source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DSGetNCChanges call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009-2010
   8    Copyright (C) Andrew Bartlett 2010-2016
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "rpc_server/dcerpc_server.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "param/param.h"
  28 #include "librpc/gen_ndr/ndr_drsblobs.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "libcli/security/security.h"
  32 #include "libcli/security/session.h"
  33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  34 #include "rpc_server/dcerpc_server_proto.h"
  35 #include "rpc_server/common/sid_helper.h"
  36 #include "../libcli/drsuapi/drsuapi.h"
  37 #include "lib/util/binsearch.h"
  38 #include "lib/util/tsort.h"
  39 #include "auth/session.h"
  40 #include "dsdb/common/util.h"
  41 #include "lib/dbwrap/dbwrap.h"
  42 #include "lib/dbwrap/dbwrap_rbt.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44
  45 /* state of a partially completed getncchanges call */
  46 struct drsuapi_getncchanges_state {
  47         struct db_context *anc_cache;
  48         struct GUID *guids;
  49         uint32_t num_records;
  50         uint32_t num_processed;
  51         struct ldb_dn *ncRoot_dn;
  52         struct GUID ncRoot_guid;
  53         bool is_schema_nc;
  54         uint64_t min_usn;
  55         uint64_t max_usn;
  56         struct drsuapi_DsReplicaHighWaterMark last_hwm;
  57         struct ldb_dn *last_dn;
  58         struct drsuapi_DsReplicaHighWaterMark final_hwm;
  59         struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
  60         struct drsuapi_DsReplicaLinkedAttribute *la_list;
  61         uint32_t la_count;
  62         struct la_for_sorting *la_sorted;
  63         uint32_t la_idx;
  64 };
  65
  66 /* We must keep the GUIDs in NDR form for sorting */
  67 struct la_for_sorting {
  68         struct drsuapi_DsReplicaLinkedAttribute *link;
  69         uint8_t target_guid[16];
  70         uint8_t source_guid[16];
  71 };
  72
  73 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
  74                                               const struct drsuapi_DsReplicaHighWaterMark *h2)
  75 {
  76         if (h1->highest_usn < h2->highest_usn) {
  77                 return -1;
  78         } else if (h1->highest_usn > h2->highest_usn) {
  79                 return 1;
  80         } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
  81                 return -1;
  82         } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
  83                 return 1;
  84         } else if (h1->reserved_usn < h2->reserved_usn) {
  85                 return -1;
  86         } else if (h1->reserved_usn > h2->reserved_usn) {
  87                 return 1;
  88         }
  89
  90         return 0;
  91 }
  92
  93 /*
  94   build a DsReplicaObjectIdentifier from a ldb msg
  95  */
  96 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
  97                                                                        const struct ldb_message *msg)
  98 {
  99         struct drsuapi_DsReplicaObjectIdentifier *identifier;
 100         struct dom_sid *sid;
 101
 102         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 103         if (identifier == NULL) {
 104                 return NULL;
 105         }
 106
 107         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
 108         identifier->guid = samdb_result_guid(msg, "objectGUID");
 109
 110         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
 111         if (sid) {
 112                 identifier->sid = *sid;
 113         } else {
 114                 ZERO_STRUCT(identifier->sid);
 115         }
 116         return identifier;
 117 }
 118
 119 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
 120 {
 121         return GUID_compare(guid1, &guid2);
 122 }
 123
 124 /*
 125   see if we can filter an attribute using the uptodateness_vector
 126  */
 127 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
 128                        const struct GUID *originating_invocation_id,
 129                        uint64_t originating_usn)
 130 {
 131         const struct drsuapi_DsReplicaCursor *c;
 132         if (udv == NULL) return false;
 133         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
 134                             originating_invocation_id, udv_compare, c);
 135         if (c && originating_usn <= c->highest_usn) {
 136                 return true;
 137         }
 138         return false;
 139 }
 140
 141 static int uint32_t_cmp(uint32_t a1, uint32_t a2)
 142 {
 143         if (a1 == a2) return 0;
 144         return a1 > a2 ? 1 : -1;
 145 }
 146
 147 static int uint32_t_ptr_cmp(uint32_t *a1, uint32_t *a2, void *unused)
 148 {
 149         if (*a1 == *a2) return 0;
 150         return *a1 > *a2 ? 1 : -1;
 151 }
 152
 153 static WERROR getncchanges_attid_remote_to_local(const struct dsdb_schema *schema,
 154                                                  const struct dsdb_syntax_ctx *ctx,
 155                                                  enum drsuapi_DsAttributeId remote_attid_as_enum,
 156                                                  enum drsuapi_DsAttributeId *local_attid_as_enum,
 157                                                  const struct dsdb_attribute **_sa)
 158 {
 159         WERROR werr;
 160         const struct dsdb_attribute *sa = NULL;
 161
 162         if (ctx->pfm_remote == NULL) {
 163                 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
 164                 goto fail;
 165         }
 166
 167         werr = dsdb_attribute_drsuapi_remote_to_local(ctx,
 168                                                       remote_attid_as_enum,
 169                                                       local_attid_as_enum,
 170                                                       _sa);
 171         if (!W_ERROR_IS_OK(werr)) {
 172                 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
 173                 goto fail;
 174         }
 175
 176         return werr;
 177 fail:
 178
 179         sa = dsdb_attribute_by_attributeID_id(schema, remote_attid_as_enum);
 180         if (sa == NULL) {
 181                 return WERR_DS_DRA_SCHEMA_MISMATCH;
 182         } else {
 183                 if (local_attid_as_enum != NULL) {
 184                         *local_attid_as_enum = sa->attributeID_id;
 185                 }
 186                 if (_sa != NULL) {
 187                         *_sa = sa;
 188                 }
 189                 return WERR_OK;
 190         }
 191 }
 192
 193 /*
 194  * Similar to function in repl_meta_data without the extra
 195  * dependencies.
 196  */
 197 static WERROR get_parsed_dns_trusted(TALLOC_CTX *mem_ctx, struct ldb_message_element *el,
 198                                   struct parsed_dn **pdn)
 199 {
 200         /* Here we get a list of 'struct parsed_dns' without the parsing */
 201         int i;
 202         *pdn = talloc_zero_array(mem_ctx, struct parsed_dn,
 203                                  el->num_values);
 204         if (!*pdn) {
 205                 return WERR_DS_DRA_INTERNAL_ERROR;
 206         }
 207
 208         for (i = 0; i < el->num_values; i++) {
 209                 (*pdn)[i].v = &el->values[i];
 210         }
 211
 212         return WERR_OK;
 213 }
 214
 215 static WERROR getncchanges_update_revealed_list(struct ldb_context *sam_ctx,
 216                                                 TALLOC_CTX *mem_ctx,
 217                                                 struct ldb_message **msg,
 218                                                 struct ldb_dn *object_dn,
 219                                                 const struct GUID *object_guid,
 220                                                 const struct dsdb_attribute *sa,
 221                                                 struct replPropertyMetaData1 *meta_data,
 222                                                 struct ldb_message *revealed_users)
 223 {
 224         enum ndr_err_code ndr_err;
 225         int ldb_err;
 226         char *attr_str = NULL;
 227         char *attr_hex = NULL;
 228         DATA_BLOB attr_blob;
 229         struct ldb_message_element *existing = NULL, *el_add = NULL, *el_del = NULL;
 230         const char * const * secret_attributes = ldb_get_opaque(sam_ctx, "LDB_SECRET_ATTRIBUTE_LIST");
 231
 232         if (!ldb_attr_in_list(secret_attributes,
 233                               sa->lDAPDisplayName)) {
 234                 return WERR_OK;
 235         }
 236
 237
 238         ndr_err = ndr_push_struct_blob(&attr_blob, mem_ctx, meta_data, (ndr_push_flags_fn_t)ndr_push_replPropertyMetaData1);
 239         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 240                 return WERR_DS_DRA_INTERNAL_ERROR;
 241         }
 242
 243         attr_hex = hex_encode_talloc(mem_ctx, attr_blob.data, attr_blob.length);
 244         if (attr_hex == NULL) {
 245                 return WERR_NOT_ENOUGH_MEMORY;
 246         }
 247
 248         attr_str = talloc_asprintf(mem_ctx, "B:%zd:%s:%s", attr_blob.length*2, attr_hex, ldb_dn_get_linearized(object_dn));
 249         if (attr_str == NULL) {
 250                 return WERR_NOT_ENOUGH_MEMORY;
 251         }
 252
 253         existing = ldb_msg_find_element(revealed_users, "msDS-RevealedUsers");
 254         if (existing != NULL) {
 255                 /* Replace the old value (if one exists) with the current one */
 256                 struct parsed_dn *link_dns;
 257                 struct parsed_dn *exact = NULL, *unused = NULL;
 258                 WERROR werr;
 259                 uint8_t attid[4];
 260                 DATA_BLOB partial_meta;
 261
 262                 werr = get_parsed_dns_trusted(mem_ctx, existing, &link_dns);
 263                 if (!W_ERROR_IS_OK(werr)) {
 264                         return werr;
 265                 }
 266
 267                 /* Construct a partial metadata blob to match on in the DB */
 268                 SIVAL(attid, 0, sa->attributeID_id);
 269                 partial_meta.length = 4;
 270                 partial_meta.data = attid;
 271
 272                 /* Binary search using GUID and attribute id for uniqueness */
 273                 ldb_err = parsed_dn_find(sam_ctx, link_dns, existing->num_values,
 274                                          object_guid, object_dn,
 275                                          partial_meta, 4,
 276                                          &exact, &unused,
 277                                          DSDB_SYNTAX_BINARY_DN, true);
 278
 279                 if (ldb_err != LDB_SUCCESS) {
 280                         DEBUG(0,(__location__ ": Failed parsed DN find - %s\n",
 281                                  ldb_errstring(sam_ctx)));
 282                         return WERR_DS_DRA_INTERNAL_ERROR;
 283                 }
 284
 285                 if (exact != NULL) {
 286                         /* Perform some verification of the blob */
 287                         struct replPropertyMetaData1 existing_meta_data;
 288                         ndr_err = ndr_pull_struct_blob_all_noalloc(&exact->dsdb_dn->extra_part,
 289                                                                    &existing_meta_data,
 290                                                                    (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaData1);
 291                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 292                                 return WERR_DS_DRA_INTERNAL_ERROR;
 293                         }
 294
 295                         if (existing_meta_data.attid == sa->attributeID_id) {
 296                                 ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_DELETE, &el_del);
 297                                 if (ldb_err != LDB_SUCCESS) {
 298                                         return WERR_DS_DRA_INTERNAL_ERROR;
 299                                 }
 300
 301                                 el_del->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 302                                 if (el_del->values == NULL) {
 303                                         return WERR_NOT_ENOUGH_MEMORY;
 304                                 }
 305                                 el_del->values[0] = *exact->v;
 306                                 el_del->num_values = 1;
 307                         } else {
 308                                 return WERR_DS_DRA_INTERNAL_ERROR;
 309                         }
 310                 }
 311         }
 312
 313         ldb_err = ldb_msg_add_empty(*msg, "msDS-RevealedUsers", LDB_FLAG_MOD_ADD, &el_add);
 314         if (ldb_err != LDB_SUCCESS) {
 315                 return WERR_DS_DRA_INTERNAL_ERROR;
 316         }
 317
 318         el_add->values = talloc_array((*msg)->elements, struct ldb_val, 1);
 319         if (el_add->values == NULL) {
 320                 return WERR_NOT_ENOUGH_MEMORY;
 321
 322         }
 323
 324         el_add->values[0] = data_blob_string_const(attr_str);
 325         el_add->num_values = 1;
 326
 327         return WERR_OK;
 328 }
 329
 330 /*
 331  * This function filter attributes for build_object based on the
 332  * uptodatenessvector and partial attribute set.
 333  *
 334  * Any secret attributes are forced here for REPL_SECRET, and audited at this
 335  * point with msDS-RevealedUsers.
