source4/dsdb/samdb/ldb_modules/dirsync.c

   1 /*
   2    SAMDB control module
   3
   4    Copyright (C) Matthieu Patou <mat@matws.net> 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20
  21 #include "includes.h"
  22 #include "ldb/include/ldb.h"
  23 #include "ldb/include/ldb_errors.h"
  24 #include "ldb/include/ldb_module.h"
  25 #include "libcli/security/security.h"
  26 #include "librpc/gen_ndr/drsblobs.h"
  27 #include "librpc/gen_ndr/ndr_drsblobs.h"
  28 #include "librpc/ndr/libndr.h"
  29 #include "dsdb/samdb/samdb.h"
  30 #include "dsdb/samdb/ldb_modules/util.h"
  31
  32 #define LDAP_DIRSYNC_OBJECT_SECURITY            0x01
  33 #define LDAP_DIRSYNC_ANCESTORS_FIRST_ORDER      0x800
  34 #define LDAP_DIRSYNC_PUBLIC_DATA_ONLY           0x2000
  35 #define LDAP_DIRSYNC_INCREMENTAL_VALUES         0x80000000
  36
  37
  38 struct dirsync_context {
  39         struct ldb_module *module;
  40         struct ldb_request *req;
  41
  42         /*
  43          * We keep a track of the number of attributes that we
  44          * add just for the need of the implementation
  45          * it will be usefull to track then entries that needs not to
  46          * be returned because there is no real change
  47          */
  48
  49         unsigned int nbDefaultAttrs;
  50         uint64_t highestUSN;
  51         uint64_t fromreqUSN;
  52         uint32_t cursor_size;
  53         bool noextended;
  54         bool linkIncrVal;
  55         bool localonly;
  56         bool partial;
  57         bool assystem;
  58         int functional_level;
  59         const struct GUID *our_invocation_id;
  60         const struct dsdb_schema *schema;
  61         struct ldb_dn *nc_root;
  62         struct drsuapi_DsReplicaCursor *cursors;
  63 };
  64
  65
  66 static int dirsync_filter_entry(struct ldb_request *req,
  67                                         struct ldb_message *msg,
  68                                         struct ldb_control **controls,
  69                                         struct dirsync_context *dsc,
  70                                         bool referral)
  71 {
  72         struct ldb_context *ldb;
  73         uint64_t val = 0;
  74         enum ndr_err_code ndr_err;
  75         uint32_t n;
  76         int i;
  77         unsigned int size, j;
  78         struct ldb_val *replMetaData = NULL;
  79         struct replPropertyMetaDataBlob rmd;
  80         const struct dsdb_attribute *attr;
  81         const char **listAttr = NULL;
  82         bool namereturned = false;
  83         bool nameasked = false;
  84         NTSTATUS status;
  85         /* Ajustment for the added attributes, it will reduce the number of
  86          * expected to be here attributes*/
  87         unsigned int delta = 0;
  88         const char **myaccept = NULL;
  89         const char *emptyaccept[] = { NULL };
  90         const char *extendedaccept[] = { "GUID", "SID", "WKGUID", NULL };
  91         const char *rdn = NULL;
  92         struct ldb_message_element *el;
  93         struct ldb_message *newmsg;
  94         bool keep = false;
  95         /*
  96          * Where we asked to do extended dn ?
  97          * if so filter out everything bug GUID, SID, WKGUID,
  98          * if not filter out everything (just keep the dn).
  99          */
 100         if ( dsc->noextended == true ) {
 101                 myaccept = emptyaccept;
 102         } else {
 103                 myaccept = extendedaccept;
 104         }
 105         ldb = ldb_module_get_ctx(dsc->module);
 106
 107         if (msg->num_elements == 0) {
 108                 /*
 109                         * Entry that we don't really have access to
 110                         */
 111                 return LDB_SUCCESS;
 112         }
 113         ldb_dn_extended_filter(msg->dn, myaccept);
 114
 115         /*
 116         * If the RDN starts with CN then the CN attribute is never returned
 117         */
 118         rdn = ldb_dn_get_rdn_name(msg->dn);
 119
 120         /*
 121          * if objectGUID is asked and we are dealing for the referrals entries and
 122          * the usn searched is 0 then we didn't count the objectGUID as an automatically
 123          * returned attribute, do to so we increament delta.
 124          */
 125         if (referral == true &&
 126                         ldb_attr_in_list(req->op.search.attrs, "objectGUID") &&
 127                         dsc->fromreqUSN == 0) {
 128                 delta++;
 129         }
 130
 131
 132         /*
 133          * In terms of big O notation this is not the best algorithm,
 134          * but we try our best not to make the worse one.
 135          * We are obliged to run through the n message's elements
 136          * and through the p elements of the replPropertyMetaData.
 137          *
 138          * It turns out that we are crawling twice the message's elements
 139          * the first crawl is to remove the non replicated and generated
 140          * attributes. The second one is to remove attributes that haven't
 141          * a USN > as the requested one.
 142          *
 143          * In the second crawl we are reading the list of elements in the
 144          * replPropertyMetaData for each remaining replicated attribute.
 145          * In order to keep the list small
 146          *
 147          * We have a O(n'*p') complexity, in worse case n' = n and p' = p
 148          * but in most case n' = n/2 (at least half of returned attributes
 149          * are not replicated or generated) and p' is small as we
 150          * list only the attribute that have been modified since last interogation
 151          *
 152          */
 153         newmsg = ldb_msg_new(dsc->req);
 154         if (newmsg == NULL) {
 155                 return ldb_oom(ldb);
 156         }
 157         for (i = msg->num_elements - 1; i >= 0; i--) {
 158                 if (ldb_attr_cmp(msg->elements[i].name, "uSNChanged") == 0) {
 159                         int error = 0;
 160                         /* Read the USN it will used at the end of the filtering
 161                          * to update the max USN in the cookie if we
 162                          * decide to keep this entry
 163                          */
 164                         val = strtoull_err(
 165                                 (const char*)msg->elements[i].values[0].data,
 166                                 NULL,
 167                                 0,
 168                                 &error);
 169                         if (error != 0) {
 170                                 ldb_set_errstring(ldb,
 171                                                   "Failed to convert USN");
 172                                 return ldb_module_done(dsc->req,
 173                                                        NULL,
 174                                                        NULL,
 175                                                        LDB_ERR_OPERATIONS_ERROR);
 176                         }
 177                         continue;
 178                 }
 179
 180                 if (ldb_attr_cmp(msg->elements[i].name,
 181                                                 "replPropertyMetaData") == 0) {
 182                         replMetaData = (talloc_steal(dsc, &msg->elements[i].values[0]));
 183                         continue;
 184                 }
 185         }
 186
 187         if (replMetaData == NULL) {
 188                 bool guidfound = false;
 189
 190                 /*
 191                  * We are in the case of deleted object where we don't have the
 192                  * right to read it.
 193                  */
 194                 if (!ldb_msg_find_attr_as_uint(msg, "isDeleted", 0)) {
 195                         /*
 196                          * This is not a deleted item and we don't
 197                          * have the replPropertyMetaData.
