?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dsdb: Fix behaviour for when to update the USN when there is no change
[Samba/bjacke.git] / source4 / dsdb / samdb / ldb_modules / repl_meta_data.c
blob0f2aa58635c4b14b7283535f03768b2b58278889
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /*
25 * Name: ldb
26 *
27 * Component: ldb repl_meta_data module
28 *
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
33 *
34 * Author: Simo Sorce
35 * Author: Stefan Metzmacher
36 */
37
38 #include "includes.h"
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
52
53 /*
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
56 */
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
58
59 struct replmd_private {
60 TALLOC_CTX *la_ctx;
61 struct la_entry *la_list;
62 TALLOC_CTX *bl_ctx;
63 struct la_backlink *la_backlinks;
64 struct nc_entry {
65 struct nc_entry *prev, *next;
66 struct ldb_dn *dn;
67 uint64_t mod_usn;
68 uint64_t mod_usn_urgent;
69 } *ncs;
70 };
71
72 struct la_entry {
73 struct la_entry *next, *prev;
74 struct drsuapi_DsReplicaLinkedAttribute *la;
75 };
76
77 struct replmd_replicated_request {
78 struct ldb_module *module;
79 struct ldb_request *req;
80
81 const struct dsdb_schema *schema;
82
83 /* the controls we pass down */
84 struct ldb_control **controls;
85
86 /* details for the mode where we apply a bunch of inbound replication meessages */
87 bool apply_mode;
88 uint32_t index_current;
89 struct dsdb_extended_replicated_objects *objs;
90
91 struct ldb_message *search_msg;
92
93 uint64_t seq_num;
94 bool is_urgent;
95 };
96
97 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar);
98
99 enum urgent_situation {
100 REPL_URGENT_ON_CREATE = 1,
101 REPL_URGENT_ON_UPDATE = 2,
102 REPL_URGENT_ON_DELETE = 4
103 };
104
105
106 static const struct {
107 const char *update_name;
108 enum urgent_situation repl_situation;
109 } urgent_objects[] = {
110 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
111 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
112 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
113 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
114 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
115 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
116 {NULL, 0}
117 };
118
119 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
120 static const char *urgent_attrs[] = {
121 "lockoutTime",
122 "pwdLastSet",
123 "userAccountControl",
124 NULL
125 };
126
127
128 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
129 enum urgent_situation situation)
130 {
131 unsigned int i, j;
132 for (i=0; urgent_objects[i].update_name; i++) {
133
134 if ((situation & urgent_objects[i].repl_situation) == 0) {
135 continue;
136 }
137
138 for (j=0; j<objectclass_el->num_values; j++) {
139 const struct ldb_val *v = &objectclass_el->values[j];
140 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 return true;
142 }
143 }
144 }
145 return false;
146 }
147
148 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
149 {
150 if (ldb_attr_in_list(urgent_attrs, el->name)) {
151 return true;
152 }
153 return false;
154 }
155
156
157 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
158
159 /*
160 initialise the module
161 allocate the private structure and build the list
162 of partition DNs for use by replmd_notify()
163 */
164 static int replmd_init(struct ldb_module *module)
165 {
166 struct replmd_private *replmd_private;
167 struct ldb_context *ldb = ldb_module_get_ctx(module);
168
169 replmd_private = talloc_zero(module, struct replmd_private);
170 if (replmd_private == NULL) {
171 ldb_oom(ldb);
172 return LDB_ERR_OPERATIONS_ERROR;
173 }
174 ldb_module_set_private(module, replmd_private);
175
176 return ldb_next_init(module);
177 }
178
179 /*
180 cleanup our per-transaction contexts
181 */
182 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
183 {
184 talloc_free(replmd_private->la_ctx);
185 replmd_private->la_list = NULL;
186 replmd_private->la_ctx = NULL;
187
188 talloc_free(replmd_private->bl_ctx);
189 replmd_private->la_backlinks = NULL;
190 replmd_private->bl_ctx = NULL;
191 }
192
193
194 struct la_backlink {
195 struct la_backlink *next, *prev;
196 const char *attr_name;
197 struct GUID forward_guid, target_guid;
198 bool active;
199 };
200
201 /*
202 process a backlinks we accumulated during a transaction, adding and
203 deleting the backlinks from the target objects
204 */
205 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
206 {
207 struct ldb_dn *target_dn, *source_dn;
208 int ret;
209 struct ldb_context *ldb = ldb_module_get_ctx(module);
210 struct ldb_message *msg;
211 TALLOC_CTX *tmp_ctx = talloc_new(bl);
212 char *dn_string;
213
214 /*
215 - find DN of target
216 - find DN of source
217 - construct ldb_message
218 - either an add or a delete
219 */
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
221 if (ret != LDB_SUCCESS) {
222 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->target_guid)));
224 return LDB_SUCCESS;
225 }
226
227 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
228 if (ret != LDB_SUCCESS) {
229 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
230 GUID_string(bl, &bl->forward_guid));
231 talloc_free(tmp_ctx);
232 return ret;
233 }
234
235 msg = ldb_msg_new(tmp_ctx);
236 if (msg == NULL) {
237 ldb_module_oom(module);
238 talloc_free(tmp_ctx);
239 return LDB_ERR_OPERATIONS_ERROR;
240 }
241
242 /* construct a ldb_message for adding/deleting the backlink */
243 msg->dn = target_dn;
244 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
245 if (!dn_string) {
246 ldb_module_oom(module);
247 talloc_free(tmp_ctx);
248 return LDB_ERR_OPERATIONS_ERROR;
249 }
250 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
251 if (ret != LDB_SUCCESS) {
252 talloc_free(tmp_ctx);
253 return ret;
254 }
255 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
256
257 /* a backlink should never be single valued. Unfortunately the
258 exchange schema has a attribute
259 msExchBridgeheadedLocalConnectorsDNBL which is single
260 valued and a backlink. We need to cope with that by
261 ignoring the single value flag */
262 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
263
264 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
265 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
266 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
267 cope with possible corruption where the backlink has
268 already been removed */
269 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
270 ldb_dn_get_linearized(target_dn),
271 ldb_dn_get_linearized(source_dn),
272 ldb_errstring(ldb)));
273 ret = LDB_SUCCESS;
274 } else if (ret != LDB_SUCCESS) {
275 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
276 bl->active?"add":"remove",
277 ldb_dn_get_linearized(source_dn),
278 ldb_dn_get_linearized(target_dn),
279 ldb_errstring(ldb));
280 talloc_free(tmp_ctx);
281 return ret;
282 }
283 talloc_free(tmp_ctx);
284 return ret;
285 }
286
287 /*
288 add a backlink to the list of backlinks to add/delete in the prepare
289 commit
290 */
291 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
292 struct GUID *forward_guid, struct GUID *target_guid,
293 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
294 {
295 const struct dsdb_attribute *target_attr;
296 struct la_backlink *bl;
297 struct replmd_private *replmd_private =
298 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
299
300 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
301 if (!target_attr) {
302 /*
303 * windows 2003 has a broken schema where the
304 * definition of msDS-IsDomainFor is missing (which is
305 * supposed to be the backlink of the
306 * msDS-HasDomainNCs attribute
307 */
308 return LDB_SUCCESS;
309 }
310
311 /* see if its already in the list */
312 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
313 if (GUID_equal(forward_guid, &bl->forward_guid) &&
314 GUID_equal(target_guid, &bl->target_guid) &&
315 (target_attr->lDAPDisplayName == bl->attr_name ||
316 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
317 break;
318 }
319 }
320
321 if (bl) {
322 /* we found an existing one */
323 if (bl->active == active) {
324 return LDB_SUCCESS;
325 }
326 DLIST_REMOVE(replmd_private->la_backlinks, bl);
327 talloc_free(bl);
328 return LDB_SUCCESS;
329 }
330
331 if (replmd_private->bl_ctx == NULL) {
332 replmd_private->bl_ctx = talloc_new(replmd_private);
333 if (replmd_private->bl_ctx == NULL) {
334 ldb_module_oom(module);
335 return LDB_ERR_OPERATIONS_ERROR;
336 }
337 }
338
339 /* its a new one */
340 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
341 if (bl == NULL) {
342 ldb_module_oom(module);
343 return LDB_ERR_OPERATIONS_ERROR;
344 }
345
346 /* Ensure the schema does not go away before the bl->attr_name is used */
347 if (!talloc_reference(bl, schema)) {
348 talloc_free(bl);
349 ldb_module_oom(module);
350 return LDB_ERR_OPERATIONS_ERROR;
351 }
352
353 bl->attr_name = target_attr->lDAPDisplayName;
354 bl->forward_guid = *forward_guid;
355 bl->target_guid = *target_guid;
356 bl->active = active;
357
358 /* the caller may ask for this backlink to be processed
359 immediately */
360 if (immediate) {
361 int ret = replmd_process_backlink(module, bl, NULL);
362 talloc_free(bl);
363 return ret;
364 }
365
366 DLIST_ADD(replmd_private->la_backlinks, bl);
367
368 return LDB_SUCCESS;
369 }
370
371
372 /*
373 * Callback for most write operations in this module:
374 *
375 * notify the repl task that a object has changed. The notifies are
376 * gathered up in the replmd_private structure then written to the
377 * @REPLCHANGED object in each partition during the prepare_commit
378 */
379 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
380 {
381 int ret;
382 struct replmd_replicated_request *ac =
383 talloc_get_type_abort(req->context, struct replmd_replicated_request);
384 struct replmd_private *replmd_private =
385 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
386 struct nc_entry *modified_partition;
387 struct ldb_control *partition_ctrl;
388 const struct dsdb_control_current_partition *partition;
389
390 struct ldb_control **controls;
391
392 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
393
394 controls = ares->controls;
395 if (ldb_request_get_control(ac->req,
396 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
397 /*
398 * Remove the current partition control from what we pass up
399 * the chain if it hasn't been requested manually.
