s4-drs: implement more of DsUpdateRefs
[nivanova/samba-autobuild/.git] / source4 / rpc_server / drsuapi / getncchanges.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Anatoliy Atanasov 2009
7    Copyright (C) Andrew Tridgell 2009
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "librpc/gen_ndr/ndr_drsuapi.h"
25 #include "rpc_server/dcerpc_server.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "param/param.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "auth/auth.h"
30 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
31 #include "rpc_server/dcerpc_server_proto.h"
32 #include "../libcli/drsuapi/drsuapi.h"
33 #include "libcli/security/security.h"
34
35 /* 
36   drsuapi_DsGetNCChanges for one object
37 */
38 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
39                                           struct ldb_message *msg,
40                                           struct ldb_context *sam_ctx,
41                                           struct ldb_dn *ncRoot_dn,
42                                           struct dsdb_schema *schema,
43                                           DATA_BLOB *session_key,
44                                           uint64_t highest_usn,
45                                           uint32_t replica_flags)
46 {
47         const struct ldb_val *md_value;
48         int i, n;
49         struct ldb_dn *obj_dn;
50         struct replPropertyMetaDataBlob md;
51         struct dom_sid *sid;
52         uint32_t rid = 0;
53         enum ndr_err_code ndr_err;
54         uint32_t *attids;
55         const char *rdn;
56         const struct dsdb_attribute *rdn_sa;
57
58         if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
59                 obj->is_nc_prefix = true;
60                 obj->parent_object_guid = NULL;
61         } else {
62                 struct ldb_dn *parent_dn;
63                 uint32_t instance_type;
64
65                 instance_type = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
66                 if (instance_type & INSTANCE_TYPE_IS_NC_HEAD) {
67                         struct ldb_result *res;
68                         int ret;
69                         const char *dnstr = ldb_dn_get_linearized(msg->dn);
70                         msg->dn = ldb_dn_new(msg, sam_ctx, dnstr);
71                         /* we need to re-search the msg, to avoid the
72                          * broken dual message problems with our
73                          * partitions implementation */
74                         DEBUG(6,(__location__ ": Re-fetching subref %s\n", 
75                                  ldb_dn_get_linearized(msg->dn)));
76                         ret = drsuapi_search_with_extended_dn(sam_ctx, msg, &res,
77                                                               msg->dn, LDB_SCOPE_BASE, NULL,
78                                                               NULL, NULL);
79                         if (ret != LDB_SUCCESS || res->count < 1) {
80                                 DEBUG(0,(__location__ ": Failed to reload subref head %s in %s\n",
81                                          ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ncRoot_dn)));
82                                 return WERR_DS_DRA_INTERNAL_ERROR;
83                         }
84                         msg = res->msgs[0];
85                 }
86
87                 parent_dn = ldb_dn_copy(msg, msg->dn);
88                 obj->is_nc_prefix = false;
89                 obj->parent_object_guid = talloc(obj, struct GUID);
90                 if (parent_dn == NULL) {
91                         return WERR_DS_DRA_INTERNAL_ERROR;
92                 }
93                 if (ldb_dn_remove_child_components(parent_dn, 1) != true) {
94                         DEBUG(0,(__location__ ": Unable to remove DN component\n"));
95                         return WERR_DS_DRA_INTERNAL_ERROR;
96                 }
97                 if (dsdb_find_guid_by_dn(sam_ctx, parent_dn, obj->parent_object_guid) != LDB_SUCCESS) {
98                         DEBUG(0,(__location__ ": Unable to find parent DN %s %s\n", 
99                                  ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(parent_dn)));
100                 }
101                 talloc_free(parent_dn);
102         }
103         obj->next_object = NULL;
104         
105         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
106         if (!md_value) {
107                 /* nothing to send */
108                 return WERR_OK;
109         }
110
111         ndr_err = ndr_pull_struct_blob(md_value, obj,
112                                        lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
113                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
114         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
115                 return WERR_DS_DRA_INTERNAL_ERROR;
116         }
117         
118         if (md.version != 1) {
119                 return WERR_DS_DRA_INTERNAL_ERROR;
120         }
121
122         rdn = ldb_dn_get_rdn_name(msg->dn);
123         if (rdn == NULL) {
124                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
125                 return WERR_DS_DRA_INTERNAL_ERROR;
126         }
127
128         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
129         if (rdn_sa == NULL) {
130                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n", 
131                          rdn, ldb_dn_get_linearized(msg->dn)));
132                 return WERR_DS_DRA_INTERNAL_ERROR;
133         }
134
135         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
136         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
137         
138         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
139         for (n=i=0; i<md.ctr.ctr1.count; i++) {
140                 /* if the attribute has not changed, and it is not the
141                    instanceType then don't include it */
142                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
143                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
144                 /* don't include the rDN */
145                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
146                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
147                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