 198                          * Do not return it
 199                          */
 200                         return LDB_SUCCESS;
 201                 }
 202                 newmsg->dn = ldb_dn_new(newmsg, ldb, "");
 203                 if (newmsg->dn == NULL) {
 204                         return ldb_oom(ldb);
 205                 }
 206
 207                 el = ldb_msg_find_element(msg, "objectGUID");
 208                 if ( el != NULL) {
 209                         guidfound = true;
 210                 }
 211                 /*
 212                  * We expect to find the GUID in the object,
 213                  * if it turns out not to be the case sometime
 214                  * well will uncomment the code bellow
 215                  */
 216                 SMB_ASSERT(guidfound == true);
 217                 /*
 218                 if (guidfound == false) {
 219                         struct GUID guid;
 220                         struct ldb_val *new_val;
 221                         DATA_BLOB guid_blob;
 222
 223                         tmp[0] = '\0';
 224                         txt = strrchr(txt, ':');
 225                         if (txt == NULL) {
 226                                 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 227                         }
 228                         txt++;
 229
 230                         status = GUID_from_string(txt, &guid);
 231                         if (!NT_STATUS_IS_OK(status)) {
 232                                 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 233                         }
 234
 235                         status = GUID_to_ndr_blob(&guid, msg, &guid_blob);
 236                         if (!NT_STATUS_IS_OK(status)) {
 237                                 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 238                         }
 239
 240                         new_val = talloc(msg, struct ldb_val);
 241                         if (new_val == NULL) {
 242                                 return ldb_oom(ldb);
 243                         }
 244                         new_val->data = talloc_steal(new_val, guid_blob.data);
 245                         new_val->length = guid_blob.length;
 246                         if (ldb_msg_add_value(msg, "objectGUID", new_val, NULL) != 0) {
 247                                 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 248                         }
 249                 }
 250                 */
 251                 ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD);
 252                 talloc_steal(newmsg->elements, el->name);
 253                 talloc_steal(newmsg->elements, el->values);
 254
 255                 talloc_steal(newmsg->elements, msg);
 256                 return ldb_module_send_entry(dsc->req, msg, controls);
 257         }
 258
 259         ndr_err = ndr_pull_struct_blob(replMetaData, dsc, &rmd,
 260                 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 261         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 262                 ldb_set_errstring(ldb, "Unable to unmarshall replPropertyMetaData");
 263                 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 264         }
 265         if (ldb_attr_in_list(req->op.search.attrs, "name") ||
 266                         ldb_attr_in_list(req->op.search.attrs, "*")) {
 267                 nameasked = true;
 268         }
 269
 270         /*
 271                 * If we don't have an USN and no updateness array then we skip the
 272                 * test phase this is an optimisation for the case when you
 273                 * first query the DC without a cookie.
 274                 * As this query is most probably the one
 275                 * that will return the biggest answer, skipping this part
 276                 * will really save time.
 277                 */
 278         if (ldb_dn_compare(dsc->nc_root, msg->dn) == 0) {
 279                 /* If we have name then we expect to have parentGUID,
 280                  * it will not be the case for the root of the NC
 281                  */
 282                 delta++;
 283         }
 284
 285         if (dsc->fromreqUSN > 0 || dsc->cursors != NULL) {
 286                 j = 0;
 287                 /*
 288                 * Allocate an array of size(replMetaData) of char*
 289                 * we know that it will be oversized but it's a short lived element
 290                 */
 291                 listAttr = talloc_array(msg, const char*, rmd.ctr.ctr1.count + 1);
 292                 if (listAttr == NULL) {
 293                         return ldb_oom(ldb);
 294                 }
 295                 for (n=0; n < rmd.ctr.ctr1.count; n++) {
 296                         struct replPropertyMetaData1 *omd = &rmd.ctr.ctr1.array[n];
 297                         if (omd->local_usn > dsc->fromreqUSN) {
 298                                 const struct dsdb_attribute *a = dsdb_attribute_by_attributeID_id(dsc->schema,
 299                                                                                 omd->attid);
 300                                 if (!dsc->localonly) {
 301                                         struct drsuapi_DsReplicaCursor *tab = dsc->cursors;
 302                                         uint32_t l;
 303                                         for (l=0; l < dsc->cursor_size; l++) {
 304                                                 if (GUID_equal(&tab[l].source_dsa_invocation_id, &omd->originating_invocation_id) &&
 305                                                                 tab[l].highest_usn >= omd->originating_usn) {
 306                                                         /*
 307                                                          * If we have in the uptodateness vector an entry
 308                                                          * with the same invocation id as the originating invocation
 309                                                          * and if the usn in the vector is greater or equal to
 310                                                          * the one in originating_usn, then it means that this entry
 311                                                          * has already been sent (from another DC) to the client
 312                                                          * no need to resend it one more time.
 313                                                          */
 314                                                         goto skip;
 315                                                 }
 316                                         }
 317                                         /* If we are here it's because we have a usn > (max(usn of vectors))*/
 318                                 }
 319                                 if (namereturned == false &&
 320                                                 nameasked == true &&
 321                                                 ldb_attr_cmp(a->lDAPDisplayName, "name") == 0) {
 322                                         namereturned = true;
 323                                         if (ldb_dn_compare(dsc->nc_root, msg->dn) == 0) {
 324                                                 delta++;
 325                                         }
 326                                 }
 327                                 listAttr[j] = a->lDAPDisplayName;
 328                                 j++;
 329 skip:
 330                                 continue;
 331                         }
 332                 }
 333                 size = j;
 334         } else {
 335                 size = 0;
 336                 if (ldb_attr_in_list(req->op.search.attrs, "*") ||
 337                                 ldb_attr_in_list(req->op.search.attrs, "name")) {
 338                         namereturned = true;
 339                 }
 340         }
 341
 342
 343         /*
 344          * Let's loop around the remaining elements
 345          * to see which one are in the listAttr.
 346          * If they are in this array it means that
 347          * their localusn > usn from the request (in the cookie)
 348          * if not we remove the attribute.
