_id;
2438         }
2439
2440         if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
2441                 /*
2442                  * The given highwatermark is only valid relative to the
2443                  * specified source_dsa_invocation_id.
2444                  */
2445                 ZERO_STRUCT(req10->highwatermark);
2446         }
2447
2448         getnc_state = b_state->getncchanges_state;
2449
2450         /* see if a previous replication has been abandoned */
2451         if (getnc_state) {
2452                 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
2453                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
2454                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
2455                                  ldb_dn_get_linearized(new_dn),
2456                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2457                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2458                         TALLOC_FREE(getnc_state);
2459                         b_state->getncchanges_state = NULL;
2460                 }
2461         }
2462
2463         if (getnc_state) {
2464                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
2465                                                          &req10->highwatermark);
2466                 if (ret != 0) {
2467                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
2468                                  "on DN %s %s highwatermark (last_dn %s)\n",
2469                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2470                                  (ret > 0) ? "older" : "newer",
2471                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2472                         TALLOC_FREE(getnc_state);
2473                         b_state->getncchanges_state = NULL;
2474                 }
2475         }
2476
2477         if (getnc_state == NULL) {
2478                 struct ldb_result *res = NULL;
2479                 const char *attrs[] = {
2480                         "instanceType",
2481                         "objectGuID",
2482                         NULL
2483                 };
2484                 uint32_t nc_instanceType;
2485                 struct ldb_dn *ncRoot_dn;
2486
2487                 ncRoot_dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, ncRoot);
2488                 if (ncRoot_dn == NULL) {
2489                         return WERR_NOT_ENOUGH_MEMORY;
2490                 }
2491
2492                 ret = dsdb_search_dn(sam_ctx, mem_ctx, &res,
2493                                      ncRoot_dn, attrs,
2494                                      DSDB_SEARCH_SHOW_DELETED |
2495                                      DSDB_SEARCH_SHOW_RECYCLED);
2496                 if (ret != LDB_SUCCESS) {
2497                         DBG_WARNING("Failed to find ncRoot_dn %s\n",
2498                                     ldb_dn_get_linearized(ncRoot_dn));
2499                         return WERR_DS_DRA_BAD_DN;
2500                 }
2501                 nc_instanceType = ldb_msg_find_attr_as_int(res->msgs[0],
2502                                                            "instanceType",
2503                                                            0);
2504
2505                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2506                         r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
2507                 }
2508
2509                 /*
2510                  * This is the first replication cycle and it is
2511                  * a good place to handle extended operations
2512                  *
2513                  * FIXME: we don't fully support extended operations yet
2514                  */
2515                 switch (req10->extended_op) {
2516                 case DRSUAPI_EXOP_NONE:
2517                         if ((nc_instanceType & INSTANCE_TYPE_IS_NC_HEAD) == 0) {
2518                                 const char *dn_str
2519                                         = ldb_dn_get_linearized(ncRoot_dn);
2520
2521                                 DBG_NOTICE("Rejecting full replication on "
2522                                            "not NC %s", dn_str);
2523
2524                                 return WERR_DS_CANT_FIND_EXPECTED_NC;
2525                         }
2526
2527                         break;
2528                 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
2529                         werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6, &search_dn);
2530                         W_ERROR_NOT_OK_RETURN(werr);
2531                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2532                                 return WERR_OK;
2533                         }
2534                         break;
2535                 case DRSUAPI_EXOP_REPL_SECRET:
2536                         werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
2537                                                         user_sid,
2538                                                         &r->out.ctr->ctr6,
2539                                                         has_get_all_changes,
2540                                                         &machine_dn);
2541                         r->out.result = werr;
2542                         W_ERROR_NOT_OK_RETURN(werr);
2543                         break;
2544                 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
2545                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2546                         W_ERROR_NOT_OK_RETURN(werr);
2547                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2548                                 return WERR_OK;
2549                         }
2550                         break;
2551                 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
2552                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2553                         W_ERROR_NOT_OK_RETURN(werr);