 336  */
 337 static WERROR get_nc_changes_filter_attrs(struct drsuapi_DsReplicaObjectListItemEx *obj,
 338                                           struct replPropertyMetaDataBlob md,
 339                                           struct ldb_context *sam_ctx,
 340                                           const struct ldb_message *msg,
 341                                           const struct GUID *guid,
 342                                           uint32_t *count,
 343                                           uint64_t highest_usn,
 344                                           const struct dsdb_attribute *rdn_sa,
 345                                           struct dsdb_schema *schema,
 346                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 347                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 348                                           uint32_t *local_pas,
 349                                           uint32_t *attids,
 350                                           bool exop_secret,
 351                                           struct ldb_message **revealed_list_msg,
 352                                           struct ldb_message *existing_revealed_list_msg)
 353 {
 354         uint32_t i, n;
 355         WERROR werr;
 356         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 357                 const struct dsdb_attribute *sa;
 358                 bool force_attribute = false;
 359
 360                 /* if the attribute has not changed, and it is not the
 361                    instanceType then don't include it */
 362                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 363                     !exop_secret &&
 364                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
 365
 366                 /* don't include the rDN */
 367                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 368
 369                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 370                 if (!sa) {
 371                         DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
 372                                  (unsigned int)md.ctr.ctr1.array[i].attid,
 373                                  ldb_dn_get_linearized(msg->dn)));
 374                         return WERR_DS_DRA_INTERNAL_ERROR;
 375                 }
 376
 377                 if (sa->linkID) {
 378                         struct ldb_message_element *el;
 379                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 380                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 381                                 /* don't send upgraded links inline */
 382                                 continue;
 383                         }
 384                 }
 385
 386                 if (exop_secret &&
 387                     !dsdb_attr_in_rodc_fas(sa)) {
 388                         force_attribute = true;
 389                         DEBUG(4,("Forcing attribute %s in %s\n",
 390                                  sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 391                         werr = getncchanges_update_revealed_list(sam_ctx, obj,
 392                                                                  revealed_list_msg,
 393                                                                  msg->dn, guid, sa,
 394                                                                  &md.ctr.ctr1.array[i],
 395                                                                  existing_revealed_list_msg);
 396                         if (!W_ERROR_IS_OK(werr)) {
 397                                 return werr;
 398                         }
 399                 }
 400
 401                 /* filter by uptodateness_vector */
 402                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
 403                     !force_attribute &&
 404                     udv_filter(uptodateness_vector,
 405                                &md.ctr.ctr1.array[i].originating_invocation_id,
 406                                md.ctr.ctr1.array[i].originating_usn)) {
 407                         continue;
 408                 }
 409
 410                 /* filter by partial_attribute_set */
 411                 if (partial_attribute_set && !force_attribute) {
 412                         uint32_t *result = NULL;
 413                         BINARY_ARRAY_SEARCH_V(local_pas, partial_attribute_set->num_attids, sa->attributeID_id,
 414                                               uint32_t_cmp, result);
 415                         if (result == NULL) {
 416                                 continue;
 417                         }
 418                 }
 419
 420                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 421                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 422                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 423                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 424                 attids[n] = md.ctr.ctr1.array[i].attid;
 425
 426                 n++;
 427         }
 428
 429         *count = n;
 430
 431         return WERR_OK;
 432 }
 433
 434 /*
 435   drsuapi_DsGetNCChanges for one object
 436 */
 437 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
 438                                           const struct ldb_message *msg,
 439                                           struct ldb_context *sam_ctx,
 440                                           struct ldb_dn *ncRoot_dn,
 441                                           bool   is_schema_nc,
 442                                           struct dsdb_schema *schema,
 443                                           DATA_BLOB *session_key,
 444                                           uint64_t highest_usn,
 445                                           uint32_t replica_flags,
 446                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 447                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 448                                           enum drsuapi_DsExtendedOperation extended_op,
 449                                           bool force_object_return,
 450                                           uint32_t *local_pas,
 451                                           struct ldb_dn *machine_dn,
 452                                           const struct GUID *guid)
 453 {
 454         const struct ldb_val *md_value;
 455         uint32_t i, n;
 456         struct replPropertyMetaDataBlob md;
 457         uint32_t rid = 0;
 458         int ldb_err;
 459         enum ndr_err_code ndr_err;
 460         uint32_t *attids;
 461         const char *rdn;
 462         const struct dsdb_attribute *rdn_sa;
 463         uint64_t uSNChanged;
 464         unsigned int instanceType;
 465         struct dsdb_syntax_ctx syntax_ctx;
 466         struct ldb_result *res = NULL;
 467         WERROR werr;
 468         int ret;
 469
 470         /* make dsdb sytanx context for conversions */
 471         dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
 472         syntax_ctx.is_schema_nc = is_schema_nc;
 473
 474         uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 475         instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
 476         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 477                 obj->is_nc_prefix = true;
 478                 obj->parent_object_guid = NULL;
 479         } else {
 480                 obj->is_nc_prefix = false;
 481                 obj->parent_object_guid = talloc(obj, struct GUID);
 482                 if (obj->parent_object_guid == NULL) {
 483                         return WERR_DS_DRA_INTERNAL_ERROR;
 484                 }
 485                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 486                 if (GUID_all_zero(obj->parent_object_guid)) {
 487                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 488                                  ldb_dn_get_linearized(msg->dn)));
 489                         return WERR_DS_DRA_INTERNAL_ERROR;
 490                 }
 491         }
 492         obj->next_object = NULL;
 493
 494         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 495         if (!md_value) {
 496                 /* nothing to send */
 497                 return WERR_OK;
 498         }
 499
 500         if (instanceType & INSTANCE_TYPE_UNINSTANT) {
 501                 /* don't send uninstantiated objects */
 502                 return WERR_OK;
 503         }
 504
 505         if (uSNChanged <= highest_usn) {
 506                 /* nothing to send */
 507                 return WERR_OK;
 508         }
 509
 510         ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
 511                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 512         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 513                 return WERR_DS_DRA_INTERNAL_ERROR;
 514         }
 515
 516         if (md.version != 1) {
 517                 return WERR_DS_DRA_INTERNAL_ERROR;
 518         }
 519
 520         rdn = ldb_dn_get_rdn_name(msg->dn);
 521         if (rdn == NULL) {
 522                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 523                 return WERR_DS_DRA_INTERNAL_ERROR;
 524         }
 525
 526         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 527         if (rdn_sa == NULL) {
 528                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 529                          rdn, ldb_dn_get_linearized(msg->dn)));
 530                 return WERR_DS_DRA_INTERNAL_ERROR;
 531         }
 532
 533         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 534         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 535
 536         obj->object.identifier = get_object_identifier(obj, msg);
 537         if (obj->object.identifier == NULL) {
 538                 return WERR_NOT_ENOUGH_MEMORY;
 539         }
 540         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 541
 542         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 543
 544         if (extended_op == DRSUAPI_EXOP_REPL_SECRET) {
 545                 /* Get the existing revealed users for the destination */
 546                 struct ldb_message *revealed_list_msg = NULL;
 547                 struct ldb_message *existing_revealed_list_msg = NULL;
 548                 const char *machine_attrs[] = {
 549                         "msDS-RevealedUsers",
 550                         NULL
 551                 };
 552
 553                 revealed_list_msg = ldb_msg_new(sam_ctx);
 554                 if (revealed_list_msg == NULL) {
 555                         return WERR_NOT_ENOUGH_MEMORY;
 556                 }
 557                 revealed_list_msg->dn = machine_dn;
 558
 559                 ret = ldb_transaction_start(sam_ctx);
 560                 if (ret != LDB_SUCCESS) {
 561                         DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 562                                  ldb_errstring(sam_ctx)));
 563                         return WERR_DS_DRA_INTERNAL_ERROR;
 564                 }
 565
 566                 ldb_err = dsdb_search_dn(sam_ctx, obj, &res, machine_dn, machine_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN);
 567                 if (ldb_err != LDB_SUCCESS || res->count != 1) {
 568                         ldb_transaction_cancel(sam_ctx);
 569                         return WERR_DS_DRA_INTERNAL_ERROR;
 570                 }
 571
 572                 existing_revealed_list_msg = res->msgs[0];
 573
 574                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg,
 575                                                    guid, &n, highest_usn,
 576                                                    rdn_sa, schema,
 577                                                    uptodateness_vector,
 578                                                    partial_attribute_set, local_pas,
 579                                                    attids,
 580                                                    true,
 581                                                    &revealed_list_msg,
 582                                                    existing_revealed_list_msg);
 583                 if (!W_ERROR_IS_OK(werr)) {
 584                         ldb_transaction_cancel(sam_ctx);
 585                         return werr;
 586                 }
 587
 588                 if (revealed_list_msg != NULL) {
 589                         ret = ldb_modify(sam_ctx, revealed_list_msg);
 590                         if (ret != LDB_SUCCESS) {
 591                                 DEBUG(0,(__location__ ": Failed to alter revealed links - %s\n",
 592                                          ldb_errstring(sam_ctx)));
 593                                 ldb_transaction_cancel(sam_ctx);
 594                                 return WERR_DS_DRA_INTERNAL_ERROR;
 595                         }
 596                 }
 597
 598                 ret = ldb_transaction_commit(sam_ctx);
 599                 if (ret != LDB_SUCCESS) {
 600                         DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 601                                  ldb_errstring(sam_ctx)));
 602                         return WERR_DS_DRA_INTERNAL_ERROR;
 603                 }
 604         } else {
 605                 werr = get_nc_changes_filter_attrs(obj, md, sam_ctx, msg, guid,
 606                                                    &n, highest_usn, rdn_sa,
 607                                                    schema, uptodateness_vector,
 608                                                    partial_attribute_set, local_pas,
 609                                                    attids,
 610                                                    false,
 611                                                    NULL,
 612                                                    NULL);
 613                 if (!W_ERROR_IS_OK(werr)) {
 614                         return werr;
 615                 }
 616         }
 617
 618         /* ignore it if its an empty change. Note that renames always
 619          * change the 'name' attribute, so they won't be ignored by
 620          * this
 621
 622          * the force_object_return check is used to force an empty
 623          * object return when we timeout in the getncchanges loop.
 624          * This allows us to return an empty object, which keeps the
 625          * client happy while preventing timeouts
 626          */
 627         if (n == 0 ||
 628             (n == 1 &&
 629              attids[0] == DRSUAPI_ATTID_instanceType &&
 630              !force_object_return)) {
 631                 talloc_free(obj->meta_data_ctr);
 632                 obj->meta_data_ctr = NULL;
 633                 return WERR_OK;
 634         }
 635
 636         obj->meta_data_ctr->count = n;
 637
 638         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 639         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 640         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 641                                                             obj->object.attribute_ctr.num_attributes);
 642         if (obj->object.attribute_ctr.attributes == NULL) {
 643                 return WERR_NOT_ENOUGH_MEMORY;
 644         }
 645
 646         /*
 647          * Note that the meta_data array and the attributes array must
 648          * be the same size and in the same order
 649          */
 650         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 651                 struct ldb_message_element *el;
 652                 const struct dsdb_attribute *sa;
 653
 654                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 655                 if (!sa) {
 656                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 657                         return WERR_DS_DRA_INTERNAL_ERROR;
 658                 }
 659
 660                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 661                 if (el == NULL) {
 662                         /* this happens for attributes that have been removed */
 663                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 664                                  sa->lDAPDisplayName, attids[i]));
 665                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 666                         obj->object.attribute_ctr.attributes[i].attid =
 667                                         dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
 668                 } else {
 669                         werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
 670                                                           &obj->object.attribute_ctr.attributes[i]);
 671                         if (!W_ERROR_IS_OK(werr)) {
 672                                 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
 673                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 674                                          win_errstr(werr)));
 675                                 return werr;
 676                         }
 677                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 678                          * check if attribute is secret and send a null value
 679                          */
 680                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 681                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 682                                                                  &obj->meta_data_ctr->meta_data[i]);
 683                         }
 684                         /* some attributes needs to be encrypted
 685                            before being sent */
 686                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 687                                                          &obj->object.attribute_ctr.attributes[i]);
 688                         if (!W_ERROR_IS_OK(werr)) {
 689                                 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
 690                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 691                                          win_errstr(werr)));
 692                                 return werr;
 693                         }
 694                 }
 695                 if (attids[i] != obj->object.attribute_ctr.attributes[i].attid) {
 696                         DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID:  "
 697                                   "0x%08x vs 0x%08x "
 698                                   "Run dbcheck!\n",
 699                                   sa->lDAPDisplayName,
 700                                   ldb_dn_get_linearized(msg->dn),
 701                                   attids[i],
 702                                   obj->object.attribute_ctr.attributes[i].attid));
 703                         return WERR_DS_DATABASE_ERROR;
 704                 }
 705         }
 706
 707         return WERR_OK;
 708 }
 709
 710 /*
 711   add one linked attribute from an object to the list of linked
 712   attributes in a getncchanges request
 713  */
 714 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 715                                     struct ldb_context *sam_ctx,
 716                                     const struct dsdb_schema *schema,
 717                                     const struct dsdb_attribute *sa,
 718                                     const struct ldb_message *msg,
 719                                     struct dsdb_dn *dsdb_dn,
 720                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 721                                     uint32_t *la_count,
 722                                     bool is_schema_nc)
 723 {
 724         struct drsuapi_DsReplicaLinkedAttribute *la;
 725         bool active;
 726         NTSTATUS status;
 727         WERROR werr;
 728
 729         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 730         W_ERROR_HAVE_NO_MEMORY(*la_list);
 731
 732         la = &(*la_list)[*la_count];
 733
 734         la->identifier = get_object_identifier(*la_list, msg);
 735         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 736
 737         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 738
 739         if (!active) {
 740                 /* We have to check that the inactive link still point to an existing object */
 741                 struct GUID guid;
 742                 struct ldb_dn *tdn;
 743                 int ret;
 744                 const char *v;
 745
 746                 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
 747                 if (strncmp(v, "TRUE", 4) == 0) {
 748                         /*
 749                           * Note: we skip the transmition of the deleted link even if the other part used to
 750                           * know about it because when we transmit the deletion of the object, the link will
 751                           * be deleted too due to deletion of object where link points and Windows do so.