 349          */
 350         for (i = msg->num_elements - 1; i >= 0; i--) {
 351                 const char *ldapattrname;
 352
 353                 el = &(msg->elements[i]);
 354                 ldapattrname = el->name;
 355
 356                 attr = dsdb_attribute_by_lDAPDisplayName(dsc->schema,
 357                                 el->name);
 358                 if (attr == NULL) {
 359                         continue;
 360                 }
 361
 362                 keep = false;
 363
 364                 if (attr->linkID & 1) {
 365                         /*
 366                          * Attribute is a backlink so let's remove it
 367                          */
 368                         continue;
 369                 }
 370
 371                 if (ldb_attr_cmp(msg->elements[i].name,
 372                                                 "replPropertyMetaData") == 0) {
 373                         continue;
 374                 }
 375
 376                 if ((attr->systemFlags & (DS_FLAG_ATTR_NOT_REPLICATED | DS_FLAG_ATTR_IS_CONSTRUCTED))) {
 377                         if (ldb_attr_cmp(attr->lDAPDisplayName, "objectGUID") != 0 &&
 378                                         ldb_attr_cmp(attr->lDAPDisplayName, "parentGUID") != 0) {
 379                                 /*
 380                                  * Attribute is constructed or not replicated, let's get rid of it
 381                                  */
 382                                 continue;
 383                         } else {
 384                                 /* Let's keep the attribute that we forced to be added
 385                                  * even if they are not in the replicationMetaData
 386                                  * or are just generated
 387                                  */
 388                                 if (namereturned == false &&
 389                                         (ldb_attr_cmp(attr->lDAPDisplayName, "parentGUID") == 0)) {
 390                                         delta++;
 391                                         continue;
 392                                 }
 393                                 if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
 394                                         return ldb_error(ldb,
 395                                                 LDB_ERR_OPERATIONS_ERROR,
 396                                                 "Unable to add attribute");
 397                                 }
 398                                 talloc_steal(newmsg->elements, el->name);
 399                                 talloc_steal(newmsg->elements, el->values);
 400                                 continue;
 401                         }
 402                 }
 403
 404                 if (ldb_attr_cmp(msg->elements[i].name, rdn) == 0) {
 405                         /*
 406                          * We have an attribute that is the same as the start of the RDN
 407                          * (ie. attribute CN with rdn CN=).
 408                          */
 409                         continue;
 410                 }
 411
 412                 if (ldb_attr_cmp(attr->lDAPDisplayName, "instanceType") == 0) {
 413                         if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
 414                                 return ldb_error(ldb,
 415                                                 LDB_ERR_OPERATIONS_ERROR,
 416                                                 "Unable to add attribute");
 417                         }
 418                         talloc_steal(newmsg->elements, el->name);
 419                         talloc_steal(newmsg->elements, el->values);
 420                         continue;
 421                 }
 422                 /* For links, when our functional level > windows 2000
 423                  * we use the RMD_LOCAL_USN information to decide whether
 424                  * we return the attribute or not.
 425                  * For windows 2000 this information is in the replPropertyMetaData
 426                  * so it will be handled like any other replicated attribute
 427                  */
 428
 429                 if (dsc->functional_level > DS_DOMAIN_FUNCTION_2000 &&
 430                                 attr->linkID != 0 ) {
 431                         int k;
 432                         /*
 433                          * Elements for incremental changes on linked attributes
 434                          */
 435                         struct ldb_message_element *el_incr_add = NULL;
 436                         struct ldb_message_element *el_incr_del = NULL;
 437                         /*
 438                          * Attribute is a forwardlink so let's remove it
 439                          */
 440
 441                         for (k = el->num_values -1; k >= 0; k--) {
 442                                 char *dn_ln;
 443                                 uint32_t flags = 0;
 444                                 uint32_t tmp_usn = 0;
 445                                 uint32_t tmp_usn2 = 0;
 446                                 struct GUID invocation_id = GUID_zero();
 447                                 struct dsdb_dn *dn = dsdb_dn_parse(msg, ldb, &el->values[k], attr->syntax->ldap_oid);
 448                                 struct ldb_dn *copydn;
 449                                 if (dn == NULL) {
 450                                         ldb_set_errstring(ldb, "Cannot parse DN");
 451                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 452                                 }
 453
 454                                 copydn = ldb_dn_copy(msg, dn->dn);
 455                                 if (copydn == NULL) {
 456                                         ldb_oom(ldb);
 457                                 }
 458
 459                                 status = dsdb_get_extended_dn_uint32(dn->dn, &tmp_usn, "RMD_LOCAL_USN");
 460                                 if (!NT_STATUS_IS_OK(status)) {
 461                                         talloc_free(dn);
 462                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 463                                 }
 464                                 status = dsdb_get_extended_dn_guid(dn->dn,  &invocation_id, "RMD_INVOCID");
 465                                 if (!NT_STATUS_IS_OK(status)) {
 466                                         talloc_free(dn);
 467                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 468                                 }
 469
 470                                 status = dsdb_get_extended_dn_uint32(dn->dn, &flags, "RMD_FLAGS");
 471                                 if (!NT_STATUS_IS_OK(status)) {
 472                                         talloc_free(dn);
 473                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 474                                 }
 475
 476                                 status = dsdb_get_extended_dn_uint32(dn->dn, &tmp_usn2, "RMD_ORIGINATING_USN");
 477                                 if (!NT_STATUS_IS_OK(status)) {
 478                                         talloc_free(dn);
 479                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 480                                 }
 481
 482                                 ldb_dn_extended_filter(dn->dn, myaccept);
 483                                 dn_ln = ldb_dn_get_extended_linearized(dn, dn->dn, 1);
 484                                 if (dn_ln == NULL)
 485                                 {
 486                                         talloc_free(dn);
 487                                         ldb_set_errstring(ldb, "Cannot linearize dn");
 488                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 489                                 }
 490
 491                                 talloc_free(el->values[k].data);
 492                                 el->values[k].data = (uint8_t*)talloc_steal(el->values, dn_ln);
 493                                 if (el->values[k].data == NULL) {
 494                                         talloc_free(dn);
 495                                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 496                                 }
 497                                 el->values[k].length = strlen(dn_ln);
 498
 499
 500                                 if (tmp_usn > dsc->fromreqUSN) {
 501                                         if (!dsc->localonly) {
 502                                                 struct drsuapi_DsReplicaCursor *tab = dsc->cursors;
 503                                                 uint32_t l;
 504
 505                                                 for (l=0; l < dsc->cursor_size; l++) {
 506                                                         if (GUID_equal(&tab[l].source_dsa_invocation_id, &invocation_id) &&
 507                                                                         tab[l].highest_usn >= tmp_usn2) {
 508                                                                 /*
 509                                                                 * If we have in the uptodateness vector an entry
 510                                                                 * with the same invocation id as the originating invocation
 511                                                                 * and if the usn in the vector is greater or equal to
 512                                                                 * the one in originating_usn, then it means that this entry
 513                                                                 * has already been sent (from another DC) to the client
 514                                                                 * no need to resend it one more time.
