2 Unix SMB/CIFS implementation.
4 implement the DRSUpdateRefs call
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "param/param.h"
27 #include "librpc/gen_ndr/ndr_drsblobs.h"
28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
29 #include "rpc_server/dcerpc_server_proto.h"
30 #include "../libcli/drsuapi/drsuapi.h"
31 #include "libcli/security/security.h"
34 drsuapi_DsGetNCChanges for one object
36 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
37 struct ldb_message *msg,
38 struct ldb_context *sam_ctx,
39 struct ldb_dn *ncRoot_dn,
40 struct dsdb_schema *schema,
41 DATA_BLOB *session_key,
43 uint32_t replica_flags)
45 const struct ldb_val *md_value;
47 struct ldb_dn *obj_dn;
48 struct replPropertyMetaDataBlob md;
51 enum ndr_err_code ndr_err;
54 const struct dsdb_attribute *rdn_sa;
56 if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
57 obj->is_nc_prefix = true;
58 obj->parent_object_guid = NULL;
60 struct ldb_dn *parent_dn;
61 uint32_t instance_type;
63 instance_type = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
64 if (instance_type & INSTANCE_TYPE_IS_NC_HEAD) {
65 struct ldb_result *res;
67 const char *dnstr = ldb_dn_get_linearized(msg->dn);
68 msg->dn = ldb_dn_new(msg, sam_ctx, dnstr);
69 /* we need to re-search the msg, to avoid the
70 * broken dual message problems with our
71 * partitions implementation */
72 DEBUG(6,(__location__ ": Re-fetching subref %s\n",
73 ldb_dn_get_linearized(msg->dn)));
74 ret = drsuapi_search_with_extended_dn(sam_ctx, msg, &res,
75 msg->dn, LDB_SCOPE_BASE, NULL,
77 if (ret != LDB_SUCCESS || res->count < 1) {
78 DEBUG(0,(__location__ ": Failed to reload subref head %s in %s\n",
79 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ncRoot_dn)));
80 return WERR_DS_DRA_INTERNAL_ERROR;
85 parent_dn = ldb_dn_copy(msg, msg->dn);
86 obj->is_nc_prefix = false;
87 obj->parent_object_guid = talloc(obj, struct GUID);
88 if (parent_dn == NULL) {
89 return WERR_DS_DRA_INTERNAL_ERROR;
91 if (ldb_dn_remove_child_components(parent_dn, 1) != true) {
92 DEBUG(0,(__location__ ": Unable to remove DN component\n"));
93 return WERR_DS_DRA_INTERNAL_ERROR;
95 if (dsdb_find_guid_by_dn(sam_ctx, parent_dn, obj->parent_object_guid) != LDB_SUCCESS) {
96 DEBUG(0,(__location__ ": Unable to find parent DN %s %s\n",
97 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(parent_dn)));
99 talloc_free(parent_dn);
101 obj->next_object = NULL;
103 md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
105 /* nothing to send */
109 ndr_err = ndr_pull_struct_blob(md_value, obj,
110 lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
111 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
112 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
113 return WERR_DS_DRA_INTERNAL_ERROR;
116 if (md.version != 1) {
117 return WERR_DS_DRA_INTERNAL_ERROR;
120 rdn = ldb_dn_get_rdn_name(msg->dn);
122 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
123 return WERR_DS_DRA_INTERNAL_ERROR;
126 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
127 if (rdn_sa == NULL) {
128 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
129 rdn, ldb_dn_get_linearized(msg->dn)));
130 return WERR_DS_DRA_INTERNAL_ERROR;
133 obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
134 attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
136 obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
137 for (n=i=0; i<md.ctr.ctr1.count; i++) {
138 /* if the attribute has not changed, and it is not the
139 instanceType then don't include it */
140 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
141 md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
143 /* don't include the rDN */
144 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
146 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
147 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
148 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
149 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
150 attids[n] = md.ctr.ctr1.array[i].attid;
155 note that if n==0 we still need to send the change, as it
156 could be a rename, which changes the uSNChanged, but not any
157 of the replicated attributes
160 obj->meta_data_ctr->count = n;
162 obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
163 obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
164 obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
165 obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
166 sid = samdb_result_dom_sid(obj, msg, "objectSid");
168 dom_sid_split_rid(NULL, sid, NULL, &rid);
169 obj->object.identifier->sid = *sid;
171 ZERO_STRUCT(obj->object.identifier->sid);
174 obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
175 obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
176 obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
177 obj->object.attribute_ctr.num_attributes);
180 * Note that the meta_data array and the attributes array must
181 * be the same size and in the same order
183 for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
184 struct ldb_message_element *el;
