2 Unix SMB/CIFS implementation.
4 implement the DSGetNCChanges call
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009-2010
8 Copyright (C) Andrew Bartlett 2010-2016
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "rpc_server/dcerpc_server.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "param/param.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30 #include "librpc/gen_ndr/ndr_security.h"
31 #include "libcli/security/security.h"
32 #include "libcli/security/session.h"
33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
34 #include "rpc_server/dcerpc_server_proto.h"
35 #include "rpc_server/common/sid_helper.h"
36 #include "../libcli/drsuapi/drsuapi.h"
37 #include "lib/util/binsearch.h"
38 #include "lib/util/tsort.h"
39 #include "auth/session.h"
40 #include "dsdb/common/util.h"
41 #include "lib/dbwrap/dbwrap.h"
42 #include "lib/dbwrap/dbwrap_rbt.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
45 /* state of a partially completed getncchanges call */
46 struct drsuapi_getncchanges_state {
47 struct db_context *anc_cache;
50 uint32_t num_processed;
51 struct ldb_dn *ncRoot_dn;
52 struct GUID ncRoot_guid;
56 struct drsuapi_DsReplicaHighWaterMark last_hwm;
57 struct ldb_dn *last_dn;
58 struct drsuapi_DsReplicaHighWaterMark final_hwm;
59 struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
60 struct drsuapi_DsReplicaLinkedAttribute *la_list;
62 struct la_for_sorting *la_sorted;
66 /* We must keep the GUIDs in NDR form for sorting */
67 struct la_for_sorting {
68 struct drsuapi_DsReplicaLinkedAttribute *link;
69 uint8_t target_guid[16];
70 uint8_t source_guid[16];
73 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
74 const struct drsuapi_DsReplicaHighWaterMark *h2)
76 if (h1->highest_usn < h2->highest_usn) {
78 } else if (h1->highest_usn > h2->highest_usn) {
80 } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
82 } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
84 } else if (h1->reserved_usn < h2->reserved_usn) {
86 } else if (h1->reserved_usn > h2->reserved_usn) {
94 build a DsReplicaObjectIdentifier from a ldb msg
96 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
97 const struct ldb_message *msg)
99 struct drsuapi_DsReplicaObjectIdentifier *identifier;
102 identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
103 if (identifier == NULL) {
107 identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
108 identifier->guid = samdb_result_guid(msg, "objectGUID");
110 sid = samdb_result_dom_sid(identifier, msg, "objectSid");
112 identifier->sid = *sid;
114 ZERO_STRUCT(identifier->sid);
119 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
121 return GUID_compare(guid1, &guid2);
125 see if we can filter an attribute using the uptodateness_vector
127 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
128 const struct GUID *originating_invocation_id,
129 uint64_t originating_usn)
131 const struct drsuapi_DsReplicaCursor *c;
132 if (udv == NULL) return false;
133 BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
134 originating_invocation_id, udv_compare, c);
135 if (c && originating_usn <= c->highest_usn) {
141 static int uint32_t_cmp(uint32_t a1, uint32_t a2)
143 if (a1 == a2) return 0;
144 return a1 > a2 ? 1 : -1;
147 static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused)
149 if (*a1 == *a2) return 0;
150 return *a1 > *a2 ? 1 : -1;
153 static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema,
154 const struct dsdb_syntax_ctx *ctx,
155 enum drsuapi_DsAttributeId remote_attid_as_enum,
156 enum drsuapi_DsAttributeId *local_attid_as_enum,
157 const struct dsdb_attribute **_sa)
160 const struct dsdb_attribute *sa = NULL;
162 if (ctx->pfm_remote == NULL) {
163 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
167 werr = dsdb_attribute_drsuapi_remote_to_local(ctx,
168 remote_attid_as_enum,
171 if (!W_ERROR_IS_OK(werr)) {
172 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
179 sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum);
181 return WERR_DS_DRA_SCHEMA_MISMATCH;
183 if (local_attid_as_enum != NULL) {
184 *local_attid_as_enum = sa->attributeID_id;
194 * Similar to function in repl_meta_data without the extra
197 static WERROR get_parsed_dns_trusted(TALLOC_CTX *mem_ctx, struct ldb_message_element *el,
198 struct parsed_dn **pdn)
200 /* Here we get a list of 'struct parsed_dns' without the parsing */
202 *pdn = talloc_zero_array(mem_ctx, struct parsed_dn,
205 return WERR_DS_DRA_INTERNAL_ERROR;
208 for (i = 0; i < el->num_values; i++) {
209 (*pdn)[i].v = &el->values[i];
215 static WERROR getncchanges_update_revealed_list(struct ldb_context *sam_ctx,
217 struct ldb_message **msg,
218 struct ldb_dn *object_dn,
219 const struct GUID *object_guid,
220 const struct dsdb_attribute *sa,
221 struct replPropertyMetaData1 *meta_data,
222 struct ldb_message *revealed_users)
224 enum ndr_err_code ndr_err;
226 char *attr_str = NULL;
227 char *attr_hex = NULL;
229 struct ldb_message_element *existing = NULL, *el_add = NULL, *el_del = NULL;
230 const char * const * secret_attributes = ldb_get_opaque(sam_ctx, "LDB_SECRET_ATTRIBUTE_LIST");
232 if (!ldb_attr_in_list(secret_attributes,
233 sa->lDAPDisplayName)) {
238 ndr_err = ndr_push_struct_blob(&attr_blob, mem_ctx, meta_data, (ndr_push_flags_fn_t)ndr_push_replPropertyMetaData1);
239 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
240 return WERR_DS_DRA_INTERNAL_ERROR;
243 attr_hex = hex_encode_talloc(mem_ctx, attr_blob.data, attr_blob.length);
244 if (attr_hex == NULL) {
245 return WERR_NOT_ENOUGH_MEMORY;
248 attr_str = talloc_asprintf(mem_ctx, "B:%zd:%s:%s", attr_blob.length*2, attr_hex, ldb_dn_get_linearized(object_dn));
249 if (attr_str == NULL) {
250 return WERR_NOT_ENOUGH_MEMORY;
253 existing = ldb_msg_find_element(revealed_users, "msDS-RevealedUsers");
254 if (existing != NULL) {
255 /* Replace the old value (if one exists) with the current one */
256 struct parsed_dn *link_dns;
257 struct parsed_dn *exact = NULL, *unused = NULL;
260 DATA_BLOB partial_meta;
262 werr = get_parsed_dns_trusted(mem_ctx, existing, &link_dns);
263 if (!W_ERROR_IS_OK(werr)) {
267 /* Construct a partial metadata blob to match on in the DB */
268 SIVAL(attid, 0, sa->attributeID_id);
269 partial_meta.length = 4;
270 partial_meta.data = attid;
272 /* Binary search using GUID and attribute id for uniqueness */
273 ldb_err = parsed_dn_find(sam_ctx, link_dns, existing->num_values,
274 object_guid, object_dn,
277 DSDB_SYNTAX_BINARY_DN, true);
279 if (ldb_err != LDB_SUCCESS) {
280 DEBUG(0,(__location__ ": Failed parsed DN find - %s\n",
281 ldb_errstring(sam_ctx)));
282 return WERR_DS_DRA_INTERNAL_ERROR;
286 /* Perform some verification of the blob */
287 struct replPropertyMetaData1 existing_meta_data;
288 ndr_err = ndr_pull_struct_blob_all_noalloc(&exact->dsdb_dn->extra_part,
290 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaData1);
291 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
292 return WERR_DS_DRA_INTERNAL_ERROR;
295 if (existing_meta_data.attid == sa->attributeID_id) {
296 ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_DELETE, &el_del);
297 if (ldb_err != LDB_SUCCESS) {
298 return WERR_DS_DRA_INTERNAL_ERROR;
301 el_del->values = talloc_array((*msg)->elements, struct ldb_val, 1);
302 if (el_del->values == NULL) {
303 return WERR_NOT_ENOUGH_MEMORY;
305 el_del->values[0] = *exact->v;
306 el_del->num_values = 1;
308 return WERR_DS_DRA_INTERNAL_ERROR;
313 ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_ADD, &el_add);
314 if (ldb_err != LDB_SUCCESS) {
315 return WERR_DS_DRA_INTERNAL_ERROR;
318 el_add->values = talloc_array((*msg)->elements, struct ldb_val, 1);
319 if (el_add->values == NULL) {
320 return WERR_NOT_ENOUGH_MEMORY;
324 el_add->values[0] = data_blob_string_const(attr_str);
325 el_add->num_values = 1;
331 * This function filter attributes for build_object based on the
332 * uptodatenessvector and partial attribute set.
334 * Any secret attributes are forced here for REPL_SECRET, and audited at this
335 * point with msDS-RevealedUsers.