 515                                                                 */
 516                                                                 goto skip_link;
 517                                                         }
 518                                                 }
 519                                                 /* If we are here it's because we have a usn > (max(usn of vectors))*/
 520                                                 keep = true;
 521                                         } else {
 522                                                 keep = true;
 523                                         }
 524                                 /* If we are here it's because the link is more recent than either any
 525                                  * originating usn or local usn
 526                                  */
 527
 528                                         if (dsc->linkIncrVal == true) {
 529                                                 struct ldb_message_element *tmpel;
 530                                                 if (flags & DSDB_RMD_FLAG_DELETED) {
 531                                                         /* We have to check that the inactive link still point to an existing object */
 532                                                         struct GUID guid;
 533                                                         struct ldb_dn *tdn;
 534                                                         int ret;
 535
 536                                                         status = dsdb_get_extended_dn_guid(copydn, &guid, "GUID");
 537                                                         if (!NT_STATUS_IS_OK(status)) {
 538                                                                 DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 539                                                                         el->name, ldb_dn_get_linearized(copydn)));
 540                                                                 return ldb_operr(ldb);
 541                                                         }
 542                                                         ret = dsdb_module_dn_by_guid(dsc->module, newmsg, &guid, &tdn, req);
 543                                                         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 544                                                                 DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 545                                                                                         GUID_string(newmsg, &guid)));
 546                                                                 continue;
 547                                                         } else if (ret != LDB_SUCCESS) {
 548                                                                 DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 549                                                                                         GUID_string(newmsg, &guid),
 550                                                                                         ret));
 551                                                                 continue;
 552                                                         }
 553                                                         tmpel = el_incr_del;
 554                                                 } else {
 555                                                         tmpel = el_incr_add;
 556                                                 }
 557
 558                                                 if (tmpel == NULL) {
 559                                                         tmpel = talloc_zero(newmsg, struct ldb_message_element);
 560                                                         if (tmpel == NULL) {
 561                                                                 return ldb_oom(ldb);
 562                                                         }
 563                                                         tmpel->values = talloc_array(tmpel, struct ldb_val, 1);
 564                                                         if (tmpel->values == NULL) {
 565                                                                 return ldb_oom(ldb);
 566                                                         }
 567                                                         if (flags & DSDB_RMD_FLAG_DELETED) {
 568                                                                 tmpel->name = talloc_asprintf(tmpel,
 569                                                                                 "%s;range=0-0",
 570                                                                                 el->name);
 571                                                         }
 572                                                         else {
 573                                                                 tmpel->name = talloc_asprintf(tmpel,
 574                                                                                 "%s;range=1-1",
 575                                                                                 el->name);
 576                                                         }
 577                                                         if (tmpel->name == NULL) {
 578                                                                 return ldb_oom(ldb);
 579                                                         }
 580                                                         tmpel->num_values = 1;
 581                                                 } else {
 582                                                         tmpel->num_values += 1;
 583                                                         tmpel->values = talloc_realloc(tmpel,
 584                                                                                                 tmpel->values,
 585                                                                                                 struct ldb_val,
 586                                                                                                 tmpel->num_values);
 587                                                         if (tmpel->values == NULL) {
 588                                                                 return ldb_oom(ldb);
 589                                                         }
 590                                                 }
 591                                                 tmpel->values[tmpel->num_values -1].data =talloc_steal(tmpel->values, el->values[k].data);
 592                                                 tmpel->values[tmpel->num_values -1].length = el->values[k].length;
 593
 594                                                 if (flags & DSDB_RMD_FLAG_DELETED) {
 595                                                         el_incr_del = tmpel;
 596                                                 } else {
 597                                                         el_incr_add = tmpel;
 598                                                 }
 599                                         }
 600                                 }
 601
 602                                 if (dsc->linkIncrVal == false) {
 603                                         if (flags & DSDB_RMD_FLAG_DELETED) {
 604                                                 if (k < (el->num_values - 1)) {
 605                                                         memmove(el->values + k,
 606                                                                         el->values + (k + 1),
 607                                                                         ((el->num_values - 1) - k)*sizeof(*el->values));
 608                                                 }
 609                                                 el->num_values--;
 610                                         }
 611                                 }
 612 skip_link:
 613                                 talloc_free(dn);
 614
 615                         }
 616                         if (keep == true) {
 617                                 if (dsc->linkIncrVal == false) {
 618                                         if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
 619                                                 return ldb_error(ldb,
 620                                                         LDB_ERR_OPERATIONS_ERROR,
 621                                                         "Unable to add attribute");
 622                                         }
 623                                         talloc_steal(newmsg->elements, el->name);
 624                                         talloc_steal(newmsg->elements, el->values);
 625                                 } else {
 626                                         if (el_incr_del) {
 627                                                 if (ldb_msg_add(newmsg, el_incr_del, LDB_FLAG_MOD_ADD))
 628                                                         return ldb_error(ldb,
 629                                                                 LDB_ERR_OPERATIONS_ERROR,
 630                                                                 "Unable to add attribute");
 631                                         }
 632                                         if (el_incr_add) {
 633                                                 if (ldb_msg_add(newmsg, el_incr_add, LDB_FLAG_MOD_ADD))
 634                                                         return ldb_error(ldb,
 635                                                                 LDB_ERR_OPERATIONS_ERROR,
 636                                                                 "Unable to add attribute");
 637                                         }
 638                                 }
 639                         }
 640                         continue;
 641                 }
 642
 643                 if (listAttr) {
 644                         for (j=0; j<size; j++) {
 645                         /*
 646                                 * We mark attribute that has already been seen well
 647                                 * as seen. So that after attribute that are still in
 648                                 * listAttr are attributes that has been modified after
 649                                 * the requested USN but not present in the attributes
 650                                 * returned by the ldb search.
 651                                 * That is to say attributes that have been removed
 652                                 */
 653                                 if (listAttr[j] && ldb_attr_cmp(listAttr[j], ldapattrname) == 0) {
 654                                         listAttr[j] = NULL;
 655                                         keep = true;
 656                                         continue;
 657                                 }
 658                         }
 659                 } else {
 660                         keep = true;
 661                 }
 662
 663                 if (keep == true) {
 664                         if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
 665                                 return ldb_error(ldb,
 666                                         LDB_ERR_OPERATIONS_ERROR,
 667                                         "Unable to add attribute");
 668                         }
 669                         talloc_steal(newmsg->elements, el->name);
 670                         talloc_steal(newmsg->elements, el->values);
 671                         continue;
 672                 }
 673         }
 674         talloc_steal(newmsg->elements, msg);
 675
 676         /*
 677          * Here we run through the list of attributes returned
 678          * in the propertyMetaData.
 679          * Entries of this list have usn > requested_usn,
 680          * entries that are also present in the message have been
 681          * replaced by NULL, so at this moment the list contains
 682          * only elements that have a usn > requested_usn and that
 683          * haven't been seen. It's attributes that were removed.
 684          * We add them to the message like empty elements.
 685          */
 686         for (j=0; j<size; j++) {
 687                 if (listAttr[j] && (
 688                                 ldb_attr_in_list(req->op.search.attrs, "*") ||
 689                                 ldb_attr_in_list(req->op.search.attrs, listAttr[j])) &&
 690                                 (ldb_attr_cmp(listAttr[j], rdn) != 0) &&
 691                                 (ldb_attr_cmp(listAttr[j], "instanceType") != 0)) {
 692                         ldb_msg_add_empty(newmsg, listAttr[j], LDB_FLAG_MOD_DELETE, NULL);
 693                 }
 694         }
 695         talloc_free(listAttr);
 696
 697         if ((newmsg->num_elements - ( dsc->nbDefaultAttrs - delta)) > 0) {
 698                 /*
 699                  * After cleaning attributes there is still some attributes that were not added just
 700                  * for the purpose of the control (objectGUID, instanceType, ...)