400 */
401 controls = ldb_controls_except_specified(ares->controls, ares,
402 partition_ctrl);
403 }
404
405 if (ares->error != LDB_SUCCESS) {
406 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
407 return ldb_module_done(ac->req, controls,
408 ares->response, ares->error);
409 }
410
411 if (ares->type != LDB_REPLY_DONE) {
412 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
413 return ldb_module_done(ac->req, NULL,
414 NULL, LDB_ERR_OPERATIONS_ERROR);
415 }
416
417 if (!partition_ctrl) {
418 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
419 return ldb_module_done(ac->req, NULL,
420 NULL, LDB_ERR_OPERATIONS_ERROR);
421 }
422
423 partition = talloc_get_type_abort(partition_ctrl->data,
424 struct dsdb_control_current_partition);
425
426 if (ac->seq_num > 0) {
427 for (modified_partition = replmd_private->ncs; modified_partition;
428 modified_partition = modified_partition->next) {
429 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
430 break;
431 }
432 }
433
434 if (modified_partition == NULL) {
435 modified_partition = talloc_zero(replmd_private, struct nc_entry);
436 if (!modified_partition) {
437 ldb_oom(ldb_module_get_ctx(ac->module));
438 return ldb_module_done(ac->req, NULL,
439 NULL, LDB_ERR_OPERATIONS_ERROR);
440 }
441 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
442 if (!modified_partition->dn) {
443 ldb_oom(ldb_module_get_ctx(ac->module));
444 return ldb_module_done(ac->req, NULL,
445 NULL, LDB_ERR_OPERATIONS_ERROR);
446 }
447 DLIST_ADD(replmd_private->ncs, modified_partition);
448 }
449
450 if (ac->seq_num > modified_partition->mod_usn) {
451 modified_partition->mod_usn = ac->seq_num;
452 if (ac->is_urgent) {
453 modified_partition->mod_usn_urgent = ac->seq_num;
454 }
455 }
456 }
457
458 if (ac->apply_mode) {
459 talloc_free(ares);
460 ac->index_current++;
461
462 ret = replmd_replicated_apply_next(ac);
463 if (ret != LDB_SUCCESS) {
464 return ldb_module_done(ac->req, NULL, NULL, ret);
465 }
466 return ret;
467 } else {
468 /* free the partition control container here, for the
469 * common path. Other cases will have it cleaned up
470 * eventually with the ares */
471 talloc_free(partition_ctrl);
472 return ldb_module_done(ac->req, controls,
473 ares->response, LDB_SUCCESS);
474 }
475 }
476
477
478 /*
479 * update a @REPLCHANGED record in each partition if there have been
480 * any writes of replicated data in the partition
481 */
482 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
483 {
484 struct replmd_private *replmd_private =
485 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
486
487 while (replmd_private->ncs) {
488 int ret;
489 struct nc_entry *modified_partition = replmd_private->ncs;
490
491 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
492 modified_partition->mod_usn,
493 modified_partition->mod_usn_urgent, parent);
494 if (ret != LDB_SUCCESS) {
495 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
496 ldb_dn_get_linearized(modified_partition->dn)));
497 return ret;
498 }
499 DLIST_REMOVE(replmd_private->ncs, modified_partition);
500 talloc_free(modified_partition);
501 }
502
503 return LDB_SUCCESS;
504 }
505
506
507 /*
508 created a replmd_replicated_request context
509 */
510 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
511 struct ldb_request *req)
512 {
513 struct ldb_context *ldb;
514 struct replmd_replicated_request *ac;
515
516 ldb = ldb_module_get_ctx(module);
517
518 ac = talloc_zero(req, struct replmd_replicated_request);
519 if (ac == NULL) {
520 ldb_oom(ldb);
521 return NULL;
522 }
523
524 ac->module = module;
525 ac->req = req;
526
527 ac->schema = dsdb_get_schema(ldb, ac);
528 if (!ac->schema) {
529 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
530 "replmd_modify: no dsdb_schema loaded");
531 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
532 return NULL;
533 }
534
535 return ac;
536 }
537
538 /*
539 add a time element to a record
540 */
541 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
542 {
543 struct ldb_message_element *el;
544 char *s;
545 int ret;
546
547 if (ldb_msg_find_element(msg, attr) != NULL) {
548 return LDB_SUCCESS;
549 }
550
551 s = ldb_timestring(msg, t);
552 if (s == NULL) {
553 return LDB_ERR_OPERATIONS_ERROR;
554 }
555
556 ret = ldb_msg_add_string(msg, attr, s);
557 if (ret != LDB_SUCCESS) {
558 return ret;
559 }
560
561 el = ldb_msg_find_element(msg, attr);
562 /* always set as replace. This works because on add ops, the flag
563 is ignored */
564 el->flags = LDB_FLAG_MOD_REPLACE;
565
566 return LDB_SUCCESS;
567 }
568
569 /*
570 add a uint64_t element to a record
571 */
572 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
573 const char *attr, uint64_t v)
574 {
575 struct ldb_message_element *el;
576 int ret;
577
578 if (ldb_msg_find_element(msg, attr) != NULL) {
579 return LDB_SUCCESS;
580 }
581
582 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
583 if (ret != LDB_SUCCESS) {
584 return ret;
585 }
586
587 el = ldb_msg_find_element(msg, attr);
588 /* always set as replace. This works because on add ops, the flag
589 is ignored */
590 el->flags = LDB_FLAG_MOD_REPLACE;
591
592 return LDB_SUCCESS;
593 }
594
595 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
596 const struct replPropertyMetaData1 *m2,
597 const uint32_t *rdn_attid)
598 {
599 if (m1->attid == m2->attid) {
600 return 0;
601 }
602
603 /*
604 * the rdn attribute should be at the end!
605 * so we need to return a value greater than zero
606 * which means m1 is greater than m2
607 */
608 if (m1->attid == *rdn_attid) {
609 return 1;
610 }
611
612 /*
613 * the rdn attribute should be at the end!
614 * so we need to return a value less than zero
615 * which means m2 is greater than m1
616 */
617 if (m2->attid == *rdn_attid) {
618 return -1;
619 }
620
621 return m1->attid > m2->attid ? 1 : -1;
622 }
623
624 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
625 const struct dsdb_schema *schema,
626 struct ldb_dn *dn)
627 {
628 const char *rdn_name;
629 const struct dsdb_attribute *rdn_sa;
630
631 rdn_name = ldb_dn_get_rdn_name(dn);
632 if (!rdn_name) {
633 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
634 return LDB_ERR_OPERATIONS_ERROR;
635 }
636
637 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
638 if (rdn_sa == NULL) {
639 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
640 return LDB_ERR_OPERATIONS_ERROR;
641 }
642
643 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
644 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
645
646 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
647
648 return LDB_SUCCESS;
649 }
650
651 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
652 const struct ldb_message_element *e2,
653 const struct dsdb_schema *schema)
654 {
655 const struct dsdb_attribute *a1;
656 const struct dsdb_attribute *a2;
657
658 /*
659 * TODO: make this faster by caching the dsdb_attribute pointer
660 * on the ldb_messag_element
661 */
662
663 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
664 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
665
666 /*
667 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
668 * in the schema
669 */
670 if (!a1 || !a2) {
671 return strcasecmp(e1->name, e2->name);
672 }
673 if (a1->attributeID_id == a2->attributeID_id) {
674 return 0;
675 }
676 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
677 }
678
679 static void replmd_ldb_message_sort(struct ldb_message *msg,
680 const struct dsdb_schema *schema)
681 {
682 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
683 }
684
685 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
686 const struct GUID *invocation_id, uint64_t seq_num,
687 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
688
689
690 /*
691 fix up linked attributes in replmd_add.
692 This involves setting up the right meta-data in extended DN
693 components, and creating backlinks to the object
694 */
695 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
696 uint64_t seq_num, const struct GUID *invocationId, time_t t,
697 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
698 {
699 unsigned int i;
700 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
701 struct ldb_context *ldb = ldb_module_get_ctx(module);
702
703 /* We will take a reference to the schema in replmd_add_backlink */
704 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
705 NTTIME now;
706
707 unix_to_nt_time(&now, t);
708
709 for (i=0; i<el->num_values; i++) {
710 struct ldb_val *v = &el->values[i];
711 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
712 struct GUID target_guid;
713 NTSTATUS status;
714 int ret;
715
716 /* note that the DN already has the extended
717 components from the extended_dn_store module */
718 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
719 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
720 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
721 if (ret != LDB_SUCCESS) {
722 talloc_free(tmp_ctx);
723 return ret;
724 }
725 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
726 if (ret != LDB_SUCCESS) {
727 talloc_free(tmp_ctx);
728 return ret;
729 }
730 }
731
732 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
733 seq_num, seq_num, now, 0, false);
734 if (ret != LDB_SUCCESS) {
735 talloc_free(tmp_ctx);
736 return ret;
737 }
738
739 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
740 if (ret != LDB_SUCCESS) {
741 talloc_free(tmp_ctx);
742 return ret;
743 }
744 }
745
746 talloc_free(tmp_ctx);
747 return LDB_SUCCESS;
748 }
749
750
751 /*
752 intercept add requests
753 */
754 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
755 {
756 struct samldb_msds_intid_persistant *msds_intid_struct;
757 struct ldb_context *ldb;
758 struct ldb_control *control;
759 struct replmd_replicated_request *ac;
760 enum ndr_err_code ndr_err;
761 struct ldb_request *down_req;
762 struct ldb_message *msg;
763 const DATA_BLOB *guid_blob;
764 struct GUID guid;
765 struct replPropertyMetaDataBlob nmd;
766 struct ldb_val nmd_value;
767 const struct GUID *our_invocation_id;
768 time_t t = time(NULL);
