source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpc_server/dcerpc_server.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "param/param.h"
  27 #include "librpc/gen_ndr/ndr_drsblobs.h"
  28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  29 #include "rpc_server/dcerpc_server_proto.h"
  30 #include "../libcli/drsuapi/drsuapi.h"
  31 #include "libcli/security/security.h"
  32
  33 /*
  34   drsuapi_DsGetNCChanges for one object
  35 */
  36 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
  37                                           struct ldb_message *msg,
  38                                           struct ldb_context *sam_ctx,
  39                                           struct ldb_dn *ncRoot_dn,
  40                                           struct dsdb_schema *schema,
  41                                           DATA_BLOB *session_key,
  42                                           uint64_t highest_usn,
  43                                           uint32_t replica_flags)
  44 {
  45         const struct ldb_val *md_value;
  46         int i, n;
  47         struct ldb_dn *obj_dn;
  48         struct replPropertyMetaDataBlob md;
  49         struct dom_sid *sid;
  50         uint32_t rid = 0;
  51         enum ndr_err_code ndr_err;
  52         uint32_t *attids;
  53         const char *rdn;
  54         const struct dsdb_attribute *rdn_sa;
  55
  56         if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
  57                 obj->is_nc_prefix = true;
  58                 obj->parent_object_guid = NULL;
  59         } else {
  60                 obj->is_nc_prefix = false;
  61                 obj->parent_object_guid = talloc(obj, struct GUID);
  62                 if (obj->parent_object_guid == NULL) {
  63                         return WERR_DS_DRA_INTERNAL_ERROR;
  64                 }
  65                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
  66                 if (GUID_all_zero(obj->parent_object_guid)) {
  67                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
  68                                  ldb_dn_get_linearized(msg->dn)));
  69                         return WERR_DS_DRA_INTERNAL_ERROR;
  70                 }
  71         }
  72         obj->next_object = NULL;
  73
  74         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
  75         if (!md_value) {
  76                 /* nothing to send */
  77                 return WERR_OK;
  78         }
  79
  80         ndr_err = ndr_pull_struct_blob(md_value, obj,
  81                                        lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
  82                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
  83         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  84                 return WERR_DS_DRA_INTERNAL_ERROR;
  85         }
  86
  87         if (md.version != 1) {
  88                 return WERR_DS_DRA_INTERNAL_ERROR;
  89         }
  90
  91         rdn = ldb_dn_get_rdn_name(msg->dn);
  92         if (rdn == NULL) {
  93                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
  94                 return WERR_DS_DRA_INTERNAL_ERROR;
  95         }
  96
  97         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
  98         if (rdn_sa == NULL) {
  99                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 100                          rdn, ldb_dn_get_linearized(msg->dn)));
 101                 return WERR_DS_DRA_INTERNAL_ERROR;
 102         }
 103
 104         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 105         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 106
 107         obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
 108         obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
 109         obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
 110         obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
 111         sid = samdb_result_dom_sid(obj, msg, "objectSid");
 112         if (sid) {
 113                 dom_sid_split_rid(NULL, sid, NULL, &rid);
 114                 obj->object.identifier->sid = *sid;
 115         } else {
 116                 ZERO_STRUCT(obj->object.identifier->sid);
 117         }
 118
 119         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 120         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 121                 /* if the attribute has not changed, and it is not the
 122                    instanceType then don't include it */
 123                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 124                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
 125
 126                 /* don't include the rDN */
 127                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 128
 129                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 130                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 131                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 132                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 133                 attids[n] = md.ctr.ctr1.array[i].attid;
 134                 n++;
 135         }
 136
 137         /*
 138           note that if n==0 we still need to send the change, as it
 139           could be a rename, which changes the uSNChanged, but not any
 140           of the replicated attributes
 141          */
 142
 143         obj->meta_data_ctr->count = n;
 144
 145         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 146         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 147         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 148                                                             obj->object.attribute_ctr.num_attributes);
 149
 150         /*
 151          * Note that the meta_data array and the attributes array must
 152          * be the same size and in the same order
 153          */
 154         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 155                 struct ldb_message_element *el;
 156                 WERROR werr;
 157                 const struct dsdb_attribute *sa;
 158
 159                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 160                 if (!sa) {
 161                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 162                         return WERR_DS_DRA_INTERNAL_ERROR;
 163                 }
 164
 165                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 166                 if (el == NULL) {
 167                         /* this happens for attributes that have been removed */
 168                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 169                                  sa->lDAPDisplayName, attids[i]));
 170                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 171                         obj->object.attribute_ctr.attributes[i].attid = attids[i];
 172                 } else {
 173                         werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
 174                                                              &obj->object.attribute_ctr.attributes[i]);
 175                         if (!W_ERROR_IS_OK(werr)) {