148                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
149                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
150                 attids[n] = md.ctr.ctr1.array[i].attid;
151                 n++;
152         }
153
154         /*
155           note that if n==0 we still need to send the change, as it
156           could be a rename, which changes the uSNChanged, but not any
157           of the replicated attributes
158          */
159
160         obj->meta_data_ctr->count = n;
161
162         obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
163         obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
164         obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
165         obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
166         sid = samdb_result_dom_sid(obj, msg, "objectSid");
167         if (sid) {
168                 dom_sid_split_rid(NULL, sid, NULL, &rid);
169                 obj->object.identifier->sid = *sid;
170         } else {
171                 ZERO_STRUCT(obj->object.identifier->sid);
172         }
173
174         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
175         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
176         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
177                                                             obj->object.attribute_ctr.num_attributes);
178
179         /*
180          * Note that the meta_data array and the attributes array must
181          * be the same size and in the same order
182          */
183         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
184                 struct ldb_message_element *el;
185                 WERROR werr;
186                 const struct dsdb_attribute *sa;
187         
188                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
189                 if (!sa) {
190                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
191                         return WERR_DS_DRA_INTERNAL_ERROR;
192                 }
193
194                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
195                 if (el == NULL) {
196                         DEBUG(0,("No element '%s' for attributeID %u in message\n", 
197                                  sa->lDAPDisplayName, attids[i]));
198                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
199                         obj->object.attribute_ctr.attributes[i].attid = attids[i];
200                 } else {
201                         werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
202                                                              &obj->object.attribute_ctr.attributes[i]);
203                         if (!W_ERROR_IS_OK(werr)) {
204                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n", 
205                                          sa->lDAPDisplayName, win_errstr(werr)));
206                                 return werr;
207                         }
208                         /* if DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING is set
209                          * check if attribute is secret and send a null value
210                          * TODO: check if we can make this in the database layer
211                          */
212                         if ((replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING)
213                             == DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING) {
214                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
215                                                                  &obj->meta_data_ctr->meta_data[i]);
216                         }
217                         /* some attributes needs to be encrypted
218                            before being sent */
219                         werr = drsuapi_encrypt_attribute(obj, session_key, rid, 
220                                                          &obj->object.attribute_ctr.attributes[i]);
221                         if (!W_ERROR_IS_OK(werr)) {
222                                 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n", 
223                                          sa->lDAPDisplayName, win_errstr(werr)));
224                                 return werr;
225                         }
226                 }
227         }
228
229         return WERR_OK;
230 }
231
232 /*
233   load replUpToDateVector from a DN
234  */
235 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
236                        struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
237 {
238         const char *attrs[] = { "replUpToDateVector", NULL };
239         struct ldb_result *res = NULL;
240         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
241         struct ldb_message_element *el;
242         enum ndr_err_code ndr_err;
243
244         ZERO_STRUCTP(ouv);
245
246         if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
247             res->count < 1) {
248                 DEBUG(0,("load_udv: failed to read partition object\n"));
249                 talloc_free(tmp_ctx);
250                 return WERR_DS_DRA_INTERNAL_ERROR;
251         }
252
253         el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
254         if (el == NULL || el->num_values < 1) {
255                 talloc_free(tmp_ctx);
256                 ouv->version = 2;
257                 return WERR_OK;
258         }
259
260         ndr_err = ndr_pull_struct_blob(&el->values[0], 
261                                        mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
262                                        ouv, 
263                                        (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
264         talloc_free(tmp_ctx);
265         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
266                 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
267                          ldb_dn_get_linearized(dn)));
268                 return WERR_DS_DRA_INTERNAL_ERROR;
269         }
270         
271         return WERR_OK;
272         
273 }
274
275 /*
276   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
277  */
278 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
279                                  struct ldb_dn *ncRoot_dn,
280                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
281 {