769 NTTIME now;
770 char *time_str;
771 int ret;
772 unsigned int i;
773 unsigned int functional_level;
774 uint32_t ni=0;
775 bool allow_add_guid = false;
776 bool remove_current_guid = false;
777 bool is_urgent = false;
778 struct ldb_message_element *objectclass_el;
779
780 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
781 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
782 if (control) {
783 allow_add_guid = true;
784 }
785
786 /* do not manipulate our control entries */
787 if (ldb_dn_is_special(req->op.add.message->dn)) {
788 return ldb_next_request(module, req);
789 }
790
791 ldb = ldb_module_get_ctx(module);
792
793 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
794
795 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
796 if (guid_blob != NULL) {
797 if (!allow_add_guid) {
798 ldb_set_errstring(ldb,
799 "replmd_add: it's not allowed to add an object with objectGUID!");
800 return LDB_ERR_UNWILLING_TO_PERFORM;
801 } else {
802 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
803 if (!NT_STATUS_IS_OK(status)) {
804 ldb_set_errstring(ldb,
805 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
806 return LDB_ERR_UNWILLING_TO_PERFORM;
807 }
808 /* we remove this attribute as it can be a string and
809 * will not be treated correctly and then we will re-add
810 * it later on in the good format */
811 remove_current_guid = true;
812 }
813 } else {
814 /* a new GUID */
815 guid = GUID_random();
816 }
817
818 ac = replmd_ctx_init(module, req);
819 if (ac == NULL) {
820 return ldb_module_oom(module);
821 }
822
823 functional_level = dsdb_functional_level(ldb);
824
825 /* Get a sequence number from the backend */
826 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
827 if (ret != LDB_SUCCESS) {
828 talloc_free(ac);
829 return ret;
830 }
831
832 /* get our invocationId */
833 our_invocation_id = samdb_ntds_invocation_id(ldb);
834 if (!our_invocation_id) {
835 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
836 "replmd_add: unable to find invocationId\n");
837 talloc_free(ac);
838 return LDB_ERR_OPERATIONS_ERROR;
839 }
840
841 /* we have to copy the message as the caller might have it as a const */
842 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
843 if (msg == NULL) {
844 ldb_oom(ldb);
845 talloc_free(ac);
846 return LDB_ERR_OPERATIONS_ERROR;
847 }
848
849 /* generated times */
850 unix_to_nt_time(&now, t);
851 time_str = ldb_timestring(msg, t);
852 if (!time_str) {
853 ldb_oom(ldb);
854 talloc_free(ac);
855 return LDB_ERR_OPERATIONS_ERROR;
856 }
857 if (remove_current_guid) {
858 ldb_msg_remove_attr(msg,"objectGUID");
859 }
860
861 /*
862 * remove autogenerated attributes
863 */
864 ldb_msg_remove_attr(msg, "whenCreated");
865 ldb_msg_remove_attr(msg, "whenChanged");
866 ldb_msg_remove_attr(msg, "uSNCreated");
867 ldb_msg_remove_attr(msg, "uSNChanged");
868 ldb_msg_remove_attr(msg, "replPropertyMetaData");
869
870 /*
871 * readd replicated attributes
872 */
873 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
874 if (ret != LDB_SUCCESS) {
875 ldb_oom(ldb);
876 talloc_free(ac);
877 return ret;
878 }
879
880 /* build the replication meta_data */
881 ZERO_STRUCT(nmd);
882 nmd.version = 1;
883 nmd.ctr.ctr1.count = msg->num_elements;
884 nmd.ctr.ctr1.array = talloc_array(msg,
885 struct replPropertyMetaData1,
886 nmd.ctr.ctr1.count);
887 if (!nmd.ctr.ctr1.array) {
888 ldb_oom(ldb);
889 talloc_free(ac);
890 return LDB_ERR_OPERATIONS_ERROR;
891 }
892
893 for (i=0; i < msg->num_elements; i++) {
894 struct ldb_message_element *e = &msg->elements[i];
895 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
896 const struct dsdb_attribute *sa;
897
898 if (e->name[0] == '@') continue;
899
900 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
901 if (!sa) {
902 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
903 "replmd_add: attribute '%s' not defined in schema\n",
904 e->name);
905 talloc_free(ac);
906 return LDB_ERR_NO_SUCH_ATTRIBUTE;
907 }
908
909 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
910 /* if the attribute is not replicated (0x00000001)
911 * or constructed (0x00000004) it has no metadata
912 */
913 continue;
914 }
915
916 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
917 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
918 if (ret != LDB_SUCCESS) {
919 talloc_free(ac);
920 return ret;
921 }
922 /* linked attributes are not stored in
923 replPropertyMetaData in FL above w2k */
924 continue;
925 }
926
927 m->attid = sa->attributeID_id;
928 m->version = 1;
929 if (m->attid == 0x20030) {
930 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
931 const char* rdn;
932
933 if (rdn_val == NULL) {
934 ldb_oom(ldb);
935 talloc_free(ac);
936 return LDB_ERR_OPERATIONS_ERROR;
937 }
938
939 rdn = (const char*)rdn_val->data;
940 if (strcmp(rdn, "Deleted Objects") == 0) {
941 /*
942 * Set the originating_change_time to 29/12/9999 at 23:59:59
943 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
944 */
945 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
946 } else {
947 m->originating_change_time = now;
948 }
949 } else {
950 m->originating_change_time = now;
951 }
952 m->originating_invocation_id = *our_invocation_id;
953 m->originating_usn = ac->seq_num;
954 m->local_usn = ac->seq_num;
955 ni++;
956 }
957
958 /* fix meta data count */
959 nmd.ctr.ctr1.count = ni;
960
961 /*
962 * sort meta data array, and move the rdn attribute entry to the end
963 */
964 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
965 if (ret != LDB_SUCCESS) {
966 talloc_free(ac);
967 return ret;
968 }
969
970 /* generated NDR encoded values */
971 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
972 &nmd,
973 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
974 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
975 ldb_oom(ldb);
976 talloc_free(ac);
977 return LDB_ERR_OPERATIONS_ERROR;
978 }
979
980 /*
981 * add the autogenerated values
982 */
983 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
984 if (ret != LDB_SUCCESS) {
985 ldb_oom(ldb);
986 talloc_free(ac);
987 return ret;
988 }
989 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
990 if (ret != LDB_SUCCESS) {
991 ldb_oom(ldb);
992 talloc_free(ac);
993 return ret;
994 }
995 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
996 if (ret != LDB_SUCCESS) {
997 ldb_oom(ldb);
998 talloc_free(ac);
999 return ret;
1000 }
1001 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1002 if (ret != LDB_SUCCESS) {
1003 ldb_oom(ldb);
1004 talloc_free(ac);
1005 return ret;
1006 }
1007 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1008 if (ret != LDB_SUCCESS) {
1009 ldb_oom(ldb);
1010 talloc_free(ac);
1011 return ret;
1012 }
1013
1014 /*
1015 * sort the attributes by attid before storing the object
1016 */
1017 replmd_ldb_message_sort(msg, ac->schema);
1018
1019 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1020 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1021 REPL_URGENT_ON_CREATE);
1022
1023 ac->is_urgent = is_urgent;
1024 ret = ldb_build_add_req(&down_req, ldb, ac,
1025 msg,
1026 req->controls,
1027 ac, replmd_op_callback,
1028 req);
1029
1030 LDB_REQ_SET_LOCATION(down_req);
1031 if (ret != LDB_SUCCESS) {
1032 talloc_free(ac);
1033 return ret;
1034 }
1035
1036 /* current partition control is needed by "replmd_op_callback" */
1037 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1038 ret = ldb_request_add_control(down_req,
1039 DSDB_CONTROL_CURRENT_PARTITION_OID,
1040 false, NULL);
1041 if (ret != LDB_SUCCESS) {
1042 talloc_free(ac);
1043 return ret;
1044 }
1045 }
1046
1047 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1048 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1049 if (ret != LDB_SUCCESS) {
1050 talloc_free(ac);
1051 return ret;
1052 }
1053 }
1054
1055 /* mark the control done */
1056 if (control) {
1057 control->critical = 0;
1058 }
1059 if (ldb_dn_compare_base(ac->schema->base_dn, req->op.add.message->dn) != 0) {
1060
1061 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
1062 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1063 if (msds_intid_struct) {
1064 msds_intid_struct->usn = ac->seq_num;
1065 }
1066 }
1067 /* go on with the call chain */
1068 return ldb_next_request(module, down_req);
1069 }
1070
1071
1072 /*
1073 * update the replPropertyMetaData for one element
1074 */
1075 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1076 struct ldb_message *msg,
1077 struct ldb_message_element *el,
1078 struct ldb_message_element *old_el,
1079 struct replPropertyMetaDataBlob *omd,
1080 const struct dsdb_schema *schema,
1081 uint64_t *seq_num,
1082 const struct GUID *our_invocation_id,
1083 NTTIME now,
1084 struct ldb_request *req)
1085 {
1086 uint32_t i;
1087 const struct dsdb_attribute *a;
1088 struct replPropertyMetaData1 *md1;
1089 bool may_skip = false;
1090
1091 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1092 if (a == NULL) {
1093 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1094 /* allow this to make it possible for dbcheck
1095 to remove bad attributes */
1096 return LDB_SUCCESS;
1097 }
1098
1099 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1100 el->name));
1101 return LDB_ERR_OPERATIONS_ERROR;
1102 }
1103
1104 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1105 return LDB_SUCCESS;
1106 }
1107
1108 /*
1109 * if the attribute's value haven't changed, and this isn't
1110 * just a delete of everything then return LDB_SUCCESS Unless
1111 * we have the provision control or if the attribute is
1112 * interSiteTopologyGenerator as this page explain:
1113 * http://support.microsoft.com/kb/224815 this attribute is
1114 * periodicaly written by the DC responsible for the intersite
1115 * generation in a given site
1116 *
1117 * Unchanged could be deleting or replacing an already-gone
1118 * thing with an unconstrained delete/empty replace or a
1119 * replace with the same value, but not an add with the same
1120 * value because that could be about adding a duplicate (which
1121 * is for someone else to error out on).