 752                           */
 753                         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
 754                                 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
 755                                 /*
 756                                  * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
 757                                  * if it join an existing domain with deleted objets, it firsts impose to have a
 758                                  * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
 759                                  * either during initial replication or after the getNCChanges.
 760                                  * Behavior of samba has been changed to always have this attribute if it's present in the schema.
 761                                  *
 762                                  * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
 763                                  * If FL >=2K8R2 we are sure that this attribute will be here.
 764                                  * For this kind of forest level we do not return the link if the object is recycled
 765                                  * (isRecycled = true).
 766                                  */
 767                                 if (strncmp(v, "TRUE", 4) == 0) {
 768                                         DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
 769                                                                 ldb_dn_get_linearized(msg->dn)));
 770                                         return WERR_OK;
 771                                 }
 772                         } else {
 773                                 return WERR_OK;
 774                         }
 775                 }
 776                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
 777                 if (!NT_STATUS_IS_OK(status)) {
 778                         DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 779                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 780                         return ntstatus_to_werror(status);
 781                 }
 782                 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
 783                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 784                         DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 785                                                 GUID_string(mem_ctx, &guid)));
 786                         return WERR_OK;
 787                 } else if (ret != LDB_SUCCESS) {
 788                         DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 789                                                 GUID_string(mem_ctx, &guid),
 790                                                 ret));
 791                         return WERR_OK;
 792                 }
 793         }
 794         la->attid = dsdb_attribute_get_attid(sa, is_schema_nc);
 795         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 796
 797         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 798         if (!NT_STATUS_IS_OK(status)) {
 799                 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
 800                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 801                 return ntstatus_to_werror(status);
 802         }
 803         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 804         if (!NT_STATUS_IS_OK(status)) {
 805                 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
 806                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 807                 return ntstatus_to_werror(status);
 808         }
 809         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 810         if (!NT_STATUS_IS_OK(status)) {
 811                 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
 812                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 813                 return ntstatus_to_werror(status);
 814         }
 815         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 816         if (!NT_STATUS_IS_OK(status)) {
 817                 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
 818                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 819                 return ntstatus_to_werror(status);
 820         }
 821
 822         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 823         if (!NT_STATUS_IS_OK(status)) {
 824                 /* this is possible for upgraded links */
 825                 la->originating_add_time = la->meta_data.originating_change_time;
 826         }
 827
 828         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 829         W_ERROR_NOT_OK_RETURN(werr);
 830
 831         (*la_count)++;
 832         return WERR_OK;
 833 }
 834
 835
 836 /*
 837   add linked attributes from an object to the list of linked
 838   attributes in a getncchanges request
 839  */
 840 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 841                                        TALLOC_CTX *mem_ctx,
 842                                        struct ldb_dn *ncRoot_dn,
 843                                        bool is_schema_nc,
 844                                        struct dsdb_schema *schema,
 845                                        uint64_t highest_usn,
 846                                        uint32_t replica_flags,
 847                                        const struct ldb_message *msg,
 848                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 849                                        uint32_t *la_count,
 850                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 851 {
 852         unsigned int i;
 853         TALLOC_CTX *tmp_ctx = NULL;
 854         uint64_t uSNChanged = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
 855         bool is_critical = ldb_msg_find_attr_as_bool(msg, "isCriticalSystemObject", false);
 856
 857         if (replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
 858                 if (!is_critical) {
 859                         return WERR_OK;
 860                 }
 861         }
 862
 863         if (uSNChanged <= highest_usn) {
 864                 return WERR_OK;
 865         }
 866
 867         tmp_ctx = talloc_new(mem_ctx);
 868         if (tmp_ctx == NULL) {
 869                 return WERR_NOT_ENOUGH_MEMORY;
 870         }
 871
 872         for (i=0; i<msg->num_elements; i++) {
 873                 struct ldb_message_element *el = &msg->elements[i];
 874                 const struct dsdb_attribute *sa;
 875                 unsigned int j;
 876
 877                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 878
 879                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 880                         /* we only want forward links */
 881                         continue;
 882                 }
 883
 884                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 885                         /* its an old style link, it will have been
 886                          * sent in the main replication data */
 887                         continue;
 888                 }
 889
 890                 for (j=0; j<el->num_values; j++) {
 891                         struct dsdb_dn *dsdb_dn;
 892                         uint64_t local_usn;
 893                         uint64_t originating_usn;
 894                         NTSTATUS status, status2;
 895                         WERROR werr;
 896                         struct GUID originating_invocation_id;
 897
 898                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 899                         if (dsdb_dn == NULL) {
 900                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 901                                          el->name, ldb_dn_get_linearized(msg->dn)));
 902                                 talloc_free(tmp_ctx);
 903                                 return WERR_DS_DRA_INTERNAL_ERROR;
 904                         }
 905
 906                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 907                         if (!NT_STATUS_IS_OK(status)) {
 908                                 /* this can happen for attributes
 909                                    given to us with old style meta
 910                                    data */
 911                                 continue;
 912                         }
 913
 914                         if (local_usn > uSNChanged) {
 915                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 916                                          el->name, ldb_dn_get_linearized(msg->dn)));
 917                                 talloc_free(tmp_ctx);
 918                                 return WERR_DS_DRA_INTERNAL_ERROR;
 919                         }
 920
 921                         if (local_usn <= highest_usn) {
 922                                 continue;
 923                         }
 924
 925                         status = dsdb_get_extended_dn_guid(dsdb_dn->dn,
 926                                                            &originating_invocation_id,
 927                                                            "RMD_INVOCID");
 928                         status2 = dsdb_get_extended_dn_uint64(dsdb_dn->dn,
 929                                                               &originating_usn,
 930                                                               "RMD_ORIGINATING_USN");
 931
 932                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(status2)) {
 933                                 if (udv_filter(uptodateness_vector,
 934                                                &originating_invocation_id,
 935                                                originating_usn)) {
 936                                         continue;
 937                                 }
 938                         }
 939
 940                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema,
 941                                                      sa, msg, dsdb_dn, la_list,
 942                                                      la_count, is_schema_nc);
 943                         if (!W_ERROR_IS_OK(werr)) {
 944                                 talloc_free(tmp_ctx);
 945                                 return werr;
 946                         }
 947                 }
 948         }
 949
 950         talloc_free(tmp_ctx);
 951         return WERR_OK;
 952 }
 953
 954 /*
 955   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 956  */
 957 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 958                                  struct ldb_dn *ncRoot_dn,
 959                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 960 {
 961         int ret;
 962
 963         udv->version = 2;
 964         udv->reserved1 = 0;
 965         udv->reserved2 = 0;
 966
 967         ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
 968         if (ret != LDB_SUCCESS) {
 969                 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
 970                          ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
 971                 return WERR_DS_DRA_INTERNAL_ERROR;
 972         }
 973
 974         return WERR_OK;
 975 }
 976
 977
 978 /* comparison function for linked attributes - see CompareLinks() in
 979  * MS-DRSR section 4.1.10.5.17 */
 980 static int linked_attribute_compare(const struct la_for_sorting *la1,
 981                                     const struct la_for_sorting *la2,
 982                                     void *opaque)
 983 {
 984         int c;
 985         c = memcmp(la1->source_guid,
 986                    la2->source_guid, sizeof(la2->source_guid));
 987         if (c != 0) {
 988                 return c;
 989         }
 990
 991         if (la1->link->attid != la2->link->attid) {
 992                 return la1->link->attid < la2->link->attid? -1:1;
 993         }
 994
 995         if ((la1->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
 996             (la2->link->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
 997                 return (la1->link->flags &
 998                         DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
 999         }
1000
1001         return memcmp(la1->target_guid,
1002                       la2->target_guid, sizeof(la2->target_guid));
1003 }
1004
1005 struct drsuapi_changed_objects {
1006         struct ldb_dn *dn;
1007         struct GUID guid;
1008         uint64_t usn;
1009 };
1010
1011 /*
1012   sort the objects we send first by uSNChanged
1013  */
1014 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
1015                                   struct drsuapi_changed_objects *m2,
1016                                   struct drsuapi_getncchanges_state *getnc_state)
1017 {
1018         int ret;
1019
1020         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
1021         if (ret == 0) {
1022                 return -1;
1023         }
1024
1025         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
1026         if (ret == 0) {
1027                 return 1;
1028         }
1029
1030         if (m1->usn == m2->usn) {
1031                 return ldb_dn_compare(m2->dn, m1->dn);
1032         }
1033
1034         if (m1->usn < m2->usn) {
1035                 return -1;
1036         }
1037
1038         return 1;
1039 }
1040
1041
1042 /*
1043   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
1044  */
1045 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
1046                                      TALLOC_CTX *mem_ctx,
1047                                      struct drsuapi_DsGetNCChangesRequest10 *req10,
1048                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1049                                      struct ldb_dn **rid_manager_dn)
1050 {
1051         struct ldb_dn *req_dn, *ntds_dn = NULL;
1052         int ret;
1053         struct ldb_context *ldb = b_state->sam_ctx;
1054         struct ldb_result *ext_res;
1055         struct dsdb_fsmo_extended_op *exop;
1056         bool is_us;
1057
1058         /*
1059           steps:
1060             - verify that the DN being asked for is the RID Manager DN
1061             - verify that we are the RID Manager
1062          */
1063
1064         /* work out who is the RID Manager, also return to caller */
1065         ret = samdb_rid_manager_dn(ldb, mem_ctx, rid_manager_dn);
1066         if (ret != LDB_SUCCESS) {
1067                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
1068                 return WERR_DS_DRA_INTERNAL_ERROR;
1069         }
1070
1071         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1072         if (!ldb_dn_validate(req_dn) ||
1073             ldb_dn_compare(req_dn, *rid_manager_dn) != 0) {
1074                 /* that isn't the RID Manager DN */
1075                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
1076                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1077                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1078                 return WERR_OK;
1079         }
1080
1081         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1082         ret = dsdb_find_dn_by_guid(ldb, mem_ctx, &req10->destination_dsa_guid, 0, &ntds_dn);
1083         if (ret != LDB_SUCCESS) {
1084                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1085                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1086                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1087                 return WERR_OK;
1088         }
1089
1090         /* find the DN of the RID Manager */
1091         ret = samdb_reference_dn_is_our_ntdsa(ldb, *rid_manager_dn, "fSMORoleOwner", &is_us);
1092         if (ret != LDB_SUCCESS) {
1093                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1094                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1095                 return WERR_DS_DRA_INTERNAL_ERROR;
1096         }
1097
1098         if (!is_us) {
1099                 /* we're not the RID Manager - go away */
1100                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
1101                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1102                 return WERR_OK;
1103         }
1104
1105         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
1106         W_ERROR_HAVE_NO_MEMORY(exop);
1107
1108         exop->fsmo_info = req10->fsmo_info;
1109         exop->destination_dsa_guid = req10->destination_dsa_guid;
1110
1111         ret = ldb_transaction_start(ldb);
1112         if (ret != LDB_SUCCESS) {
1113                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1114                          ldb_errstring(ldb)));
1115                 return WERR_DS_DRA_INTERNAL_ERROR;
1116         }
1117
1118         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
1119         if (ret != LDB_SUCCESS) {
1120                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
1121                          ldb_errstring(ldb)));
1122                 ldb_transaction_cancel(ldb);
1123                 return WERR_DS_DRA_INTERNAL_ERROR;
1124         }
1125
1126         ret = ldb_transaction_commit(ldb);
1127         if (ret != LDB_SUCCESS) {
1128                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1129                          ldb_errstring(ldb)));
1130                 return WERR_DS_DRA_INTERNAL_ERROR;
1131         }
1132
1133         talloc_free(ext_res);
1134
1135         DEBUG(2,("Allocated RID pool for server %s\n",
1136                  GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1137
1138         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1139
1140         return WERR_OK;
1141 }
1142
1143 /*
1144   handle a DRSUAPI_EXOP_REPL_SECRET call
1145  */
1146 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
1147                                        TALLOC_CTX *mem_ctx,
1148                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1149                                        struct dom_sid *user_sid,
1150                                        struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1151                                        bool has_get_all_changes,
1152                                        struct ldb_dn **machine_dn)
1153 {
1154         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1155         struct ldb_dn *obj_dn = NULL;
1156         struct ldb_dn *ntds_dn = NULL, *server_dn = NULL;
1157         struct ldb_dn *rodc_dn, *krbtgt_link_dn;
1158         int ret;
1159         const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", "objectGUID", NULL };
1160         const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
1161         struct ldb_result *rodc_res = NULL, *obj_res = NULL;
1162         const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
1163         const struct dom_sid *object_sid = NULL;
1164         WERROR werr;
1165         const struct dom_sid *additional_sids[] = { NULL, NULL };
1166
1167         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
1168                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1169
1170         /*
1171          * we need to work out if we will allow this DC to
1172          * replicate the secrets for this object
1173          *
1174          * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
1175          * of this function
1176          */
1177
1178         if (b_state->sam_ctx_system == NULL) {
1179                 /* this operation needs system level access */
1180                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
1181                 return WERR_DS_DRA_ACCESS_DENIED;
1182         }
1183
1184         /*
1185          * Before we accept or deny, fetch the machine DN for the destination
1186          * DSA GUID.