337 static WERROR get_nc_changes_filter_attrs(struct drsuapi_DsReplicaObjectListItemEx *obj,
338 struct replPropertyMetaDataBlob md,
339 struct ldb_context *sam_ctx,
340 const struct ldb_message *msg,
341 const struct GUID *guid,
343 uint64_t highest_usn,
344 const struct dsdb_attribute *rdn_sa,
345 struct dsdb_schema *schema,
346 struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
347 struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
351 struct ldb_message **revealed_list_msg,
352 struct ldb_message *existing_revealed_list_msg)
356 for (n=i=0; i<md.ctr.ctr1.count; i++) {
357 const struct dsdb_attribute *sa;
358 bool force_attribute = false;
360 /* if the attribute has not changed, and it is not the
361 instanceType then don't include it */
362 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
364 md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
366 /* don't include the rDN */
367 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
369 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
371 DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
372 (unsigned int)md.ctr.ctr1.array[i].attid,
373 ldb_dn_get_linearized(msg->dn)));
374 return WERR_DS_DRA_INTERNAL_ERROR;
378 struct ldb_message_element *el;
379 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
380 if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
381 /* don't send upgraded links inline */
387 !dsdb_attr_in_rodc_fas(sa)) {
388 force_attribute = true;
389 DEBUG(4,("Forcing attribute %s in %s\n",
390 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
391 werr = getncchanges_update_revealed_list(sam_ctx, obj,
394 &md.ctr.ctr1.array[i],
395 existing_revealed_list_msg);
396 if (!W_ERROR_IS_OK(werr)) {
401 /* filter by uptodateness_vector */
402 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
404 udv_filter(uptodateness_vector,
405 &md.ctr.ctr1.array[i].originating_invocation_id,
406 md.ctr.ctr1.array[i].originating_usn)) {
410 /* filter by partial_attribute_set */
411 if (partial_attribute_set && !force_attribute) {
412 uint32_t *result = NULL;
413 BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
414 uint32_t_cmp, result);
415 if (result == NULL) {
420 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
421 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
422 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
423 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
424 attids[n] = md.ctr.ctr1.array[i].attid;
435 drsuapi_DsGetNCChanges for one object
437 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
438 const struct ldb_message *msg,
439 struct ldb_context *sam_ctx,
440 struct ldb_dn *ncRoot_dn,
442 struct dsdb_schema *schema,
443 DATA_BLOB *session_key,
444 uint64_t highest_usn,
445 uint32_t replica_flags,
446 struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
447 struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
448 enum drsuapi_DsExtendedOperation extended_op,
449 bool force_object_return,
451 struct ldb_dn *machine_dn,
452 const struct GUID *guid)
454 const struct ldb_val *md_value;
456 struct replPropertyMetaDataBlob md;
459 enum ndr_err_code ndr_err;
462 const struct dsdb_attribute *rdn_sa;
464 unsigned int instanceType;
465 struct dsdb_syntax_ctx syntax_ctx;
466 struct ldb_result *res = NULL;
470 /* make dsdb sytanx context for conversions */
471 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
472 syntax_ctx.is_schema_nc = is_schema_nc;
474 uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
475 instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
476 if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
477 obj->is_nc_prefix = true;
478 obj->parent_object_guid = NULL;
480 obj->is_nc_prefix = false;
481 obj->parent_object_guid = talloc(obj, struct GUID);
482 if (obj->parent_object_guid == NULL) {
483 return WERR_DS_DRA_INTERNAL_ERROR;
485 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
486 if (GUID_all_zero(obj->parent_object_guid)) {
487 DEBUG(0,(__location__ ": missing parentGUID for %s\n",
488 ldb_dn_get_linearized(msg->dn)));
489 return WERR_DS_DRA_INTERNAL_ERROR;
492 obj->next_object = NULL;
494 md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
496 /* nothing to send */
500 if (instanceType & INSTANCE_TYPE_UNINSTANT) {
501 /* don't send uninstantiated objects */
505 if (uSNChanged <= highest_usn) {
506 /* nothing to send */
510 ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
511 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
512 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
513 return WERR_DS_DRA_INTERNAL_ERROR;
516 if (md.version != 1) {
517 return WERR_DS_DRA_INTERNAL_ERROR;
520 rdn = ldb_dn_get_rdn_name(msg->dn);
522 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
523 return WERR_DS_DRA_INTERNAL_ERROR;
526 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
527 if (rdn_sa == NULL) {
528 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
529 rdn, ldb_dn_get_linearized(msg->dn)));
530 return WERR_DS_DRA_INTERNAL_ERROR;
533 obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
534 attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
536 obj->object.identifier = get_object_identifier(obj, msg);
537 if (obj->object.identifier == NULL) {
538 return WERR_NOT_ENOUGH_MEMORY;
540 dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
542 obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
544 if (extended_op == DRSUAPI_EXOP_REPL_SECRET) {
545 /* Get the existing revealed users for the destination */
546 struct ldb_message *revealed_list_msg = NULL;
547 struct ldb_message *existing_revealed_list_msg = NULL;
548 const char *machine_attrs[] = {
549 "msDS-RevealedUsers",
553 revealed_list_msg = ldb_msg_new(sam_ctx);
554 if (revealed_list_msg == NULL) {
555 return WERR_NOT_ENOUGH_MEMORY;
557 revealed_list_msg->dn = machine_dn;
559 ret = ldb_transaction_start(sam_ctx);
560 if (ret != LDB_SUCCESS) {
561 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
562 ldb_errstring(sam_ctx)));
563 return WERR_DS_DRA_INTERNAL_ERROR;
566 ldb_err = dsdb_search_dn(sam_ctx, obj, &res, machine_dn, machine_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN);
567 if (ldb_err != LDB_SUCCESS || res->count != 1) {
568 ldb_transaction_cancel(sam_ctx);
569 return WERR_DS_DRA_INTERNAL_ERROR;
572 existing_revealed_list_msg = res->msgs[0];
574 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg,
575 guid, &n, highest_usn,
578 partial_attribute_set, local_pas,
582 existing_revealed_list_msg);
583 if (!W_ERROR_IS_OK(werr)) {
584 ldb_transaction_cancel(sam_ctx);
588 if (revealed_list_msg != NULL) {
589 ret = ldb_modify(sam_ctx, revealed_list_msg);
590 if (ret != LDB_SUCCESS) {
591 DEBUG(0,(__location__ ": Failed to alter revealed links - %s\n",
592 ldb_errstring(sam_ctx)));
593 ldb_transaction_cancel(sam_ctx);
594 return WERR_DS_DRA_INTERNAL_ERROR;
598 ret = ldb_transaction_commit(sam_ctx);
599 if (ret != LDB_SUCCESS) {
600 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
601 ldb_errstring(sam_ctx)));
602 return WERR_DS_DRA_INTERNAL_ERROR;
605 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg, guid,
606 &n, highest_usn, rdn_sa,
607 schema, uptodateness_vector,
608 partial_attribute_set, local_pas,
613 if (!W_ERROR_IS_OK(werr)) {
618 /* ignore it if its an empty change. Note that renames always
619 * change the 'name' attribute, so they won't be ignored by
622 * the force_object_return check is used to force an empty
623 * object return when we timeout in the getncchanges loop.
624 * This allows us to return an empty object, which keeps the
625 * client happy while preventing timeouts
629 attids[0] == DRSUAPI_ATTID_instanceType &&
630 !force_object_return)) {
631 talloc_free(obj->meta_data_ctr);
632 obj->meta_data_ctr = NULL;
636 obj->meta_data_ctr->count = n;
638 obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
639 obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
640 obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
641 obj->object.attribute_ctr.num_attributes);
642 if (obj->object.attribute_ctr.attributes == NULL) {
643 return WERR_NOT_ENOUGH_MEMORY;
647 * Note that the meta_data array and the attributes array must
648 * be the same size and in the same order
650 for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
651 struct ldb_message_element *el;
652 const struct dsdb_attribute *sa;
654 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
656 DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
657 return WERR_DS_DRA_INTERNAL_ERROR;
660 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
662 /* this happens for attributes that have been removed */
663 DEBUG(5,("No element '%s' for attributeID %u in message\n",
664 sa->lDAPDisplayName, attids[i]));
665 ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
666 obj->object.attribute_ctr.attributes[i].attid =
667 dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
669 werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
670 &obj->object.attribute_ctr.attributes[i]);
671 if (!W_ERROR_IS_OK(werr)) {
672 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
673 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
677 /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
678 * check if attribute is secret and send a null value
680 if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
681 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
682 &obj->meta_data_ctr->meta_data[i]);
684 /* some attributes needs to be encrypted
686 werr = drsuapi_encrypt_attribute(obj, session_key, rid,
687 &obj->object.attribute_ctr.attributes[i]);
688 if (!W_ERROR_IS_OK(werr)) {
689 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
690 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
695 if (attids[i] != obj->object.attribute_ctr.attributes[i].attid) {
696 DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID: "
700 ldb_dn_get_linearized(msg->dn),
702 obj->object.attribute_ctr.attributes[i].attid));
703 return WERR_DS_DATABASE_ERROR;
711 add one linked attribute from an object to the list of linked
712 attributes in a getncchanges request
714 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
715 struct ldb_context *sam_ctx,
716 const struct dsdb_schema *schema,
717 const struct dsdb_attribute *sa,
718 const struct ldb_message *msg,
719 struct dsdb_dn *dsdb_dn,
720 struct drsuapi_DsReplicaLinkedAttribute **la_list,
724 struct drsuapi_DsReplicaLinkedAttribute *la;
729 (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
730 W_ERROR_HAVE_NO_MEMORY(*la_list);
732 la = &(*la_list)[*la_count];
734 la->identifier = get_object_identifier(*la_list, msg);
735 W_ERROR_HAVE_NO_MEMORY(la->identifier);
737 active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
740 /* We have to check that the inactive link still point to an existing object */
746 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
747 if (strncmp(v, "TRUE", 4) == 0) {
749 * Note: we skip the transmition of the deleted link even if the other part used to
750 * know about it because when we transmit the deletion of the object, the link will
751 * be deleted too due to deletion of object where link points and Windows do so.
753 if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
754 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
756 * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
757 * if it join an existing domain with deleted objets, it firsts impose to have a
758 * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
759 * either during initial replication or after the getNCChanges.
760 * Behavior of samba has been changed to always have this attribute if it's present in the schema.