1122 */
1123 if (old_el != NULL && ldb_msg_element_equal_ordered(el, old_el)) {
1124 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1125 may_skip = true;
1126 }
1127 } else if (old_el == NULL && el->num_values == 0) {
1128 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1129 may_skip = true;
1130 } else if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
1131 may_skip = true;
1132 }
1133 }
1134
1135 if (may_skip) {
1136 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1137 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1138 /*
1139 * allow this to make it possible for dbcheck
1140 * to rebuild broken metadata
1141 */
1142 return LDB_SUCCESS;
1143 }
1144 }
1145
1146 for (i=0; i<omd->ctr.ctr1.count; i++) {
1147 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1148 }
1149
1150 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1151 /* linked attributes are not stored in
1152 replPropertyMetaData in FL above w2k, but we do
1153 raise the seqnum for the object */
1154 if (*seq_num == 0 &&
1155 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1156 return LDB_ERR_OPERATIONS_ERROR;
1157 }
1158 return LDB_SUCCESS;
1159 }
1160
1161 if (i == omd->ctr.ctr1.count) {
1162 /* we need to add a new one */
1163 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1164 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1165 if (omd->ctr.ctr1.array == NULL) {
1166 ldb_oom(ldb);
1167 return LDB_ERR_OPERATIONS_ERROR;
1168 }
1169 omd->ctr.ctr1.count++;
1170 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1171 }
1172
1173 /* Get a new sequence number from the backend. We only do this
1174 * if we have a change that requires a new
1175 * replPropertyMetaData element
1176 */
1177 if (*seq_num == 0) {
1178 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1179 if (ret != LDB_SUCCESS) {
1180 return LDB_ERR_OPERATIONS_ERROR;
1181 }
1182 }
1183
1184 md1 = &omd->ctr.ctr1.array[i];
1185 md1->version++;
1186 md1->attid = a->attributeID_id;
1187 if (md1->attid == 0x20030) {
1188 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1189 const char* rdn;
1190
1191 if (rdn_val == NULL) {
1192 ldb_oom(ldb);
1193 return LDB_ERR_OPERATIONS_ERROR;
1194 }
1195
1196 rdn = (const char*)rdn_val->data;
1197 if (strcmp(rdn, "Deleted Objects") == 0) {
1198 /*
1199 * Set the originating_change_time to 29/12/9999 at 23:59:59
1200 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1201 */
1202 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1203 } else {
1204 md1->originating_change_time = now;
1205 }
1206 } else {
1207 md1->originating_change_time = now;
1208 }
1209 md1->originating_invocation_id = *our_invocation_id;
1210 md1->originating_usn = *seq_num;
1211 md1->local_usn = *seq_num;
1212
1213 return LDB_SUCCESS;
1214 }
1215
1216 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1217 {
1218 uint32_t count = omd.ctr.ctr1.count;
1219 uint64_t max = 0;
1220 uint32_t i;
1221 for (i=0; i < count; i++) {
1222 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1223 if (max < m.local_usn) {
1224 max = m.local_usn;
1225 }
1226 }
1227 return max;
1228 }
1229
1230 /*
1231 * update the replPropertyMetaData object each time we modify an
1232 * object. This is needed for DRS replication, as the merge on the
1233 * client is based on this object
1234 */
1235 static int replmd_update_rpmd(struct ldb_module *module,
1236 const struct dsdb_schema *schema,
1237 struct ldb_request *req,
1238 const char * const *rename_attrs,
1239 struct ldb_message *msg, uint64_t *seq_num,
1240 time_t t,
1241 bool *is_urgent, bool *rodc)
1242 {
1243 const struct ldb_val *omd_value;
1244 enum ndr_err_code ndr_err;
1245 struct replPropertyMetaDataBlob omd;
1246 unsigned int i;
1247 NTTIME now;
1248 const struct GUID *our_invocation_id;
1249 int ret;
1250 const char * const *attrs = NULL;
1251 const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1252 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1253 struct ldb_result *res;
1254 struct ldb_context *ldb;
1255 struct ldb_message_element *objectclass_el;
1256 enum urgent_situation situation;
1257 bool rmd_is_provided;
1258
1259 if (rename_attrs) {
1260 attrs = rename_attrs;
1261 } else {
1262 attrs = attrs1;
1263 }
1264
1265 ldb = ldb_module_get_ctx(module);
1266
1267 our_invocation_id = samdb_ntds_invocation_id(ldb);
1268 if (!our_invocation_id) {
1269 /* this happens during an initial vampire while
1270 updating the schema */
1271 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1272 return LDB_SUCCESS;
1273 }
1274
1275 unix_to_nt_time(&now, t);
1276
1277 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1278 rmd_is_provided = true;
1279 } else {
1280 rmd_is_provided = false;
1281 }
1282
1283 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1284 * otherwise we consider we are updating */
1285 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1286 situation = REPL_URGENT_ON_DELETE;
1287 } else if (rename_attrs) {
1288 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1289 } else {
1290 situation = REPL_URGENT_ON_UPDATE;
1291 }
1292
1293 if (rmd_is_provided) {
1294 /* In this case the change_replmetadata control was supplied */
1295 /* We check that it's the only attribute that is provided
1296 * (it's a rare case so it's better to keep the code simplier)
1297 * We also check that the highest local_usn is bigger than
1298 * uSNChanged. */
1299 uint64_t db_seq;
1300 if( msg->num_elements != 1 ||
1301 strncmp(msg->elements[0].name,
1302 "replPropertyMetaData", 20) ) {
1303 DEBUG(0,(__location__ ": changereplmetada control called without "\
1304 "a specified replPropertyMetaData attribute or with others\n"));
1305 return LDB_ERR_OPERATIONS_ERROR;
1306 }
1307 if (situation != REPL_URGENT_ON_UPDATE) {
1308 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1309 return LDB_ERR_OPERATIONS_ERROR;
1310 }
1311 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1312 if (!omd_value) {
1313 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1314 ldb_dn_get_linearized(msg->dn)));
1315 return LDB_ERR_OPERATIONS_ERROR;
1316 }
1317 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1318 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1319 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1320 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1321 ldb_dn_get_linearized(msg->dn)));
1322 return LDB_ERR_OPERATIONS_ERROR;
1323 }
1324 *seq_num = find_max_local_usn(omd);
1325
1326 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1327 DSDB_FLAG_NEXT_MODULE |
1328 DSDB_SEARCH_SHOW_RECYCLED |
1329 DSDB_SEARCH_SHOW_EXTENDED_DN |
1330 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1331 DSDB_SEARCH_REVEAL_INTERNALS, req);
1332
1333 if (ret != LDB_SUCCESS) {
1334 return ret;
1335 }
1336
1337 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1338 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1339 situation)) {
1340 *is_urgent = true;
1341 }
1342
1343 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1344 if (*seq_num <= db_seq) {
1345 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1346 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1347 (long long)*seq_num, (long long)db_seq));
1348 return LDB_ERR_OPERATIONS_ERROR;
1349 }
1350
1351 } else {
1352 /* search for the existing replPropertyMetaDataBlob. We need
1353 * to use REVEAL and ask for DNs in storage format to support
1354 * the check for values being the same in
1355 * replmd_update_rpmd_element()
1356 */
1357 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1358 DSDB_FLAG_NEXT_MODULE |
1359 DSDB_SEARCH_SHOW_RECYCLED |
1360 DSDB_SEARCH_SHOW_EXTENDED_DN |
1361 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1362 DSDB_SEARCH_REVEAL_INTERNALS, req);
1363 if (ret != LDB_SUCCESS) {
1364 return ret;
1365 }
1366
1367 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1368 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1369 situation)) {
1370 *is_urgent = true;
1371 }
1372
1373 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1374 if (!omd_value) {
1375 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1376 ldb_dn_get_linearized(msg->dn)));
1377 return LDB_ERR_OPERATIONS_ERROR;
1378 }
1379
1380 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1381 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1382 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1383 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1384 ldb_dn_get_linearized(msg->dn)));
1385 return LDB_ERR_OPERATIONS_ERROR;
1386 }
1387
1388 if (omd.version != 1) {
1389 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1390 omd.version, ldb_dn_get_linearized(msg->dn)));
1391 return LDB_ERR_OPERATIONS_ERROR;
1392 }
1393
1394 for (i=0; i<msg->num_elements; i++) {
1395 struct ldb_message_element *old_el;
1396 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1397 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1398 our_invocation_id, now, req);
1399 if (ret != LDB_SUCCESS) {
1400 return ret;
1401 }
1402
1403 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1404 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1405 }
1406
1407 }
1408 }
1409 /*
1410 * replmd_update_rpmd_element has done an update if the
1411 * seq_num is set
1412 */
1413 if (*seq_num != 0) {
1414 struct ldb_val *md_value;
1415 struct ldb_message_element *el;
1416
1417 /*if we are RODC and this is a DRSR update then its ok*/
1418 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1419 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1420 unsigned instanceType;
1421
1422 ret = samdb_rodc(ldb, rodc);
1423 if (ret != LDB_SUCCESS) {
1424 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1425 } else if (*rodc) {
1426 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1427 return LDB_ERR_REFERRAL;
1428 }
1429
1430 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1431 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1432 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1433 "cannot change replicated attribute on partial replica");
1434 }
1435 }
1436
1437 md_value = talloc(msg, struct ldb_val);
1438 if (md_value == NULL) {
1439 ldb_oom(ldb);
1440 return LDB_ERR_OPERATIONS_ERROR;
1441 }
1442
1443 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1444 if (ret != LDB_SUCCESS) {
1445 return ret;
1446 }
1447
1448 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1449 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1450 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1451 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1452 ldb_dn_get_linearized(msg->dn)));
1453 return LDB_ERR_OPERATIONS_ERROR;
1454 }
1455
1456 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1457 if (ret != LDB_SUCCESS) {
1458 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1459 ldb_dn_get_linearized(msg->dn)));
1460 return ret;
1461 }
1462
1463 el->num_values = 1;
1464 el->values = md_value;
1465 }
1466
1467 return LDB_SUCCESS;
1468 }
1469
1470 struct parsed_dn {
1471 struct dsdb_dn *dsdb_dn;
1472 struct GUID *guid;
1473 struct ldb_val *v;
1474 };
1475
1476 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1477 {
1478 return GUID_compare(pdn1->guid, pdn2->guid);
1479 }
1480
1481 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1482 unsigned int count, struct GUID *guid,
1483 struct ldb_dn *dn)