1187          *
1188          * If we are the RODC, we will check that this matches the SID.
1189          */
1190         ret = dsdb_find_dn_by_guid(b_state->sam_ctx_system, mem_ctx,
1191                                    &req10->destination_dsa_guid, 0,
1192                                    &ntds_dn);
1193         if (ret != LDB_SUCCESS) {
1194                 goto failed;
1195         }
1196
1197         server_dn = ldb_dn_get_parent(mem_ctx, ntds_dn);
1198         if (server_dn == NULL) {
1199                 goto failed;
1200         }
1201
1202         ret = samdb_reference_dn(b_state->sam_ctx_system, mem_ctx, server_dn,
1203                                  "serverReference", machine_dn);
1204
1205         if (ret != LDB_SUCCESS) {
1206                 goto failed;
1207         }
1208
1209         /*
1210          * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1211          *
1212          * The pseudo code indicate
1213          * revealsecrets = true
1214          * if IsRevealSecretRequest(msgIn) then
1215          *   if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1216          *   then
1217          *     if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1218          *     <... check if this account is ok to be replicated on this DC ...>
1219          *     <... and if not reveal secrets = no ...>
1220          *     else
1221          *       reveal secrets = false
1222          *     endif
1223          *   endif
1224          * endif
1225          *
1226          * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1227          * then you can do EXOP_REPL_SECRETS
1228          */
1229         obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
1230         if (!ldb_dn_validate(obj_dn)) goto failed;
1231
1232         if (has_get_all_changes) {
1233                 goto allowed;
1234         }
1235
1236         rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
1237                                  dom_sid_string(mem_ctx, user_sid));
1238         if (!ldb_dn_validate(rodc_dn)) goto failed;
1239
1240         /* do the two searches we need */
1241         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
1242                              DSDB_SEARCH_SHOW_EXTENDED_DN);
1243         if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
1244
1245         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1246         if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1247
1248         /* if the object SID is equal to the user_sid, allow */
1249         object_sid = samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid");
1250         if (dom_sid_equal(user_sid, object_sid)) {
1251                 goto allowed;
1252         }
1253
1254         additional_sids[0] = object_sid;
1255
1256         /*
1257          * Must be an RODC account at this point, verify machine DN matches the
1258          * SID account
1259          */
1260         if (ldb_dn_compare(rodc_res->msgs[0]->dn, *machine_dn) != 0) {
1261                 goto denied;
1262         }
1263
1264         /* an RODC is allowed to get its own krbtgt account secrets */
1265         krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1266                                          rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1267         if (krbtgt_link_dn != NULL &&
1268             ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1269                 goto allowed;
1270         }
1271
1272         /* but it isn't allowed to get anyone elses krbtgt secrets */
1273         if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1274                             obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1275                 goto denied;
1276         }
1277
1278         if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1279                                       "userAccountControl", 0) &
1280             UF_INTERDOMAIN_TRUST_ACCOUNT) {
1281                 goto denied;
1282         }
1283
1284         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1285                                          mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1286         if (!W_ERROR_IS_OK(werr)) {
1287                 goto denied;
1288         }
1289
1290         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1291                                          mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1292         if (!W_ERROR_IS_OK(werr)) {
1293                 goto denied;
1294         }
1295
1296         /*
1297          * The SID list needs to include itself as well as the tokenGroups.
1298          *
1299          * TODO determine if sIDHistory is required for this check
1300          */
1301         werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1302                                           mem_ctx, "tokenGroups", &token_sids,
1303                                           additional_sids, 1);
1304         if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1305                 goto denied;
1306         }
1307
1308         if (never_reveal_sids &&
1309             sid_list_match(token_sids, never_reveal_sids)) {
1310                 goto denied;
1311         }
1312
1313         if (reveal_sids &&
1314             sid_list_match(token_sids, reveal_sids)) {
1315                 goto allowed;
1316         }
1317
1318         /* default deny */
1319 denied:
1320         DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1321                  ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1322         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1323         return WERR_DS_DRA_SECRETS_DENIED;
1324
1325 allowed:
1326         DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1327                  ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1328                  ldb_dn_get_linearized(*machine_dn)));
1329         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1330         req10->highwatermark.highest_usn = 0;
1331         return WERR_OK;
1332
1333 failed:
1334         DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1335                  ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1336         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1337         return WERR_DS_DRA_BAD_DN;
1338 }
1339
1340 /*
1341   handle a DRSUAPI_EXOP_REPL_OBJ call
1342  */
1343 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1344                                     TALLOC_CTX *mem_ctx,
1345                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
1346                                     struct dom_sid *user_sid,
1347                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1348 {
1349         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1350
1351         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1352                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1353
1354         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1355         return WERR_OK;
1356 }
1357
1358
1359 /*
1360   handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1361   DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1362   and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1363  */
1364 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1365                                          TALLOC_CTX *mem_ctx,
1366                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
1367                                          struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1368 {
1369         struct ldb_dn *req_dn, *ntds_dn;
1370         int ret;
1371         unsigned int i;
1372         struct ldb_context *ldb = b_state->sam_ctx;
1373         struct ldb_message *msg;
1374         bool is_us;
1375
1376         /*
1377           steps:
1378             - verify that the client dn exists
1379             - verify that we are the current master
1380          */
1381
1382         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1383         if (!ldb_dn_validate(req_dn)) {
1384                 /* that is not a valid dn */
1385                 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1386                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1387                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1388                 return WERR_OK;
1389         }
1390
1391         /* find the DN of the current role owner */
1392         ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1393         if (ret != LDB_SUCCESS) {
1394                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1395                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1396                 return WERR_DS_DRA_INTERNAL_ERROR;
1397         }
1398
1399         if (!is_us) {
1400                 /* we're not the RID Manager or role owner - go away */
1401                 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1402                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1403                 return WERR_OK;
1404         }
1405
1406         /* change the current master */
1407         msg = ldb_msg_new(ldb);
1408         W_ERROR_HAVE_NO_MEMORY(msg);
1409         msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1410         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1411
1412         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1413         ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1414         if (ret != LDB_SUCCESS) {
1415                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1416                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1417                 talloc_free(msg);
1418                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1419                 return WERR_OK;
1420         }
1421
1422         ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1423         if (ret != 0) {
1424                 talloc_free(msg);
1425                 return WERR_DS_DRA_INTERNAL_ERROR;
1426         }
1427
1428         for (i=0;i<msg->num_elements;i++) {
1429                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1430         }
1431
1432         ret = ldb_transaction_start(ldb);
1433         if (ret != LDB_SUCCESS) {
1434                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1435                          ldb_errstring(ldb)));
1436                 return WERR_DS_DRA_INTERNAL_ERROR;
1437         }
1438
1439         ret = ldb_modify(ldb, msg);
1440         if (ret != LDB_SUCCESS) {
1441                 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1442                          ldb_errstring(ldb)));
1443                 ldb_transaction_cancel(ldb);
1444                 return WERR_DS_DRA_INTERNAL_ERROR;
1445         }
1446
1447         ret = ldb_transaction_commit(ldb);
1448         if (ret != LDB_SUCCESS) {
1449                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1450                          ldb_errstring(ldb)));
1451                 return WERR_DS_DRA_INTERNAL_ERROR;
1452         }
1453
1454         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1455
1456         return WERR_OK;
1457 }
1458
1459 /*
1460   see if this getncchanges request includes a request to reveal secret information
1461  */
1462 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1463                                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1464                                                        struct dsdb_schema_prefixmap *pfm_remote,
1465                                                        bool *is_secret_request)
1466 {
1467         enum drsuapi_DsExtendedOperation exop;
1468         uint32_t i;
1469         struct dsdb_schema *schema;
1470         struct dsdb_syntax_ctx syntax_ctx;
1471
1472         *is_secret_request = true;
1473
1474         exop = req10->extended_op;
1475
1476         switch (exop) {
1477         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1478         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1479         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1480         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1481         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1482                 /* FSMO exops can reveal secrets */
1483                 *is_secret_request = true;
1484                 return WERR_OK;
1485         case DRSUAPI_EXOP_REPL_SECRET:
1486         case DRSUAPI_EXOP_REPL_OBJ:
1487         case DRSUAPI_EXOP_NONE:
1488                 break;
1489         }
1490
1491         if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1492                 *is_secret_request = false;
1493                 return WERR_OK;
1494         }
1495
1496         if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1497             req10->partial_attribute_set == NULL) {
1498                 /* they want secrets */
1499                 *is_secret_request = true;
1500                 return WERR_OK;
1501         }
1502
1503         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1504         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1505         syntax_ctx.pfm_remote = pfm_remote;
1506
1507         /* check the attributes they asked for */
1508         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1509                 const struct dsdb_attribute *sa;
1510                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1511                                                                  &syntax_ctx,
1512                                                                  req10->partial_attribute_set->attids[i],
1513                                                                  NULL,
1514                                                                  &sa);
1515
1516                 if (!W_ERROR_IS_OK(werr)) {
1517                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1518                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1519                         return werr;
1520                 }
1521
1522                 if (!dsdb_attr_in_rodc_fas(sa)) {
1523                         *is_secret_request = true;
1524                         return WERR_OK;
1525                 }
1526         }
1527
1528         if (req10->partial_attribute_set_ex) {
1529                 /* check the extended attributes they asked for */
1530                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1531                         const struct dsdb_attribute *sa;
1532                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1533                                                                          &syntax_ctx,
1534                                                                          req10->partial_attribute_set_ex->attids[i],
1535                                                                          NULL,
1536                                                                          &sa);
1537
1538                         if (!W_ERROR_IS_OK(werr)) {
1539                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1540                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1541                                 return werr;
1542                         }
1543
1544                         if (!dsdb_attr_in_rodc_fas(sa)) {
1545                                 *is_secret_request = true;
1546                                 return WERR_OK;
1547                         }
1548                 }
1549         }
1550
1551         *is_secret_request = false;
1552         return WERR_OK;
1553 }
1554
1555 /*
1556   see if this getncchanges request is only for attributes in the GC
1557   partial attribute set
1558  */
1559 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1560                                                struct drsuapi_DsGetNCChangesRequest10 *req10,
1561                                                struct dsdb_schema_prefixmap *pfm_remote,
1562                                                bool *is_gc_pas_request)
1563 {
1564         enum drsuapi_DsExtendedOperation exop;
1565         uint32_t i;
1566         struct dsdb_schema *schema;
1567         struct dsdb_syntax_ctx syntax_ctx;
1568
1569         exop = req10->extended_op;
1570
1571         switch (exop) {
1572         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1573         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1574         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1575         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1576         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1577         case DRSUAPI_EXOP_REPL_SECRET:
1578                 *is_gc_pas_request = false;
1579                 return WERR_OK;
1580         case DRSUAPI_EXOP_REPL_OBJ:
1581         case DRSUAPI_EXOP_NONE:
1582                 break;
1583         }
1584
1585         if (req10->partial_attribute_set == NULL) {
1586                 /* they want it all */
1587                 *is_gc_pas_request = false;
1588                 return WERR_OK;
1589         }
1590
1591         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1592         dsdb_syntax_ctx_init(&syntax_ctx, b_state->sam_ctx, schema);
1593         syntax_ctx.pfm_remote = pfm_remote;
1594
1595         /* check the attributes they asked for */
1596         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1597                 const struct dsdb_attribute *sa;
1598                 WERROR werr = getncchanges_attid_remote_to_local(schema,
1599                                                                  &syntax_ctx,
1600                                                                  req10->partial_attribute_set->attids[i],
1601                                                                  NULL,
1602                                                                  &sa);
1603
1604                 if (!W_ERROR_IS_OK(werr)) {
1605                         DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1606                                  req10->partial_attribute_set->attids[i], win_errstr(werr)));
1607                         return werr;
1608                 }
1609
1610                 if (!sa->isMemberOfPartialAttributeSet) {
1611                         *is_gc_pas_request = false;
1612                         return WERR_OK;
1613                 }
1614         }
1615
1616         if (req10->partial_attribute_set_ex) {
1617                 /* check the extended attributes they asked for */
1618                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1619                         const struct dsdb_attribute *sa;
1620                         WERROR werr = getncchanges_attid_remote_to_local(schema,
1621                                                                          &syntax_ctx,
1622                                                                          req10->partial_attribute_set_ex->attids[i],
1623                                                                          NULL,
1624                                                                          &sa);
1625
1626                         if (!W_ERROR_IS_OK(werr)) {
1627                                 DEBUG(0,(__location__": attid 0x%08X not found: %s\n",
1628                                          req10->partial_attribute_set_ex->attids[i], win_errstr(werr)));
1629                                 return werr;
1630                         }
1631
1632                         if (!sa->isMemberOfPartialAttributeSet) {
1633                                 *is_gc_pas_request = false;
1634                                 return WERR_OK;
1635                         }
1636                 }
1637         }
1638
1639         *is_gc_pas_request = true;
1640         return WERR_OK;
1641 }
1642
1643
1644 /*
1645   map from req8 to req10
1646  */
1647 static struct drsuapi_DsGetNCChangesRequest10 *
1648 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1649                       struct drsuapi_DsGetNCChangesRequest8 *req8)
1650 {
1651         struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1652                                                                     struct drsuapi_DsGetNCChangesRequest10);
1653         if (req10 == NULL) {
1654                 return NULL;
1655         }
1656
1657         req10->destination_dsa_guid = req8->destination_dsa_guid;
1658         req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1659         req10->naming_context = req8->naming_context;
1660         req10->highwatermark = req8->highwatermark;
1661         req10->uptodateness_vector = req8->uptodateness_vector;
1662         req10->replica_flags = req8->replica_flags;
1663         req10->max_object_count = req8->max_object_count;
1664         req10->max_ndr_size = req8->max_ndr_size;
1665         req10->extended_op = req8->extended_op;
1666         req10->fsmo_info = req8->fsmo_info;
1667         req10->partial_attribute_set = req8->partial_attribute_set;
1668         req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1669         req10->mapping_ctr = req8->mapping_ctr;
1670
1671         return req10;
1672 }
1673
1674 static const char *collect_objects_attrs[] = { "uSNChanged",
1675                                                "objectGUID" ,
1676                                                NULL };
1677
1678 /**
1679  * Collects object for normal replication cycle.
