s4:drsuapi/getncchanges.c - Update the list of operational attributes
[ira/wip.git] / source4 / rpc_server / drsuapi / getncchanges.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Anatoliy Atanasov 2009
7    Copyright (C) Andrew Tridgell 2009
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "param/param.h"
27 #include "librpc/gen_ndr/ndr_drsblobs.h"
28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
29 #include "rpc_server/dcerpc_server_proto.h"
30 #include "../libcli/drsuapi/drsuapi.h"
31 #include "libcli/security/security.h"
32
33 /* 
34   drsuapi_DsGetNCChanges for one object
35 */
36 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
37                                           struct ldb_message *msg,
38                                           struct ldb_context *sam_ctx,
39                                           struct ldb_dn *ncRoot_dn,
40                                           struct dsdb_schema *schema,
41                                           DATA_BLOB *session_key,
42                                           uint64_t highest_usn,
43                                           uint32_t replica_flags)
44 {
45         const struct ldb_val *md_value;
46         int i, n;
47         struct ldb_dn *obj_dn;
48         struct replPropertyMetaDataBlob md;
49         struct dom_sid *sid;
50         uint32_t rid = 0;
51         enum ndr_err_code ndr_err;
52         uint32_t *attids;
53         const char *rdn;
54         const struct dsdb_attribute *rdn_sa;
55
56         if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
57                 obj->is_nc_prefix = true;
58                 obj->parent_object_guid = NULL;
59         } else {
60                 obj->is_nc_prefix = false;
61                 obj->parent_object_guid = talloc(obj, struct GUID);
62                 if (obj->parent_object_guid == NULL) {
63                         return WERR_DS_DRA_INTERNAL_ERROR;
64                 }
65                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
66                 if (GUID_all_zero(obj->parent_object_guid)) {
67                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
68                                  ldb_dn_get_linearized(msg->dn)));
69                         return WERR_DS_DRA_INTERNAL_ERROR;
70                 }
71         }
72         obj->next_object = NULL;
73         
74         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
75         if (!md_value) {
76                 /* nothing to send */
77                 return WERR_OK;
78         }
79
80         ndr_err = ndr_pull_struct_blob(md_value, obj,
81                                        lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
82                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
83         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
84                 return WERR_DS_DRA_INTERNAL_ERROR;
85         }
86         
87         if (md.version != 1) {
88                 return WERR_DS_DRA_INTERNAL_ERROR;
89         }
90
91         rdn = ldb_dn_get_rdn_name(msg->dn);
92         if (rdn == NULL) {
93                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
94                 return WERR_DS_DRA_INTERNAL_ERROR;
95         }
96
97         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
98         if (rdn_sa == NULL) {
99                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n", 
100                          rdn, ldb_dn_get_linearized(msg->dn)));
101                 return WERR_DS_DRA_INTERNAL_ERROR;
102         }
103
104         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
105         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
106
107         obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
108         obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
109         obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
110         obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
111         sid = samdb_result_dom_sid(obj, msg, "objectSid");
112         if (sid) {
113                 dom_sid_split_rid(NULL, sid, NULL, &rid);
114                 obj->object.identifier->sid = *sid;
115         } else {
116                 ZERO_STRUCT(obj->object.identifier->sid);
117         }
118         
119         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
120         for (n=i=0; i<md.ctr.ctr1.count; i++) {
121                 /* if the attribute has not changed, and it is not the
122                    instanceType then don't include it */
123                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
124                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
125
126                 /* don't include the rDN */
127                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
128
129                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
130                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
131                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
132                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
133                 attids[n] = md.ctr.ctr1.array[i].attid;
134                 n++;
135         }
136
137         /*
138           note that if n==0 we still need to send the change, as it
139           could be a rename, which changes the uSNChanged, but not any
140           of the replicated attributes
141          */
142
143         obj->meta_data_ctr->count = n;
144
145         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
146         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
147         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
148                                                             obj->object.attribute_ctr.num_attributes);
149
150         /*
151          * Note that the meta_data array and the attributes array must
152          * be the same size and in the same order
153          */
154         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
155                 struct ldb_message_element *el;
156                 WERROR werr;
157                 const struct dsdb_attribute *sa;
158         
159                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
160                 if (!sa) {
161                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
162                         return WERR_DS_DRA_INTERNAL_ERROR;
163                 }