1484 {
1485 struct parsed_dn *ret;
1486 unsigned int i;
1487 if (dn && GUID_all_zero(guid)) {
1488 /* when updating a link using DRS, we sometimes get a
1489 NULL GUID. We then need to try and match by DN */
1490 for (i=0; i<count; i++) {
1491 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1492 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1493 return &pdn[i];
1494 }
1495 }
1496 return NULL;
1497 }
1498 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1499 return ret;
1500 }
1501
1502 /*
1503 get a series of message element values as an array of DNs and GUIDs
1504 the result is sorted by GUID
1505 */
1506 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1507 struct ldb_message_element *el, struct parsed_dn **pdn,
1508 const char *ldap_oid, struct ldb_request *parent)
1509 {
1510 unsigned int i;
1511 struct ldb_context *ldb = ldb_module_get_ctx(module);
1512
1513 if (el == NULL) {
1514 *pdn = NULL;
1515 return LDB_SUCCESS;
1516 }
1517
1518 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1519 if (!*pdn) {
1520 ldb_module_oom(module);
1521 return LDB_ERR_OPERATIONS_ERROR;
1522 }
1523
1524 for (i=0; i<el->num_values; i++) {
1525 struct ldb_val *v = &el->values[i];
1526 NTSTATUS status;
1527 struct ldb_dn *dn;
1528 struct parsed_dn *p;
1529
1530 p = &(*pdn)[i];
1531
1532 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1533 if (p->dsdb_dn == NULL) {
1534 return LDB_ERR_INVALID_DN_SYNTAX;
1535 }
1536
1537 dn = p->dsdb_dn->dn;
1538
1539 p->guid = talloc(*pdn, struct GUID);
1540 if (p->guid == NULL) {
1541 ldb_module_oom(module);
1542 return LDB_ERR_OPERATIONS_ERROR;
1543 }
1544
1545 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1546 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1547 /* we got a DN without a GUID - go find the GUID */
1548 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1549 if (ret != LDB_SUCCESS) {
1550 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1551 ldb_dn_get_linearized(dn));
1552 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1553 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1554 ldb_attr_cmp(el->name, "member") == 0) {
1555 return LDB_ERR_UNWILLING_TO_PERFORM;
1556 }
1557 return ret;
1558 }
1559 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1560 if (ret != LDB_SUCCESS) {
1561 return ret;
1562 }
1563 } else if (!NT_STATUS_IS_OK(status)) {
1564 return LDB_ERR_OPERATIONS_ERROR;
1565 }
1566
1567 /* keep a pointer to the original ldb_val */
1568 p->v = v;
1569 }
1570
1571 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1572
1573 return LDB_SUCCESS;
1574 }
1575
1576 /*
1577 build a new extended DN, including all meta data fields
1578
1579 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1580 RMD_ADDTIME = originating_add_time
1581 RMD_INVOCID = originating_invocation_id
1582 RMD_CHANGETIME = originating_change_time
1583 RMD_ORIGINATING_USN = originating_usn
1584 RMD_LOCAL_USN = local_usn
1585 RMD_VERSION = version
1586 */
1587 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1588 const struct GUID *invocation_id, uint64_t seq_num,
1589 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1590 {
1591 struct ldb_dn *dn = dsdb_dn->dn;
1592 const char *tstring, *usn_string, *flags_string;
1593 struct ldb_val tval;
1594 struct ldb_val iid;
1595 struct ldb_val usnv, local_usnv;
1596 struct ldb_val vers, flagsv;
1597 NTSTATUS status;
1598 int ret;
1599 const char *dnstring;
1600 char *vstring;
1601 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1602
1603 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1604 if (!tstring) {
1605 return LDB_ERR_OPERATIONS_ERROR;
1606 }
1607 tval = data_blob_string_const(tstring);
1608
1609 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1610 if (!usn_string) {
1611 return LDB_ERR_OPERATIONS_ERROR;
1612 }
1613 usnv = data_blob_string_const(usn_string);
1614
1615 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1616 if (!usn_string) {
1617 return LDB_ERR_OPERATIONS_ERROR;
1618 }
1619 local_usnv = data_blob_string_const(usn_string);
1620
1621 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1622 if (!vstring) {
1623 return LDB_ERR_OPERATIONS_ERROR;
1624 }
1625 vers = data_blob_string_const(vstring);
1626
1627 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1628 if (!NT_STATUS_IS_OK(status)) {
1629 return LDB_ERR_OPERATIONS_ERROR;
1630 }
1631
1632 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1633 if (!flags_string) {
1634 return LDB_ERR_OPERATIONS_ERROR;
1635 }
1636 flagsv = data_blob_string_const(flags_string);
1637
1638 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1639 if (ret != LDB_SUCCESS) return ret;
1640 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1641 if (ret != LDB_SUCCESS) return ret;
1642 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1643 if (ret != LDB_SUCCESS) return ret;
1644 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1645 if (ret != LDB_SUCCESS) return ret;
1646 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1647 if (ret != LDB_SUCCESS) return ret;
1648 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1649 if (ret != LDB_SUCCESS) return ret;
1650 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1651 if (ret != LDB_SUCCESS) return ret;
1652
1653 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1654 if (dnstring == NULL) {
1655 return LDB_ERR_OPERATIONS_ERROR;
1656 }
1657 *v = data_blob_string_const(dnstring);
1658
1659 return LDB_SUCCESS;
1660 }
1661
1662 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1663 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1664 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1665 uint32_t version, bool deleted);
1666
1667 /*
1668 check if any links need upgrading from w2k format
1669
1670 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1671 */
1672 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1673 {
1674 uint32_t i;
1675 for (i=0; i<count; i++) {
1676 NTSTATUS status;
1677 uint32_t version;
1678 int ret;
1679
1680 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1681 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1682 continue;
1683 }
1684
1685 /* it's an old one that needs upgrading */
1686 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1687 1, 1, 0, 0, false);
1688 if (ret != LDB_SUCCESS) {
1689 return ret;
1690 }
1691 }
1692 return LDB_SUCCESS;
1693 }
1694
1695 /*
1696 update an extended DN, including all meta data fields
1697
1698 see replmd_build_la_val for value names
1699 */
1700 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1701 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1702 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1703 uint32_t version, bool deleted)
1704 {
1705 struct ldb_dn *dn = dsdb_dn->dn;
1706 const char *tstring, *usn_string, *flags_string;
1707 struct ldb_val tval;
1708 struct ldb_val iid;
1709 struct ldb_val usnv, local_usnv;
1710 struct ldb_val vers, flagsv;
1711 const struct ldb_val *old_addtime;
1712 uint32_t old_version;
1713 NTSTATUS status;
1714 int ret;
1715 const char *dnstring;
1716 char *vstring;
1717 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1718
1719 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1720 if (!tstring) {
1721 return LDB_ERR_OPERATIONS_ERROR;
1722 }
1723 tval = data_blob_string_const(tstring);
1724
1725 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1726 if (!usn_string) {
1727 return LDB_ERR_OPERATIONS_ERROR;
1728 }
1729 usnv = data_blob_string_const(usn_string);
1730
1731 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1732 if (!usn_string) {
1733 return LDB_ERR_OPERATIONS_ERROR;
1734 }
1735 local_usnv = data_blob_string_const(usn_string);
1736
1737 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1738 if (!NT_STATUS_IS_OK(status)) {
1739 return LDB_ERR_OPERATIONS_ERROR;
1740 }
1741
1742 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1743 if (!flags_string) {
1744 return LDB_ERR_OPERATIONS_ERROR;
1745 }
1746 flagsv = data_blob_string_const(flags_string);
1747
1748 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1749 if (ret != LDB_SUCCESS) return ret;
1750
1751 /* get the ADDTIME from the original */
1752 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1753 if (old_addtime == NULL) {
1754 old_addtime = &tval;
1755 }
1756 if (dsdb_dn != old_dsdb_dn ||
1757 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1758 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1759 if (ret != LDB_SUCCESS) return ret;
1760 }
1761
1762 /* use our invocation id */
1763 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1764 if (ret != LDB_SUCCESS) return ret;
1765
1766 /* changetime is the current time */
1767 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1768 if (ret != LDB_SUCCESS) return ret;
1769
1770 /* update the USN */
1771 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1772 if (ret != LDB_SUCCESS) return ret;
1773
1774 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1775 if (ret != LDB_SUCCESS) return ret;
1776
1777 /* increase the version by 1 */
1778 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1779 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1780 version = old_version+1;
1781 }
1782 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1783 vers = data_blob_string_const(vstring);
1784 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1785 if (ret != LDB_SUCCESS) return ret;
1786
1787 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1788 if (dnstring == NULL) {
1789 return LDB_ERR_OPERATIONS_ERROR;
1790 }
1791 *v = data_blob_string_const(dnstring);
1792
1793 return LDB_SUCCESS;
1794 }
1795
1796 /*
1797 handle adding a linked attribute
1798 */
1799 static int replmd_modify_la_add(struct ldb_module *module,
1800 const struct dsdb_schema *schema,
1801 struct ldb_message *msg,
1802 struct ldb_message_element *el,
1803 struct ldb_message_element *old_el,
1804 const struct dsdb_attribute *schema_attr,
1805 uint64_t seq_num,
1806 time_t t,
1807 struct GUID *msg_guid,
1808 struct ldb_request *parent)
1809 {
1810 unsigned int i;
1811 struct parsed_dn *dns, *old_dns;
1812 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1813 int ret;
1814 struct ldb_val *new_values = NULL;
1815 unsigned int num_new_values = 0;
1816 unsigned old_num_values = old_el?old_el->num_values:0;
1817 const struct GUID *invocation_id;
1818 struct ldb_context *ldb = ldb_module_get_ctx(module);
1819 NTTIME now;
1820
1821 unix_to_nt_time(&now, t);
1822
1823 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1824 if (ret != LDB_SUCCESS) {
1825 talloc_free(tmp_ctx);
1826 return ret;
1827 }
1828
1829 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1830 if (ret != LDB_SUCCESS) {
1831 talloc_free(tmp_ctx);
1832 return ret;
1833 }
1834
1835 invocation_id = samdb_ntds_invocation_id(ldb);
1836 if (!invocation_id) {
1837 talloc_free(tmp_ctx);
1838 return LDB_ERR_OPERATIONS_ERROR;
1839 }
1840
1841 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1842 if (ret != LDB_SUCCESS) {
1843 talloc_free(tmp_ctx);
1844 return ret;
1845 }
1846
1847 /* for each new value, see if it exists already with the same GUID */
1848 for (i=0; i<el->num_values; i++) {
1849 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1850 if (p == NULL) {
1851 /* this is a new linked attribute value */