2554                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2555                                 return WERR_OK;
2556                         }
2557                         break;
2558                 case DRSUAPI_EXOP_FSMO_REQ_PDC:
2559                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2560                         W_ERROR_NOT_OK_RETURN(werr);
2561                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2562                                 return WERR_OK;
2563                         }
2564                         break;
2565                 case DRSUAPI_EXOP_REPL_OBJ:
2566                         werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
2567                         r->out.result = werr;
2568                         W_ERROR_NOT_OK_RETURN(werr);
2569                         break;
2570
2571                 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
2572
2573                         DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
2574                                  (unsigned)req10->extended_op));
2575                         return WERR_DS_DRA_NOT_SUPPORTED;
2576                 }
2577
2578                 /* Initialize the state we'll store over the replication cycle */
2579                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
2580                 if (getnc_state == NULL) {
2581                         return WERR_NOT_ENOUGH_MEMORY;
2582                 }
2583                 b_state->getncchanges_state = getnc_state;
2584
2585                 getnc_state->ncRoot_dn = ncRoot_dn;
2586                 talloc_steal(getnc_state, ncRoot_dn);
2587
2588                 getnc_state->ncRoot_guid = samdb_result_guid(res->msgs[0],
2589                                                              "objectGUID");
2590                 ncRoot->guid = getnc_state->ncRoot_guid;
2591
2592                 /* find out if we are to replicate Schema NC */
2593                 ret = ldb_dn_compare_base(ldb_get_schema_basedn(sam_ctx),
2594                                           ncRoot_dn);
2595                 getnc_state->is_schema_nc = (0 == ret);
2596
2597                 TALLOC_FREE(res);
2598         }
2599
2600         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
2601             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
2602                 DEBUG(0,(__location__ ": Bad DN '%s'\n",
2603                          drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
2604                 return WERR_DS_DRA_INVALID_PARAMETER;
2605         }
2606
2607         ncRoot->guid = getnc_state->ncRoot_guid;
2608
2609         /* we need the session key for encrypting password attributes */
2610         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
2611         if (!NT_STATUS_IS_OK(status)) {
2612                 DEBUG(0,(__location__ ": Failed to get session key\n"));
2613                 return WERR_DS_DRA_INTERNAL_ERROR;
2614         }
2615
2616         /*
2617            TODO: MS-DRSR section 4.1.10.1.1
2618            Work out if this is the start of a new cycle */
2619
2620         if (getnc_state->guids == NULL) {
2621                 const char *extra_filter;
2622                 struct ldb_result *search_res = NULL;
2623                 static const struct drsuapi_DsReplicaCursorCtrEx empty_udv;
2624                 const struct drsuapi_DsReplicaCursorCtrEx *udv = NULL;
2625
2626                 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
2627
2628                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2629                         if (req10->uptodateness_vector != NULL) {
2630                                 udv = req10->uptodateness_vector;
2631                         } else {
2632                                 udv = &empty_udv;
2633                         }
2634
2635                         getnc_state->min_usn = req10->highwatermark.highest_usn;
2636                         for (i = 0; i < udv->count; i++) {
2637                                 bool match;
2638                                 const struct drsuapi_DsReplicaCursor *cur =
2639                                         &udv->cursors[i];
2640
2641                                 match = GUID_equal(&invocation_id,
2642                                                    &cur->source_dsa_invocation_id);
2643                                 if (!match) {
2644                                         continue;
2645                                 }
2646                                 if (cur->highest_usn > getnc_state->min_usn) {
2647                                         getnc_state->min_usn = cur->highest_usn;
2648                                 }
2649                                 break;
2650                         }
2651                 } else {
2652                         /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
2653                         udv = &empty_udv;
2654                         getnc_state->min_usn = 0;
2655                 }
2656
2657                 getnc_state->max_usn = getnc_state->min_usn;
2658
2659                 getnc_state->final_udv = talloc_zero(getnc_state,
2660                                         struct drsuapi_DsReplicaCursor2CtrEx);
2661                 if (getnc_state->final_udv == NULL) {
2662                         return WERR_NOT_ENOUGH_MEMORY;
2663                 }
2664                 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
2665                                           getnc_state->final_udv);
2666                 if (!W_ERROR_IS_OK(werr)) {
2667                         return werr;
2668                 }
2669
2670                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2671                         werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
2672                                                             search_dn, extra_filter,
2673                                                             &search_res);