164
165                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
166                 if (el == NULL) {
167                         /* this happens for attributes that have been removed */
168                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
169                                  sa->lDAPDisplayName, attids[i]));
170                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
171                         obj->object.attribute_ctr.attributes[i].attid = attids[i];
172                 } else {
173                         werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
174                                                              &obj->object.attribute_ctr.attributes[i]);
175                         if (!W_ERROR_IS_OK(werr)) {
176                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n", 
177                                          sa->lDAPDisplayName, win_errstr(werr)));
178                                 return werr;
179                         }
180                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
181                          * check if attribute is secret and send a null value
182                          */
183                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
184                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
185                                                                  &obj->meta_data_ctr->meta_data[i]);
186                         }
187                         /* some attributes needs to be encrypted
188                            before being sent */
189                         werr = drsuapi_encrypt_attribute(obj, session_key, rid, 
190                                                          &obj->object.attribute_ctr.attributes[i]);
191                         if (!W_ERROR_IS_OK(werr)) {
192                                 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n", 
193                                          sa->lDAPDisplayName, win_errstr(werr)));
194                                 return werr;
195                         }
196                 }
197         }
198
199         return WERR_OK;
200 }
201
202 /*
203   load replUpToDateVector from a DN
204  */
205 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
206                        struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
207 {
208         const char *attrs[] = { "replUpToDateVector", NULL };
209         struct ldb_result *res = NULL;
210         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
211         struct ldb_message_element *el;
212         enum ndr_err_code ndr_err;
213
214         ZERO_STRUCTP(ouv);
215
216         if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
217             res->count < 1) {
218                 DEBUG(0,("load_udv: failed to read partition object\n"));
219                 talloc_free(tmp_ctx);
220                 return WERR_DS_DRA_INTERNAL_ERROR;
221         }
222
223         el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
224         if (el == NULL || el->num_values < 1) {
225                 talloc_free(tmp_ctx);
226                 ouv->version = 2;
227                 return WERR_OK;
228         }
229
230         ndr_err = ndr_pull_struct_blob(&el->values[0], 
231                                        mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
232                                        ouv, 
233                                        (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
234         talloc_free(tmp_ctx);
235         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
236                 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
237                          ldb_dn_get_linearized(dn)));
238                 return WERR_DS_DRA_INTERNAL_ERROR;
239         }
240         
241         return WERR_OK;
242         
243 }
244
245 /*
246   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
247  */
248 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
249                                  struct ldb_dn *ncRoot_dn,
250                                  struct drsuapi_DsReplicaCursor2CtrEx *udv,
251                                  uint64_t highestUSN)
252 {
253         WERROR werr;
254         struct drsuapi_DsReplicaCursor2 *tmp_cursor;
255         NTTIME now;
256         time_t t = time(NULL);
257         struct replUpToDateVectorBlob ouv;
258
259         werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
260         if (!W_ERROR_IS_OK(werr)) {
261                 return werr;
262         }
263         
264         tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
265         tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
266         tmp_cursor->highest_usn = highestUSN;
267         unix_to_nt_time(&now, t);
268         tmp_cursor->last_sync_success = now;
269
270         udv->count = ouv.ctr.ctr2.count + 1;
271         udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
272         udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
273         if (!udv->cursors) {
274                 return WERR_DS_DRA_INTERNAL_ERROR;
275         }
276         udv->cursors[udv->count - 1] = *tmp_cursor;
277         
278         qsort(udv->cursors, udv->count,
279               sizeof(struct drsuapi_DsReplicaCursor2),
280               (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
281
282         return WERR_OK;
283 }
284
285 /* state of a partially completed getncchanges call */
286 struct drsuapi_getncchanges_state {
287         struct ldb_result *site_res;
288         uint32_t num_sent;
289         struct ldb_dn *ncRoot_dn;
290         uint64_t min_usn;
291         uint64_t highest_usn;
292 };
293
294 /* 
295   drsuapi_DsGetNCChanges
296
297   see MS-DRSR 4.1.10.5.2 for basic logic of this function
298 */
299 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
300                                      struct drsuapi_DsGetNCChanges *r)
301 {
302         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
303         int ret;
304         int i;
305         struct dsdb_schema *schema;
306         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
307         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
308         NTSTATUS status;
309         DATA_BLOB session_key;
310         const char *attrs[] = { "*", "distinguishedName",
311                                 "nTSecurityDescriptor",