1680  */
1681 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1682                                            TALLOC_CTX *mem_ctx,
1683                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
1684                                            struct ldb_dn *search_dn,
1685                                            const char *extra_filter,
1686                                            struct ldb_result **search_res)
1687 {
1688         int ret;
1689         char* search_filter;
1690         enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1691         struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1692         bool critical_only = false;
1693
1694         if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1695                 critical_only = true;
1696         }
1697
1698         if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1699             req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1700                 scope = LDB_SCOPE_BASE;
1701                 critical_only = false;
1702         }
1703
1704         /* Construct response. */
1705         search_filter = talloc_asprintf(mem_ctx,
1706                                         "(uSNChanged>=%llu)",
1707                                         (unsigned long long)(getnc_state->min_usn+1));
1708
1709         if (extra_filter) {
1710                 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1711         }
1712
1713         if (critical_only) {
1714                 search_filter = talloc_asprintf(mem_ctx,
1715                                                 "(&%s(isCriticalSystemObject=TRUE))",
1716                                                 search_filter);
1717         }
1718
1719         if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1720                 scope = LDB_SCOPE_BASE;
1721         }
1722
1723         if (!search_dn) {
1724                 search_dn = getnc_state->ncRoot_dn;
1725         }
1726
1727         DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1728                  ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1729         ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1730                                               search_dn, scope,
1731                                               collect_objects_attrs,
1732                                               search_filter);
1733         if (ret != LDB_SUCCESS) {
1734                 return WERR_DS_DRA_INTERNAL_ERROR;
1735         }
1736
1737         return WERR_OK;
1738 }
1739
1740 /**
1741  * Collects object for normal replication cycle.
1742  */
1743 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1744                                                 TALLOC_CTX *mem_ctx,
1745                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
1746                                                 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1747                                                 struct ldb_dn *search_dn,
1748                                                 const char *extra_filter,
1749                                                 struct ldb_result **search_res)
1750 {
1751         /* we have nothing to do in case of ex-op failure */
1752         if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1753                 return WERR_OK;
1754         }
1755
1756         switch (req10->extended_op) {
1757         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1758         {
1759                 int ret;
1760                 struct ldb_dn *ntds_dn = NULL;
1761                 struct ldb_dn *server_dn = NULL;
1762                 struct ldb_dn *machine_dn = NULL;
1763                 struct ldb_dn *rid_set_dn = NULL;
1764                 struct ldb_result *search_res2 = NULL;
1765                 struct ldb_result *search_res3 = NULL;
1766                 TALLOC_CTX *frame = talloc_stackframe();
1767                 /* get RID manager, RID set and server DN (in that order) */
1768
1769                 /* This first search will get the RID Manager */
1770                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1771                                                       search_res,
1772                                                       search_dn, LDB_SCOPE_BASE,
1773                                                       collect_objects_attrs,
1774                                                       NULL);
1775                 if (ret != LDB_SUCCESS) {
1776                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1777                                   ldb_dn_get_linearized(search_dn),
1778                                   ldb_errstring(b_state->sam_ctx)));
1779                         TALLOC_FREE(frame);
1780                         return WERR_DS_DRA_INTERNAL_ERROR;
1781                 }
1782
1783                 if ((*search_res)->count != 1) {
1784                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1785                                   ldb_dn_get_linearized(search_dn),
1786                                   (*search_res)->count));
1787                         TALLOC_FREE(frame);
1788                         return WERR_DS_DRA_INTERNAL_ERROR;
1789                 }
1790
1791                 /* Now extend it to the RID set */
1792
1793                 /* Find the computer account DN for the destination
1794                  * dsa GUID specified */
1795
1796                 ret = dsdb_find_dn_by_guid(b_state->sam_ctx, frame,
1797                                            &req10->destination_dsa_guid, 0,
1798                                            &ntds_dn);
1799                 if (ret != LDB_SUCCESS) {
1800                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1801                                   GUID_string(frame,
1802                                               &req10->destination_dsa_guid),
1803                                   ldb_errstring(b_state->sam_ctx)));
1804                         TALLOC_FREE(frame);
1805                         return WERR_DS_DRA_INTERNAL_ERROR;
1806                 }
1807
1808                 server_dn = ldb_dn_get_parent(frame, ntds_dn);
1809                 if (!server_dn) {
1810                         TALLOC_FREE(frame);
1811                         return WERR_DS_DRA_INTERNAL_ERROR;
1812                 }
1813
1814                 ret = samdb_reference_dn(b_state->sam_ctx, frame, server_dn,
1815                                          "serverReference", &machine_dn);
1816                 if (ret != LDB_SUCCESS) {
1817                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1818                                   ldb_dn_get_linearized(server_dn),
1819                                   ldb_errstring(b_state->sam_ctx)));
1820                         TALLOC_FREE(frame);
1821                         return WERR_DS_DRA_INTERNAL_ERROR;
1822                 }
1823
1824                 ret = samdb_reference_dn(b_state->sam_ctx, frame, machine_dn,
1825                                          "rIDSetReferences", &rid_set_dn);
1826                 if (ret != LDB_SUCCESS) {
1827                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1828                                   ldb_dn_get_linearized(server_dn),
1829                                   ldb_errstring(b_state->sam_ctx)));
1830                         TALLOC_FREE(frame);
1831                         return WERR_DS_DRA_INTERNAL_ERROR;
1832                 }
1833
1834
1835                 /* This first search will get the RID Manager, now get the RID set */
1836                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1837                                                       &search_res2,
1838                                                       rid_set_dn, LDB_SCOPE_BASE,
1839                                                       collect_objects_attrs,
1840                                                       NULL);
1841                 if (ret != LDB_SUCCESS) {
1842                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1843                                   ldb_dn_get_linearized(rid_set_dn),
1844                                   ldb_errstring(b_state->sam_ctx)));
1845                         TALLOC_FREE(frame);
1846                         return WERR_DS_DRA_INTERNAL_ERROR;
1847                 }
1848
1849                 if (search_res2->count != 1) {
1850                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1851                                   ldb_dn_get_linearized(rid_set_dn),
1852                                   search_res2->count));
1853                         TALLOC_FREE(frame);
1854                         return WERR_DS_DRA_INTERNAL_ERROR;
1855                 }
1856
1857                 /* Finally get the server DN */
1858                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, frame,
1859                                                       &search_res3,
1860                                                       machine_dn, LDB_SCOPE_BASE,
1861                                                       collect_objects_attrs,
1862                                                       NULL);
1863                 if (ret != LDB_SUCCESS) {
1864                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1865                                   ldb_dn_get_linearized(server_dn),
1866                                   ldb_errstring(b_state->sam_ctx)));
1867                         TALLOC_FREE(frame);
1868                         return WERR_DS_DRA_INTERNAL_ERROR;
1869                 }
1870
1871                 if (search_res3->count != 1) {
1872                         DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1873                                   ldb_dn_get_linearized(server_dn),
1874                                   search_res3->count));
1875                         TALLOC_FREE(frame);
1876                         return WERR_DS_DRA_INTERNAL_ERROR;
1877                 }
1878
1879                 /* Now extend the original search_res with these answers */
1880                 (*search_res)->count = 3;
1881
1882                 (*search_res)->msgs = talloc_realloc(frame, (*search_res)->msgs,
1883                                                      struct ldb_message *,
1884                                                      (*search_res)->count);
1885                 if ((*search_res)->msgs == NULL) {
1886                         TALLOC_FREE(frame);
1887                         return WERR_NOT_ENOUGH_MEMORY;
1888                 }
1889
1890
1891                 talloc_steal(mem_ctx, *search_res);
1892                 (*search_res)->msgs[1] =
1893                         talloc_steal((*search_res)->msgs, search_res2->msgs[0]);
1894                 (*search_res)->msgs[2] =
1895                         talloc_steal((*search_res)->msgs, search_res3->msgs[0]);
1896
1897                 TALLOC_FREE(frame);
1898                 return WERR_OK;
1899         }
1900         default:
1901                 /* TODO: implement extended op specific collection
1902                  * of objects. Right now we just normal procedure
1903                  * for collecting objects */
1904                 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1905         }
1906 }
1907
1908 static void dcesrv_drsuapi_update_highwatermark(const struct ldb_message *msg,
1909                                                 uint64_t max_usn,
1910                                                 struct drsuapi_DsReplicaHighWaterMark *hwm)
1911 {
1912         uint64_t uSN = ldb_msg_find_attr_as_uint64(msg, "uSNChanged", 0);
1913
1914         if (uSN > max_usn) {
1915                 /*
1916                  * Only report the max_usn we had at the start
1917                  * of the replication cycle.
1918                  *
1919                  * If this object has changed lately we better
1920                  * let the destination dsa refetch the change.
1921                  * This is better than the risk of loosing some
1922                  * objects or linked attributes.
1923                  */
1924                 return;
1925         }
1926
1927         if (uSN <= hwm->tmp_highest_usn) {
1928                 return;
1929         }
1930
1931         hwm->tmp_highest_usn = uSN;
1932         hwm->reserved_usn = 0;
1933 }
1934
1935 static WERROR dcesrv_drsuapi_anc_cache_add(struct db_context *anc_cache,
1936                                            const struct GUID *guid)
1937 {
1938         enum ndr_err_code ndr_err;
1939         uint8_t guid_buf[16] = { 0, };
1940         DATA_BLOB b = {
1941                 .data = guid_buf,
1942                 .length = sizeof(guid_buf),
1943         };
1944         TDB_DATA key = {
1945                 .dptr = b.data,
1946                 .dsize = b.length,
1947         };
1948         TDB_DATA val = {
1949                 .dptr = NULL,
1950                 .dsize = 0,
1951         };
1952         NTSTATUS status;
1953
1954         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1955                         (ndr_push_flags_fn_t)ndr_push_GUID);
1956         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1957                 return WERR_DS_DRA_INTERNAL_ERROR;
1958         }
1959
1960         status = dbwrap_store(anc_cache, key, val, TDB_REPLACE);
1961         if (!NT_STATUS_IS_OK(status)) {
1962                 return WERR_DS_DRA_INTERNAL_ERROR;
1963         }
1964
1965         return WERR_OK;
1966 }
1967
1968 static WERROR dcesrv_drsuapi_anc_cache_exists(struct db_context *anc_cache,
1969                                               const struct GUID *guid)
1970 {
1971         enum ndr_err_code ndr_err;
1972         uint8_t guid_buf[16] = { 0, };
1973         DATA_BLOB b = {
1974                 .data = guid_buf,
1975                 .length = sizeof(guid_buf),
1976         };
1977         TDB_DATA key = {
1978                 .dptr = b.data,
1979                 .dsize = b.length,
1980         };
1981         bool exists;
1982
1983         ndr_err = ndr_push_struct_into_fixed_blob(&b, guid,
1984                         (ndr_push_flags_fn_t)ndr_push_GUID);
1985         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1986                 return WERR_DS_DRA_INTERNAL_ERROR;
1987         }
1988
1989         exists = dbwrap_exists(anc_cache, key);
1990         if (!exists) {
1991                 return WERR_OBJECT_NOT_FOUND;
1992         }
1993
1994         return WERR_OBJECT_NAME_EXISTS;
1995 }
1996
1997 /*
1998   drsuapi_DsGetNCChanges
1999
2000   see MS-DRSR 4.1.10.5.2 for basic logic of this function
2001 */
2002 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2003                                      struct drsuapi_DsGetNCChanges *r)
2004 {
2005         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
2006         int ret;
2007         uint32_t i, k;
2008         struct dsdb_schema *schema;
2009         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
2010         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
2011         NTSTATUS status;
2012         DATA_BLOB session_key;
2013         WERROR werr;
2014         struct dcesrv_handle *h;
2015         struct drsuapi_bind_state *b_state;
2016         struct drsuapi_getncchanges_state *getnc_state;
2017         struct drsuapi_DsGetNCChangesRequest10 *req10;
2018         uint32_t options;
2019         uint32_t max_objects;
2020         uint32_t max_links;
2021         uint32_t link_count = 0;
2022         uint32_t link_total = 0;
2023         uint32_t link_given = 0;
2024         struct ldb_dn *search_dn = NULL;
2025         bool am_rodc;
2026         enum security_user_level security_level;
2027         struct ldb_context *sam_ctx;
2028         struct dom_sid *user_sid;
2029         bool is_secret_request;
2030         bool is_gc_pas_request;
2031         struct drsuapi_changed_objects *changes;
2032         time_t max_wait;
2033         time_t start = time(NULL);
2034         bool max_wait_reached = false;
2035         bool has_get_all_changes = false;
2036         struct GUID invocation_id;
2037         static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr;
2038         struct dsdb_schema_prefixmap *pfm_remote = NULL;
2039         bool full = true;
2040         uint32_t *local_pas = NULL;
2041         struct ldb_dn *machine_dn = NULL; /* Only used for REPL SECRET EXOP */
2042
2043         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
2044         b_state = h->data;
2045
2046         /* sam_ctx_system is not present for non-administrator users */
2047         sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
2048
2049         invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2050
2051         *r->out.level_out = 6;
2052         /* TODO: linked attributes*/
2053         r->out.ctr->ctr6.linked_attributes_count = 0;
2054         r->out.ctr->ctr6.linked_attributes = discard_const_p(struct drsuapi_DsReplicaLinkedAttribute, &no_linked_attr);
2055
2056         r->out.ctr->ctr6.object_count = 0;
2057         r->out.ctr->ctr6.nc_object_count = 0;
2058         r->out.ctr->ctr6.more_data = false;
2059         r->out.ctr->ctr6.uptodateness_vector = NULL;
2060         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2061         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2062         r->out.ctr->ctr6.first_object = NULL;
2063
2064         /* a RODC doesn't allow for any replication */
2065         ret = samdb_rodc(sam_ctx, &am_rodc);
2066         if (ret == LDB_SUCCESS && am_rodc) {
2067                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
2068                 return WERR_DS_DRA_SOURCE_DISABLED;
2069         }
2070
2071         /* Check request revision.