 176                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
 177                                          sa->lDAPDisplayName, win_errstr(werr)));
 178                                 return werr;
 179                         }
 180                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 181                          * check if attribute is secret and send a null value
 182                          */
 183                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 184                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 185                                                                  &obj->meta_data_ctr->meta_data[i]);
 186                         }
 187                         /* some attributes needs to be encrypted
 188                            before being sent */
 189                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 190                                                          &obj->object.attribute_ctr.attributes[i]);
 191                         if (!W_ERROR_IS_OK(werr)) {
 192                                 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
 193                                          sa->lDAPDisplayName, win_errstr(werr)));
 194                                 return werr;
 195                         }
 196                 }
 197         }
 198
 199         return WERR_OK;
 200 }
 201
 202 /*
 203   load replUpToDateVector from a DN
 204  */
 205 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 206                        struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
 207 {
 208         const char *attrs[] = { "replUpToDateVector", NULL };
 209         struct ldb_result *res = NULL;
 210         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 211         struct ldb_message_element *el;
 212         enum ndr_err_code ndr_err;
 213
 214         ZERO_STRUCTP(ouv);
 215
 216         if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
 217             res->count < 1) {
 218                 DEBUG(0,("load_udv: failed to read partition object\n"));
 219                 talloc_free(tmp_ctx);
 220                 return WERR_DS_DRA_INTERNAL_ERROR;
 221         }
 222
 223         el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
 224         if (el == NULL || el->num_values < 1) {
 225                 talloc_free(tmp_ctx);
 226                 ouv->version = 2;
 227                 return WERR_OK;
 228         }
 229
 230         ndr_err = ndr_pull_struct_blob(&el->values[0],
 231                                        mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
 232                                        ouv,
 233                                        (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
 234         talloc_free(tmp_ctx);
 235         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 236                 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
 237                          ldb_dn_get_linearized(dn)));
 238                 return WERR_DS_DRA_INTERNAL_ERROR;
 239         }
 240
 241         return WERR_OK;
 242
 243 }
 244
 245 /*
 246   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 247  */
 248 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 249                                  struct ldb_dn *ncRoot_dn,
 250                                  struct drsuapi_DsReplicaCursor2CtrEx *udv,
 251                                  uint64_t highestUSN)
 252 {
 253         WERROR werr;
 254         struct drsuapi_DsReplicaCursor2 *tmp_cursor;
 255         NTTIME now;
 256         time_t t = time(NULL);
 257         struct replUpToDateVectorBlob ouv;
 258
 259         werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
 260         if (!W_ERROR_IS_OK(werr)) {
 261                 return werr;
 262         }
 263
 264         tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
 265         tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
 266         tmp_cursor->highest_usn = highestUSN;
 267         unix_to_nt_time(&now, t);
 268         tmp_cursor->last_sync_success = now;
 269
 270         udv->count = ouv.ctr.ctr2.count + 1;
 271         udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
 272         udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
 273         if (!udv->cursors) {
 274                 return WERR_DS_DRA_INTERNAL_ERROR;
 275         }
 276         udv->cursors[udv->count - 1] = *tmp_cursor;
 277
 278         qsort(udv->cursors, udv->count,
 279               sizeof(struct drsuapi_DsReplicaCursor2),
 280               (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
 281
 282         return WERR_OK;
 283 }
 284
 285 /* state of a partially completed getncchanges call */
 286 struct drsuapi_getncchanges_state {
 287         struct ldb_result *site_res;
 288         uint32_t num_sent;
 289         struct ldb_dn *ncRoot_dn;
 290         uint64_t min_usn;
 291         uint64_t highest_usn;
 292 };
 293
 294 /*
 295   drsuapi_DsGetNCChanges
 296
 297   see MS-DRSR 4.1.10.5.2 for basic logic of this function
 298 */
 299 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 300                                      struct drsuapi_DsGetNCChanges *r)
 301 {
 302         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
 303         int ret;
 304         int i;
 305         struct dsdb_schema *schema;
 306         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
 307         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
 308         NTSTATUS status;
 309         DATA_BLOB session_key;
 310         const char *attrs[] = { "*", "distinguishedName",
 311                                 "ntSecurityDescriptor",
 312                                 "replPropertyMetaData",
 313                                 "lmPwdHistory",
 314                                 "ntPwdHistory",
 315                                 "supplementalCredentials",
 316                                 "unicodePwd",
 317                                 "parentGUID",
 318                                 NULL };
 319         WERROR werr;
 320         struct dcesrv_handle *h;
 321         struct drsuapi_bind_state *b_state;
 322         struct drsuapi_getncchanges_state *getnc_state;
 323         struct drsuapi_DsGetNCChangesRequest8 *req8;
 324         uint32_t options;
 325
 326         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 327         b_state = h->data;
 328
 329         *r->out.level_out = 6;
 330         /* TODO: linked attributes*/
 331         r->out.ctr->ctr6.linked_attributes_count = 0;
 332         r->out.ctr->ctr6.linked_attributes = NULL;
 333
 334         r->out.ctr->ctr6.object_count = 0;
 335         r->out.ctr->ctr6.nc_object_count = 0;
 336         r->out.ctr->ctr6.more_data = false;
 337         r->out.ctr->ctr6.uptodateness_vector = NULL;
 338
 339         /* a RODC doesn't allow for any replication */
 340         if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
 341                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
 342                 return WERR_DS_DRA_SOURCE_DISABLED;
 343         }
 344
 345         /* Check request revision.