282         WERROR werr;
283         struct drsuapi_DsReplicaCursor2 *tmp_cursor;
284         uint64_t highest_commited_usn;
285         NTTIME now;
286         time_t t = time(NULL);
287         int ret;
288         struct replUpToDateVectorBlob ouv;
289
290         werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
291         if (!W_ERROR_IS_OK(werr)) {
292                 return werr;
293         }
294         
295         ret = ldb_sequence_number(sam_ctx, LDB_SEQ_HIGHEST_SEQ, &highest_commited_usn);
296         if (ret != LDB_SUCCESS) {
297                 return WERR_DS_DRA_INTERNAL_ERROR;
298         }
299
300         tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
301         tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
302         tmp_cursor->highest_usn = highest_commited_usn;
303         unix_to_nt_time(&now, t);
304         tmp_cursor->last_sync_success = now;
305
306         udv->count = ouv.ctr.ctr2.count + 1;
307         udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
308         udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
309         if (!udv->cursors) {
310                 return WERR_DS_DRA_INTERNAL_ERROR;
311         }
312         udv->cursors[udv->count - 1] = *tmp_cursor;
313         
314         qsort(udv->cursors, udv->count,
315               sizeof(struct drsuapi_DsReplicaCursor2),
316               (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
317
318         return WERR_OK;
319 }
320
321 /* state of a partially completed getncchanges call */
322 struct drsuapi_getncchanges_state {
323         struct ldb_result *site_res;
324         uint32_t num_sent;
325         struct ldb_dn *ncRoot_dn;
326         uint32_t min_usn;
327 };
328
329 /* 
330   drsuapi_DsGetNCChanges
331
332   see MS-DRSR 4.1.10.5.2 for basic logic of this function
333 */
334 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
335                                      struct drsuapi_DsGetNCChanges *r)
336 {
337         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
338         int ret;
339         int i;
340         struct dsdb_schema *schema;
341         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
342         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
343         NTSTATUS status;
344         DATA_BLOB session_key;
345         const char *attrs[] = { "*", "distinguishedName", NULL };
346         WERROR werr;
347         struct dcesrv_handle *h;
348         struct drsuapi_bind_state *b_state;     
349         struct drsuapi_getncchanges_state *getnc_state;
350         struct drsuapi_DsGetNCChangesRequest8 *req8;
351         uint32_t options;
352
353         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
354         b_state = h->data;
355
356         *r->out.level_out = 6;
357         /* TODO: linked attributes*/
358         r->out.ctr->ctr6.linked_attributes_count = 0;
359         r->out.ctr->ctr6.linked_attributes = NULL;
360
361         r->out.ctr->ctr6.object_count = 0;
362         r->out.ctr->ctr6.nc_object_count = 0;
363         r->out.ctr->ctr6.more_data = false;
364         r->out.ctr->ctr6.uptodateness_vector = NULL;
365
366         /* a RODC doesn't allow for any replication */
367         if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
368                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
369                 return WERR_DS_DRA_SOURCE_DISABLED;
370         }
371
372         /* Check request revision. 
373            TODO: Adding mappings to req8 from the other levels
374          */
375         if (r->in.level != 8) {
376                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
377                          r->in.level));
378                 return WERR_REVISION_MISMATCH;
379         }
380
381         req8 = &r->in.req->req8;
382
383         /* Perform access checks. */
384         ncRoot = req8->naming_context;
385         if (ncRoot == NULL) {
386                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
387                 return WERR_DS_DRA_INVALID_PARAMETER;
388         }
389
390         if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
391                 return WERR_DS_DRA_INTERNAL_ERROR;
392         }
393         
394         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
395             !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
396                 return WERR_DS_DRA_SOURCE_DISABLED;
397         }
398
399
400         if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
401                 /* Ignore the _in_ uptpdateness vector*/
402                 req8->uptodateness_vector = NULL;
403         } 
404
405         werr = drs_security_level_check(dce_call, "DsGetNCChanges");
406         if (!W_ERROR_IS_OK(werr)) {
407                 return werr;
408         }
409
410         getnc_state = b_state->getncchanges_state;
411         if (getnc_state == NULL) {
412                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
413                 if (getnc_state == NULL) {
414                         return WERR_NOMEM;
415                 }
416                 b_state->getncchanges_state = getnc_state;
417         }
418
419         /* we need the session key for encrypting password attributes */
420         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
421         if (!NT_STATUS_IS_OK(status)) {
422                 DEBUG(0,(__location__ ": Failed to get session key\n"));
423                 return WERR_DS_DRA_INTERNAL_ERROR;              
424         }
425
426         /* we don't yet support extended operations */
427         if (req8->extended_op != DRSUAPI_EXOP_NONE) {
428                 DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
429                          (unsigned)req8->extended_op));
430                 return WERR_DS_DRA_NOT_SUPPORTED;
431         }
432
433         /* 
434            TODO: MS-DRSR section 4.1.10.1.1
435            Work out if this is the start of a new cycle */
436
437         if (getnc_state->site_res == NULL) {
438                 char* search_filter;
439                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
440
441                 getnc_state->min_usn = req8->highwatermark.highest_usn;
442
443                 /* Construct response. */
444                 search_filter = talloc_asprintf(mem_ctx,
445                                                 "(uSNChanged>=%llu)",