2674                 } else {
2675                         werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
2676                                                                  &r->out.ctr->ctr6,
2677                                                                  search_dn, extra_filter,
2678                                                                  &search_res);
2679                 }
2680                 W_ERROR_NOT_OK_RETURN(werr);
2681
2682                 /* extract out the GUIDs list */
2683                 getnc_state->num_records = search_res ? search_res->count : 0;
2684                 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
2685                 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
2686
2687                 changes = talloc_array(getnc_state,
2688                                        struct drsuapi_changed_objects,
2689                                        getnc_state->num_records);
2690                 W_ERROR_HAVE_NO_MEMORY(changes);
2691
2692                 for (i=0; i<getnc_state->num_records; i++) {
2693                         changes[i].dn = search_res->msgs[i]->dn;
2694                         changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
2695                         changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
2696
2697                         if (changes[i].usn > getnc_state->max_usn) {
2698                                 getnc_state->max_usn = changes[i].usn;
2699                         }
2700                 }
2701
2702                 /* RID_ALLOC returns 3 objects in a fixed order */
2703                 if (req10->extended_op == DRSUAPI_EXOP_FSMO_RID_ALLOC) {
2704                         /* Do nothing */
2705                 } else {
2706                         LDB_TYPESAFE_QSORT(changes,
2707                                            getnc_state->num_records,
2708                                            getnc_state,
2709                                            site_res_cmp_usn_order);
2710                 }
2711
2712                 for (i=0; i < getnc_state->num_records; i++) {
2713                         getnc_state->guids[i] = changes[i].guid;
2714                         if (GUID_all_zero(&getnc_state->guids[i])) {
2715                                 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
2716                                          ldb_dn_get_linearized(search_res->msgs[i]->dn)));
2717                                 return WERR_DS_DRA_INTERNAL_ERROR;
2718                         }
2719                 }
2720
2721                 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
2722                 getnc_state->final_hwm.reserved_usn = 0;
2723                 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
2724
2725                 talloc_free(search_res);
2726                 talloc_free(changes);
2727
2728                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2729                         /* Do nothing */
2730                 } else if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
2731                         getnc_state->obj_cache = db_open_rbt(getnc_state);
2732                         if (getnc_state->obj_cache == NULL) {
2733                                 return WERR_NOT_ENOUGH_MEMORY;
2734                         }
2735                         getnc_state->is_get_anc = true;
2736                 }
2737         }
2738
2739         if (req10->uptodateness_vector) {
2740                 /* make sure its sorted */
2741                 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
2742                                req10->uptodateness_vector->count,
2743                                drsuapi_DsReplicaCursor_compare);
2744         }
2745
2746         /* Prefix mapping */
2747         schema = dsdb_get_schema(sam_ctx, mem_ctx);
2748         if (!schema) {
2749                 DEBUG(0,("No schema in sam_ctx\n"));
2750                 return WERR_DS_DRA_INTERNAL_ERROR;
2751         }
2752
2753         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
2754         if (r->out.ctr->ctr6.naming_context == NULL) {
2755                 return WERR_NOT_ENOUGH_MEMORY;
2756         }
2757         *r->out.ctr->ctr6.naming_context = *ncRoot;
2758
2759         /* find the SID if there is one */
2760         dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
2761
2762         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
2763         r->out.ctr->ctr6.mapping_ctr = *ctr;
2764
2765         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2766         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2767
2768         r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
2769         r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
2770
2771         currentObject = &r->out.ctr->ctr6.first_object;
2772
2773         max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
2774         /*
2775          * The client control here only applies in normal replication, not extended
2776          * operations, which return a fixed set, even if the caller
2777          * sets max_object_count == 0
2778          */
2779         if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2780                 /* use this to force single objects at a time, which is useful
2781                  * for working out what object is giving problems
2782                  */
2783                 if (req10->max_object_count < max_objects) {
2784                         max_objects = req10->max_object_count;
2785                 }
2786         }
2787         /*
2788          * TODO: work out how the maximum should be calculated
2789          */
2790         max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
2791
2792         /*
2793          * Maximum time that we can spend in a getncchanges
2794          * in order to avoid timeout of the other part.
2795          * 10 seconds by default.