186 const struct dsdb_attribute *sa;
188 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
190 DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
191 return WERR_DS_DRA_INTERNAL_ERROR;
194 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
196 DEBUG(0,("No element '%s' for attributeID %u in message\n",
197 sa->lDAPDisplayName, attids[i]));
198 ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
199 obj->object.attribute_ctr.attributes[i].attid = attids[i];
201 werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
202 &obj->object.attribute_ctr.attributes[i]);
203 if (!W_ERROR_IS_OK(werr)) {
204 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
205 sa->lDAPDisplayName, win_errstr(werr)));
208 /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
209 * check if attribute is secret and send a null value
211 if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
212 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
213 &obj->meta_data_ctr->meta_data[i]);
215 /* some attributes needs to be encrypted
217 werr = drsuapi_encrypt_attribute(obj, session_key, rid,
218 &obj->object.attribute_ctr.attributes[i]);
219 if (!W_ERROR_IS_OK(werr)) {
220 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
221 sa->lDAPDisplayName, win_errstr(werr)));
231 load replUpToDateVector from a DN
233 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
234 struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
236 const char *attrs[] = { "replUpToDateVector", NULL };
237 struct ldb_result *res = NULL;
238 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
239 struct ldb_message_element *el;
240 enum ndr_err_code ndr_err;
244 if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
246 DEBUG(0,("load_udv: failed to read partition object\n"));
247 talloc_free(tmp_ctx);
248 return WERR_DS_DRA_INTERNAL_ERROR;
251 el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
252 if (el == NULL || el->num_values < 1) {
253 talloc_free(tmp_ctx);
258 ndr_err = ndr_pull_struct_blob(&el->values[0],
259 mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
261 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
262 talloc_free(tmp_ctx);
263 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
264 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
265 ldb_dn_get_linearized(dn)));
266 return WERR_DS_DRA_INTERNAL_ERROR;
274 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
276 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
277 struct ldb_dn *ncRoot_dn,
278 struct drsuapi_DsReplicaCursor2CtrEx *udv)
281 struct drsuapi_DsReplicaCursor2 *tmp_cursor;
282 uint64_t highest_commited_usn;
284 time_t t = time(NULL);
286 struct replUpToDateVectorBlob ouv;
288 werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
289 if (!W_ERROR_IS_OK(werr)) {
293 ret = ldb_sequence_number(sam_ctx, LDB_SEQ_HIGHEST_SEQ, &highest_commited_usn);
294 if (ret != LDB_SUCCESS) {
295 return WERR_DS_DRA_INTERNAL_ERROR;
298 tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
299 tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
300 tmp_cursor->highest_usn = highest_commited_usn;
301 unix_to_nt_time(&now, t);
302 tmp_cursor->last_sync_success = now;
304 udv->count = ouv.ctr.ctr2.count + 1;
305 udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
306 udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
308 return WERR_DS_DRA_INTERNAL_ERROR;
310 udv->cursors[udv->count - 1] = *tmp_cursor;
312 qsort(udv->cursors, udv->count,
313 sizeof(struct drsuapi_DsReplicaCursor2),
314 (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
319 /* state of a partially completed getncchanges call */
320 struct drsuapi_getncchanges_state {
321 struct ldb_result *site_res;
323 struct ldb_dn *ncRoot_dn;
328 drsuapi_DsGetNCChanges
330 see MS-DRSR 4.1.10.5.2 for basic logic of this function
332 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
333 struct drsuapi_DsGetNCChanges *r)
335 struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
338 struct dsdb_schema *schema;
339 struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
340 struct drsuapi_DsReplicaObjectListItemEx **currentObject;
342 DATA_BLOB session_key;
343 const char *attrs[] = { "*", "distinguishedName", "ntSecurityDescriptor", NULL };
345 struct dcesrv_handle *h;
346 struct drsuapi_bind_state *b_state;
347 struct drsuapi_getncchanges_state *getnc_state;
348 struct drsuapi_DsGetNCChangesRequest8 *req8;
351 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
354 *r->out.level_out = 6;
355 /* TODO: linked attributes*/
356 r->out.ctr->ctr6.linked_attributes_count = 0;
357 r->out.ctr->ctr6.linked_attributes = NULL;
359 r->out.ctr->ctr6.object_count = 0;
360 r->out.ctr->ctr6.nc_object_count = 0;
361 r->out.ctr->ctr6.more_data = false;
362 r->out.ctr->ctr6.uptodateness_vector = NULL;
364 /* a RODC doesn't allow for any replication */
365 if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
366 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
367 return WERR_DS_DRA_SOURCE_DISABLED;
370 /* Check request revision.