 701                  */
 702
 703                 newmsg->dn = talloc_steal(newmsg, msg->dn);
 704                 if (val > dsc->highestUSN) {
 705                         dsc->highestUSN = val;
 706                 }
 707                 return ldb_module_send_entry(dsc->req, newmsg, controls);
 708         } else {
 709                 talloc_free(newmsg);
 710                 return LDB_SUCCESS;
 711         }
 712 }
 713
 714
 715 static int dirsync_create_vector(struct ldb_request *req,
 716                                         struct ldb_reply *ares,
 717                                         struct dirsync_context *dsc,
 718                                         struct ldapControlDirSyncCookie *cookie,
 719                                         struct ldb_context *ldb)
 720 {
 721         struct ldb_result *resVector;
 722         const char* attrVector[] = {"replUpToDateVector", NULL };
 723         uint64_t highest_usn;
 724         uint32_t count = 1;
 725         int ret;
 726         struct drsuapi_DsReplicaCursor *tab;
 727
 728         ret = ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &highest_usn);
 729         if (ret != LDB_SUCCESS) {
 730                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "Unable to get highest USN from current NC");
 731         }
 732
 733         /* If we have a full answer then the highest USN
 734          * is not the highest USN from the result set but the
 735          * highest of the naming context, unless the sequence is not updated yet.
 736          */
 737         if (highest_usn > dsc->highestUSN) {
 738                 dsc->highestUSN = highest_usn;
 739         }
 740
 741
 742         ret = dsdb_module_search_dn(dsc->module, dsc, &resVector,
 743                         dsc->nc_root,
 744                         attrVector,
 745                         DSDB_FLAG_NEXT_MODULE, req);
 746         if (ret != LDB_SUCCESS) {
 747                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
 748                                  "Unable to get replUpToDateVector for current NC");
 749         }
 750
 751         if (resVector->count != 0) {
 752                 DATA_BLOB blob;
 753                 uint32_t i;
 754                 struct ldb_message_element *el = ldb_msg_find_element(resVector->msgs[0], "replUpToDateVector");
 755                 if (el) {
 756                         enum ndr_err_code ndr_err;
 757                         struct replUpToDateVectorBlob utd;
 758                         blob.data = el->values[0].data;
 759                         blob.length = el->values[0].length;
 760                         ndr_err = ndr_pull_struct_blob(&blob, dsc, &utd,
 761                                                 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
 762
 763                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 764                                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
 765                                                 "Unable to pull replUpToDateVectorBlob structure");
 766                         }
 767
 768
 769                         count += utd.ctr.ctr2.count;
 770                         tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
 771                         if (tab == NULL) {
 772                                 return ldb_oom(ldb);
 773                         }
 774                         for (i=1; i < count; i++) {
 775                                 memset(&tab[i], 0, sizeof(struct drsuapi_DsReplicaCursor));
 776                                 tab[i].highest_usn = utd.ctr.ctr2.cursors[i-1].highest_usn;
 777                                 tab[i].source_dsa_invocation_id = utd.ctr.ctr2.cursors[i-1].source_dsa_invocation_id;
 778                         }
 779                 } else {
 780                         tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
 781                         if (tab == NULL) {
 782                                 return ldb_oom(ldb);
 783                         }
 784                 }
 785         } else {
 786                 /*
 787                  * No replUpToDateVector ? it happens quite often (1 DC,
 788                  * other DCs didn't update ...
 789                  */
 790                 tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
 791                 if (tab == NULL) {
 792                         return ldb_oom(ldb);
 793                 }
 794         }
 795         /* Our vector is always the first */
 796         tab[0].highest_usn = dsc->highestUSN;
 797         tab[0].source_dsa_invocation_id = *(dsc->our_invocation_id);
 798
 799
 800         /* We have to add the updateness vector that we have*/
 801         /* Version is always 1 in dirsync cookies */
 802         cookie->blob.extra.uptodateness_vector.version = 1;
 803         cookie->blob.extra.uptodateness_vector.reserved = 0;
 804         cookie->blob.extra.uptodateness_vector.ctr.ctr1.count = count;
 805         cookie->blob.extra.uptodateness_vector.ctr.ctr1.reserved = 0;
 806         cookie->blob.extra.uptodateness_vector.ctr.ctr1.cursors = tab;
 807
 808         return LDB_SUCCESS;
 809 }
 810
 811 static int dirsync_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 812 {
 813         int ret;
 814         struct dirsync_context *dsc;
 815         struct ldb_result *res, *res2;
 816         struct ldb_dirsync_control *control;
 817         struct ldapControlDirSyncCookie *cookie;
 818         struct ldb_context *ldb;
 819         struct ldb_dn *dn;
 820         struct ldb_val *val;
 821         DATA_BLOB *blob;
 822         NTTIME now;
 823         const char *attrs[] = { "objectGUID", NULL };
 824         enum ndr_err_code ndr_err;
 825         char *tmp;
 826         uint32_t flags;
 827
 828         dsc = talloc_get_type_abort(req->context, struct dirsync_context);
 829         ldb = ldb_module_get_ctx(dsc->module);
 830         if (!ares) {
 831                 return ldb_module_done(dsc->req, NULL, NULL,
 832                                        LDB_ERR_OPERATIONS_ERROR);
 833         }
 834         if (ares->error != LDB_SUCCESS) {
 835                 return ldb_module_done(dsc->req, ares->controls,
 836                                        ares->response, ares->error);
 837         }
 838
 839         switch (ares->type) {
 840         case LDB_REPLY_ENTRY:
 841                 return dirsync_filter_entry(req, ares->message, ares->controls, dsc, false);
 842
 843         case LDB_REPLY_REFERRAL:
 844                 /* Skip the ldap(s):// so up to 8 chars,
 845                  * we don't care to be precise as the goal is to be in
 846                  * the name of DC, then we search the next '/'
 847                  * as it will be the last char before the DN of the referal
 848                  */
 849                 if (strncmp(ares->referral, "ldap://", 7) == 0) {
 850                         tmp = ares->referral + 7;
 851                 } else if (strncmp(ares->referral, "ldaps://", 8) == 0) {
 852                         tmp = ares->referral + 8;
 853                 } else {
 854                         return ldb_operr(ldb);
 855                 }
 856
 857                 tmp = strchr(tmp, '/');
 858                 if (tmp == NULL) {
 859                         return ldb_operr(ldb);
 860                 }
 861                 tmp++;
 862
 863                 dn = ldb_dn_new(dsc, ldb, tmp);
 864                 if (dn == NULL) {
 865                         return ldb_oom(ldb);
 866                 }
 867
 868                 flags = DSDB_FLAG_NEXT_MODULE |
 869                         DSDB_SEARCH_SHOW_DELETED |
 870                         DSDB_SEARCH_SHOW_EXTENDED_DN;
 871
 872                 if (dsc->assystem) {
 873                         flags = flags | DSDB_FLAG_AS_SYSTEM;
 874                 }
 875
 876                 ret = dsdb_module_search_tree(dsc->module, dsc, &res,
 877                                         dn, LDB_SCOPE_BASE,
 878                                         req->op.search.tree,
 879                                         req->op.search.attrs,
 880                                         flags, req);
 881
 882                 if (ret != LDB_SUCCESS) {
 883                         talloc_free(dn);
 884                         return ret;
 885                 }
 886
 887                 if (res->count > 1) {
 888                         char *ldbmsg = talloc_asprintf(dn, "LDB returned more than result for dn: %s", tmp);
 889                         if (ldbmsg) {
 890                                 ldb_set_errstring(ldb, ldbmsg);
 891                         }
 892                         talloc_free(dn);
 893                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 894                 } else if (res->count == 0) {
 895                         /* if nothing is returned then it means that we don't
 896                         * have access to it.