446                                                 (unsigned long long)(getnc_state->min_usn+1));
447         
448                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
449                         search_filter = talloc_asprintf(mem_ctx,
450                                                         "(&%s(isCriticalSystemObject=TRUE))",
451                                                         search_filter);
452                 }
453                 
454                 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
455                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
456                         scope = LDB_SCOPE_BASE;
457                 }
458                 
459                 DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
460                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
461                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
462                                                       getnc_state->ncRoot_dn, scope, attrs,
463                                                       "uSNChanged",
464                                                       search_filter);
465                 if (ret != LDB_SUCCESS) {
466                         return WERR_DS_DRA_INTERNAL_ERROR;
467                 }
468         } else {
469                 /* check that this request is for the same NC as the previous one */
470                 struct ldb_dn *dn;
471                 dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
472                 if (!dn) {
473                         return WERR_NOMEM;
474                 }
475                 if (ldb_dn_compare(dn, getnc_state->ncRoot_dn) != 0) {
476                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
477                                  ldb_dn_get_linearized(dn),
478                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
479                         return WERR_DS_DRA_BAD_NC;
480                 }
481         }
482
483         /* Prefix mapping */
484         schema = dsdb_get_schema(b_state->sam_ctx);
485         if (!schema) {
486                 DEBUG(0,("No schema in sam_ctx\n"));
487                 return WERR_DS_DRA_INTERNAL_ERROR;
488         }
489
490         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
491         *r->out.ctr->ctr6.naming_context = *ncRoot;
492
493         if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, 
494                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
495                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
496                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
497                 return WERR_DS_DRA_INTERNAL_ERROR;
498         }
499
500         /* find the SID if there is one */
501         dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
502
503         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
504         r->out.ctr->ctr6.mapping_ctr = *ctr;
505
506         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
507         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
508
509         r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
510         r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
511
512         r->out.ctr->ctr6.first_object = NULL;
513         currentObject = &r->out.ctr->ctr6.first_object;
514
515         for(i=getnc_state->num_sent; 
516             i<getnc_state->site_res->count && 
517                     (r->out.ctr->ctr6.object_count < req8->max_object_count);
518             i++) {
519                 int uSN;
520                 struct drsuapi_DsReplicaObjectListItemEx *obj;
521                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
522
523                 uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
524                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
525                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
526                 }
527
528                 werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i], 
529                                                    b_state->sam_ctx, getnc_state->ncRoot_dn, 
530                                                    schema, &session_key, getnc_state->min_usn,
531                                                    req8->replica_flags);
532                 if (!W_ERROR_IS_OK(werr)) {
533                         return werr;
534                 }
535
536                 if (obj->meta_data_ctr == NULL) {
537                         DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
538                                  ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
539                         /* no attributes to send */
540                         talloc_free(obj);
541                         continue;
542                 }
543
544                 r->out.ctr->ctr6.object_count++;
545                 
546                 *currentObject = obj;
547                 currentObject = &obj->next_object;
548         }
549
550         getnc_state->num_sent += r->out.ctr->ctr6.object_count;
551
552         r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
553
554         if (i < getnc_state->site_res->count) {
555                 r->out.ctr->ctr6.more_data = true;
556         } else {
557                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
558                 r->out.ctr->ctr6.uptodateness_vector->version = 2;
559                 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
560                 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
561
562                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
563
564                 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn, 
565                                           r->out.ctr->ctr6.uptodateness_vector);
566                 if (!W_ERROR_IS_OK(werr)) {
567                         return werr;
568                 }
569
570                 talloc_free(getnc_state);
571                 b_state->getncchanges_state = NULL;
572         }
573
574         DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu on %s gave %u objects\n", 
575                  (unsigned long long)(req8->highwatermark.highest_usn+1),
576                  ncRoot->dn, r->out.ctr->ctr6.object_count));
577
578         return WERR_OK;
579 }