2796          */
2797         max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
2798
2799         if (req10->partial_attribute_set != NULL) {
2800                 struct dsdb_syntax_ctx syntax_ctx;
2801                 uint32_t j = 0;
2802
2803                 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
2804                 syntax_ctx.pfm_remote = pfm_remote;
2805
2806                 local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids);
2807
2808                 for (j = 0; j < req10->partial_attribute_set->num_attids; j++) {
2809                         getncchanges_attid_remote_to_local(schema,
2810                                                            &syntax_ctx,
2811                                                            req10->partial_attribute_set->attids[j],
2812                                                            (enum drsuapi_DsAttributeId *)&local_pas[j],
2813                                                            NULL);
2814                 }
2815
2816                 LDB_TYPESAFE_QSORT(local_pas,
2817                                    req10->partial_attribute_set->num_attids,
2818                                    NULL,
2819                                    uint32_t_ptr_cmp);
2820         }
2821
2822         for (i=getnc_state->num_processed;
2823              i<getnc_state->num_records &&
2824                      (r->out.ctr->ctr6.object_count < max_objects)
2825                      && !max_wait_reached;
2826             i++) {
2827                 struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
2828                 struct drsuapi_DsReplicaObjectListItemEx *obj;
2829                 struct ldb_message *msg;
2830                 static const char * const msg_attrs[] = {
2831                                             "*",
2832                                             "nTSecurityDescriptor",
2833                                             "parentGUID",
2834                                             "replPropertyMetaData",
2835                                             DSDB_SECRET_ATTRIBUTES,
2836                                             NULL };
2837                 struct ldb_result *msg_res;
2838                 struct ldb_dn *msg_dn;
2839
2840                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
2841                 W_ERROR_HAVE_NO_MEMORY(obj);
2842
2843                 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
2844                 W_ERROR_HAVE_NO_MEMORY(msg_dn);
2845
2846
2847                 /*
2848                  * by re-searching here we avoid having a lot of full
2849                  * records in memory between calls to getncchanges.
2850                  *
2851                  * We expect that we may get some objects that vanish
2852                  * (tombstone expunge) between the first and second
2853                  * check.
2854                  */
2855                 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
2856                                                       msg_dn,
2857                                                       LDB_SCOPE_BASE, msg_attrs, NULL);
2858                 if (ret != LDB_SUCCESS) {
2859                         if (ret != LDB_ERR_NO_SUCH_OBJECT) {
2860                                 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
2861                                          ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
2862                         }
2863                         talloc_free(obj);
2864                         continue;
2865                 }
2866
2867                 if (msg_res->count == 0) {
2868                         DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
2869                                  "to get any results in fetch of DN "
2870                                  "%s (race with tombstone expunge?)\n",
2871                                  ldb_dn_get_extended_linearized(obj,
2872                                                                 msg_dn, 1)));
2873                         talloc_free(obj);
2874                         continue;
2875                 }
2876
2877                 msg = msg_res->msgs[0];
2878
2879                 /*
2880                  * If it has already been added as an ancestor of
2881                  * an object, we don't need to do anything more
2882                  */
2883                 if (getnc_state->obj_cache != NULL) {
2884                         werr = dcesrv_drsuapi_obj_cache_exists(getnc_state->obj_cache,
2885                                                                &getnc_state->guids[i]);
2886                         if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2887                                 dcesrv_drsuapi_update_highwatermark(msg,
2888                                                 getnc_state->max_usn,
2889                                                 &r->out.ctr->ctr6.new_highwatermark);
2890
2891                                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2892                                                                 getnc_state->ncRoot_dn,
2893                                                                 getnc_state->is_schema_nc,
2894                                                                 schema, getnc_state->min_usn,
2895                                                                 req10->replica_flags,
2896                                                                 msg,
2897                                                                 &getnc_state->la_list,
2898                                                                 &getnc_state->la_count,
2899                                                                 req10->uptodateness_vector);
2900
2901                                 if (!W_ERROR_IS_OK(werr)) {
2902                                         return werr;
2903                                 }
2904
2905                                 /* no attributes to send */
2906                                 talloc_free(obj);
2907                                 continue;
2908                         }
2909                 }
2910
2911                 max_wait_reached = (time(NULL) - start > max_wait);
2912
2913                 werr = get_nc_changes_build_object(obj, msg,
2914                                                    sam_ctx, getnc_state->ncRoot_dn,
2915                                                    getnc_state->is_schema_nc,