1852 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1853 if (new_values == NULL) {
1854 ldb_module_oom(module);
1855 talloc_free(tmp_ctx);
1856 return LDB_ERR_OPERATIONS_ERROR;
1857 }
1858 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1859 invocation_id, seq_num, seq_num, now, 0, false);
1860 if (ret != LDB_SUCCESS) {
1861 talloc_free(tmp_ctx);
1862 return ret;
1863 }
1864 num_new_values++;
1865 } else {
1866 /* this is only allowed if the GUID was
1867 previously deleted. */
1868 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1869
1870 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1871 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1872 el->name, GUID_string(tmp_ctx, p->guid));
1873 talloc_free(tmp_ctx);
1874 /* error codes for 'member' need to be
1875 special cased */
1876 if (ldb_attr_cmp(el->name, "member") == 0) {
1877 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1878 } else {
1879 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1880 }
1881 }
1882 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1883 invocation_id, seq_num, seq_num, now, 0, false);
1884 if (ret != LDB_SUCCESS) {
1885 talloc_free(tmp_ctx);
1886 return ret;
1887 }
1888 }
1889
1890 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1891 if (ret != LDB_SUCCESS) {
1892 talloc_free(tmp_ctx);
1893 return ret;
1894 }
1895 }
1896
1897 /* add the new ones on to the end of the old values, constructing a new el->values */
1898 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1899 struct ldb_val,
1900 old_num_values+num_new_values);
1901 if (el->values == NULL) {
1902 ldb_module_oom(module);
1903 return LDB_ERR_OPERATIONS_ERROR;
1904 }
1905
1906 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1907 el->num_values = old_num_values + num_new_values;
1908
1909 talloc_steal(msg->elements, el->values);
1910 talloc_steal(el->values, new_values);
1911
1912 talloc_free(tmp_ctx);
1913
1914 /* we now tell the backend to replace all existing values
1915 with the one we have constructed */
1916 el->flags = LDB_FLAG_MOD_REPLACE;
1917
1918 return LDB_SUCCESS;
1919 }
1920
1921
1922 /*
1923 handle deleting all active linked attributes
1924 */
1925 static int replmd_modify_la_delete(struct ldb_module *module,
1926 const struct dsdb_schema *schema,
1927 struct ldb_message *msg,
1928 struct ldb_message_element *el,
1929 struct ldb_message_element *old_el,
1930 const struct dsdb_attribute *schema_attr,
1931 uint64_t seq_num,
1932 time_t t,
1933 struct GUID *msg_guid,
1934 struct ldb_request *parent)
1935 {
1936 unsigned int i;
1937 struct parsed_dn *dns, *old_dns;
1938 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1939 int ret;
1940 const struct GUID *invocation_id;
1941 struct ldb_context *ldb = ldb_module_get_ctx(module);
1942 NTTIME now;
1943
1944 unix_to_nt_time(&now, t);
1945
1946 /* check if there is nothing to delete */
1947 if ((!old_el || old_el->num_values == 0) &&
1948 el->num_values == 0) {
1949 return LDB_SUCCESS;
1950 }
1951
1952 if (!old_el || old_el->num_values == 0) {
1953 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1954 }
1955
1956 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1957 if (ret != LDB_SUCCESS) {
1958 talloc_free(tmp_ctx);
1959 return ret;
1960 }
1961
1962 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1963 if (ret != LDB_SUCCESS) {
1964 talloc_free(tmp_ctx);
1965 return ret;
1966 }
1967
1968 invocation_id = samdb_ntds_invocation_id(ldb);
1969 if (!invocation_id) {
1970 return LDB_ERR_OPERATIONS_ERROR;
1971 }
1972
1973 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1974 if (ret != LDB_SUCCESS) {
1975 talloc_free(tmp_ctx);
1976 return ret;
1977 }
1978
1979 el->values = NULL;
1980
1981 /* see if we are being asked to delete any links that
1982 don't exist or are already deleted */
1983 for (i=0; i<el->num_values; i++) {
1984 struct parsed_dn *p = &dns[i];
1985 struct parsed_dn *p2;
1986 uint32_t rmd_flags;
1987
1988 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1989 if (!p2) {
1990 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1991 el->name, GUID_string(tmp_ctx, p->guid));
1992 if (ldb_attr_cmp(el->name, "member") == 0) {
1993 return LDB_ERR_UNWILLING_TO_PERFORM;
1994 } else {
1995 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1996 }
1997 }
1998 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1999 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
2000 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
2001 el->name, GUID_string(tmp_ctx, p->guid));
2002 if (ldb_attr_cmp(el->name, "member") == 0) {
2003 return LDB_ERR_UNWILLING_TO_PERFORM;
2004 } else {
2005 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2006 }
2007 }
2008 }
2009
2010 /* for each new value, see if it exists already with the same GUID
2011 if it is not already deleted and matches the delete list then delete it
2012 */
2013 for (i=0; i<old_el->num_values; i++) {
2014 struct parsed_dn *p = &old_dns[i];
2015 uint32_t rmd_flags;
2016
2017 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
2018 continue;
2019 }
2020
2021 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
2022 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2023
2024 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2025 invocation_id, seq_num, seq_num, now, 0, true);
2026 if (ret != LDB_SUCCESS) {
2027 talloc_free(tmp_ctx);
2028 return ret;
2029 }
2030
2031 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
2032 if (ret != LDB_SUCCESS) {
2033 talloc_free(tmp_ctx);
2034 return ret;
2035 }
2036 }
2037
2038 el->values = talloc_steal(msg->elements, old_el->values);
2039 el->num_values = old_el->num_values;
2040
2041 talloc_free(tmp_ctx);
2042
2043 /* we now tell the backend to replace all existing values
2044 with the one we have constructed */
2045 el->flags = LDB_FLAG_MOD_REPLACE;
2046
2047 return LDB_SUCCESS;
2048 }
2049
2050 /*
2051 handle replacing a linked attribute
2052 */
2053 static int replmd_modify_la_replace(struct ldb_module *module,
2054 const struct dsdb_schema *schema,
2055 struct ldb_message *msg,
2056 struct ldb_message_element *el,
2057 struct ldb_message_element *old_el,
2058 const struct dsdb_attribute *schema_attr,
2059 uint64_t seq_num,
2060 time_t t,
2061 struct GUID *msg_guid,
2062 struct ldb_request *parent)
2063 {
2064 unsigned int i;
2065 struct parsed_dn *dns, *old_dns;
2066 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2067 int ret;
2068 const struct GUID *invocation_id;
2069 struct ldb_context *ldb = ldb_module_get_ctx(module);
2070 struct ldb_val *new_values = NULL;
2071 unsigned int num_new_values = 0;
2072 unsigned int old_num_values = old_el?old_el->num_values:0;
2073 NTTIME now;
2074
2075 unix_to_nt_time(&now, t);
2076
2077 /* check if there is nothing to replace */
2078 if ((!old_el || old_el->num_values == 0) &&
2079 el->num_values == 0) {
2080 return LDB_SUCCESS;
2081 }
2082
2083 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2084 if (ret != LDB_SUCCESS) {
2085 talloc_free(tmp_ctx);
2086 return ret;
2087 }
2088
2089 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2090 if (ret != LDB_SUCCESS) {
2091 talloc_free(tmp_ctx);
2092 return ret;
2093 }
2094
2095 invocation_id = samdb_ntds_invocation_id(ldb);
2096 if (!invocation_id) {
2097 return LDB_ERR_OPERATIONS_ERROR;
2098 }
2099
2100 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2101 if (ret != LDB_SUCCESS) {
2102 talloc_free(tmp_ctx);
2103 return ret;
2104 }
2105
2106 /* mark all the old ones as deleted */
2107 for (i=0; i<old_num_values; i++) {
2108 struct parsed_dn *old_p = &old_dns[i];
2109 struct parsed_dn *p;
2110 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2111
2112 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2113
2114 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2115 if (ret != LDB_SUCCESS) {
2116 talloc_free(tmp_ctx);
2117 return ret;
2118 }
2119
2120 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2121 if (p) {
2122 /* we don't delete it if we are re-adding it */
2123 continue;
2124 }
2125
2126 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2127 invocation_id, seq_num, seq_num, now, 0, true);
2128 if (ret != LDB_SUCCESS) {
2129 talloc_free(tmp_ctx);
2130 return ret;
2131 }
2132 }
2133
2134 /* for each new value, either update its meta-data, or add it
2135 * to old_el
2136 */
2137 for (i=0; i<el->num_values; i++) {
2138 struct parsed_dn *p = &dns[i], *old_p;
2139
2140 if (old_dns &&
2141 (old_p = parsed_dn_find(old_dns,
2142 old_num_values, p->guid, NULL)) != NULL) {
2143 /* update in place */
2144 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2145 old_p->dsdb_dn, invocation_id,
2146 seq_num, seq_num, now, 0, false);
2147 if (ret != LDB_SUCCESS) {
2148 talloc_free(tmp_ctx);
2149 return ret;
2150 }
2151 } else {
2152 /* add a new one */
2153 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2154 num_new_values+1);
2155 if (new_values == NULL) {
2156 ldb_module_oom(module);
2157 talloc_free(tmp_ctx);
2158 return LDB_ERR_OPERATIONS_ERROR;
2159 }
2160 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2161 invocation_id, seq_num, seq_num, now, 0, false);
2162 if (ret != LDB_SUCCESS) {
2163 talloc_free(tmp_ctx);
2164 return ret;
2165 }
2166 num_new_values++;
2167 }
2168
2169 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2170 if (ret != LDB_SUCCESS) {
2171 talloc_free(tmp_ctx);
2172 return ret;
2173 }
2174 }
2175
2176 /* add the new values to the end of old_el */
2177 if (num_new_values != 0) {
2178 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2179 struct ldb_val, old_num_values+num_new_values);
2180 if (el->values == NULL) {
2181 ldb_module_oom(module);
2182 return LDB_ERR_OPERATIONS_ERROR;
2183 }
2184 memcpy(&el->values[old_num_values], &new_values[0],
2185 sizeof(struct ldb_val)*num_new_values);
2186 el->num_values = old_num_values + num_new_values;
2187 talloc_steal(msg->elements, new_values);
2188 } else {
2189 el->values = old_el->values;
2190 el->num_values = old_el->num_values;
2191 talloc_steal(msg->elements, el->values);
2192 }
2193
2194 talloc_free(tmp_ctx);
2195
2196 /* we now tell the backend to replace all existing values
2197 with the one we have constructed */
2198 el->flags = LDB_FLAG_MOD_REPLACE;
2199
2200 return LDB_SUCCESS;
2201 }
2202
2203
2204 /*
2205 handle linked attributes in modify requests
2206 */
2207 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2208 struct ldb_message *msg,
2209 uint64_t seq_num, time_t t,
2210 struct ldb_request *parent)
2211 {
2212 struct ldb_result *res;
2213 unsigned int i;
2214 int ret;
2215 struct ldb_context *ldb = ldb_module_get_ctx(module);
2216 struct ldb_message *old_msg;
2217
2218 const struct dsdb_schema *schema;
2219 struct GUID old_guid;
2220
2221 if (seq_num == 0) {
2222 /* there the replmd_update_rpmd code has already
2223 * checked and saw that there are no linked
2224 * attributes */
2225 return LDB_SUCCESS;
2226 }
2227
2228 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2229 /* don't do anything special for linked attributes */
2230 return LDB_SUCCESS;
2231 }
2232
2233 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2234 DSDB_FLAG_NEXT_MODULE |
2235 DSDB_SEARCH_SHOW_RECYCLED |
2236 DSDB_SEARCH_REVEAL_INTERNALS |
2237 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2238 parent);
2239 if (ret != LDB_SUCCESS) {