312                                 "parentGUID",
313                                 "replPropertyMetaData",
314                                 "unicodePwd",
315                                 "dBCSPwd",
316                                 "ntPwdHistory",
317                                 "lmPwdHistory",
318                                 "supplementalCredentials",
319                                 NULL };
320         WERROR werr;
321         struct dcesrv_handle *h;
322         struct drsuapi_bind_state *b_state;     
323         struct drsuapi_getncchanges_state *getnc_state;
324         struct drsuapi_DsGetNCChangesRequest8 *req8;
325         uint32_t options;
326
327         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
328         b_state = h->data;
329
330         *r->out.level_out = 6;
331         /* TODO: linked attributes*/
332         r->out.ctr->ctr6.linked_attributes_count = 0;
333         r->out.ctr->ctr6.linked_attributes = NULL;
334
335         r->out.ctr->ctr6.object_count = 0;
336         r->out.ctr->ctr6.nc_object_count = 0;
337         r->out.ctr->ctr6.more_data = false;
338         r->out.ctr->ctr6.uptodateness_vector = NULL;
339
340         /* a RODC doesn't allow for any replication */
341         if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
342                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
343                 return WERR_DS_DRA_SOURCE_DISABLED;
344         }
345
346         /* Check request revision. 
347            TODO: Adding mappings to req8 from the other levels
348          */
349         if (r->in.level != 8) {
350                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
351                          r->in.level));
352                 return WERR_REVISION_MISMATCH;
353         }
354
355         req8 = &r->in.req->req8;
356
357         /* Perform access checks. */
358         /* TODO: we need to support a sync on a specific non-root
359          * DN. We'll need to find the real partition root here */
360         ncRoot = req8->naming_context;
361         if (ncRoot == NULL) {
362                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
363                 return WERR_DS_DRA_INVALID_PARAMETER;
364         }
365
366         if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
367                 return WERR_DS_DRA_INTERNAL_ERROR;
368         }
369         
370         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
371             !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
372                 return WERR_DS_DRA_SOURCE_DISABLED;
373         }
374
375
376         if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
377                 /* Ignore the _in_ uptpdateness vector*/
378                 req8->uptodateness_vector = NULL;
379         } 
380
381         werr = drs_security_level_check(dce_call, "DsGetNCChanges");
382         if (!W_ERROR_IS_OK(werr)) {
383                 return werr;
384         }
385
386         getnc_state = b_state->getncchanges_state;
387
388         /* see if a previous replication has been abandoned */
389         if (getnc_state) {
390                 struct ldb_dn *new_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
391                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
392                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
393                                  ldb_dn_get_linearized(new_dn),
394                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
395                         talloc_free(getnc_state);
396                         getnc_state = NULL;
397                 }
398         }
399
400         if (getnc_state == NULL) {
401                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
402                 if (getnc_state == NULL) {
403                         return WERR_NOMEM;
404                 }
405                 b_state->getncchanges_state = getnc_state;
406                 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
407         }
408
409         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
410             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
411                 DEBUG(0,(__location__ ": Bad DN '%s'\n", ncRoot->dn));
412                 return WERR_DS_DRA_INVALID_PARAMETER;
413         }
414
415         /* we need the session key for encrypting password attributes */
416         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
417         if (!NT_STATUS_IS_OK(status)) {
418                 DEBUG(0,(__location__ ": Failed to get session key\n"));
419                 return WERR_DS_DRA_INTERNAL_ERROR;              
420         }
421
422         /* we don't yet support extended operations */
423         if (req8->extended_op != DRSUAPI_EXOP_NONE) {
424                 DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
425                          (unsigned)req8->extended_op));
426                 return WERR_DS_DRA_NOT_SUPPORTED;
427         }
428
429         /* 
430            TODO: MS-DRSR section 4.1.10.1.1
431            Work out if this is the start of a new cycle */
432
433         if (getnc_state->site_res == NULL) {
434                 char* search_filter;
435                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
436
437                 getnc_state->min_usn = req8->highwatermark.highest_usn;
438
439                 /* Construct response. */
440                 search_filter = talloc_asprintf(mem_ctx,
441                                                 "(uSNChanged>=%llu)",
442                                                 (unsigned long long)(getnc_state->min_usn+1));
443         
444                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
445                         search_filter = talloc_asprintf(mem_ctx,
446                                                         "(&%s(isCriticalSystemObject=TRUE))",
447                                                         search_filter);
448                 }
449                 
450                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
451                         scope = LDB_SCOPE_BASE;
452                 }
453                 
454                 DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
455                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
456                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