762 * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
763 * If FL >=2K8R2 we are sure that this attribute will be here.
764 * For this kind of forest level we do not return the link if the object is recycled
765 * (isRecycled = true).
767 if (strncmp(v, "TRUE", 4) == 0) {
768 DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
769 ldb_dn_get_linearized(msg->dn)));
776 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
777 if (!NT_STATUS_IS_OK(status)) {
778 DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
779 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
780 return ntstatus_to_werror(status);
782 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
783 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
784 DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
785 GUID_string(mem_ctx, &guid)));
787 } else if (ret != LDB_SUCCESS) {
788 DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
789 GUID_string(mem_ctx, &guid),
794 la->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
795 la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
797 status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
798 if (!NT_STATUS_IS_OK(status)) {
799 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
800 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
801 return ntstatus_to_werror(status);
803 status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
804 if (!NT_STATUS_IS_OK(status)) {
805 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
806 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
807 return ntstatus_to_werror(status);
809 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
810 if (!NT_STATUS_IS_OK(status)) {
811 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
812 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
813 return ntstatus_to_werror(status);
815 status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
816 if (!NT_STATUS_IS_OK(status)) {
817 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
818 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
819 return ntstatus_to_werror(status);
822 status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
823 if (!NT_STATUS_IS_OK(status)) {
824 /* this is possible for upgraded links */
825 la->originating_add_time = la->meta_data.originating_change_time;
828 werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
829 W_ERROR_NOT_OK_RETURN(werr);
837 add linked attributes from an object to the list of linked
838 attributes in a getncchanges request
840 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
842 struct ldb_dn *ncRoot_dn,
844 struct dsdb_schema *schema,
845 uint64_t highest_usn,
846 uint32_t replica_flags,
847 const struct ldb_message *msg,
848 struct drsuapi_DsReplicaLinkedAttribute **la_list,
850 struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
853 TALLOC_CTX *tmp_ctx = NULL;
854 uint64_t uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
855 bool is_critical = ldb_msg_find_attr_as_bool(msg, "isCriticalSystemObject", false);
857 if (replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
863 if (uSNChanged <= highest_usn) {
867 tmp_ctx = talloc_new(mem_ctx);
868 if (tmp_ctx == NULL) {
869 return WERR_NOT_ENOUGH_MEMORY;
872 for (i=0; i<msg->num_elements; i++) {
873 struct ldb_message_element *el = &msg->elements[i];
874 const struct dsdb_attribute *sa;
877 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
879 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
880 /* we only want forward links */
884 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
885 /* its an old style link, it will have been
886 * sent in the main replication data */
890 for (j=0; j<el->num_values; j++) {
891 struct dsdb_dn *dsdb_dn;
893 uint64_t originating_usn;
894 NTSTATUS status, status2;
896 struct GUID originating_invocation_id;
898 dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
899 if (dsdb_dn == NULL) {
900 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
901 el->name, ldb_dn_get_linearized(msg->dn)));
902 talloc_free(tmp_ctx);
903 return WERR_DS_DRA_INTERNAL_ERROR;
906 status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
907 if (!NT_STATUS_IS_OK(status)) {
908 /* this can happen for attributes
909 given to us with old style meta
914 if (local_usn > uSNChanged) {
915 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
916 el->name, ldb_dn_get_linearized(msg->dn)));
917 talloc_free(tmp_ctx);
918 return WERR_DS_DRA_INTERNAL_ERROR;
921 if (local_usn <= highest_usn) {
925 status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
926 &originating_invocation_id,
928 status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
930 "RMD_ORIGINATING_USN");
932 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
933 if (udv_filter(uptodateness_vector,
934 &originating_invocation_id,
940 werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
941 sa, msg, dsdb_dn, la_list,
942 la_count, is_schema_nc);
943 if (!W_ERROR_IS_OK(werr)) {
944 talloc_free(tmp_ctx);
950 talloc_free(tmp_ctx);
955 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
957 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
958 struct ldb_dn *ncRoot_dn,
959 struct drsuapi_DsReplicaCursor2CtrEx *udv)
967 ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
968 if (ret != LDB_SUCCESS) {
969 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
970 ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
971 return WERR_DS_DRA_INTERNAL_ERROR;
978 /* comparison function for linked attributes - see CompareLinks() in
979 * MS-DRSR section 4.1.10.5.17 */
980 static int linked_attribute_compare(const struct la_for_sorting *la1,
981 const struct la_for_sorting *la2,
985 c = memcmp(la1->source_guid,
986 la2->source_guid, sizeof(la2->source_guid));
991 if (la1->link->attid != la2->link->attid) {
992 return la1->link->attid < la2->link->attid? -1:1;
995 if ((la1->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
996 (la2->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
997 return (la1->link->flags &
998 DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
1001 return memcmp(la1->target_guid,
1002 la2->target_guid, sizeof(la2->target_guid));
1005 struct drsuapi_changed_objects {
1012 sort the objects we send first by uSNChanged
1014 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
1015 struct drsuapi_changed_objects *m2,
1016 struct drsuapi_getncchanges_state *getnc_state)
1020 ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
1025 ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
1030 if (m1->usn == m2->usn) {
1031 return ldb_dn_compare(m2->dn, m1->dn);
1034 if (m1->usn < m2->usn) {
1043 handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
1045 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
1046 TALLOC_CTX *mem_ctx,
1047 struct drsuapi_DsGetNCChangesRequest10 *req10,
1048 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1049 struct ldb_dn **rid_manager_dn)
1051 struct ldb_dn *req_dn, *ntds_dn = NULL;
1053 struct ldb_context *ldb = b_state->sam_ctx;
1054 struct ldb_result *ext_res;
1055 struct dsdb_fsmo_extended_op *exop;
1060 - verify that the DN being asked for is the RID Manager DN
1061 - verify that we are the RID Manager
1064 /* work out who is the RID Manager, also return to caller */
1065 ret = samdb_rid_manager_dn(ldb, mem_ctx, rid_manager_dn);
1066 if (ret != LDB_SUCCESS) {
1067 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
1068 return WERR_DS_DRA_INTERNAL_ERROR;
1071 req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1072 if (!ldb_dn_validate(req_dn) ||
1073 ldb_dn_compare(req_dn, *rid_manager_dn) != 0) {
1074 /* that isn't the RID Manager DN */
1075 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
1076 drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1077 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1081 /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1082 ret = dsdb_find_dn_by_guid(ldb, mem_ctx, &req10->destination_dsa_guid, 0, &ntds_dn);
1083 if (ret != LDB_SUCCESS) {
1084 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1085 GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1086 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1090 /* find the DN of the RID Manager */
1091 ret = samdb_reference_dn_is_our_ntdsa(ldb, *rid_manager_dn, "fSMORoleOwner", &is_us);
1092 if (ret != LDB_SUCCESS) {
1093 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1094 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1095 return WERR_DS_DRA_INTERNAL_ERROR;
1099 /* we're not the RID Manager - go away */
1100 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
1101 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1105 exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
1106 W_ERROR_HAVE_NO_MEMORY(exop);
1108 exop->fsmo_info = req10->fsmo_info;
1109 exop->destination_dsa_guid = req10->destination_dsa_guid;
1111 ret = ldb_transaction_start(ldb);
1112 if (ret != LDB_SUCCESS) {
1113 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1114 ldb_errstring(ldb)));
1115 return WERR_DS_DRA_INTERNAL_ERROR;
1118 ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
1119 if (ret != LDB_SUCCESS) {
1120 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
1121 ldb_errstring(ldb)));
1122 ldb_transaction_cancel(ldb);
1123 return WERR_DS_DRA_INTERNAL_ERROR;
1126 ret = ldb_transaction_commit(ldb);
1127 if (ret != LDB_SUCCESS) {
1128 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1129 ldb_errstring(ldb)));
1130 return WERR_DS_DRA_INTERNAL_ERROR;
1133 talloc_free(ext_res);
1135 DEBUG(2,("Allocated RID pool for server %s\n",
1136 GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1138 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1144 handle a DRSUAPI_EXOP_REPL_SECRET call
1146 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
1147 TALLOC_CTX *mem_ctx,
1148 struct drsuapi_DsGetNCChangesRequest10 *req10,
1149 struct dom_sid *user_sid,
1150 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1151 bool has_get_all_changes,
1152 struct ldb_dn **machine_dn)
1154 struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1155 struct ldb_dn *obj_dn = NULL;
1156 struct ldb_dn *ntds_dn = NULL, *server_dn = NULL;
1157 struct ldb_dn *rodc_dn, *krbtgt_link_dn;
1159 const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", "objectGUID", NULL };
1160 const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
1161 struct ldb_result *rodc_res = NULL, *obj_res = NULL;
1162 const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
1163 const struct dom_sid *object_sid = NULL;
1165 const struct dom_sid *additional_sids[] = { NULL, NULL };
1167 DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
1168 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1171 * we need to work out if we will allow this DC to
1172 * replicate the secrets for this object
1174 * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
1178 if (b_state->sam_ctx_system == NULL) {
1179 /* this operation needs system level access */
1180 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
1181 return WERR_DS_DRA_ACCESS_DENIED;
1185 * Before we accept or deny, fetch the machine DN for the destination
1188 * If we are the RODC, we will check that this matches the SID.