2072          */
2073         switch (r->in.level) {
2074         case 8:
2075                 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
2076                 if (req10 == NULL) {
2077                         return WERR_NOT_ENOUGH_MEMORY;
2078                 }
2079                 break;
2080         case 10:
2081                 req10 = &r->in.req->req10;
2082                 break;
2083         default:
2084                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
2085                          r->in.level));
2086                 return WERR_REVISION_MISMATCH;
2087         }
2088
2089
2090         /* Perform access checks. */
2091         /* TODO: we need to support a sync on a specific non-root
2092          * DN. We'll need to find the real partition root here */
2093         ncRoot = req10->naming_context;
2094         if (ncRoot == NULL) {
2095                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
2096                 return WERR_DS_DRA_INVALID_PARAMETER;
2097         }
2098
2099         if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
2100                 return WERR_DS_DRA_INTERNAL_ERROR;
2101         }
2102
2103         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
2104             !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
2105                 return WERR_DS_DRA_SOURCE_DISABLED;
2106         }
2107
2108         user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
2109
2110         /* all clients must have GUID_DRS_GET_CHANGES */
2111         werr = drs_security_access_check_nc_root(sam_ctx,
2112                                                  mem_ctx,
2113                                                  dce_call->conn->auth_state.session_info->security_token,
2114                                                  req10->naming_context,
2115                                                  GUID_DRS_GET_CHANGES);
2116         if (!W_ERROR_IS_OK(werr)) {
2117                 return werr;
2118         }
2119
2120         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008) {
2121                 full = req10->partial_attribute_set == NULL &&
2122                        req10->partial_attribute_set_ex == NULL;
2123         } else {
2124                 full = (options & DRSUAPI_DRS_WRIT_REP) != 0;
2125         }
2126
2127         werr = dsdb_schema_pfm_from_drsuapi_pfm(&req10->mapping_ctr, true,
2128                                                 mem_ctx, &pfm_remote, NULL);
2129
2130         /* We were supplied a partial attribute set, without the prefix map! */
2131         if (!full && !W_ERROR_IS_OK(werr)) {
2132                 if (req10->mapping_ctr.num_mappings == 0) {
2133                         /*
2134                          * Despite the fact MS-DRSR specifies that this shouldn't
2135                          * happen, Windows RODCs will in fact not provide a prefixMap.
2136                          */
2137                         DEBUG(5,(__location__ ": Failed to provide a remote prefixMap,"
2138                                  " falling back to local prefixMap\n"));
2139                 } else {
2140                         DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n",
2141                                  win_errstr(werr)));
2142                         return werr;
2143                 }
2144         }
2145
2146         /* allowed if the GC PAS and client has
2147            GUID_DRS_GET_FILTERED_ATTRIBUTES */
2148         werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, pfm_remote, &is_gc_pas_request);
2149         if (!W_ERROR_IS_OK(werr)) {
2150                 return werr;
2151         }
2152         if (is_gc_pas_request) {
2153                 werr = drs_security_access_check_nc_root(sam_ctx,
2154                                                          mem_ctx,
2155                                                          dce_call->conn->auth_state.session_info->security_token,
2156                                                          req10->naming_context,
2157                                                          GUID_DRS_GET_FILTERED_ATTRIBUTES);
2158                 if (W_ERROR_IS_OK(werr)) {
2159                         goto allowed;
2160                 }
2161         }
2162
2163         werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10,
2164                                                         pfm_remote,
2165                                                         &is_secret_request);
2166         if (!W_ERROR_IS_OK(werr)) {
2167                 return werr;
2168         }
2169         if (is_secret_request) {
2170                 werr = drs_security_access_check_nc_root(sam_ctx,
2171                                                          mem_ctx,
2172                                                          dce_call->conn->auth_state.session_info->security_token,
2173                                                          req10->naming_context,
2174                                                          GUID_DRS_GET_ALL_CHANGES);
2175                 if (!W_ERROR_IS_OK(werr)) {
2176                         /* Only bail if this is not a EXOP_REPL_SECRET */
2177                         if (req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
2178                                 return werr;
2179                         }
2180                 } else {
2181                         has_get_all_changes = true;
2182                 }
2183         }
2184
2185 allowed:
2186         /* for non-administrator replications, check that they have
2187            given the correct source_dsa_invocation_id */
2188         security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
2189                                                      samdb_domain_sid(sam_ctx));
2190         if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
2191                 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
2192                         /* we rely on this flag being unset for RODC requests */
2193                         req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
2194                 }
2195         }
2196
2197         if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
2198                 /* Ignore the _in_ uptpdateness vector*/
2199                 req10->uptodateness_vector = NULL;
2200         }
2201
2202         if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
2203                 req10->source_dsa_invocation_id = invocation_id;
2204         }
2205
2206         if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
2207                 /*
2208                  * The given highwatermark is only valid relative to the
2209                  * specified source_dsa_invocation_id.
2210                  */
2211                 ZERO_STRUCT(req10->highwatermark);
2212         }
2213
2214         getnc_state = b_state->getncchanges_state;
2215
2216         /* see if a previous replication has been abandoned */
2217         if (getnc_state) {
2218                 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
2219                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
2220                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
2221                                  ldb_dn_get_linearized(new_dn),
2222                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2223                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2224                         TALLOC_FREE(getnc_state);
2225                         b_state->getncchanges_state = NULL;
2226                 }
2227         }
2228
2229         if (getnc_state) {
2230                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
2231                                                          &req10->highwatermark);
2232                 if (ret != 0) {
2233                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
2234                                  "on DN %s %s highwatermark (last_dn %s)\n",
2235                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
2236                                  (ret > 0) ? "older" : "newer",
2237                                  ldb_dn_get_linearized(getnc_state->last_dn)));
2238                         TALLOC_FREE(getnc_state);
2239                         b_state->getncchanges_state = NULL;
2240                 }
2241         }
2242
2243         if (getnc_state == NULL) {
2244                 struct ldb_result *res = NULL;
2245                 const char *attrs[] = {
2246                         "instanceType",
2247                         "objectGuID",
2248                         NULL
2249                 };
2250                 uint32_t nc_instanceType;
2251                 struct ldb_dn *ncRoot_dn;
2252
2253                 ncRoot_dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, ncRoot);
2254                 if (ncRoot_dn == NULL) {
2255                         return WERR_NOT_ENOUGH_MEMORY;
2256                 }
2257
2258                 ret = dsdb_search_dn(sam_ctx, mem_ctx, &res,
2259                                      ncRoot_dn, attrs,
2260                                      DSDB_SEARCH_SHOW_DELETED |
2261                                      DSDB_SEARCH_SHOW_RECYCLED);
2262                 if (ret != LDB_SUCCESS) {
2263                         DBG_WARNING("Failed to find ncRoot_dn %s\n",
2264                                     ldb_dn_get_linearized(ncRoot_dn));
2265                         return WERR_DS_CANT_FIND_EXPECTED_NC;
2266                 }
2267                 nc_instanceType = ldb_msg_find_attr_as_int(res->msgs[0],
2268                                                            "instanceType",
2269                                                            0);
2270
2271                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2272                         r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
2273                 }
2274
2275                 /*
2276                  * This is the first replication cycle and it is
2277                  * a good place to handle extended operations
2278                  *
2279                  * FIXME: we don't fully support extended operations yet
2280                  */
2281                 switch (req10->extended_op) {
2282                 case DRSUAPI_EXOP_NONE:
2283                         if ((nc_instanceType & INSTANCE_TYPE_IS_NC_HEAD) == 0) {
2284                                 const char *dn_str
2285                                         = ldb_dn_get_linearized(ncRoot_dn);
2286
2287                                 DBG_NOTICE("Rejecting full replication on "
2288                                            "not NC %s", dn_str);
2289
2290                                 return WERR_DS_CANT_FIND_EXPECTED_NC;
2291                         }
2292
2293                         break;
2294                 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
2295                         werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6, &search_dn);
2296                         W_ERROR_NOT_OK_RETURN(werr);
2297                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2298                                 return WERR_OK;
2299                         }
2300                         break;
2301                 case DRSUAPI_EXOP_REPL_SECRET:
2302                         werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
2303                                                         user_sid,
2304                                                         &r->out.ctr->ctr6,
2305                                                         has_get_all_changes,
2306                                                         &machine_dn);
2307                         r->out.result = werr;
2308                         W_ERROR_NOT_OK_RETURN(werr);
2309                         break;
2310                 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
2311                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2312                         W_ERROR_NOT_OK_RETURN(werr);
2313                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2314                                 return WERR_OK;
2315                         }
2316                         break;
2317                 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
2318                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2319                         W_ERROR_NOT_OK_RETURN(werr);
2320                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2321                                 return WERR_OK;
2322                         }
2323                         break;
2324                 case DRSUAPI_EXOP_FSMO_REQ_PDC:
2325                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
2326                         W_ERROR_NOT_OK_RETURN(werr);
2327                         if (r->out.ctr->ctr6.extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
2328                                 return WERR_OK;
2329                         }
2330                         break;
2331                 case DRSUAPI_EXOP_REPL_OBJ:
2332                         werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
2333                         r->out.result = werr;
2334                         W_ERROR_NOT_OK_RETURN(werr);
2335                         break;
2336
2337                 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
2338
2339                         DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
2340                                  (unsigned)req10->extended_op));
2341                         return WERR_DS_DRA_NOT_SUPPORTED;
2342                 }
2343
2344                 /* Initialize the state we'll store over the replication cycle */
2345                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
2346                 if (getnc_state == NULL) {
2347                         return WERR_NOT_ENOUGH_MEMORY;
2348                 }
2349                 b_state->getncchanges_state = getnc_state;
2350
2351                 getnc_state->ncRoot_dn = ncRoot_dn;
2352                 talloc_steal(getnc_state, ncRoot_dn);
2353
2354                 getnc_state->ncRoot_guid = samdb_result_guid(res->msgs[0],
2355                                                              "objectGUID");
2356                 ncRoot->guid = getnc_state->ncRoot_guid;
2357
2358                 /* find out if we are to replicate Schema NC */
2359                 ret = ldb_dn_compare_base(ldb_get_schema_basedn(sam_ctx),
2360                                           ncRoot_dn);
2361                 getnc_state->is_schema_nc = (0 == ret);
2362
2363                 TALLOC_FREE(res);
2364         }
2365
2366         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
2367             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
2368                 DEBUG(0,(__location__ ": Bad DN '%s'\n",
2369                          drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
2370                 return WERR_DS_DRA_INVALID_PARAMETER;
2371         }
2372
2373         ncRoot->guid = getnc_state->ncRoot_guid;
2374
2375         /* we need the session key for encrypting password attributes */
2376         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
2377         if (!NT_STATUS_IS_OK(status)) {
2378                 DEBUG(0,(__location__ ": Failed to get session key\n"));
2379                 return WERR_DS_DRA_INTERNAL_ERROR;
2380         }
2381
2382         /*
2383            TODO: MS-DRSR section 4.1.10.1.1
2384            Work out if this is the start of a new cycle */
2385
2386         if (getnc_state->guids == NULL) {
2387                 const char *extra_filter;
2388                 struct ldb_result *search_res = NULL;
2389                 static const struct drsuapi_DsReplicaCursorCtrEx empty_udv;
2390                 const struct drsuapi_DsReplicaCursorCtrEx *udv = NULL;
2391
2392                 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
2393
2394                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2395                         if (req10->uptodateness_vector != NULL) {
2396                                 udv = req10->uptodateness_vector;
2397                         } else {
2398                                 udv = &empty_udv;
2399                         }
2400
2401                         getnc_state->min_usn = req10->highwatermark.highest_usn;
2402                         for (i = 0; i < udv->count; i++) {
2403                                 bool match;
2404                                 const struct drsuapi_DsReplicaCursor *cur =
2405                                         &udv->cursors[i];