 346            TODO: Adding mappings to req8 from the other levels
 347          */
 348         if (r->in.level != 8) {
 349                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
 350                          r->in.level));
 351                 return WERR_REVISION_MISMATCH;
 352         }
 353
 354         req8 = &r->in.req->req8;
 355
 356         /* Perform access checks. */
 357         /* TODO: we need to support a sync on a specific non-root
 358          * DN. We'll need to find the real partition root here */
 359         ncRoot = req8->naming_context;
 360         if (ncRoot == NULL) {
 361                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
 362                 return WERR_DS_DRA_INVALID_PARAMETER;
 363         }
 364
 365         if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
 366                 return WERR_DS_DRA_INTERNAL_ERROR;
 367         }
 368
 369         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
 370             !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
 371                 return WERR_DS_DRA_SOURCE_DISABLED;
 372         }
 373
 374
 375         if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
 376                 /* Ignore the _in_ uptpdateness vector*/
 377                 req8->uptodateness_vector = NULL;
 378         }
 379
 380         werr = drs_security_level_check(dce_call, "DsGetNCChanges");
 381         if (!W_ERROR_IS_OK(werr)) {
 382                 return werr;
 383         }
 384
 385         getnc_state = b_state->getncchanges_state;
 386
 387         /* see if a previous replication has been abandoned */
 388         if (getnc_state) {
 389                 struct ldb_dn *new_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 390                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
 391                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
 392                                  ldb_dn_get_linearized(new_dn),
 393                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
 394                         talloc_free(getnc_state);
 395                         getnc_state = NULL;
 396                 }
 397         }
 398
 399         if (getnc_state == NULL) {
 400                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
 401                 if (getnc_state == NULL) {
 402                         return WERR_NOMEM;
 403                 }
 404                 b_state->getncchanges_state = getnc_state;
 405                 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 406         }
 407
 408         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
 409             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
 410                 DEBUG(0,(__location__ ": Bad DN '%s'\n", ncRoot->dn));
 411                 return WERR_DS_DRA_INVALID_PARAMETER;
 412         }
 413
 414         /* we need the session key for encrypting password attributes */
 415         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
 416         if (!NT_STATUS_IS_OK(status)) {
 417                 DEBUG(0,(__location__ ": Failed to get session key\n"));
 418                 return WERR_DS_DRA_INTERNAL_ERROR;
 419         }
 420
 421         /* we don't yet support extended operations */
 422         if (req8->extended_op != DRSUAPI_EXOP_NONE) {
 423                 DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
 424                          (unsigned)req8->extended_op));
 425                 return WERR_DS_DRA_NOT_SUPPORTED;
 426         }
 427
 428         /*
 429            TODO: MS-DRSR section 4.1.10.1.1
 430            Work out if this is the start of a new cycle */
 431
 432         if (getnc_state->site_res == NULL) {
 433                 char* search_filter;
 434                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
 435
 436                 getnc_state->min_usn = req8->highwatermark.highest_usn;
 437
 438                 /* Construct response. */
 439                 search_filter = talloc_asprintf(mem_ctx,
 440                                                 "(uSNChanged>=%llu)",
 441                                                 (unsigned long long)(getnc_state->min_usn+1));
 442
 443                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
 444                         search_filter = talloc_asprintf(mem_ctx,
 445                                                         "(&%s(isCriticalSystemObject=TRUE))",
 446                                                         search_filter);
 447                 }
 448
 449                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
 450                         scope = LDB_SCOPE_BASE;
 451                 }
 452
 453                 DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
 454                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
 455                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
 456                                                       getnc_state->ncRoot_dn, scope, attrs,
 457                                                       "uSNChanged",
 458                                                       search_filter);
 459                 if (ret != LDB_SUCCESS) {
 460                         return WERR_DS_DRA_INTERNAL_ERROR;
 461                 }
 462         }
 463
 464         /* Prefix mapping */
 465         schema = dsdb_get_schema(b_state->sam_ctx);
 466         if (!schema) {
 467                 DEBUG(0,("No schema in sam_ctx\n"));
 468                 return WERR_DS_DRA_INTERNAL_ERROR;
 469         }
 470
 471         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 472         *r->out.ctr->ctr6.naming_context = *ncRoot;
 473