1190 ret = dsdb_find_dn_by_guid(b_state->sam_ctx_system, mem_ctx,
1191 &req10->destination_dsa_guid, 0,
1193 if (ret != LDB_SUCCESS) {
1197 server_dn = ldb_dn_get_parent(mem_ctx, ntds_dn);
1198 if (server_dn == NULL) {
1202 ret = samdb_reference_dn(b_state->sam_ctx_system, mem_ctx, server_dn,
1203 "serverReference", machine_dn);
1205 if (ret != LDB_SUCCESS) {
1210 * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1212 * The pseudo code indicate
1213 * revealsecrets = true
1214 * if IsRevealSecretRequest(msgIn) then
1215 * if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1217 * if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1218 * <... check if this account is ok to be replicated on this DC ...>
1219 * <... and if not reveal secrets = no ...>
1221 * reveal secrets = false
1226 * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1227 * then you can do EXOP_REPL_SECRETS
1229 obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
1230 if (!ldb_dn_validate(obj_dn)) goto failed;
1232 if (has_get_all_changes) {
1236 rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
1237 dom_sid_string(mem_ctx, user_sid));
1238 if (!ldb_dn_validate(rodc_dn)) goto failed;
1240 /* do the two searches we need */
1241 ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
1242 DSDB_SEARCH_SHOW_EXTENDED_DN);
1243 if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
1245 ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1246 if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1248 /* if the object SID is equal to the user_sid, allow */
1249 object_sid = samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid");
1250 if (dom_sid_equal(user_sid, object_sid)) {
1254 additional_sids[0] = object_sid;
1257 * Must be an RODC account at this point, verify machine DN matches the
1260 if (ldb_dn_compare(rodc_res->msgs[0]->dn, *machine_dn) != 0) {
1264 /* an RODC is allowed to get its own krbtgt account secrets */
1265 krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1266 rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1267 if (krbtgt_link_dn != NULL &&
1268 ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1272 /* but it isn't allowed to get anyone elses krbtgt secrets */
1273 if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1274 obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1278 if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1279 "userAccountControl", 0) &
1280 UF_INTERDOMAIN_TRUST_ACCOUNT) {
1284 werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1285 mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1286 if (!W_ERROR_IS_OK(werr)) {
1290 werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1291 mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1292 if (!W_ERROR_IS_OK(werr)) {
1297 * The SID list needs to include itself as well as the tokenGroups.
1299 * TODO determine if sIDHistory is required for this check
1301 werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1302 mem_ctx, "tokenGroups", &token_sids,
1303 additional_sids, 1);
1304 if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1308 if (never_reveal_sids &&
1309 sid_list_match(token_sids, never_reveal_sids)) {
1314 sid_list_match(token_sids, reveal_sids)) {
1320 DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1321 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1322 ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1323 return WERR_DS_DRA_SECRETS_DENIED;
1326 DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1327 ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1328 ldb_dn_get_linearized(*machine_dn)));
1329 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1330 req10->highwatermark.highest_usn = 0;
1334 DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1335 ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1336 ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1337 return WERR_DS_DRA_BAD_DN;
1341 handle a DRSUAPI_EXOP_REPL_OBJ call
1343 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1344 TALLOC_CTX *mem_ctx,
1345 struct drsuapi_DsGetNCChangesRequest10 *req10,
1346 struct dom_sid *user_sid,
1347 struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1349 struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1351 DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1352 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1354 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1360 handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1361 DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1362 and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1364 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1365 TALLOC_CTX *mem_ctx,
1366 struct drsuapi_DsGetNCChangesRequest10 *req10,
1367 struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1369 struct ldb_dn *req_dn, *ntds_dn;
1372 struct ldb_context *ldb = b_state->sam_ctx;
1373 struct ldb_message *msg;
1378 - verify that the client dn exists
1379 - verify that we are the current master
1382 req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1383 if (!ldb_dn_validate(req_dn)) {
1384 /* that is not a valid dn */
1385 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1386 drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1387 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1391 /* find the DN of the current role owner */
1392 ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1393 if (ret != LDB_SUCCESS) {
1394 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1395 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1396 return WERR_DS_DRA_INTERNAL_ERROR;
1400 /* we're not the RID Manager or role owner - go away */
1401 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1402 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1406 /* change the current master */
1407 msg = ldb_msg_new(ldb);
1408 W_ERROR_HAVE_NO_MEMORY(msg);
1409 msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1410 W_ERROR_HAVE_NO_MEMORY(msg->dn);
1412 /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1413 ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1414 if (ret != LDB_SUCCESS) {
1415 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1416 GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1418 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1422 ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1425 return WERR_DS_DRA_INTERNAL_ERROR;
1428 for (i=0;i<msg->num_elements;i++) {
1429 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1432 ret = ldb_transaction_start(ldb);
1433 if (ret != LDB_SUCCESS) {
1434 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1435 ldb_errstring(ldb)));
1436 return WERR_DS_DRA_INTERNAL_ERROR;
1439 ret = ldb_modify(ldb, msg);
1440 if (ret != LDB_SUCCESS) {
1441 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1442 ldb_errstring(ldb)));
1443 ldb_transaction_cancel(ldb);
1444 return WERR_DS_DRA_INTERNAL_ERROR;
1447 ret = ldb_transaction_commit(ldb);
1448 if (ret != LDB_SUCCESS) {
1449 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1450 ldb_errstring(ldb)));
1451 return WERR_DS_DRA_INTERNAL_ERROR;
1454 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1460 see if this getncchanges request includes a request to reveal secret information
1462 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1463 struct drsuapi_DsGetNCChangesRequest10 *req10,
1464 struct dsdb_schema_prefixmap *pfm_remote,
1465 bool *is_secret_request)
1467 enum drsuapi_DsExtendedOperation exop;
1469 struct dsdb_schema *schema;
1470 struct dsdb_syntax_ctx syntax_ctx;
1472 *is_secret_request = true;
1474 exop = req10->extended_op;
1477 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1478 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1479 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1480 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1481 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1482 /* FSMO exops can reveal secrets */
1483 *is_secret_request = true;
1485 case DRSUAPI_EXOP_REPL_SECRET:
1486 case DRSUAPI_EXOP_REPL_OBJ:
1487 case DRSUAPI_EXOP_NONE:
1491 if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1492 *is_secret_request = false;
1496 if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1497 req10->partial_attribute_set == NULL) {
1498 /* they want secrets */
1499 *is_secret_request = true;
1503 schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1504 dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1505 syntax_ctx.pfm_remote = pfm_remote;
1507 /* check the attributes they asked for */
1508 for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1509 const struct dsdb_attribute *sa;
1510 WERROR werr = getncchanges_attid_remote_to_local(schema,
1512 req10->partial_attribute_set->attids[i],
1516 if (!W_ERROR_IS_OK(werr)) {
1517 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1518 req10->partial_attribute_set->attids[i], win_errstr(werr)));
1522 if (!dsdb_attr_in_rodc_fas(sa)) {
1523 *is_secret_request = true;
1528 if (req10->partial_attribute_set_ex) {
1529 /* check the extended attributes they asked for */
1530 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1531 const struct dsdb_attribute *sa;
1532 WERROR werr = getncchanges_attid_remote_to_local(schema,
1534 req10->partial_attribute_set_ex->attids[i],
1538 if (!W_ERROR_IS_OK(werr)) {
1539 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1540 req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1544 if (!dsdb_attr_in_rodc_fas(sa)) {
1545 *is_secret_request = true;
1551 *is_secret_request = false;
1556 see if this getncchanges request is only for attributes in the GC
1557 partial attribute set
1559 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1560 struct drsuapi_DsGetNCChangesRequest10 *req10,
1561 struct dsdb_schema_prefixmap *pfm_remote,
1562 bool *is_gc_pas_request)
1564 enum drsuapi_DsExtendedOperation exop;
1566 struct dsdb_schema *schema;
1567 struct dsdb_syntax_ctx syntax_ctx;
1569 exop = req10->extended_op;
1572 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1573 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1574 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1575 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1576 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1577 case DRSUAPI_EXOP_REPL_SECRET:
1578 *is_gc_pas_request = false;
1580 case DRSUAPI_EXOP_REPL_OBJ:
1581 case DRSUAPI_EXOP_NONE:
1585 if (req10->partial_attribute_set == NULL) {
1586 /* they want it all */
1587 *is_gc_pas_request = false;
1591 schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1592 dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1593 syntax_ctx.pfm_remote = pfm_remote;
1595 /* check the attributes they asked for */
1596 for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1597 const struct dsdb_attribute *sa;
1598 WERROR werr = getncchanges_attid_remote_to_local(schema,
1600 req10->partial_attribute_set->attids[i],
1604 if (!W_ERROR_IS_OK(werr)) {
1605 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1606 req10->partial_attribute_set->attids[i], win_errstr(werr)));
1610 if (!sa->isMemberOfPartialAttributeSet) {
1611 *is_gc_pas_request = false;
1616 if (req10->partial_attribute_set_ex) {
1617 /* check the extended attributes they asked for */
1618 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1619 const struct dsdb_attribute *sa;
1620 WERROR werr = getncchanges_attid_remote_to_local(schema,
1622 req10->partial_attribute_set_ex->attids[i],
1626 if (!W_ERROR_IS_OK(werr)) {
1627 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1628 req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1632 if (!sa->isMemberOfPartialAttributeSet) {
1633 *is_gc_pas_request = false;
1639 *is_gc_pas_request = true;
1645 map from req8 to req10
1647 static struct drsuapi_DsGetNCChangesRequest10 *
1648 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1649 struct drsuapi_DsGetNCChangesRequest8 *req8)
1651 struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1652 struct drsuapi_DsGetNCChangesRequest10);
1653 if (req10 == NULL) {
1657 req10->destination_dsa_guid = req8->destination_dsa_guid;
1658 req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1659 req10->naming_context = req8->naming_context;
1660 req10->highwatermark = req8->highwatermark;
1661 req10->uptodateness_vector = req8->uptodateness_vector;
1662 req10->replica_flags = req8->replica_flags;
1663 req10->max_object_count = req8->max_object_count;
1664 req10->max_ndr_size = req8->max_ndr_size;
1665 req10->extended_op = req8->extended_op;
1666 req10->fsmo_info = req8->fsmo_info;
1667 req10->partial_attribute_set = req8->partial_attribute_set;
1668 req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1669 req10->mapping_ctr = req8->mapping_ctr;
1674 static const char *collect_objects_attrs[] = { "uSNChanged",
1679 * Collects object for normal replication cycle.