2406
2407                                 match = GUID_equal(&invocation_id,
2408                                                    &cur->source_dsa_invocation_id);
2409                                 if (!match) {
2410                                         continue;
2411                                 }
2412                                 if (cur->highest_usn > getnc_state->min_usn) {
2413                                         getnc_state->min_usn = cur->highest_usn;
2414                                 }
2415                                 break;
2416                         }
2417                 } else {
2418                         /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
2419                         udv = &empty_udv;
2420                         getnc_state->min_usn = 0;
2421                 }
2422
2423                 getnc_state->max_usn = getnc_state->min_usn;
2424
2425                 getnc_state->final_udv = talloc_zero(getnc_state,
2426                                         struct drsuapi_DsReplicaCursor2CtrEx);
2427                 if (getnc_state->final_udv == NULL) {
2428                         return WERR_NOT_ENOUGH_MEMORY;
2429                 }
2430                 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
2431                                           getnc_state->final_udv);
2432                 if (!W_ERROR_IS_OK(werr)) {
2433                         return werr;
2434                 }
2435
2436                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2437                         werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
2438                                                             search_dn, extra_filter,
2439                                                             &search_res);
2440                 } else {
2441                         werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
2442                                                                  &r->out.ctr->ctr6,
2443                                                                  search_dn, extra_filter,
2444                                                                  &search_res);
2445                 }
2446                 W_ERROR_NOT_OK_RETURN(werr);
2447
2448                 /* extract out the GUIDs list */
2449                 getnc_state->num_records = search_res ? search_res->count : 0;
2450                 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
2451                 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
2452
2453                 changes = talloc_array(getnc_state,
2454                                        struct drsuapi_changed_objects,
2455                                        getnc_state->num_records);
2456                 W_ERROR_HAVE_NO_MEMORY(changes);
2457
2458                 for (i=0; i<getnc_state->num_records; i++) {
2459                         changes[i].dn = search_res->msgs[i]->dn;
2460                         changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
2461                         changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
2462
2463                         if (changes[i].usn > getnc_state->max_usn) {
2464                                 getnc_state->max_usn = changes[i].usn;
2465                         }
2466                 }
2467
2468                 /* RID_ALLOC returns 3 objects in a fixed order */
2469                 if (req10->extended_op == DRSUAPI_EXOP_FSMO_RID_ALLOC) {
2470                         /* Do nothing */
2471                 } else {
2472                         LDB_TYPESAFE_QSORT(changes,
2473                                            getnc_state->num_records,
2474                                            getnc_state,
2475                                            site_res_cmp_usn_order);
2476                 }
2477
2478                 for (i=0; i < getnc_state->num_records; i++) {
2479                         getnc_state->guids[i] = changes[i].guid;
2480                         if (GUID_all_zero(&getnc_state->guids[i])) {
2481                                 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
2482                                          ldb_dn_get_linearized(search_res->msgs[i]->dn)));
2483                                 return WERR_DS_DRA_INTERNAL_ERROR;
2484                         }
2485                 }
2486
2487                 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
2488                 getnc_state->final_hwm.reserved_usn = 0;
2489                 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
2490
2491                 talloc_free(search_res);
2492                 talloc_free(changes);
2493
2494                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2495                         /* Do nothing */
2496                 } else if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
2497                         getnc_state->anc_cache = db_open_rbt(getnc_state);
2498                         if (getnc_state->anc_cache == NULL) {
2499                                 return WERR_NOT_ENOUGH_MEMORY;
2500                         }
2501                 }
2502         }
2503
2504         if (req10->uptodateness_vector) {
2505                 /* make sure its sorted */
2506                 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
2507                                req10->uptodateness_vector->count,
2508                                drsuapi_DsReplicaCursor_compare);
2509         }
2510
2511         /* Prefix mapping */
2512         schema = dsdb_get_schema(sam_ctx, mem_ctx);
2513         if (!schema) {
2514                 DEBUG(0,("No schema in sam_ctx\n"));
2515                 return WERR_DS_DRA_INTERNAL_ERROR;
2516         }
2517
2518         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
2519         if (r->out.ctr->ctr6.naming_context == NULL) {
2520                 return WERR_NOT_ENOUGH_MEMORY;
2521         }
2522         *r->out.ctr->ctr6.naming_context = *ncRoot;
2523
2524         /* find the SID if there is one */
2525         dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
2526
2527         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
2528         r->out.ctr->ctr6.mapping_ctr = *ctr;
2529
2530         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
2531         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
2532
2533         r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
2534         r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
2535
2536         currentObject = &r->out.ctr->ctr6.first_object;
2537
2538         max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
2539         /*
2540          * The client control here only applies in normal replication, not extended
2541          * operations, which return a fixed set, even if the caller
2542          * sets max_object_count == 0
2543          */
2544         if (req10->extended_op == DRSUAPI_EXOP_NONE) {
2545                 /* use this to force single objects at a time, which is useful
2546                  * for working out what object is giving problems
2547                  */
2548                 if (req10->max_object_count < max_objects) {
2549                         max_objects = req10->max_object_count;
2550                 }
2551         }
2552         /*
2553          * TODO: work out how the maximum should be calculated
2554          */
2555         max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
2556
2557         /*
2558          * Maximum time that we can spend in a getncchanges
2559          * in order to avoid timeout of the other part.
2560          * 10 seconds by default.
2561          */
2562         max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
2563
2564         if (req10->partial_attribute_set != NULL) {
2565                 struct dsdb_syntax_ctx syntax_ctx;
2566                 uint32_t j = 0;
2567
2568                 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
2569                 syntax_ctx.pfm_remote = pfm_remote;
2570
2571                 local_pas = talloc_array(b_state, uint32_t, req10->partial_attribute_set->num_attids);
2572
2573                 for (j = 0; j < req10->partial_attribute_set->num_attids; j++) {
2574                         getncchanges_attid_remote_to_local(schema,
2575                                                            &syntax_ctx,
2576                                                            req10->partial_attribute_set->attids[j],
2577                                                            (enum drsuapi_DsAttributeId *)&local_pas[j],
2578                                                            NULL);
2579                 }
2580
2581                 LDB_TYPESAFE_QSORT(local_pas,
2582                                    req10->partial_attribute_set->num_attids,
2583                                    NULL,
2584                                    uint32_t_ptr_cmp);
2585         }
2586
2587         for (i=getnc_state->num_processed;
2588              i<getnc_state->num_records &&
2589                      (r->out.ctr->ctr6.object_count < max_objects)
2590                      && !max_wait_reached;
2591             i++) {
2592                 struct drsuapi_DsReplicaObjectListItemEx *new_objs = NULL;
2593                 struct drsuapi_DsReplicaObjectListItemEx *obj;
2594                 struct ldb_message *msg;
2595                 static const char * const msg_attrs[] = {
2596                                             "*",
2597                                             "nTSecurityDescriptor",
2598                                             "parentGUID",
2599                                             "replPropertyMetaData",
2600                                             DSDB_SECRET_ATTRIBUTES,
2601                                             NULL };
2602                 struct ldb_result *msg_res;
2603                 struct ldb_dn *msg_dn;
2604                 const struct GUID *next_anc_guid = NULL;
2605
2606                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
2607                 W_ERROR_HAVE_NO_MEMORY(obj);
2608
2609                 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
2610                 W_ERROR_HAVE_NO_MEMORY(msg_dn);
2611
2612
2613                 /*
2614                  * by re-searching here we avoid having a lot of full
2615                  * records in memory between calls to getncchanges.
2616                  *
2617                  * We expect that we may get some objects that vanish
2618                  * (tombstone expunge) between the first and second
2619                  * check.
2620                  */
2621                 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
2622                                                       msg_dn,
2623                                                       LDB_SCOPE_BASE, msg_attrs, NULL);
2624                 if (ret != LDB_SUCCESS) {
2625                         if (ret != LDB_ERR_NO_SUCH_OBJECT) {
2626                                 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
2627                                          ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
2628                         }
2629                         talloc_free(obj);
2630                         continue;
2631                 }
2632
2633                 if (msg_res->count == 0) {
2634                         DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
2635                                  "to get any results in fetch of DN "
2636                                  "%s (race with tombstone expunge?)\n",
2637                                  ldb_dn_get_extended_linearized(obj,
2638                                                                 msg_dn, 1)));
2639                         talloc_free(obj);
2640                         continue;
2641                 }
2642
2643                 msg = msg_res->msgs[0];
2644
2645                 /*
2646                  * If it has already been added as an ancestor of
2647                  * an object, we don't need to do anything more,
2648                  * as we've already added the links.
2649                  */
2650                 if (getnc_state->anc_cache != NULL) {
2651                         werr = dcesrv_drsuapi_anc_cache_exists(getnc_state->anc_cache,
2652                                                                &getnc_state->guids[i]);
2653                         if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2654                                 dcesrv_drsuapi_update_highwatermark(msg,
2655                                                 getnc_state->max_usn,
2656                                                 &r->out.ctr->ctr6.new_highwatermark);
2657                                 /* no attributes to send */
2658                                 talloc_free(obj);
2659                                 continue;
2660                         }
2661                 }
2662
2663                 max_wait_reached = (time(NULL) - start > max_wait);
2664
2665                 werr = get_nc_changes_build_object(obj, msg,
2666                                                    sam_ctx, getnc_state->ncRoot_dn,
2667                                                    getnc_state->is_schema_nc,
2668                                                    schema, &session_key, getnc_state->min_usn,
2669                                                    req10->replica_flags,
2670                                                    req10->partial_attribute_set,
2671                                                    req10->uptodateness_vector,
2672                                                    req10->extended_op,
2673                                                    max_wait_reached,
2674                                                    local_pas, machine_dn,
2675                                                    &getnc_state->guids[i]);
2676                 if (!W_ERROR_IS_OK(werr)) {
2677                         return werr;
2678                 }
2679
2680                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2681                                                 getnc_state->ncRoot_dn,
2682                                                 getnc_state->is_schema_nc,
2683                                                 schema, getnc_state->min_usn,
2684                                                 req10->replica_flags,
2685                                                 msg,
2686                                                 &getnc_state->la_list,
2687                                                 &getnc_state->la_count,
2688                                                 req10->uptodateness_vector);
2689                 if (!W_ERROR_IS_OK(werr)) {
2690                         return werr;
2691                 }
2692
2693                 dcesrv_drsuapi_update_highwatermark(msg,
2694                                         getnc_state->max_usn,
2695                                         &r->out.ctr->ctr6.new_highwatermark);
2696
2697                 if (obj->meta_data_ctr == NULL) {
2698                         DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
2699                                  ldb_dn_get_linearized(msg->dn)));
2700                         /* no attributes to send */
2701                         talloc_free(obj);
2702                         continue;
2703                 }
2704
2705                 new_objs = obj;
2706
2707                 if (getnc_state->anc_cache != NULL) {
2708                         werr = dcesrv_drsuapi_anc_cache_add(getnc_state->anc_cache,
2709                                                             &getnc_state->guids[i]);
2710                         if (!W_ERROR_IS_OK(werr)) {
2711                                 return werr;
2712                         }
2713
2714                         next_anc_guid = obj->parent_object_guid;
2715                 }
2716
2717                 while (next_anc_guid != NULL) {
2718                         struct drsuapi_DsReplicaObjectListItemEx *anc_obj = NULL;
2719                         struct ldb_message *anc_msg = NULL;
2720                         struct ldb_result *anc_res = NULL;
2721                         struct ldb_dn *anc_dn = NULL;
2722
2723                         werr = dcesrv_drsuapi_anc_cache_exists(getnc_state->anc_cache,
2724                                                                next_anc_guid);
2725                         if (W_ERROR_EQUAL(werr, WERR_OBJECT_NAME_EXISTS)) {
2726                                 /*
2727                                  * We don't need to send it twice.