 897                         */
 898                         return LDB_SUCCESS;
 899                 }
 900
 901                 talloc_free(dn);
 902                 /*
 903                  * Fetch the objectGUID of the root of current NC
 904                  */
 905                 ret = dsdb_module_search_dn(dsc->module, dsc, &res2,
 906                                         req->op.search.base,
 907                                         attrs,
 908                                         DSDB_FLAG_NEXT_MODULE, req);
 909
 910                 if (ret != LDB_SUCCESS) {
 911                         return ret;
 912                 }
 913                 if (res2->msgs[0]->num_elements != 1) {
 914                         ldb_set_errstring(ldb,
 915                                           "More than 1 attribute returned while looking for objectGUID");
 916                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 917                 }
 918
 919                 val = res2->msgs[0]->elements[0].values;
 920                 ret = ldb_msg_add_value(res->msgs[0], "parentGUID", val, NULL);
 921                 /*
 922                  * It *very* important to steal otherwise as val is in a subcontext
 923                  * related to res2, when the value will be one more time stolen
 924                  * it's elements[x].values that will be stolen, so it's important to
 925                  * recreate the context hierrachy as if it was done from a ldb_request
 926                  */
 927                 talloc_steal(res->msgs[0]->elements[0].values, val);
 928                 if (ret != LDB_SUCCESS) {
 929                         return ret;
 930                 }
 931                 return dirsync_filter_entry(req, res->msgs[0], res->controls, dsc, true);
 932
 933         case LDB_REPLY_DONE:
 934                 /*
 935                  * Let's add our own control
 936                  */
 937
 938                 control = talloc_zero(ares->controls, struct ldb_dirsync_control);
 939                 if (control == NULL) {
 940                         return ldb_oom(ldb);
 941                 }
 942
 943                 /*
 944                  * When outputing flags is used to say more results.
 945                  * For the moment we didn't honnor the size info */
 946
 947                 control->flags = 0;
 948
 949                 /*
 950                  * max_attribute is unused cf. 3.1.1.3.4.1.3 LDAP_SERVER_DIRSYNC_OID in MS-ADTS
 951                  */
 952
 953                 control->max_attributes = 0;
 954                 cookie = talloc_zero(control, struct ldapControlDirSyncCookie);
 955                 if (cookie == NULL) {
 956                         return ldb_oom(ldb);
 957                 }
 958
 959                 if (!dsc->partial) {
 960                         ret = dirsync_create_vector(req, ares, dsc, cookie, ldb);
 961                         if (ret != LDB_SUCCESS) {
 962                                 return ldb_module_done(dsc->req, NULL, NULL, ret);
 963                         }
 964                 }
 965
 966                 unix_to_nt_time(&now, time(NULL));
 967                 cookie->blob.time = now;
 968                 cookie->blob.highwatermark.highest_usn = dsc->highestUSN;
 969                 cookie->blob.highwatermark.tmp_highest_usn = dsc->highestUSN;
 970                 cookie->blob.guid1 = *(dsc->our_invocation_id);
 971
 972                 blob = talloc_zero(control, DATA_BLOB);
 973                 if (blob == NULL) {
 974                         return ldb_oom(ldb);
 975                 }
 976
 977                 ndr_err = ndr_push_struct_blob(blob, blob, cookie,
 978                                                 (ndr_push_flags_fn_t)ndr_push_ldapControlDirSyncCookie);
 979
 980                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 981                         ldb_set_errstring(ldb, "Can't marshall ldapControlDirSyncCookie struct");
 982                         return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 983                 }
 984                 control->cookie = (char *)blob->data;
 985                 control->cookie_len = blob->length;
 986                 ldb_reply_add_control(ares, LDB_CONTROL_DIRSYNC_OID, true, control);
 987
 988                 return ldb_module_done(dsc->req, ares->controls,
 989                                        ares->response, LDB_SUCCESS);
 990
 991         }
 992         return LDB_SUCCESS;
 993 }
 994
 995 static int dirsync_ldb_search(struct ldb_module *module, struct ldb_request *req)
 996 {
 997         struct ldb_control *control;
 998         struct ldb_result *acl_res;
 999         struct ldb_dirsync_control *dirsync_ctl;
1000         struct ldb_request *down_req;
1001         struct dirsync_context *dsc;
1002         struct ldb_context *ldb;
1003         struct ldb_parse_tree *new_tree = req->op.search.tree;
1004         uint32_t flags = 0;
1005         enum ndr_err_code ndr_err;
1006         DATA_BLOB blob;
1007         const char **attrs;
1008         int ret;
1009
1010
1011         if (ldb_dn_is_special(req->op.search.base)) {
1012                 return ldb_next_request(module, req);
1013         }
1014
1015         /*
1016          * check if there's an extended dn control
1017          */
1018         control = ldb_request_get_control(req, LDB_CONTROL_DIRSYNC_OID);
1019         if (control == NULL) {
1020                 /* not found go on */
1021                 return ldb_next_request(module, req);
1022         }
1023
1024         ldb = ldb_module_get_ctx(module);
1025         /*
1026          * This control must always be critical otherwise we return PROTOCOL error
1027          */
1028         if (!control->critical) {
1029                 return ldb_operr(ldb);
1030         }
1031
1032         dsc = talloc_zero(req, struct dirsync_context);
1033         if (dsc == NULL) {
1034                 return ldb_oom(ldb);
1035         }
1036         dsc->module = module;
1037         dsc->req = req;
1038         dsc->nbDefaultAttrs = 0;
1039
1040
1041         dirsync_ctl = talloc_get_type(control->data, struct ldb_dirsync_control);
1042         if (dirsync_ctl == NULL) {
1043                 return ldb_error(ldb, LDB_ERR_PROTOCOL_ERROR, "No data in dirsync control");
1044         }
1045
1046         ret = dsdb_find_nc_root(ldb, dsc, req->op.search.base, &dsc->nc_root);
1047         if (ret != LDB_SUCCESS) {
1048                 return ret;
1049         }
1050
1051         if (ldb_dn_compare(dsc->nc_root, req->op.search.base) != 0) {
1052                 if (dirsync_ctl->flags & LDAP_DIRSYNC_OBJECT_SECURITY) {
1053                         return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1054                                  "DN is not one of the naming context");
1055                 }
1056                 else {
1057                         return ldb_error(ldb, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS,
1058                                  "dN is not one of the naming context");
1059                 }
1060         }
1061
1062         if (!(dirsync_ctl->flags & LDAP_DIRSYNC_OBJECT_SECURITY)) {
1063                 struct dom_sid *sid;
1064                 struct security_descriptor *sd = NULL;
1065                 const char *acl_attrs[] = { "nTSecurityDescriptor", "objectSid", NULL };
1066                 /*
1067                  * If we don't have the flag and if we have the "replicate directory change" granted
1068                  * then we upgrade ourself to system to not be blocked by the acl
1069                  */
1070                 /* FIXME we won't check the replicate directory change filtered attribute set
1071                  * it should be done so that if attr is not empty then we check that the user
1072                  * has also this right
1073                  */
1074
1075                 /*
1076                  * First change to system to get the SD of the root of current NC
1077                  * if we don't the acl_read will forbid us the right to read it ...