1681 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1682 TALLOC_CTX *mem_ctx,
1683 struct drsuapi_DsGetNCChangesRequest10 *req10,
1684 struct ldb_dn *search_dn,
1685 const char *extra_filter,
1686 struct ldb_result **search_res)
1689 char* search_filter;
1690 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1691 struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1692 bool critical_only = false;
1694 if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1695 critical_only = true;
1698 if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1699 req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1700 scope = LDB_SCOPE_BASE;
1701 critical_only = false;
1704 /* Construct response. */
1705 search_filter = talloc_asprintf(mem_ctx,
1706 "(uSNChanged>=%llu)",
1707 (unsigned long long)(getnc_state->min_usn+1));
1710 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1713 if (critical_only) {
1714 search_filter = talloc_asprintf(mem_ctx,
1715 "(&%s(isCriticalSystemObject=TRUE))",
1719 if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1720 scope = LDB_SCOPE_BASE;
1724 search_dn = getnc_state->ncRoot_dn;
1727 DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1728 ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1729 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1731 collect_objects_attrs,
1733 if (ret != LDB_SUCCESS) {
1734 return WERR_DS_DRA_INTERNAL_ERROR;
1741 * Collects object for normal replication cycle.
1743 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1744 TALLOC_CTX *mem_ctx,
1745 struct drsuapi_DsGetNCChangesRequest10 *req10,
1746 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1747 struct ldb_dn *search_dn,
1748 const char *extra_filter,
1749 struct ldb_result **search_res)
1751 /* we have nothing to do in case of ex-op failure */
1752 if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1756 switch (req10->extended_op) {
1757 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1760 struct ldb_dn *ntds_dn = NULL;
1761 struct ldb_dn *server_dn = NULL;
1762 struct ldb_dn *machine_dn = NULL;
1763 struct ldb_dn *rid_set_dn = NULL;
1764 struct ldb_result *search_res2 = NULL;
1765 struct ldb_result *search_res3 = NULL;
1766 TALLOC_CTX *frame = talloc_stackframe();
1767 /* get RID manager, RID set and server DN (in that order) */
1769 /* This first search will get the RID Manager */
1770 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1772 search_dn, LDB_SCOPE_BASE,
1773 collect_objects_attrs,
1775 if (ret != LDB_SUCCESS) {
1776 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1777 ldb_dn_get_linearized(search_dn),
1778 ldb_errstring(b_state->sam_ctx)));
1780 return WERR_DS_DRA_INTERNAL_ERROR;
1783 if ((*search_res)->count != 1) {
1784 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1785 ldb_dn_get_linearized(search_dn),
1786 (*search_res)->count));
1788 return WERR_DS_DRA_INTERNAL_ERROR;
1791 /* Now extend it to the RID set */
1793 /* Find the computer account DN for the destination
1794 * dsa GUID specified */
1796 ret = dsdb_find_dn_by_guid(b_state->sam_ctx, frame,
1797 &req10->destination_dsa_guid, 0,
1799 if (ret != LDB_SUCCESS) {
1800 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1802 &req10->destination_dsa_guid),
1803 ldb_errstring(b_state->sam_ctx)));
1805 return WERR_DS_DRA_INTERNAL_ERROR;
1808 server_dn = ldb_dn_get_parent(frame, ntds_dn);
1811 return WERR_DS_DRA_INTERNAL_ERROR;
1814 ret = samdb_reference_dn(b_state->sam_ctx, frame, server_dn,
1815 "serverReference", &machine_dn);
1816 if (ret != LDB_SUCCESS) {
1817 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1818 ldb_dn_get_linearized(server_dn),
1819 ldb_errstring(b_state->sam_ctx)));
1821 return WERR_DS_DRA_INTERNAL_ERROR;
1824 ret = samdb_reference_dn(b_state->sam_ctx, frame, machine_dn,
1825 "rIDSetReferences", &rid_set_dn);
1826 if (ret != LDB_SUCCESS) {
1827 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1828 ldb_dn_get_linearized(server_dn),
1829 ldb_errstring(b_state->sam_ctx)));
1831 return WERR_DS_DRA_INTERNAL_ERROR;
1835 /* This first search will get the RID Manager, now get the RID set */
1836 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1838 rid_set_dn, LDB_SCOPE_BASE,
1839 collect_objects_attrs,
1841 if (ret != LDB_SUCCESS) {
1842 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1843 ldb_dn_get_linearized(rid_set_dn),
1844 ldb_errstring(b_state->sam_ctx)));
1846 return WERR_DS_DRA_INTERNAL_ERROR;
1849 if (search_res2->count != 1) {
1850 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1851 ldb_dn_get_linearized(rid_set_dn),
1852 search_res2->count));
1854 return WERR_DS_DRA_INTERNAL_ERROR;
1857 /* Finally get the server DN */
1858 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1860 machine_dn, LDB_SCOPE_BASE,
1861 collect_objects_attrs,
1863 if (ret != LDB_SUCCESS) {
1864 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1865 ldb_dn_get_linearized(server_dn),
1866 ldb_errstring(b_state->sam_ctx)));
1868 return WERR_DS_DRA_INTERNAL_ERROR;
1871 if (search_res3->count != 1) {
1872 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1873 ldb_dn_get_linearized(server_dn),
1874 search_res3->count));
1876 return WERR_DS_DRA_INTERNAL_ERROR;
1879 /* Now extend the original search_res with these answers */
1880 (*search_res)->count = 3;
1882 (*search_res)->msgs = talloc_realloc(frame, (*search_res)->msgs,
1883 struct ldb_message *,
1884 (*search_res)->count);
1885 if ((*search_res)->msgs == NULL) {
1887 return WERR_NOT_ENOUGH_MEMORY;
1891 talloc_steal(mem_ctx, *search_res);
1892 (*search_res)->msgs[1] =
1893 talloc_steal((*search_res)->msgs, search_res2->msgs[0]);
1894 (*search_res)->msgs[2] =
1895 talloc_steal((*search_res)->msgs, search_res3->msgs[0]);
1901 /* TODO: implement extended op specific collection
1902 * of objects. Right now we just normal procedure
1903 * for collecting objects */
1904 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1908 static void dcesrv_drsuapi_update_highwatermark(const struct ldb_message *msg,
1910 struct drsuapi_DsReplicaHighWaterMark *hwm)
1912 uint64_t uSN = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
1914 if (uSN > max_usn) {
1916 * Only report the max_usn we had at the start
1917 * of the replication cycle.
1919 * If this object has changed lately we better
1920 * let the destination dsa refetch the change.
1921 * This is better than the risk of loosing some
1922 * objects or linked attributes.
1927 if (uSN <= hwm->tmp_highest_usn) {
1931 hwm->tmp_highest_usn = uSN;
1932 hwm->reserved_usn = 0;
1935 static WERROR dcesrv_drsuapi_anc_cache_add(struct db_context *anc_cache,
1936 const struct GUID *guid)
1938 enum ndr_err_code ndr_err;
1939 uint8_t guid_buf[16] = { 0, };
1942 .length = sizeof(guid_buf),
1954 ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1955 (ndr_push_flags_fn_t)ndr_push_GUID);
1956 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1957 return WERR_DS_DRA_INTERNAL_ERROR;
1960 status = dbwrap_store(anc_cache, key, val, TDB_REPLACE);
1961 if (!NT_STATUS_IS_OK(status)) {
1962 return WERR_DS_DRA_INTERNAL_ERROR;
1968 static WERROR dcesrv_drsuapi_anc_cache_exists(struct db_context *anc_cache,
1969 const struct GUID *guid)
1971 enum ndr_err_code ndr_err;
1972 uint8_t guid_buf[16] = { 0, };
1975 .length = sizeof(guid_buf),
1983 ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1984 (ndr_push_flags_fn_t)ndr_push_GUID);
1985 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1986 return WERR_DS_DRA_INTERNAL_ERROR;
1989 exists = dbwrap_exists(anc_cache, key);
1991 return WERR_OBJECT_NOT_FOUND;
1994 return WERR_OBJECT_NAME_EXISTS;
1998 drsuapi_DsGetNCChanges
2000 see MS-DRSR 4.1.10.5.2 for basic logic of this function
2002 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2003 struct drsuapi_DsGetNCChanges *r)
2005 struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
2008 struct dsdb_schema *schema;
2009 struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
2010 struct drsuapi_DsReplicaObjectListItemEx **currentObject;
2012 DATA_BLOB session_key;
2014 struct dcesrv_handle *h;
2015 struct drsuapi_bind_state *b_state;
2016 struct drsuapi_getncchanges_state *getnc_state;
2017 struct drsuapi_DsGetNCChangesRequest10 *req10;
2019 uint32_t max_objects;
2021 uint32_t link_count = 0;
2022 uint32_t link_total = 0;
2023 uint32_t link_given = 0;
2024 struct ldb_dn *search_dn = NULL;
2026 enum security_user_level security_level;
2027 struct ldb_context *sam_ctx;
2028 struct dom_sid *user_sid;
2029 bool is_secret_request;
2030 bool is_gc_pas_request;
2031 struct drsuapi_changed_objects *changes;
2033 time_t start = time(NULL);
2034 bool max_wait_reached = false;
2035 bool has_get_all_changes = false;
2036 struct GUID invocation_id;
2037 static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
2038 struct dsdb_schema_prefixmap *pfm_remote = NULL;
2040 uint32_t *local_pas = NULL;
2041 struct ldb_dn *machine_dn = NULL; /* Only used for REPL SECRET EXOP */
2043 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
2046 /* sam_ctx_system is not present for non-administrator users */
2047 sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
2049 invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2051 *r->out.level_out = 6;
2052 /* TODO: linked attributes*/
2053 r->out.ctr->ctr6.linked_attributes_count = 0;
2054 r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
2056 r->out.ctr->ctr6.object_count = 0;
2057 r->out.ctr->ctr6.nc_object_count = 0;
2058 r->out.ctr->ctr6.more_data = false;
2059 r->out.ctr->ctr6.uptodateness_vector = NULL;
2060 r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2061 r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2062 r->out.ctr->ctr6.first_object = NULL;
2064 /* a RODC doesn't allow for any replication */
2065 ret = samdb_rodc(sam_ctx, &am_rodc);
2066 if (ret == LDB_SUCCESS && am_rodc) {
2067 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
2068 return WERR_DS_DRA_SOURCE_DISABLED;
2071 /* Check request revision.