 474         if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn,
 475                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
 476                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
 477                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
 478                 return WERR_DS_DRA_INTERNAL_ERROR;
 479         }
 480
 481         /* find the SID if there is one */
 482         dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
 483
 484         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
 485         r->out.ctr->ctr6.mapping_ctr = *ctr;
 486
 487         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
 488         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
 489
 490         r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
 491         r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
 492
 493         r->out.ctr->ctr6.first_object = NULL;
 494         currentObject = &r->out.ctr->ctr6.first_object;
 495
 496         for(i=getnc_state->num_sent;
 497             i<getnc_state->site_res->count &&
 498                     (r->out.ctr->ctr6.object_count < req8->max_object_count);
 499             i++) {
 500                 int uSN;
 501                 struct drsuapi_DsReplicaObjectListItemEx *obj;
 502                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
 503
 504                 uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
 505                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
 506                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
 507                 }
 508                 if (uSN > getnc_state->highest_usn) {
 509                         getnc_state->highest_usn = uSN;
 510                 }
 511
 512                 werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i],
 513                                                    b_state->sam_ctx, getnc_state->ncRoot_dn,
 514                                                    schema, &session_key, getnc_state->min_usn,
 515                                                    req8->replica_flags);
 516                 if (!W_ERROR_IS_OK(werr)) {
 517                         return werr;
 518                 }
 519
 520                 if (obj->meta_data_ctr == NULL) {
 521                         DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
 522                                  ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
 523                         /* no attributes to send */
 524                         talloc_free(obj);
 525                         continue;
 526                 }
 527
 528                 r->out.ctr->ctr6.object_count++;
 529
 530                 *currentObject = obj;
 531                 currentObject = &obj->next_object;
 532         }
 533
 534         getnc_state->num_sent += r->out.ctr->ctr6.object_count;
 535
 536         r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
 537
 538         /* the client can us to call UpdateRefs on its behalf to
 539            re-establish monitoring of the NC */
 540         if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) &&
 541             !GUID_all_zero(&req8->destination_dsa_guid)) {
 542                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
 543                 ureq.naming_context = ncRoot;
 544                 ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
 545                                                          GUID_string(mem_ctx, &req8->destination_dsa_guid),
 546                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
 547                 if (!ureq.dest_dsa_dns_name) {
 548                         return WERR_NOMEM;
 549                 }
 550                 ureq.dest_dsa_guid = req8->destination_dsa_guid;
 551                 ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
 552                         DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
 553                         DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
 554                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
 555                 if (!W_ERROR_IS_OK(werr)) {
 556                         DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
 557                                  win_errstr(werr)));
 558                 }
 559         }
 560
 561         if (i < getnc_state->site_res->count) {
 562                 r->out.ctr->ctr6.more_data = true;
 563         } else {
 564                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
 565                 r->out.ctr->ctr6.uptodateness_vector->version = 2;
 566                 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
 567                 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
 568
 569                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
 570
 571                 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn,
 572                                           r->out.ctr->ctr6.uptodateness_vector,
 573                                           getnc_state->highest_usn);
 574                 if (!W_ERROR_IS_OK(werr)) {
 575                         return werr;
 576                 }
 577
 578                 talloc_free(getnc_state);
 579                 b_state->getncchanges_state = NULL;
 580         }
 581
 582         DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d)\n",
 583                  (unsigned long long)(req8->highwatermark.highest_usn+1),
 584                  req8->replica_flags,
 585                  ncRoot->dn, r->out.ctr->ctr6.object_count,
 586                  i, r->out.ctr->ctr6.more_data?getnc_state->site_res->count:i));
 587
 588         return WERR_OK;
 589 }