2916                                                    schema, &session_key, getnc_state->min_usn,
2917                                                    req10->replica_flags,
2918                                                    req10->partial_attribute_set,
2919                                                    req10->uptodateness_vector,
2920                                                    req10->extended_op,
2921                                                    max_wait_reached,
2922                                                    local_pas, machine_dn,
2923                                                    &getnc_state->guids[i]);
2924                 if (!W_ERROR_IS_OK(werr)) {
2925                         return werr;
2926                 }
2927
2928                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2929                                                 getnc_state->ncRoot_dn,
2930                                                 getnc_state->is_schema_nc,
2931                                                 schema, getnc_state->min_usn,
2932                                                 req10->replica_flags,
2933                                                 msg,
2934                                                 &getnc_state->la_list,
2935                                                 &getnc_state->la_count,
2936                                                 req10->uptodateness_vector);
2937                 if (!W_ERROR_IS_OK(werr)) {
2938                         return werr;
2939                 }
2940
2941                 dcesrv_drsuapi_update_highwatermark(msg,
2942                                         getnc_state->max_usn,
2943                                         &r->out.ctr->ctr6.new_highwatermark);
2944
2945                 if (obj->meta_data_ctr == NULL) {
2946                         DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
2947                                  ldb_dn_get_linearized(msg->dn)));
2948                         /* no attributes to send */
2949                         talloc_free(obj);
2950                         continue;
2951                 }
2952
2953                 new_objs = obj;
2954
2955                 if (getnc_state->obj_cache != NULL) {
2956                         werr = dcesrv_drsuapi_obj_cache_add(getnc_state->obj_cache,
2957                                                             &getnc_state->guids[i]);
2958                         if (!W_ERROR_IS_OK(werr)) {
2959                                 return werr;
2960                         }
2961                 }
2962
2963                 /*
2964                  * For GET_ANC, prepend any parents that the client needs
2965                  * to know about before it can add this object
2966                  */
2967                 if (getnc_state->is_get_anc) {
2968                         werr = getncchanges_add_ancestors(obj, msg->dn, mem_ctx,
2969                                                           sam_ctx, getnc_state,
2970                                                           schema, &session_key,
2971                                                           req10, local_pas,
2972                                                           machine_dn,
2973                                                           &new_objs);
2974                         if (!W_ERROR_IS_OK(werr)) {
2975                                 return werr;
2976                         }
2977                 }
2978
2979                 *currentObject = new_objs;
2980                 while (new_objs != NULL) {
2981                         r->out.ctr->ctr6.object_count += 1;
2982                         if (new_objs->next_object == NULL) {
2983                                 currentObject = &new_objs->next_object;
2984                         }
2985                         new_objs = new_objs->next_object;
2986                 }
2987
2988                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
2989
2990                 talloc_free(getnc_state->last_dn);
2991                 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
2992
2993                 talloc_free(msg_res);
2994                 talloc_free(msg_dn);
2995         }
2996
2997         getnc_state->num_processed = i;
2998
2999         /* the client can us to call UpdateRefs on its behalf to
3000            re-establish monitoring of the NC */
3001         if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
3002             !GUID_all_zero(&req10->destination_dsa_guid)) {
3003                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
3004                 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
3005                          GUID_string(mem_ctx, &req10->destination_dsa_guid)));
3006                 ureq.naming_context = ncRoot;
3007                 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(sam_ctx, mem_ctx,
3008                                                                    &req10->destination_dsa_guid);
3009                 if (!ureq.dest_dsa_dns_name) {
3010                         return WERR_NOT_ENOUGH_MEMORY;
3011                 }
3012                 ureq.dest_dsa_guid = req10->destination_dsa_guid;
3013                 ureq.options = DRSUAPI_DRS_ADD_REF |
3014                         DRSUAPI_DRS_ASYNC_OP |
3015                         DRSUAPI_DRS_GETCHG_CHECK;
3016
3017                 /* we also need to pass through the
3018                    DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
3019                    to send notifies using the GC SPN */
3020                 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
3021
3022                 werr = drsuapi_UpdateRefs(dce_call->msg_ctx,
3023                                           dce_call->event_ctx, b_state,
3024                                           mem_ctx, &ureq);
3025                 if (!W_ERROR_IS_OK(werr)) {
3026                         DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
3027                                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
3028                                  win_errstr(werr)));
3029                 }
3030         }
3031
3032         /*
3033          * TODO:
3034          * This is just a guess, how to calculate the
3035          * number of linked attributes to send, we need to
3036          * find out how to do this right.