1078                  */
1079                 ret = dsdb_module_search_dn(module, dsc, &acl_res,
1080                                         req->op.search.base,
1081                                         acl_attrs,
1082                                         DSDB_FLAG_NEXT_MODULE|DSDB_FLAG_AS_SYSTEM, req);
1083
1084                 if (ret != LDB_SUCCESS) {
1085                         return ret;
1086                 }
1087
1088                 sid = samdb_result_dom_sid(dsc, acl_res->msgs[0], "objectSid");
1089                 /* sid can be null ... */
1090                 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), acl_res, acl_res->msgs[0], &sd);
1091
1092                 if (ret != LDB_SUCCESS) {
1093                         return ret;
1094                 }
1095                 ret = acl_check_extended_right(dsc, sd, acl_user_token(module), GUID_DRS_GET_CHANGES, SEC_ADS_CONTROL_ACCESS, sid);
1096
1097                 if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
1098                         return ret;
1099                 }
1100                 dsc->assystem = true;
1101                 ret = ldb_request_add_control(req, LDB_CONTROL_AS_SYSTEM_OID, false, NULL);
1102
1103                 if (ret != LDB_SUCCESS) {
1104                         return ret;
1105                 }
1106                 talloc_free(acl_res);
1107         } else {
1108                 flags |= DSDB_ACL_CHECKS_DIRSYNC_FLAG;
1109
1110                 if (ret != LDB_SUCCESS) {
1111                         return ret;
1112                 }
1113
1114         }
1115
1116         dsc->functional_level = dsdb_functional_level(ldb);
1117
1118         if (req->op.search.attrs) {
1119                 attrs = ldb_attr_list_copy(dsc, req->op.search.attrs);
1120                 if (attrs == NULL) {
1121                         return ldb_oom(ldb);
1122                 }
1123                 /*
1124                 * Check if we have only "dn" as attribute, if so then
1125                 * treat as if "*" was requested
1126                 */
1127                 if (attrs && attrs[0]) {
1128                         if (ldb_attr_cmp(attrs[0], "dn") == 0 && !attrs[1]) {
1129                                 attrs = talloc_array(dsc, const char*, 2);
1130                                 if (attrs == NULL) {
1131                                         return ldb_oom(ldb);
1132                                 }
1133                                 attrs[0] = "*";
1134                                 attrs[1] = NULL;
1135                         }
1136                 }
1137                 /*
1138                  * When returning all the attributes return also the SD as
1139                  * Windws do so.
1140                  */
1141                 if (ldb_attr_in_list(attrs, "*")) {
1142                         struct ldb_sd_flags_control *sdctr = talloc_zero(dsc, struct ldb_sd_flags_control);
1143                         sdctr->secinfo_flags = 0xF;
1144                         ret = ldb_request_add_control(req, LDB_CONTROL_SD_FLAGS_OID, false, sdctr);
1145                         if (ret != LDB_SUCCESS) {
1146                                 return ret;
1147                         }
1148                         attrs = ldb_attr_list_copy_add(dsc, attrs, "parentGUID");
1149                         if (attrs == NULL) {
1150                                 return ldb_oom(ldb);
1151                         }
1152                         attrs = ldb_attr_list_copy_add(dsc, attrs, "replPropertyMetaData");
1153                         if (attrs == NULL) {
1154                                 return ldb_oom(ldb);
1155                         }
1156                         /*
1157                         * When no attributes are asked we in anycase expect at least 3 attributes:
1158                         * * instanceType
1159                         * * objectGUID
1160                         * * parentGUID
1161                         */
1162
1163                         dsc->nbDefaultAttrs = 3;
1164                 } else {
1165                         /*
1166                          * We will need this two attributes in the callback
1167                          */
1168                         attrs = ldb_attr_list_copy_add(dsc, attrs, "usnChanged");
1169                         if (attrs == NULL) {
1170                                 return ldb_operr(ldb);
1171                         }
1172                         attrs = ldb_attr_list_copy_add(dsc, attrs, "replPropertyMetaData");
1173                         if (attrs == NULL) {
1174                                 return ldb_operr(ldb);
1175                         }
1176
1177                         if (!ldb_attr_in_list(attrs, "instanceType")) {
1178                                 attrs = ldb_attr_list_copy_add(dsc, attrs, "instanceType");
1179                                 if (attrs == NULL) {
1180                                         return ldb_operr(ldb);
1181                                 }
1182                                 dsc->nbDefaultAttrs++;
1183                         }
1184
1185                         if (!ldb_attr_in_list(attrs, "objectGUID")) {
1186                                 attrs = ldb_attr_list_copy_add(dsc, attrs, "objectGUID");
1187                                 if (attrs == NULL) {
1188                                         return ldb_operr(ldb);
1189                                 }
1190                         }
1191                         /*
1192                          * Always increment the number of asked attributes as we don't care if objectGUID was asked
1193                          * or not for counting the number of "real" attributes returned.