2073 switch (r->in.level) {
2075 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
2076 if (req10 == NULL) {
2077 return WERR_NOT_ENOUGH_MEMORY;
2081 req10 = &r->in.req->req10;
2084 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
2086 return WERR_REVISION_MISMATCH;
2090 /* Perform access checks. */
2091 /* TODO: we need to support a sync on a specific non-root
2092 * DN. We'll need to find the real partition root here */
2093 ncRoot = req10->naming_context;
2094 if (ncRoot == NULL) {
2095 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
2096 return WERR_DS_DRA_INVALID_PARAMETER;
2099 if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
2100 return WERR_DS_DRA_INTERNAL_ERROR;
2103 if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
2104 !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
2105 return WERR_DS_DRA_SOURCE_DISABLED;
2108 user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
2110 /* all clients must have GUID_DRS_GET_CHANGES */
2111 werr = drs_security_access_check_nc_root(sam_ctx,
2113 dce_call->conn->auth_state.session_info->security_token,
2114 req10->naming_context,
2115 GUID_DRS_GET_CHANGES);
2116 if (!W_ERROR_IS_OK(werr)) {
2120 if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) {
2121 full = req10->partial_attribute_set == NULL &&
2122 req10->partial_attribute_set_ex == NULL;
2124 full = (options & DRSUAPI_DRS_WRIT_REP) != 0;
2127 werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true,
2128 mem_ctx, &pfm_remote, NULL);
2130 /* We were supplied a partial attribute set, without the prefix map! */
2131 if (!full && !W_ERROR_IS_OK(werr)) {
2132 if (req10->mapping_ctr.num_mappings == 0) {
2134 * Despite the fact MS-DRSR specifies that this shouldn't
2135 * happen, Windows RODCs will in fact not provide a prefixMap.
2137 DEBUG(5,(__location__ ": Failed to provide a remote prefixMap,"
2138 " falling back to local prefixMap\n"));
2140 DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n",
2146 /* allowed if the GC PAS and client has
2147 GUID_DRS_GET_FILTERED_ATTRIBUTES */
2148 werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request);
2149 if (!W_ERROR_IS_OK(werr)) {
2152 if (is_gc_pas_request) {
2153 werr = drs_security_access_check_nc_root(sam_ctx,
2155 dce_call->conn->auth_state.session_info->security_token,
2156 req10->naming_context,
2157 GUID_DRS_GET_FILTERED_ATTRIBUTES);
2158 if (W_ERROR_IS_OK(werr)) {
2163 werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10,
2165 &is_secret_request);
2166 if (!W_ERROR_IS_OK(werr)) {
2169 if (is_secret_request) {
2170 werr = drs_security_access_check_nc_root(sam_ctx,
2172 dce_call->conn->auth_state.session_info->security_token,
2173 req10->naming_context,
2174 GUID_DRS_GET_ALL_CHANGES);
2175 if (!W_ERROR_IS_OK(werr)) {
2176 /* Only bail if this is not a EXOP_REPL_SECRET */
2177 if (req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
2181 has_get_all_changes = true;
2186 /* for non-administrator replications, check that they have
2187 given the correct source_dsa_invocation_id */
2188 security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
2189 samdb_domain_sid(sam_ctx));
2190 if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
2191 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
2192 /* we rely on this flag being unset for RODC requests */
2193 req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2197 if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
2198 /* Ignore the _in_ uptpdateness vector*/
2199 req10->uptodateness_vector = NULL;
2202 if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
2203 req10->source_dsa_invocation_id = invocation_id;
2206 if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
2208 * The given highwatermark is only valid relative to the
2209 * specified source_dsa_invocation_id.
2211 ZERO_STRUCT(req10->highwatermark);
2214 getnc_state = b_state->getncchanges_state;
2216 /* see if a previous replication has been abandoned */
2218 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
2219 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
2220 DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
2221 ldb_dn_get_linearized(new_dn),
2222 ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2223 ldb_dn_get_linearized(getnc_state->last_dn)));
2224 TALLOC_FREE(getnc_state);
2225 b_state->getncchanges_state = NULL;
2230 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
2231 &req10->highwatermark);
2233 DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
2234 "on DN %s %s highwatermark (last_dn %s)\n",
2235 ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2236 (ret > 0) ? "older" : "newer",
2237 ldb_dn_get_linearized(getnc_state->last_dn)));
2238 TALLOC_FREE(getnc_state);
2239 b_state->getncchanges_state = NULL;
2243 if (getnc_state == NULL) {
2244 struct ldb_result *res = NULL;
2245 const char *attrs[] = {
2250 uint32_t nc_instanceType;
2251 struct ldb_dn *ncRoot_dn;
2253 ncRoot_dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, ncRoot);
2254 if (ncRoot_dn == NULL) {
2255 return WERR_NOT_ENOUGH_MEMORY;
2258 ret = dsdb_search_dn(sam_ctx, mem_ctx, &res,
2260 DSDB_SEARCH_SHOW_DELETED |
2261 DSDB_SEARCH_SHOW_RECYCLED);
2262 if (ret != LDB_SUCCESS) {
2263 DBG_WARNING("Failed to find ncRoot_dn %s\n",
2264 ldb_dn_get_linearized(ncRoot_dn));
2265 return WERR_DS_CANT_FIND_EXPECTED_NC;
2267 nc_instanceType = ldb_msg_find_attr_as_int(res->msgs[0],
2271 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2272 r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
2276 * This is the first replication cycle and it is
2277 * a good place to handle extended operations
2279 * FIXME: we don't fully support extended operations yet
2281 switch (req10->extended_op) {
2282 case DRSUAPI_EXOP_NONE:
2283 if ((nc_instanceType & INSTANCE_TYPE_IS_NC_HEAD) == 0) {
2285 = ldb_dn_get_linearized(ncRoot_dn);
2287 DBG_NOTICE("Rejecting full replication on "
2288 "not NC %s", dn_str);
2290 return WERR_DS_CANT_FIND_EXPECTED_NC;
2294 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
2295 werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6, &search_dn);
2296 W_ERROR_NOT_OK_RETURN(werr);
2297 if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2301 case DRSUAPI_EXOP_REPL_SECRET:
2302 werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
2305 has_get_all_changes,
2307 r->out.result = werr;
2308 W_ERROR_NOT_OK_RETURN(werr);
2310 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
2311 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2312 W_ERROR_NOT_OK_RETURN(werr);
2313 if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2317 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
2318 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2319 W_ERROR_NOT_OK_RETURN(werr);
2320 if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2324 case DRSUAPI_EXOP_FSMO_REQ_PDC:
2325 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2326 W_ERROR_NOT_OK_RETURN(werr);
2327 if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2331 case DRSUAPI_EXOP_REPL_OBJ:
2332 werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
2333 r->out.result = werr;
2334 W_ERROR_NOT_OK_RETURN(werr);
2337 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
2339 DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
2340 (unsigned)req10->extended_op));
2341 return WERR_DS_DRA_NOT_SUPPORTED;
2344 /* Initialize the state we'll store over the replication cycle */
2345 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
2346 if (getnc_state == NULL) {
2347 return WERR_NOT_ENOUGH_MEMORY;
2349 b_state->getncchanges_state = getnc_state;
2351 getnc_state->ncRoot_dn = ncRoot_dn;
2352 talloc_steal(getnc_state, ncRoot_dn);
2354 getnc_state->ncRoot_guid = samdb_result_guid(res->msgs[0],
2356 ncRoot->guid = getnc_state->ncRoot_guid;
2358 /* find out if we are to replicate Schema NC */
2359 ret = ldb_dn_compare_base(ldb_get_schema_basedn(sam_ctx),
2361 getnc_state->is_schema_nc = (0 == ret);
2366 if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
2367 ldb_dn_is_null(getnc_state->ncRoot_dn)) {
2368 DEBUG(0,(__location__ ": Bad DN '%s'\n",
2369 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
2370 return WERR_DS_DRA_INVALID_PARAMETER;
2373 ncRoot->guid = getnc_state->ncRoot_guid;
2375 /* we need the session key for encrypting password attributes */
2376 status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
2377 if (!NT_STATUS_IS_OK(status)) {
2378 DEBUG(0,(__location__ ": Failed to get session key\n"));
2379 return WERR_DS_DRA_INTERNAL_ERROR;
2383 TODO: MS-DRSR section 4.1.10.1.1
2384 Work out if this is the start of a new cycle */
2386 if (getnc_state->guids == NULL) {
2387 const char *extra_filter;
2388 struct ldb_result *search_res = NULL;
2389 static const struct drsuapi_DsReplicaCursorCtrEx empty_udv;
2390 const struct drsuapi_DsReplicaCursorCtrEx *udv = NULL;
2392 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