2240 return ret;
2241 }
2242 schema = dsdb_get_schema(ldb, res);
2243 if (!schema) {
2244 return LDB_ERR_OPERATIONS_ERROR;
2245 }
2246
2247 old_msg = res->msgs[0];
2248
2249 old_guid = samdb_result_guid(old_msg, "objectGUID");
2250
2251 for (i=0; i<msg->num_elements; i++) {
2252 struct ldb_message_element *el = &msg->elements[i];
2253 struct ldb_message_element *old_el, *new_el;
2254 const struct dsdb_attribute *schema_attr
2255 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2256 if (!schema_attr) {
2257 ldb_asprintf_errstring(ldb,
2258 "%s: attribute %s is not a valid attribute in schema",
2259 __FUNCTION__, el->name);
2260 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2261 }
2262 if (schema_attr->linkID == 0) {
2263 continue;
2264 }
2265 if ((schema_attr->linkID & 1) == 1) {
2266 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2267 continue;
2268 }
2269 /* Odd is for the target. Illegal to modify */
2270 ldb_asprintf_errstring(ldb,
2271 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2272 return LDB_ERR_UNWILLING_TO_PERFORM;
2273 }
2274 old_el = ldb_msg_find_element(old_msg, el->name);
2275 switch (el->flags & LDB_FLAG_MOD_MASK) {
2276 case LDB_FLAG_MOD_REPLACE:
2277 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2278 break;
2279 case LDB_FLAG_MOD_DELETE:
2280 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2281 break;
2282 case LDB_FLAG_MOD_ADD:
2283 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2284 break;
2285 default:
2286 ldb_asprintf_errstring(ldb,
2287 "invalid flags 0x%x for %s linked attribute",
2288 el->flags, el->name);
2289 return LDB_ERR_UNWILLING_TO_PERFORM;
2290 }
2291 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2292 ldb_asprintf_errstring(ldb,
2293 "Attribute %s is single valued but more than one value has been supplied",
2294 el->name);
2295 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2296 } else {
2297 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2298 }
2299
2300
2301
2302 if (ret != LDB_SUCCESS) {
2303 return ret;
2304 }
2305 if (old_el) {
2306 ldb_msg_remove_attr(old_msg, el->name);
2307 }
2308 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2309 new_el->num_values = el->num_values;
2310 new_el->values = talloc_steal(msg->elements, el->values);
2311
2312 /* TODO: this relises a bit too heavily on the exact
2313 behaviour of ldb_msg_find_element and
2314 ldb_msg_remove_element */
2315 old_el = ldb_msg_find_element(msg, el->name);
2316 if (old_el != el) {
2317 ldb_msg_remove_element(msg, old_el);
2318 i--;
2319 }
2320 }
2321
2322 talloc_free(res);
2323 return ret;
2324 }
2325
2326
2327
2328 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2329 {
2330 struct samldb_msds_intid_persistant *msds_intid_struct;
2331 struct ldb_context *ldb;
2332 struct replmd_replicated_request *ac;
2333 struct ldb_request *down_req;
2334 struct ldb_message *msg;
2335 time_t t = time(NULL);
2336 int ret;
2337 bool is_urgent = false, rodc = false;
2338 unsigned int functional_level;
2339 const DATA_BLOB *guid_blob;
2340 struct ldb_control *sd_propagation_control;
2341
2342 /* do not manipulate our control entries */
2343 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2344 return ldb_next_request(module, req);
2345 }
2346
2347 sd_propagation_control = ldb_request_get_control(req,
2348 DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
2349 if (sd_propagation_control != NULL) {
2350 if (req->op.mod.message->num_elements != 1) {
2351 return ldb_module_operr(module);
2352 }
2353 ret = strcmp(req->op.mod.message->elements[0].name,
2354 "nTSecurityDescriptor");
2355 if (ret != 0) {
2356 return ldb_module_operr(module);
2357 }
2358
2359 return ldb_next_request(module, req);
2360 }
2361
2362 ldb = ldb_module_get_ctx(module);
2363
2364 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2365
2366 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2367 if ( guid_blob != NULL ) {
2368 ldb_set_errstring(ldb,
2369 "replmd_modify: it's not allowed to change the objectGUID!");
2370 return LDB_ERR_CONSTRAINT_VIOLATION;
2371 }
2372
2373 ac = replmd_ctx_init(module, req);
2374 if (ac == NULL) {
2375 return ldb_module_oom(module);
2376 }
2377
2378 functional_level = dsdb_functional_level(ldb);
2379
2380 /* we have to copy the message as the caller might have it as a const */
2381 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2382 if (msg == NULL) {
2383 ldb_oom(ldb);
2384 talloc_free(ac);
2385 return LDB_ERR_OPERATIONS_ERROR;
2386 }
2387
2388 ldb_msg_remove_attr(msg, "whenChanged");
2389 ldb_msg_remove_attr(msg, "uSNChanged");
2390
2391 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2392 msg, &ac->seq_num, t, &is_urgent, &rodc);
2393 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2394 struct loadparm_context *lp_ctx;
2395 char *referral;
2396
2397 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2398 struct loadparm_context);
2399
2400 referral = talloc_asprintf(req,
2401 "ldap://%s/%s",
2402 lpcfg_dnsdomain(lp_ctx),
2403 ldb_dn_get_linearized(msg->dn));
2404 ret = ldb_module_send_referral(req, referral);
2405 talloc_free(ac);
2406 return ret;
2407 }
2408
2409 if (ret != LDB_SUCCESS) {
2410 talloc_free(ac);
2411 return ret;
2412 }
2413
2414 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2415 if (ret != LDB_SUCCESS) {
2416 talloc_free(ac);
2417 return ret;
2418 }
2419
2420 /* TODO:
2421 * - replace the old object with the newly constructed one
2422 */
2423
2424 ac->is_urgent = is_urgent;
2425
2426 ret = ldb_build_mod_req(&down_req, ldb, ac,
2427 msg,
2428 req->controls,
2429 ac, replmd_op_callback,
2430 req);
2431 LDB_REQ_SET_LOCATION(down_req);
2432 if (ret != LDB_SUCCESS) {
2433 talloc_free(ac);
2434 return ret;
2435 }
2436
2437 /* current partition control is needed by "replmd_op_callback" */
2438 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2439 ret = ldb_request_add_control(down_req,
2440 DSDB_CONTROL_CURRENT_PARTITION_OID,
2441 false, NULL);
2442 if (ret != LDB_SUCCESS) {
2443 talloc_free(ac);
2444 return ret;
2445 }
2446 }
2447
2448 /* If we are in functional level 2000, then
2449 * replmd_modify_handle_linked_attribs will have done
2450 * nothing */
2451 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2452 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2453 if (ret != LDB_SUCCESS) {
2454 talloc_free(ac);
2455 return ret;
2456 }
2457 }
2458
2459 talloc_steal(down_req, msg);
2460
2461 /* we only change whenChanged and uSNChanged if the seq_num
2462 has changed */
2463 if (ac->seq_num != 0) {
2464 ret = add_time_element(msg, "whenChanged", t);
2465 if (ret != LDB_SUCCESS) {
2466 talloc_free(ac);
2467 ldb_operr(ldb);
2468 return ret;
2469 }
2470
2471 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2472 if (ret != LDB_SUCCESS) {
2473 talloc_free(ac);
2474 ldb_operr(ldb);
2475 return ret;
2476 }
2477 }
2478
2479 if (!ldb_dn_compare_base(ac->schema->base_dn, msg->dn)) {
2480 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
2481 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
2482 if (msds_intid_struct) {
2483 msds_intid_struct->usn = ac->seq_num;
2484 }
2485 }
2486
2487 /* go on with the call chain */
2488 return ldb_next_request(module, down_req);
2489 }
2490
2491 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2492
2493 /*
2494 handle a rename request
2495
2496 On a rename we need to do an extra ldb_modify which sets the
2497 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2498 */
2499 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2500 {
2501 struct ldb_context *ldb;
2502 struct replmd_replicated_request *ac;
2503 int ret;
2504 struct ldb_request *down_req;
2505
2506 /* do not manipulate our control entries */
2507 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2508 return ldb_next_request(module, req);
2509 }
2510
2511 ldb = ldb_module_get_ctx(module);
2512
2513 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2514
2515 ac = replmd_ctx_init(module, req);
2516 if (ac == NULL) {
2517 return ldb_module_oom(module);
2518 }
2519
2520 ret = ldb_build_rename_req(&down_req, ldb, ac,
2521 ac->req->op.rename.olddn,
2522 ac->req->op.rename.newdn,
2523 ac->req->controls,
2524 ac, replmd_rename_callback,
2525 ac->req);
2526 LDB_REQ_SET_LOCATION(down_req);
2527 if (ret != LDB_SUCCESS) {
2528 talloc_free(ac);
2529 return ret;
2530 }
2531
2532 /* go on with the call chain */
2533 return ldb_next_request(module, down_req);
2534 }
2535
2536 /* After the rename is compleated, update the whenchanged etc */
2537 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2538 {
2539 struct ldb_context *ldb;
2540 struct replmd_replicated_request *ac;
2541 struct ldb_request *down_req;
2542 struct ldb_message *msg;
2543 const struct dsdb_attribute *rdn_attr;
2544 const char *rdn_name;
2545 const struct ldb_val *rdn_val;
2546 const char *attrs[5] = { NULL, };
2547 time_t t = time(NULL);
2548 int ret;
2549 bool is_urgent = false, rodc = false;
2550
2551 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2552 ldb = ldb_module_get_ctx(ac->module);
2553
2554 if (ares->error != LDB_SUCCESS) {
2555 return ldb_module_done(ac->req, ares->controls,
2556 ares->response, ares->error);
2557 }
2558
2559 if (ares->type != LDB_REPLY_DONE) {
2560 ldb_set_errstring(ldb,
2561 "invalid ldb_reply_type in callback");
2562 talloc_free(ares);
2563 return ldb_module_done(ac->req, NULL, NULL,
2564 LDB_ERR_OPERATIONS_ERROR);
2565 }
2566
2567 /* TODO:
2568 * - replace the old object with the newly constructed one
2569 */
2570
2571 msg = ldb_msg_new(ac);
2572 if (msg == NULL) {
2573 ldb_oom(ldb);
2574 return LDB_ERR_OPERATIONS_ERROR;
2575 }
2576
2577 msg->dn = ac->req->op.rename.newdn;
2578
2579 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2580 if (rdn_name == NULL) {
2581 talloc_free(ares);
2582 return ldb_module_done(ac->req, NULL, NULL,
2583 ldb_operr(ldb));
2584 }
2585
2586 /* normalize the rdn attribute name */
2587 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2588 if (rdn_attr == NULL) {
2589 talloc_free(ares);
2590 return ldb_module_done(ac->req, NULL, NULL,
2591 ldb_operr(ldb));
2592 }
2593 rdn_name = rdn_attr->lDAPDisplayName;
2594
2595 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2596 if (rdn_val == NULL) {
2597 talloc_free(ares);
2598 return ldb_module_done(ac->req, NULL, NULL,
2599 ldb_operr(ldb));
2600 }
2601
2602 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2603 talloc_free(ares);
2604 return ldb_module_done(ac->req, NULL, NULL,
2605 ldb_oom(ldb));
2606 }
2607 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2608 talloc_free(ares);
2609 return ldb_module_done(ac->req, NULL, NULL,
2610 ldb_oom(ldb));
2611 }
2612 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2613 talloc_free(ares);
2614 return ldb_module_done(ac->req, NULL, NULL,
2615 ldb_oom(ldb));
2616 }
2617 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2618 talloc_free(ares);
2619 return ldb_module_done(ac->req, NULL, NULL,
2620 ldb_oom(ldb));
2621 }
2622
2623 /*
2624 * here we let replmd_update_rpmd() only search for
2625 * the existing "replPropertyMetaData" and rdn_name attributes.
2626 *
2627 * We do not want the existing "name" attribute as
2628 * the "name" attribute needs to get the version
2629 * updated on rename even if the rdn value hasn't changed.