1194                          */
1195                         dsc->nbDefaultAttrs++;
1196
1197                         if (!ldb_attr_in_list(attrs, "parentGUID")) {
1198                                 attrs = ldb_attr_list_copy_add(dsc, attrs, "parentGUID");
1199                                 if (attrs == NULL) {
1200                                         return ldb_operr(ldb);
1201                                 }
1202                         }
1203                         dsc->nbDefaultAttrs++;
1204
1205                 }
1206         } else {
1207                 struct ldb_sd_flags_control *sdctr = talloc_zero(dsc, struct ldb_sd_flags_control);
1208                 sdctr->secinfo_flags = 0xF;
1209                 ret = ldb_request_add_control(req, LDB_CONTROL_SD_FLAGS_OID, false, sdctr);
1210                 attrs = talloc_array(dsc, const char*, 4);
1211                 if (attrs == NULL) {
1212                         return ldb_operr(ldb);
1213                 }
1214                 attrs[0] = "*";
1215                 attrs[1] = "parentGUID";
1216                 attrs[2] = "replPropertyMetaData";
1217                 attrs[3] = NULL;
1218                 if (ret != LDB_SUCCESS) {
1219                         return ret;
1220                 }
1221                 /*
1222                  * When no attributes are asked we in anycase expect at least 3 attributes:
1223                  * * instanceType
1224                  * * objectGUID
1225                  * * parentGUID
1226                  */
1227
1228                 dsc->nbDefaultAttrs = 3;
1229         }
1230
1231         if (!ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID)) {
1232                 ret = ldb_request_add_control(req, LDB_CONTROL_EXTENDED_DN_OID, false, NULL);
1233                 if (ret != LDB_SUCCESS) {
1234                         return ret;
1235                 }
1236                 dsc->noextended = true;
1237         }
1238
1239         if (ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS) == NULL) {
1240                 ret = ldb_request_add_control(req, LDB_CONTROL_REVEAL_INTERNALS, false, NULL);
1241                 if (ret != LDB_SUCCESS) {
1242                         return ret;
1243                 }
1244         }
1245
1246         if (ldb_request_get_control(req, LDB_CONTROL_SHOW_RECYCLED_OID) == NULL) {
1247                 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_RECYCLED_OID, false, NULL);
1248                 if (ret != LDB_SUCCESS) {
1249                         return ret;
1250                 }
1251         }
1252
1253         if (ldb_request_get_control(req, LDB_CONTROL_SHOW_DELETED_OID) == NULL) {
1254                 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, false, NULL);
1255                 if (ret != LDB_SUCCESS) {
1256                         return ret;
1257                 }
1258         }
1259
1260         if (dirsync_ctl->flags & LDAP_DIRSYNC_INCREMENTAL_VALUES) {
1261                 dsc->linkIncrVal = true;
1262         } else {
1263                 dsc->linkIncrVal = false;
1264         }
1265
1266         dsc->our_invocation_id = samdb_ntds_invocation_id(ldb);
1267         if (dsc->our_invocation_id == NULL) {
1268                 return ldb_operr(ldb);
1269         }
1270
1271         if (dirsync_ctl->cookie_len > 0) {
1272                 struct ldapControlDirSyncCookie cookie;
1273
1274                 blob.data = (uint8_t *)dirsync_ctl->cookie;
1275                 blob.length = dirsync_ctl->cookie_len;
1276                 ndr_err = ndr_pull_struct_blob(&blob, dsc, &cookie,
1277                                                 (ndr_pull_flags_fn_t)ndr_pull_ldapControlDirSyncCookie);
1278
1279                 /* If we can't unmarshall the cookie into the correct structure we return
1280                 * unsupported critical extension
1281                 */
1282                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1283                         return ldb_error(ldb, LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION,
1284                                          "Unable to unmarshall cookie as a ldapControlDirSyncCookie structure");
1285                 }
1286
1287                 /*
1288                 * Let's search for the max usn withing the cookie
1289                 */
1290                 if (GUID_equal(&(cookie.blob.guid1), dsc->our_invocation_id)) {
1291                         /*
1292                          * Ok, it's our invocation ID so we can treat the demand
1293                          * Let's take the highest usn from (tmp)highest_usn
1294                          */
1295                         dsc->fromreqUSN = cookie.blob.highwatermark.tmp_highest_usn;
1296                         dsc->localonly = true;
1297
1298                         if (cookie.blob.highwatermark.highest_usn > cookie.blob.highwatermark.tmp_highest_usn) {
1299                                 dsc->fromreqUSN = cookie.blob.highwatermark.highest_usn;
1300                         }
1301                 } else {
1302                         dsc->localonly = false;
1303                 }
1304                 if (cookie.blob.extra_length > 0 &&
1305                                 cookie.blob.extra.uptodateness_vector.ctr.ctr1.count > 0) {
1306                         struct drsuapi_DsReplicaCursor cursor;
1307                         uint32_t p;
1308                         for (p=0; p < cookie.blob.extra.uptodateness_vector.ctr.ctr1.count; p++) {
1309                                 cursor = cookie.blob.extra.uptodateness_vector.ctr.ctr1.cursors[p];
1310                                 if (GUID_equal( &(cursor.source_dsa_invocation_id), dsc->our_invocation_id)) {
1311                                         if (cursor.highest_usn > dsc->fromreqUSN) {
1312                                                 dsc->fromreqUSN = cursor.highest_usn;
1313                                         }
1314                                 }
1315                         }
1316                         dsc->cursors = talloc_steal(dsc,
1317                                         cookie.blob.extra.uptodateness_vector.ctr.ctr1.cursors);
1318                         if (dsc->cursors == NULL) {
1319                                 return ldb_oom(ldb);
1320                         }
1321                         dsc->cursor_size = p;
1322                 }
1323         }
1324
1325         DEBUG(4, ("Dirsync: searching with min usn > %llu\n",
1326                                 (long long unsigned int)dsc->fromreqUSN));
1327         if (dsc->fromreqUSN > 0) {
1328                 /* FIXME it would be better to use PRId64 */
1329                 char *expression = talloc_asprintf(dsc, "(&%s(uSNChanged>=%llu))",
1330                                                         ldb_filter_from_tree(dsc,
1331                                                              req->op.search.tree),
1332                                                         (long long unsigned int)(dsc->fromreqUSN + 1));
1333
1334                 if (expression == NULL) {
1335                         return ldb_oom(ldb);
1336                 }
1337                 new_tree = ldb_parse_tree(req, expression);
1338                 if (new_tree == NULL) {
1339                         return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
1340                                         "Problem while parsing tree");
1341                 }
1342
1343         }
1344         /*
1345          * Remove our control from the list of controls
1346          */
1347         if (!ldb_save_controls(control, req, NULL)) {
1348                 return ldb_operr(ldb);
1349         }
1350         dsc->schema = dsdb_get_schema(ldb, dsc);
1351         /*
1352          * At the begining we make the hypothesis that we will return a complete
1353          * result set
1354          */
1355
1356         dsc->partial = false;
1357
1358         /*
1359          * 3.1.1.3.4.1.3 of MS-ADTS.pdf specify that if the scope is not subtree
1360          * we treat the search as if subtree was specified
1361          */
1362
1363         ret = ldb_build_search_req_ex(&down_req, ldb, dsc,
1364                                       req->op.search.base,
1365                                       LDB_SCOPE_SUBTREE,
1366                                       new_tree,
1367                                       attrs,
1368                                       req->controls,
1369                                       dsc, dirsync_search_callback,
1370                                       req);
1371         ldb_req_set_custom_flags(down_req, flags);
1372         LDB_REQ_SET_LOCATION(down_req);
1373         if (ret != LDB_SUCCESS) {
1374                 return ret;
1375         }
1376         /* perform the search */
1377         return ldb_next_request(module, down_req);
1378 }
1379
1380 static int dirsync_ldb_init(struct ldb_module *module)
1381 {
1382         int ret;
1383
1384         ret = ldb_mod_register_control(module, LDB_CONTROL_DIRSYNC_OID);
1385         if (ret != LDB_SUCCESS) {
1386                 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
1387                         "dirsync: Unable to register control with rootdse!\n");
1388                 return ldb_operr(ldb_module_get_ctx(module));
1389         }
1390
1391         return ldb_next_init(module);
1392 }
1393
1394 static const struct ldb_module_ops ldb_dirsync_ldb_module_ops = {
1395         .name              = "dirsync",
1396         .search            = dirsync_ldb_search,
1397         .init_context      = dirsync_ldb_init,
1398 };
1399
1400 /*
1401   initialise the module
1402  */
1403 _PUBLIC_ int ldb_dirsync_module_init(const char *version)
1404 {
1405         int ret;
1406         LDB_MODULE_CHECK_VERSION(version);
1407         ret = ldb_register_module(&ldb_dirsync_ldb_module_ops);
1408         return ret;
1409 }