2728                                  */
2729                                 break;
2730                         }
2731                         if (W_ERROR_IS_OK(werr)) {
2732                                 return WERR_INTERNAL_ERROR;
2733                         }
2734                         if (!W_ERROR_EQUAL(werr, WERR_OBJECT_NOT_FOUND)) {
2735                                 return werr;
2736                         }
2737                         werr = WERR_OK;
2738
2739                         anc_obj = talloc_zero(mem_ctx,
2740                                         struct drsuapi_DsReplicaObjectListItemEx);
2741                         if (anc_obj == NULL) {
2742                                 return WERR_NOT_ENOUGH_MEMORY;
2743                         }
2744
2745                         anc_dn = ldb_dn_new_fmt(anc_obj, sam_ctx, "<GUID=%s>",
2746                                         GUID_string(anc_obj, next_anc_guid));
2747                         if (anc_dn == NULL) {
2748                                 return WERR_NOT_ENOUGH_MEMORY;
2749                         }
2750
2751                         ret = drsuapi_search_with_extended_dn(sam_ctx, anc_obj,
2752                                                               &anc_res, anc_dn,
2753                                                               LDB_SCOPE_BASE,
2754                                                               msg_attrs, NULL);
2755                         if (ret != LDB_SUCCESS) {
2756                                 const char *anc_str = NULL;
2757                                 const char *obj_str = NULL;
2758
2759                                 anc_str = ldb_dn_get_extended_linearized(anc_obj,
2760                                                                          anc_dn,
2761                                                                          1);
2762                                 obj_str = ldb_dn_get_extended_linearized(anc_obj,
2763                                                                          msg->dn,
2764                                                                          1),
2765
2766                                 DBG_ERR("getncchanges: failed to fetch ANC "
2767                                         "DN %s for DN %s - %s\n",
2768                                         anc_str, obj_str,
2769                                         ldb_errstring(sam_ctx));
2770                                 return WERR_DS_DRA_INCONSISTENT_DIT;
2771                         }
2772
2773                         anc_msg = anc_res->msgs[0];
2774
2775                         werr = get_nc_changes_build_object(anc_obj, anc_msg,
2776                                                            sam_ctx,
2777                                                            getnc_state->ncRoot_dn,
2778                                                            getnc_state->is_schema_nc,
2779                                                            schema, &session_key,
2780                                                            getnc_state->min_usn,
2781                                                            req10->replica_flags,
2782                                                            req10->partial_attribute_set,
2783                                                            req10->uptodateness_vector,
2784                                                            req10->extended_op,
2785                                                            false, /* force_object_return */
2786                                                            local_pas,
2787                                                            machine_dn,
2788                                                            next_anc_guid);
2789                         if (!W_ERROR_IS_OK(werr)) {
2790                                 return werr;
2791                         }
2792
2793                         werr = get_nc_changes_add_links(sam_ctx, getnc_state,
2794                                                         getnc_state->ncRoot_dn,
2795                                                         getnc_state->is_schema_nc,
2796                                                         schema, getnc_state->min_usn,
2797                                                         req10->replica_flags,
2798                                                         anc_msg,
2799                                                         &getnc_state->la_list,
2800                                                         &getnc_state->la_count,
2801                                                         req10->uptodateness_vector);
2802                         if (!W_ERROR_IS_OK(werr)) {
2803                                 return werr;
2804                         }
2805
2806                         /*
2807                          * Regardless of if we actually use it or not,
2808                          * we add it to the cache so we don't look at it again
2809                          */
2810                         werr = dcesrv_drsuapi_anc_cache_add(getnc_state->anc_cache,
2811                                                             next_anc_guid);
2812                         if (!W_ERROR_IS_OK(werr)) {
2813                                 return werr;
2814                         }
2815
2816                         /*
2817                          * Any ancestors which are below the highwatermark
2818                          * or uptodateness_vector shouldn't be added,
2819                          * but we still look further up the
2820                          * tree for ones which have been changed recently.
2821                          */
2822                         if (anc_obj->meta_data_ctr != NULL) {
2823                                 /*
2824                                  * prepend it to the list
2825                                  */
2826                                 anc_obj->next_object = new_objs;
2827                                 new_objs = anc_obj;
2828                         }
2829
2830                         anc_msg = NULL;
2831                         TALLOC_FREE(anc_res);
2832                         TALLOC_FREE(anc_dn);
2833
2834                         /*
2835                          * We may need to resolve more...
2836                          */
2837                         next_anc_guid = anc_obj->parent_object_guid;
2838                 }
2839
2840                 *currentObject = new_objs;
2841                 while (new_objs != NULL) {
2842                         r->out.ctr->ctr6.object_count += 1;
2843                         if (new_objs->next_object == NULL) {
2844                                 currentObject = &new_objs->next_object;
2845                         }
2846                         new_objs = new_objs->next_object;
2847                 }
2848
2849                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
2850
2851                 talloc_free(getnc_state->last_dn);
2852                 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
2853
2854                 talloc_free(msg_res);
2855                 talloc_free(msg_dn);
2856         }
2857
2858         getnc_state->num_processed = i;
2859
2860         /* the client can us to call UpdateRefs on its behalf to
2861            re-establish monitoring of the NC */
2862         if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
2863             !GUID_all_zero(&req10->destination_dsa_guid)) {
2864                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
2865                 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
2866                          GUID_string(mem_ctx, &req10->destination_dsa_guid)));
2867                 ureq.naming_context = ncRoot;
2868                 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(sam_ctx, mem_ctx,
2869                                                                    &req10->destination_dsa_guid);
2870                 if (!ureq.dest_dsa_dns_name) {
2871                         return WERR_NOT_ENOUGH_MEMORY;
2872                 }
2873                 ureq.dest_dsa_guid = req10->destination_dsa_guid;
2874                 ureq.options = DRSUAPI_DRS_ADD_REF |
2875                         DRSUAPI_DRS_ASYNC_OP |
2876                         DRSUAPI_DRS_GETCHG_CHECK;
2877
2878                 /* we also need to pass through the
2879                    DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
2880                    to send notifies using the GC SPN */
2881                 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
2882
2883                 werr = drsuapi_UpdateRefs(dce_call->msg_ctx,
2884                                           dce_call->event_ctx, b_state,
2885                                           mem_ctx, &ureq);
2886                 if (!W_ERROR_IS_OK(werr)) {
2887                         DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
2888                                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
2889                                  win_errstr(werr)));
2890                 }
2891         }
2892
2893         /*
2894          * TODO:
2895          * This is just a guess, how to calculate the
2896          * number of linked attributes to send, we need to
2897          * find out how to do this right.
2898          */
2899         if (r->out.ctr->ctr6.object_count >= max_links) {
2900                 max_links = 0;
2901         } else {
2902                 max_links -= r->out.ctr->ctr6.object_count;
2903         }
2904
2905         link_total = getnc_state->la_count;
2906
2907         if (i < getnc_state->num_records) {
2908                 r->out.ctr->ctr6.more_data = true;
2909         } else {
2910                 /* sort the whole array the first time */
2911                 if (getnc_state->la_sorted == NULL) {
2912                         int j;
2913                         struct la_for_sorting *guid_array = talloc_array(getnc_state, struct la_for_sorting, getnc_state->la_count);
2914                         if (guid_array == NULL) {
2915                                 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", getnc_state->la_count));
2916                                 return WERR_NOT_ENOUGH_MEMORY;
2917                         }
2918                         for (j = 0; j < getnc_state->la_count; j++) {
2919                                 /* we need to get the target GUIDs to compare */
2920                                 struct dsdb_dn *dn;
2921                                 const struct drsuapi_DsReplicaLinkedAttribute *la = &getnc_state->la_list[j];
2922                                 const struct dsdb_attribute *schema_attrib;
2923                                 const struct ldb_val *target_guid;
2924                                 DATA_BLOB source_guid;
2925                                 TALLOC_CTX *frame = talloc_stackframe();
2926
2927                                 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la->attid);
2928
2929                                 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, frame, la->value.blob, &dn);
2930                                 if (!W_ERROR_IS_OK(werr)) {
2931                                         DEBUG(0,(__location__ ": Bad la blob in sort\n"));
2932                                         TALLOC_FREE(frame);
2933                                         return werr;
2934                                 }
2935
2936                                 /* Extract the target GUID in NDR form */
2937                                 target_guid = ldb_dn_get_extended_component(dn->dn, "GUID");
2938                                 if (target_guid == NULL
2939                                     || target_guid->length != sizeof(guid_array[0].target_guid)) {
2940                                         status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
2941                                 } else {
2942                                         /* Repack the source GUID as NDR for sorting */
2943                                         status = GUID_to_ndr_blob(&la->identifier->guid,
2944                                                                   frame,
2945                                                                   &source_guid);
2946                                 }
2947
2948                                 if (!NT_STATUS_IS_OK(status)
2949                                     || source_guid.length != sizeof(guid_array[0].source_guid)) {
2950                                         DEBUG(0,(__location__ ": Bad la guid in sort\n"));
2951                                         TALLOC_FREE(frame);
2952                                         return ntstatus_to_werror(status);
2953                                 }
2954
2955                                 guid_array[j].link = &getnc_state->la_list[j];
2956                                 memcpy(guid_array[j].target_guid, target_guid->data,
2957                                        sizeof(guid_array[j].target_guid));
2958                                 memcpy(guid_array[j].source_guid, source_guid.data,
2959                                        sizeof(guid_array[j].source_guid));
2960                                 TALLOC_FREE(frame);
2961                         }
2962
2963                         LDB_TYPESAFE_QSORT(guid_array, getnc_state->la_count, NULL, linked_attribute_compare);
2964                         getnc_state->la_sorted = guid_array;
2965                 }
2966
2967                 link_count = getnc_state->la_count - getnc_state->la_idx;
2968                 link_count = MIN(max_links, link_count);
2969
2970                 r->out.ctr->ctr6.linked_attributes_count = link_count;
2971                 r->out.ctr->ctr6.linked_attributes = talloc_array(r->out.ctr, struct drsuapi_DsReplicaLinkedAttribute, link_count);
2972                 if (r->out.ctr->ctr6.linked_attributes == NULL) {
2973                         DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count));
2974                         return WERR_NOT_ENOUGH_MEMORY;
2975                 }
2976
2977                 for (k = 0; k < link_count; k++) {
2978                         r->out.ctr->ctr6.linked_attributes[k]
2979                                 = *getnc_state->la_sorted[getnc_state->la_idx + k].link;
2980                 }
2981
2982                 getnc_state->la_idx += link_count;
2983                 link_given = getnc_state->la_idx;
2984
2985                 if (getnc_state->la_idx < getnc_state->la_count) {
2986                         r->out.ctr->ctr6.more_data = true;
2987                 }
2988         }
2989
2990         if (req10->replica_flags & DRSUAPI_DRS_GET_NC_SIZE) {
2991                 /*
2992                  * TODO: This implementation is wrong
2993                  * we should find out the total number of
2994                  * objects and links in the whole naming context
2995                  * at the start of the cycle and return these
2996                  * values in each message.
2997                  *
2998                  * For now we keep our current strategy and return
2999                  * the number of objects for this cycle and the number
3000                  * of links we found so far during the cycle.
3001                  */
3002                 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
3003                 r->out.ctr->ctr6.nc_linked_attributes_count = getnc_state->la_count;
3004         }
3005
3006         if (!r->out.ctr->ctr6.more_data) {
3007                 talloc_steal(mem_ctx, getnc_state->la_list);
3008
3009                 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
3010                 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
3011                                                         &getnc_state->final_udv);
3012
3013                 talloc_free(getnc_state);
3014                 b_state->getncchanges_state = NULL;
3015         } else {
3016                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
3017                                                          &r->out.ctr->ctr6.new_highwatermark);
3018                 if (ret == 0) {
3019                         /*
3020                          * We need to make sure that we never return the
3021                          * same highwatermark within the same replication
3022                          * cycle more than once. Otherwise we cannot detect
3023                          * when the client uses an unexptected highwatermark.
3024                          *
3025                          * This is a HACK which is needed because our
3026                          * object ordering is wrong and set tmp_highest_usn
3027                          * to a value that is higher than what we already
3028                          * sent to the client (destination dsa).
3029                          */
3030                         r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
3031                 }
3032
3033                 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
3034         }
3035
3036         if (req10->extended_op != DRSUAPI_EXOP_NONE) {
3037                 r->out.ctr->ctr6.uptodateness_vector = NULL;
3038                 r->out.ctr->ctr6.nc_object_count = 0;
3039                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
3040         }
3041
3042         DEBUG(r->out.ctr->ctr6.more_data?4:2,
3043               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
3044                (unsigned long long)(req10->highwatermark.highest_usn+1),
3045                req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
3046                r->out.ctr->ctr6.object_count,
3047                i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
3048                r->out.ctr->ctr6.linked_attributes_count,
3049                link_given, link_total,
3050                dom_sid_string(mem_ctx, user_sid)));
3051
3052 #if 0
3053         if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
3054                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
3055         }
3056 #endif
3057
3058         return WERR_OK;
3059 }