371 TODO: Adding mappings to req8 from the other levels
373 if (r->in.level != 8) {
374 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
376 return WERR_REVISION_MISMATCH;
379 req8 = &r->in.req->req8;
381 /* Perform access checks. */
382 ncRoot = req8->naming_context;
383 if (ncRoot == NULL) {
384 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
385 return WERR_DS_DRA_INVALID_PARAMETER;
388 if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
389 return WERR_DS_DRA_INTERNAL_ERROR;
392 if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
393 !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
394 return WERR_DS_DRA_SOURCE_DISABLED;
398 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
399 /* Ignore the _in_ uptpdateness vector*/
400 req8->uptodateness_vector = NULL;
403 werr = drs_security_level_check(dce_call, "DsGetNCChanges");
404 if (!W_ERROR_IS_OK(werr)) {
408 getnc_state = b_state->getncchanges_state;
409 if (getnc_state == NULL) {
410 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
411 if (getnc_state == NULL) {
414 b_state->getncchanges_state = getnc_state;
417 /* we need the session key for encrypting password attributes */
418 status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
419 if (!NT_STATUS_IS_OK(status)) {
420 DEBUG(0,(__location__ ": Failed to get session key\n"));
421 return WERR_DS_DRA_INTERNAL_ERROR;
424 /* we don't yet support extended operations */
425 if (req8->extended_op != DRSUAPI_EXOP_NONE) {
426 DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
427 (unsigned)req8->extended_op));
428 return WERR_DS_DRA_NOT_SUPPORTED;
432 TODO: MS-DRSR section 4.1.10.1.1
433 Work out if this is the start of a new cycle */
435 if (getnc_state->site_res == NULL) {
437 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
439 getnc_state->min_usn = req8->highwatermark.highest_usn;
441 /* Construct response. */
442 search_filter = talloc_asprintf(mem_ctx,
443 "(uSNChanged>=%llu)",
444 (unsigned long long)(getnc_state->min_usn+1));
446 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
447 search_filter = talloc_asprintf(mem_ctx,
448 "(&%s(isCriticalSystemObject=TRUE))",
452 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
453 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
454 scope = LDB_SCOPE_BASE;
457 DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
458 ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
459 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
460 getnc_state->ncRoot_dn, scope, attrs,
463 if (ret != LDB_SUCCESS) {
464 return WERR_DS_DRA_INTERNAL_ERROR;
467 /* check that this request is for the same NC as the previous one */
469 dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
473 if (ldb_dn_compare(dn, getnc_state->ncRoot_dn) != 0) {
474 DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
475 ldb_dn_get_linearized(dn),
476 ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
477 return WERR_DS_DRA_BAD_NC;
482 schema = dsdb_get_schema(b_state->sam_ctx);
484 DEBUG(0,("No schema in sam_ctx\n"));
485 return WERR_DS_DRA_INTERNAL_ERROR;
488 r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
489 *r->out.ctr->ctr6.naming_context = *ncRoot;
491 if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn,
492 &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
493 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
494 ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
495 return WERR_DS_DRA_INTERNAL_ERROR;
498 /* find the SID if there is one */
499 dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
501 dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
502 r->out.ctr->ctr6.mapping_ctr = *ctr;
504 r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
505 r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
507 r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
508 r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
510 r->out.ctr->ctr6.first_object = NULL;
511 currentObject = &r->out.ctr->ctr6.first_object;
513 for(i=getnc_state->num_sent;
514 i<getnc_state->site_res->count &&
515 (r->out.ctr->ctr6.object_count < req8->max_object_count);
518 struct drsuapi_DsReplicaObjectListItemEx *obj;
519 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
521 uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
522 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
523 r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
526 werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i],
527 b_state->sam_ctx, getnc_state->ncRoot_dn,
528 schema, &session_key, getnc_state->min_usn,
529 req8->replica_flags);
530 if (!W_ERROR_IS_OK(werr)) {
534 if (obj->meta_data_ctr == NULL) {
535 DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
536 ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
537 /* no attributes to send */
542 r->out.ctr->ctr6.object_count++;
544 *currentObject = obj;
545 currentObject = &obj->next_object;
548 getnc_state->num_sent += r->out.ctr->ctr6.object_count;
550 r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
552 /* the client can us to call UpdateRefs on its behalf to
553 re-establish monitoring of the NC */
554 if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) &&
555 !GUID_all_zero(&req8->destination_dsa_guid)) {
556 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
557 ureq.naming_context = ncRoot;
558 ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
559 GUID_string(mem_ctx, &req8->destination_dsa_guid),
560 lp_realm(dce_call->conn->dce_ctx->lp_ctx));
561 if (!ureq.dest_dsa_dns_name) {
564 ureq.dest_dsa_guid = req8->destination_dsa_guid;
565 ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
566 DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
567 DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
568 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
569 if (!W_ERROR_IS_OK(werr)) {
570 DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
575 if (i < getnc_state->site_res->count) {
576 r->out.ctr->ctr6.more_data = true;
578 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
579 r->out.ctr->ctr6.uptodateness_vector->version = 2;
580 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
581 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
583 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
585 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn,
586 r->out.ctr->ctr6.uptodateness_vector);
587 if (!W_ERROR_IS_OK(werr)) {
591 talloc_free(getnc_state);
592 b_state->getncchanges_state = NULL;
595 DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects\n",
596 (unsigned long long)(req8->highwatermark.highest_usn+1),
598 ncRoot->dn, r->out.ctr->ctr6.object_count));