2394 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2395 if (req10->uptodateness_vector != NULL) {
2396 udv = req10->uptodateness_vector;
2401 getnc_state->min_usn = req10->highwatermark.highest_usn;
2402 for (i = 0; i < udv->count; i++) {
2404 const struct drsuapi_DsReplicaCursor *cur =
2407 match = GUID_equal(&invocation_id,
2408 &cur->source_dsa_invocation_id);
2412 if (cur->highest_usn > getnc_state->min_usn) {
2413 getnc_state->min_usn = cur->highest_usn;
2418 /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
2420 getnc_state->min_usn = 0;
2423 getnc_state->max_usn = getnc_state->min_usn;
2425 getnc_state->final_udv = talloc_zero(getnc_state,
2426 struct drsuapi_DsReplicaCursor2CtrEx);
2427 if (getnc_state->final_udv == NULL) {
2428 return WERR_NOT_ENOUGH_MEMORY;
2430 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
2431 getnc_state->final_udv);
2432 if (!W_ERROR_IS_OK(werr)) {
2436 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2437 werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
2438 search_dn, extra_filter,
2441 werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
2443 search_dn, extra_filter,
2446 W_ERROR_NOT_OK_RETURN(werr);
2448 /* extract out the GUIDs list */
2449 getnc_state->num_records = search_res ? search_res->count : 0;
2450 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
2451 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
2453 changes = talloc_array(getnc_state,
2454 struct drsuapi_changed_objects,
2455 getnc_state->num_records);
2456 W_ERROR_HAVE_NO_MEMORY(changes);
2458 for (i=0; i<getnc_state->num_records; i++) {
2459 changes[i].dn = search_res->msgs[i]->dn;
2460 changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
2461 changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
2463 if (changes[i].usn > getnc_state->max_usn) {
2464 getnc_state->max_usn = changes[i].usn;
2468 /* RID_ALLOC returns 3 objects in a fixed order */
2469 if (req10->extended_op == DRSUAPI_EXOP_FSMO_RID_ALLOC) {
2472 LDB_TYPESAFE_QSORT(changes,
2473 getnc_state->num_records,
2475 site_res_cmp_usn_order);
2478 for (i=0; i < getnc_state->num_records; i++) {
2479 getnc_state->guids[i] = changes[i].guid;
2480 if (GUID_all_zero(&getnc_state->guids[i])) {
2481 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
2482 ldb_dn_get_linearized(search_res->msgs[i]->dn)));
2483 return WERR_DS_DRA_INTERNAL_ERROR;
2487 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
2488 getnc_state->final_hwm.reserved_usn = 0;
2489 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
2491 talloc_free(search_res);
2492 talloc_free(changes);
2494 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2496 } else if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
2497 getnc_state->anc_cache = db_open_rbt(getnc_state);
2498 if (getnc_state->anc_cache == NULL) {
2499 return WERR_NOT_ENOUGH_MEMORY;
2504 if (req10->uptodateness_vector) {
2505 /* make sure its sorted */
2506 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
2507 req10->uptodateness_vector->count,
2508 drsuapi_DsReplicaCursor_compare);
2511 /* Prefix mapping */
2512 schema = dsdb_get_schema(sam_ctx, mem_ctx);
2514 DEBUG(0,("No schema in sam_ctx\n"));
2515 return WERR_DS_DRA_INTERNAL_ERROR;
2518 r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
2519 if (r->out.ctr->ctr6.naming_context == NULL) {
2520 return WERR_NOT_ENOUGH_MEMORY;
2522 *r->out.ctr->ctr6.naming_context = *ncRoot;
2524 /* find the SID if there is one */
2525 dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
2527 dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
2528 r->out.ctr->ctr6.mapping_ctr = *ctr;
2530 r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2531 r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2533 r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
2534 r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
2536 currentObject = &r->out.ctr->ctr6.first_object;
2538 max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
2540 * The client control here only applies in normal replication, not extended
2541 * operations, which return a fixed set, even if the caller
2542 * sets max_object_count == 0
2544 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2545 /* use this to force single objects at a time, which is useful
2546 * for working out what object is giving problems
2548 if (req10->max_object_count < max_objects) {
2549 max_objects = req10->max_object_count;
2553 * TODO: work out how the maximum should be calculated
2555 max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
2558 * Maximum time that we can spend in a getncchanges
2559 * in order to avoid timeout of the other part.
2560 * 10 seconds by default.
2562 max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
2564 if (req10->partial_attribute_set != NULL) {
2565 struct dsdb_syntax_ctx syntax_ctx;
2568 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
2569 syntax_ctx.pfm_remote = pfm_remote;
2571 local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids);
2573 for (j = 0; j < req10->partial_attribute_set->num_attids; j++) {
2574 getncchanges_attid_remote_to_local(schema,
2576 req10->partial_attribute_set->attids[j],
2577 (enum drsuapi_DsAttributeId *)&local_pas[j],
2581 LDB_TYPESAFE_QSORT(local_pas,
2582 req10->partial_attribute_set->num_attids,
2587 for (i=getnc_state->num_processed;
2588 i<getnc_state->num_records &&
2589 (r->out.ctr->ctr6.object_count < max_objects)
2590 && !max_wait_reached;
2592 struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
2593 struct drsuapi_DsReplicaObjectListItemEx *obj;
2594 struct ldb_message *msg;
2595 static const char * const msg_attrs[] = {
2597 "nTSecurityDescriptor",
2599 "replPropertyMetaData",
2600 DSDB_SECRET_ATTRIBUTES,
2602 struct ldb_result *msg_res;
2603 struct ldb_dn *msg_dn;
2604 const struct GUID *next_anc_guid = NULL;
2606 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
2607 W_ERROR_HAVE_NO_MEMORY(obj);
2609 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
2610 W_ERROR_HAVE_NO_MEMORY(msg_dn);
2614 * by re-searching here we avoid having a lot of full
2615 * records in memory between calls to getncchanges.
2617 * We expect that we may get some objects that vanish
2618 * (tombstone expunge) between the first and second
2621 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
2623 LDB_SCOPE_BASE, msg_attrs, NULL);
2624 if (ret != LDB_SUCCESS) {
2625 if (ret != LDB_ERR_NO_SUCH_OBJECT) {
2626 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
2627 ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
2633 if (msg_res->count == 0) {
2634 DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
2635 "to get any results in fetch of DN "
2636 "%s (race with tombstone expunge?)\n",
2637 ldb_dn_get_extended_linearized(obj,
2643 msg = msg_res->msgs[0];
2646 * If it has already been added as an ancestor of
2647 * an object, we don't need to do anything more,
2648 * as we've already added the links.
2650 if (getnc_state->anc_cache != NULL) {
2651 werr = dcesrv_drsuapi_anc_cache_exists(getnc_state->anc_cache,
2652 &getnc_state->guids[i]);
2653 if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2654 dcesrv_drsuapi_update_highwatermark(msg,
2655 getnc_state->max_usn,
2656 &r->out.ctr->ctr6.new_highwatermark);
2657 /* no attributes to send */
2663 max_wait_reached = (time(NULL) - start > max_wait);
2665 werr = get_nc_changes_build_object(obj, msg,
2666 sam_ctx, getnc_state->ncRoot_dn,
2667 getnc_state->is_schema_nc,
2668 schema, &session_key, getnc_state->min_usn,
2669 req10->replica_flags,
2670 req10->partial_attribute_set,
2671 req10->uptodateness_vector,
2674 local_pas, machine_dn,
2675 &getnc_state->guids[i]);
2676 if (!W_ERROR_IS_OK(werr)) {
2680 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2681 getnc_state->ncRoot_dn,
2682 getnc_state->is_schema_nc,
2683 schema, getnc_state->min_usn,
2684 req10->replica_flags,
2686 &getnc_state->la_list,
2687 &getnc_state->la_count,
2688 req10->uptodateness_vector);
2689 if (!W_ERROR_IS_OK(werr)) {
2693 dcesrv_drsuapi_update_highwatermark(msg,
2694 getnc_state->max_usn,
2695 &r->out.ctr->ctr6.new_highwatermark);
2697 if (obj->meta_data_ctr == NULL) {
2698 DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
2699 ldb_dn_get_linearized(msg->dn)));
2700 /* no attributes to send */
2707 if (getnc_state->anc_cache != NULL) {
2708 werr = dcesrv_drsuapi_anc_cache_add(getnc_state->anc_cache,
2709 &getnc_state->guids[i]);
2710 if (!W_ERROR_IS_OK(werr)) {
2714 next_anc_guid = obj->parent_object_guid;
2717 while (next_anc_guid != NULL) {
2718 struct drsuapi_DsReplicaObjectListItemEx *anc_obj = NULL;
2719 struct ldb_message *anc_msg = NULL;
2720 struct ldb_result *anc_res = NULL;
2721 struct ldb_dn *anc_dn = NULL;
2723 werr = dcesrv_drsuapi_anc_cache_exists(getnc_state->anc_cache,
2725 if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2727 * We don't need to send it twice.