3037          */
3038         if (r->out.ctr->ctr6.object_count >= max_links) {
3039                 max_links = 0;
3040         } else {
3041                 max_links -= r->out.ctr->ctr6.object_count;
3042         }
3043
3044         link_total = getnc_state->la_count;
3045
3046         if (i < getnc_state->num_records) {
3047                 r->out.ctr->ctr6.more_data = true;
3048         } else {
3049                 /* sort the whole array the first time */
3050                 if (getnc_state->la_sorted == NULL) {
3051                         werr = getncchanges_get_sorted_array(getnc_state->la_list,
3052                                                              getnc_state->la_count,
3053                                                              sam_ctx, getnc_state,
3054                                                              schema,
3055                                                              &getnc_state->la_sorted);
3056                         if (!W_ERROR_IS_OK(werr)) {
3057                                 return werr;
3058                         }
3059                 }
3060
3061                 link_count = getnc_state->la_count - getnc_state->la_idx;
3062                 link_count = MIN(max_links, link_count);
3063
3064                 r->out.ctr->ctr6.linked_attributes_count = link_count;
3065                 r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
3066                 if (r->out.ctr->ctr6.linked_attributes == NULL) {
3067                         DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count));
3068                         return WERR_NOT_ENOUGH_MEMORY;
3069                 }
3070
3071                 for (k = 0; k < link_count; k++) {
3072                         r->out.ctr->ctr6.linked_attributes[k]
3073                                 = *getnc_state->la_sorted[getnc_state->la_idx + k].link;
3074                 }
3075
3076                 getnc_state->la_idx += link_count;
3077                 link_given = getnc_state->la_idx;
3078
3079                 if (getnc_state->la_idx < getnc_state->la_count) {
3080                         r->out.ctr->ctr6.more_data = true;
3081                 }
3082         }
3083
3084         if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
3085                 /*
3086                  * TODO: This implementation is wrong
3087                  * we should find out the total number of
3088                  * objects and links in the whole naming context
3089                  * at the start of the cycle and return these
3090                  * values in each message.
3091                  *
3092                  * For now we keep our current strategy and return
3093                  * the number of objects for this cycle and the number
3094                  * of links we found so far during the cycle.
3095                  */
3096                 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
3097                 r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->la_count;
3098         }
3099
3100         if (!r->out.ctr->ctr6.more_data) {
3101                 talloc_steal(mem_ctx, getnc_state->la_list);
3102
3103                 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
3104                 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
3105                                                         &getnc_state->final_udv);
3106
3107                 talloc_free(getnc_state);
3108                 b_state->getncchanges_state = NULL;
3109         } else {
3110                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
3111                                                          &r->out.ctr->ctr6.new_highwatermark);
3112                 if (ret == 0) {
3113                         /*
3114                          * We need to make sure that we never return the
3115                          * same highwatermark within the same replication
3116                          * cycle more than once. Otherwise we cannot detect
3117                          * when the client uses an unexptected highwatermark.
3118                          *
3119                          * This is a HACK which is needed because our
3120                          * object ordering is wrong and set tmp_highest_usn
3121                          * to a value that is higher than what we already
3122                          * sent to the client (destination dsa).
3123                          */
3124                         r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
3125                 }
3126
3127                 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
3128         }
3129
3130         if (req10->extended_op != DRSUAPI_EXOP_NONE) {
3131                 r->out.ctr->ctr6.uptodateness_vector = NULL;
3132                 r->out.ctr->ctr6.nc_object_count = 0;
3133                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
3134         }
3135
3136         DEBUG(r->out.ctr->ctr6.more_data?4:2,
3137               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
3138                (unsigned long long)(req10->highwatermark.highest_usn+1),
3139                req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
3140                r->out.ctr->ctr6.object_count,
3141                i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
3142                r->out.ctr->ctr6.linked_attributes_count,
3143                link_given, link_total,
3144                dom_sid_string(mem_ctx, user_sid)));
3145
3146 #if 0
3147         if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
3148                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
3149         }
3150 #endif
3151
3152         return WERR_OK;
3153 }