457                                                       getnc_state->ncRoot_dn, scope, attrs,
458                                                       "uSNChanged",
459                                                       search_filter);
460                 if (ret != LDB_SUCCESS) {
461                         return WERR_DS_DRA_INTERNAL_ERROR;
462                 }
463         }
464
465         /* Prefix mapping */
466         schema = dsdb_get_schema(b_state->sam_ctx);
467         if (!schema) {
468                 DEBUG(0,("No schema in sam_ctx\n"));
469                 return WERR_DS_DRA_INTERNAL_ERROR;
470         }
471
472         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
473         *r->out.ctr->ctr6.naming_context = *ncRoot;
474
475         if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, 
476                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
477                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
478                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
479                 return WERR_DS_DRA_INTERNAL_ERROR;
480         }
481
482         /* find the SID if there is one */
483         dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
484
485         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
486         r->out.ctr->ctr6.mapping_ctr = *ctr;
487
488         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
489         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
490
491         r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
492         r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
493
494         r->out.ctr->ctr6.first_object = NULL;
495         currentObject = &r->out.ctr->ctr6.first_object;
496
497         for(i=getnc_state->num_sent; 
498             i<getnc_state->site_res->count && 
499                     (r->out.ctr->ctr6.object_count < req8->max_object_count);
500             i++) {
501                 int uSN;
502                 struct drsuapi_DsReplicaObjectListItemEx *obj;
503                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
504
505                 uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
506                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
507                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
508                 }
509                 if (uSN > getnc_state->highest_usn) {
510                         getnc_state->highest_usn = uSN;
511                 }
512
513                 werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i], 
514                                                    b_state->sam_ctx, getnc_state->ncRoot_dn, 
515                                                    schema, &session_key, getnc_state->min_usn,
516                                                    req8->replica_flags);
517                 if (!W_ERROR_IS_OK(werr)) {
518                         return werr;
519                 }
520
521                 if (obj->meta_data_ctr == NULL) {
522                         DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
523                                  ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
524                         /* no attributes to send */
525                         talloc_free(obj);
526                         continue;
527                 }
528
529                 r->out.ctr->ctr6.object_count++;
530                 
531                 *currentObject = obj;
532                 currentObject = &obj->next_object;
533         }
534
535         getnc_state->num_sent += r->out.ctr->ctr6.object_count;
536
537         r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
538
539         /* the client can us to call UpdateRefs on its behalf to
540            re-establish monitoring of the NC */
541         if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) && 
542             !GUID_all_zero(&req8->destination_dsa_guid)) {
543                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
544                 ureq.naming_context = ncRoot;
545                 ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
546                                                          GUID_string(mem_ctx, &req8->destination_dsa_guid),
547                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
548                 if (!ureq.dest_dsa_dns_name) {
549                         return WERR_NOMEM;
550                 }
551                 ureq.dest_dsa_guid = req8->destination_dsa_guid;
552                 ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
553                         DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
554                         DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
555                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
556                 if (!W_ERROR_IS_OK(werr)) {
557                         DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
558                                  win_errstr(werr)));
559                 }
560         }
561
562         if (i < getnc_state->site_res->count) {
563                 r->out.ctr->ctr6.more_data = true;
564         } else {
565                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
566                 r->out.ctr->ctr6.uptodateness_vector->version = 2;
567                 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
568                 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
569
570                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
571
572                 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn, 
573                                           r->out.ctr->ctr6.uptodateness_vector,
574                                           getnc_state->highest_usn);
575                 if (!W_ERROR_IS_OK(werr)) {
576                         return werr;
577                 }
578
579                 talloc_free(getnc_state);
580                 b_state->getncchanges_state = NULL;
581         }
582
583         DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d)\n",
584                  (unsigned long long)(req8->highwatermark.highest_usn+1),
585                  req8->replica_flags,
586                  ncRoot->dn, r->out.ctr->ctr6.object_count,
587                  i, r->out.ctr->ctr6.more_data?getnc_state->site_res->count:i));
588
589         return WERR_OK;
590 }