2731 if (W_ERROR_IS_OK(werr)) {
2732 return WERR_INTERNAL_ERROR;
2734 if (!W_ERROR_EQUAL(werr, WERR_OBJECT_NOT_FOUND)) {
2739 anc_obj = talloc_zero(mem_ctx,
2740 struct drsuapi_DsReplicaObjectListItemEx);
2741 if (anc_obj == NULL) {
2742 return WERR_NOT_ENOUGH_MEMORY;
2745 anc_dn = ldb_dn_new_fmt(anc_obj, sam_ctx, "<GUID=%s>",
2746 GUID_string(anc_obj, next_anc_guid));
2747 if (anc_dn == NULL) {
2748 return WERR_NOT_ENOUGH_MEMORY;
2751 ret = drsuapi_search_with_extended_dn(sam_ctx, anc_obj,
2755 if (ret != LDB_SUCCESS) {
2756 const char *anc_str = NULL;
2757 const char *obj_str = NULL;
2759 anc_str = ldb_dn_get_extended_linearized(anc_obj,
2762 obj_str = ldb_dn_get_extended_linearized(anc_obj,
2766 DBG_ERR("getncchanges: failed to fetch ANC "
2767 "DN %s for DN %s - %s\n",
2769 ldb_errstring(sam_ctx));
2770 return WERR_DS_DRA_INCONSISTENT_DIT;
2773 anc_msg = anc_res->msgs[0];
2775 werr = get_nc_changes_build_object(anc_obj, anc_msg,
2777 getnc_state->ncRoot_dn,
2778 getnc_state->is_schema_nc,
2779 schema, &session_key,
2780 getnc_state->min_usn,
2781 req10->replica_flags,
2782 req10->partial_attribute_set,
2783 req10->uptodateness_vector,
2785 false, /* force_object_return */
2789 if (!W_ERROR_IS_OK(werr)) {
2793 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2794 getnc_state->ncRoot_dn,
2795 getnc_state->is_schema_nc,
2796 schema, getnc_state->min_usn,
2797 req10->replica_flags,
2799 &getnc_state->la_list,
2800 &getnc_state->la_count,
2801 req10->uptodateness_vector);
2802 if (!W_ERROR_IS_OK(werr)) {
2807 * Regardless of if we actually use it or not,
2808 * we add it to the cache so we don't look at it again
2810 werr = dcesrv_drsuapi_anc_cache_add(getnc_state->anc_cache,
2812 if (!W_ERROR_IS_OK(werr)) {
2817 * Any ancestors which are below the highwatermark
2818 * or uptodateness_vector shouldn't be added,
2819 * but we still look further up the
2820 * tree for ones which have been changed recently.
2822 if (anc_obj->meta_data_ctr != NULL) {
2824 * prepend it to the list
2826 anc_obj->next_object = new_objs;
2831 TALLOC_FREE(anc_res);
2832 TALLOC_FREE(anc_dn);
2835 * We may need to resolve more...
2837 next_anc_guid = anc_obj->parent_object_guid;
2840 *currentObject = new_objs;
2841 while (new_objs != NULL) {
2842 r->out.ctr->ctr6.object_count += 1;
2843 if (new_objs->next_object == NULL) {
2844 currentObject = &new_objs->next_object;
2846 new_objs = new_objs->next_object;
2849 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
2851 talloc_free(getnc_state->last_dn);
2852 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
2854 talloc_free(msg_res);
2855 talloc_free(msg_dn);
2858 getnc_state->num_processed = i;
2860 /* the client can us to call UpdateRefs on its behalf to
2861 re-establish monitoring of the NC */
2862 if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
2863 !GUID_all_zero(&req10->destination_dsa_guid)) {
2864 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
2865 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
2866 GUID_string(mem_ctx, &req10->destination_dsa_guid)));
2867 ureq.naming_context = ncRoot;
2868 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(sam_ctx, mem_ctx,
2869 &req10->destination_dsa_guid);
2870 if (!ureq.dest_dsa_dns_name) {
2871 return WERR_NOT_ENOUGH_MEMORY;
2873 ureq.dest_dsa_guid = req10->destination_dsa_guid;
2874 ureq.options = DRSUAPI_DRS_ADD_REF |
2875 DRSUAPI_DRS_ASYNC_OP |
2876 DRSUAPI_DRS_GETCHG_CHECK;
2878 /* we also need to pass through the
2879 DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
2880 to send notifies using the GC SPN */
2881 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
2883 werr = drsuapi_UpdateRefs(dce_call->msg_ctx,
2884 dce_call->event_ctx, b_state,
2886 if (!W_ERROR_IS_OK(werr)) {
2887 DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
2888 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
2895 * This is just a guess, how to calculate the
2896 * number of linked attributes to send, we need to
2897 * find out how to do this right.
2899 if (r->out.ctr->ctr6.object_count >= max_links) {
2902 max_links -= r->out.ctr->ctr6.object_count;
2905 link_total = getnc_state->la_count;
2907 if (i < getnc_state->num_records) {
2908 r->out.ctr->ctr6.more_data = true;
2910 /* sort the whole array the first time */
2911 if (getnc_state->la_sorted == NULL) {
2913 struct la_for_sorting *guid_array = talloc_array(getnc_state, struct la_for_sorting, getnc_state->la_count);
2914 if (guid_array == NULL) {
2915 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", getnc_state->la_count));
2916 return WERR_NOT_ENOUGH_MEMORY;
2918 for (j = 0; j < getnc_state->la_count; j++) {
2919 /* we need to get the target GUIDs to compare */
2921 const struct drsuapi_DsReplicaLinkedAttribute *la = &getnc_state->la_list[j];
2922 const struct dsdb_attribute *schema_attrib;
2923 const struct ldb_val *target_guid;
2924 DATA_BLOB source_guid;
2925 TALLOC_CTX *frame = talloc_stackframe();
2927 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la->attid);
2929 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, frame, la->value.blob, &dn);
2930 if (!W_ERROR_IS_OK(werr)) {
2931 DEBUG(0,(__location__ ": Bad la blob in sort\n"));
2936 /* Extract the target GUID in NDR form */
2937 target_guid = ldb_dn_get_extended_component(dn->dn, "GUID");
2938 if (target_guid == NULL
2939 || target_guid->length != sizeof(guid_array[0].target_guid)) {
2940 status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2942 /* Repack the source GUID as NDR for sorting */
2943 status = GUID_to_ndr_blob(&la->identifier->guid,
2948 if (!NT_STATUS_IS_OK(status)
2949 || source_guid.length != sizeof(guid_array[0].source_guid)) {
2950 DEBUG(0,(__location__ ": Bad la guid in sort\n"));
2952 return ntstatus_to_werror(status);
2955 guid_array[j].link = &getnc_state->la_list[j];
2956 memcpy(guid_array[j].target_guid, target_guid->data,
2957 sizeof(guid_array[j].target_guid));
2958 memcpy(guid_array[j].source_guid, source_guid.data,
2959 sizeof(guid_array[j].source_guid));
2963 LDB_TYPESAFE_QSORT(guid_array, getnc_state->la_count, NULL, linked_attribute_compare);
2964 getnc_state->la_sorted = guid_array;
2967 link_count = getnc_state->la_count - getnc_state->la_idx;
2968 link_count = MIN(max_links, link_count);
2970 r->out.ctr->ctr6.linked_attributes_count = link_count;
2971 r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
2972 if (r->out.ctr->ctr6.linked_attributes == NULL) {
2973 DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count));
2974 return WERR_NOT_ENOUGH_MEMORY;
2977 for (k = 0; k < link_count; k++) {
2978 r->out.ctr->ctr6.linked_attributes[k]
2979 = *getnc_state->la_sorted[getnc_state->la_idx + k].link;
2982 getnc_state->la_idx += link_count;
2983 link_given = getnc_state->la_idx;
2985 if (getnc_state->la_idx < getnc_state->la_count) {
2986 r->out.ctr->ctr6.more_data = true;
2990 if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
2992 * TODO: This implementation is wrong
2993 * we should find out the total number of
2994 * objects and links in the whole naming context
2995 * at the start of the cycle and return these
2996 * values in each message.
2998 * For now we keep our current strategy and return
2999 * the number of objects for this cycle and the number
3000 * of links we found so far during the cycle.
3002 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
3003 r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->la_count;
3006 if (!r->out.ctr->ctr6.more_data) {
3007 talloc_steal(mem_ctx, getnc_state->la_list);
3009 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
3010 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
3011 &getnc_state->final_udv);
3013 talloc_free(getnc_state);
3014 b_state->getncchanges_state = NULL;
3016 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
3017 &r->out.ctr->ctr6.new_highwatermark);
3020 * We need to make sure that we never return the
3021 * same highwatermark within the same replication
3022 * cycle more than once. Otherwise we cannot detect
3023 * when the client uses an unexptected highwatermark.
3025 * This is a HACK which is needed because our
3026 * object ordering is wrong and set tmp_highest_usn
3027 * to a value that is higher than what we already
3028 * sent to the client (destination dsa).
3030 r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
3033 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
3036 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
3037 r->out.ctr->ctr6.uptodateness_vector = NULL;
3038 r->out.ctr->ctr6.nc_object_count = 0;
3039 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
3042 DEBUG(r->out.ctr->ctr6.more_data?4:2,
3043 ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
3044 (unsigned long long)(req10->highwatermark.highest_usn+1),
3045 req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
3046 r->out.ctr->ctr6.object_count,
3047 i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
3048 r->out.ctr->ctr6.linked_attributes_count,
3049 link_given, link_total,
3050 dom_sid_string(mem_ctx, user_sid)));
3053 if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
3054 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);