2630 *
2631 * This is the diff of the meta data, for a moved user
2632 * on a w2k8r2 server:
2633 *
2634 * # record 1
2635 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2636 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2637 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2638 * version : 0x00000001 (1)
2639 * reserved : 0x00000000 (0)
2640 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2641 * local_usn : 0x00000000000037a5 (14245)
2642 * array: struct replPropertyMetaData1
2643 * attid : DRSUAPI_ATTID_name (0x90001)
2644 * - version : 0x00000001 (1)
2645 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2646 * + version : 0x00000002 (2)
2647 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2648 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2649 * - originating_usn : 0x00000000000037a5 (14245)
2650 * - local_usn : 0x00000000000037a5 (14245)
2651 * + originating_usn : 0x0000000000003834 (14388)
2652 * + local_usn : 0x0000000000003834 (14388)
2653 * array: struct replPropertyMetaData1
2654 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2655 * version : 0x00000004 (4)
2656 */
2657 attrs[0] = "replPropertyMetaData";
2658 attrs[1] = "objectClass";
2659 attrs[2] = "instanceType";
2660 attrs[3] = rdn_name;
2661 attrs[4] = NULL;
2662
2663 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2664 msg, &ac->seq_num, t, &is_urgent, &rodc);
2665 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2666 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2667 struct loadparm_context *lp_ctx;
2668 char *referral;
2669
2670 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2671 struct loadparm_context);
2672
2673 referral = talloc_asprintf(req,
2674 "ldap://%s/%s",
2675 lpcfg_dnsdomain(lp_ctx),
2676 ldb_dn_get_linearized(olddn));
2677 ret = ldb_module_send_referral(req, referral);
2678 talloc_free(ares);
2679 return ldb_module_done(req, NULL, NULL, ret);
2680 }
2681
2682 if (ret != LDB_SUCCESS) {
2683 talloc_free(ares);
2684 return ldb_module_done(ac->req, NULL, NULL, ret);
2685 }
2686
2687 if (ac->seq_num == 0) {
2688 talloc_free(ares);
2689 return ldb_module_done(ac->req, NULL, NULL,
2690 ldb_error(ldb, ret,
2691 "internal error seq_num == 0"));
2692 }
2693 ac->is_urgent = is_urgent;
2694
2695 ret = ldb_build_mod_req(&down_req, ldb, ac,
2696 msg,
2697 req->controls,
2698 ac, replmd_op_callback,
2699 req);
2700 LDB_REQ_SET_LOCATION(down_req);
2701 if (ret != LDB_SUCCESS) {
2702 talloc_free(ac);
2703 return ret;
2704 }
2705
2706 /* current partition control is needed by "replmd_op_callback" */
2707 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2708 ret = ldb_request_add_control(down_req,
2709 DSDB_CONTROL_CURRENT_PARTITION_OID,
2710 false, NULL);
2711 if (ret != LDB_SUCCESS) {
2712 talloc_free(ac);
2713 return ret;
2714 }
2715 }
2716
2717 talloc_steal(down_req, msg);
2718
2719 ret = add_time_element(msg, "whenChanged", t);
2720 if (ret != LDB_SUCCESS) {
2721 talloc_free(ac);
2722 ldb_operr(ldb);
2723 return ret;
2724 }
2725
2726 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2727 if (ret != LDB_SUCCESS) {
2728 talloc_free(ac);
2729 ldb_operr(ldb);
2730 return ret;
2731 }
2732
2733 /* go on with the call chain - do the modify after the rename */
2734 return ldb_next_request(ac->module, down_req);
2735 }
2736
2737 /*
2738 remove links from objects that point at this object when an object
2739 is deleted
2740 */
2741 static int replmd_delete_remove_link(struct ldb_module *module,
2742 const struct dsdb_schema *schema,
2743 struct ldb_dn *dn,
2744 struct ldb_message_element *el,
2745 const struct dsdb_attribute *sa,
2746 struct ldb_request *parent)
2747 {
2748 unsigned int i;
2749 TALLOC_CTX *tmp_ctx = talloc_new(module);
2750 struct ldb_context *ldb = ldb_module_get_ctx(module);
2751
2752 for (i=0; i<el->num_values; i++) {
2753 struct dsdb_dn *dsdb_dn;
2754 NTSTATUS status;
2755 int ret;
2756 struct GUID guid2;
2757 struct ldb_message *msg;
2758 const struct dsdb_attribute *target_attr;
2759 struct ldb_message_element *el2;
2760 struct ldb_val dn_val;
2761
2762 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2763 continue;
2764 }
2765
2766 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2767 if (!dsdb_dn) {
2768 talloc_free(tmp_ctx);
2769 return LDB_ERR_OPERATIONS_ERROR;
2770 }
2771
2772 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2773 if (!NT_STATUS_IS_OK(status)) {
2774 talloc_free(tmp_ctx);
2775 return LDB_ERR_OPERATIONS_ERROR;
2776 }
2777
2778 /* remove the link */
2779 msg = ldb_msg_new(tmp_ctx);
2780 if (!msg) {
2781 ldb_module_oom(module);
2782 talloc_free(tmp_ctx);
2783 return LDB_ERR_OPERATIONS_ERROR;
2784 }
2785
2786
2787 msg->dn = dsdb_dn->dn;
2788
2789 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2790 if (target_attr == NULL) {
2791 continue;
2792 }
2793
2794 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2795 if (ret != LDB_SUCCESS) {
2796 ldb_module_oom(module);
2797 talloc_free(tmp_ctx);
2798 return LDB_ERR_OPERATIONS_ERROR;
2799 }
2800 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2801 el2->values = &dn_val;
2802 el2->num_values = 1;
2803
2804 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2805 if (ret != LDB_SUCCESS) {
2806 talloc_free(tmp_ctx);
2807 return ret;
2808 }
2809 }
2810 talloc_free(tmp_ctx);
2811 return LDB_SUCCESS;
2812 }
2813
2814
2815 /*
2816 handle update of replication meta data for deletion of objects
2817
2818 This also handles the mapping of delete to a rename operation
2819 to allow deletes to be replicated.
2820 */
2821 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2822 {
2823 int ret = LDB_ERR_OTHER;
2824 bool retb, disallow_move_on_delete;
2825 struct ldb_dn *old_dn, *new_dn;
2826 const char *rdn_name;
2827 const struct ldb_val *rdn_value, *new_rdn_value;
2828 struct GUID guid;
2829 struct ldb_context *ldb = ldb_module_get_ctx(module);
2830 const struct dsdb_schema *schema;
2831 struct ldb_message *msg, *old_msg;
2832 struct ldb_message_element *el;
2833 TALLOC_CTX *tmp_ctx;
2834 struct ldb_result *res, *parent_res;
2835 const char *preserved_attrs[] = {
2836 /* yes, this really is a hard coded list. See MS-ADTS
2837 section 3.1.1.5.5.1.1 */
2838 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2839 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2840 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2841 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2842 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2843 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2844 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2845 "whenChanged", NULL};
2846 unsigned int i, el_count = 0;
2847 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2848 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2849 enum deletion_state deletion_state, next_deletion_state;
2850 bool enabled;
2851
2852 if (ldb_dn_is_special(req->op.del.dn)) {
2853 return ldb_next_request(module, req);
2854 }
2855
2856 tmp_ctx = talloc_new(ldb);
2857 if (!tmp_ctx) {
2858 ldb_oom(ldb);
2859 return LDB_ERR_OPERATIONS_ERROR;
2860 }
2861
2862 schema = dsdb_get_schema(ldb, tmp_ctx);
2863 if (!schema) {
2864 return LDB_ERR_OPERATIONS_ERROR;
2865 }
2866
2867 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2868
2869 /* we need the complete msg off disk, so we can work out which
2870 attributes need to be removed */
2871 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2872 DSDB_FLAG_NEXT_MODULE |
2873 DSDB_SEARCH_SHOW_RECYCLED |
2874 DSDB_SEARCH_REVEAL_INTERNALS |
2875 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2876 if (ret != LDB_SUCCESS) {
2877 talloc_free(tmp_ctx);
2878 return ret;
2879 }
2880 old_msg = res->msgs[0];
2881
2882
2883 ret = dsdb_recyclebin_enabled(module, &enabled);
2884 if (ret != LDB_SUCCESS) {
2885 talloc_free(tmp_ctx);
2886 return ret;
2887 }
2888
2889 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2890 if (!enabled) {
2891 deletion_state = OBJECT_TOMBSTONE;
2892 next_deletion_state = OBJECT_REMOVED;
2893 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2894 deletion_state = OBJECT_RECYCLED;
2895 next_deletion_state = OBJECT_REMOVED;
2896 } else {
2897 deletion_state = OBJECT_DELETED;
2898 next_deletion_state = OBJECT_RECYCLED;
2899 }
2900 } else {
2901 deletion_state = OBJECT_NOT_DELETED;
2902 if (enabled) {
2903 next_deletion_state = OBJECT_DELETED;
2904 } else {
2905 next_deletion_state = OBJECT_TOMBSTONE;
2906 }
2907 }
2908
2909 if (next_deletion_state == OBJECT_REMOVED) {
2910 struct auth_session_info *session_info =
2911 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2912 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2913 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2914 ldb_dn_get_linearized(old_msg->dn));
2915 return LDB_ERR_UNWILLING_TO_PERFORM;
2916 }
2917
2918 /* it is already deleted - really remove it this time */
2919 talloc_free(tmp_ctx);
2920 return ldb_next_request(module, req);
2921 }
2922
2923 rdn_name = ldb_dn_get_rdn_name(old_dn);
2924 rdn_value = ldb_dn_get_rdn_val(old_dn);
2925 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2926 talloc_free(tmp_ctx);
2927 return ldb_operr(ldb);
2928 }
2929
2930 msg = ldb_msg_new(tmp_ctx);
2931 if (msg == NULL) {
2932 ldb_module_oom(module);
2933 talloc_free(tmp_ctx);
2934 return LDB_ERR_OPERATIONS_ERROR;
2935 }
2936
2937 msg->dn = old_dn;
2938
2939 if (deletion_state == OBJECT_NOT_DELETED){
2940 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2941 disallow_move_on_delete =
2942 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2943 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2944
2945 /* work out where we will be renaming this object to */
2946 if (!disallow_move_on_delete) {
2947 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2948 &new_dn);
2949 if (ret != LDB_SUCCESS) {
2950 /* this is probably an attempted delete on a partition
2951 * that doesn't allow delete operations, such as the
2952 * schema partition */
2953 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2954 ldb_dn_get_linearized(old_dn));
2955 talloc_free(tmp_ctx);
2956 return LDB_ERR_UNWILLING_TO_PERFORM;
2957 }
2958 } else {
2959 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2960 if (new_dn == NULL) {
2961 ldb_module_oom(module);
2962 talloc_free(tmp_ctx);
2963 return LDB_ERR_OPERATIONS_ERROR;
2964 }
2965 }
2966
2967 /* get the objects GUID from the search we just did */
2968 guid = samdb_result_guid(old_msg, "objectGUID");
2969
2970 /* Add a formatted child */
2971 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2972 rdn_name,
2973 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2974 GUID_string(tmp_ctx, &guid));
2975 if (!retb) {
2976 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2977 ldb_dn_get_linearized(new_dn)));
2978 talloc_free(tmp_ctx);
2979 return LDB_ERR_OPERATIONS_ERROR;
2980 }
2981
2982 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2983 if (ret != LDB_SUCCESS) {
2984 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2985 ldb_module_oom(module);
2986 talloc_free(tmp_ctx);
2987 return ret;
2988 }
2989 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2990 }
2991
2992 /*
2993 now we need to modify the object in the following ways:
2994
2995 - add isDeleted=TRUE
2996 - update rDN and name, with new rDN
2997 - remove linked attributes
2998 - remove objectCategory and sAMAccountType
2999 - remove attribs not on the preserved list
3000 - preserved if in above list, or is rDN
3001 - remove all linked attribs from this object
3002 - remove all links from other objects to this object
3003 - add lastKnownParent
3004 - update replPropertyMetaData?
3005
3006 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
3007 */
3008
3009 /* we need the storage form of the parent GUID */
3010 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
3011 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
3012 DSDB_FLAG_NEXT_MODULE |
3013 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3014 DSDB_SEARCH_REVEAL_INTERNALS|
3015 DSDB_SEARCH_SHOW_RECYCLED, req);
3016 if (ret != LDB_SUCCESS) {
3017 talloc_free(tmp_ctx);
3018 return ret;
3019 }
3020
3021 if (deletion_state == OBJECT_NOT_DELETED){
3022 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3023 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
3024 if (ret != LDB_SUCCESS) {
3025 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3026 ldb_module_oom(module);
3027 talloc_free(tmp_ctx);
3028 return ret;
3029 }
3030 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3031 }
3032
3033 switch (next_deletion_state){
3034
3035 case OBJECT_DELETED:
3036
3037 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
3038 if (ret != LDB_SUCCESS) {
3039 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
3040 ldb_module_oom(module);
3041 talloc_free(tmp_ctx);
3042 return ret;
3043 }
3044 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3045
3046 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3047 if (ret != LDB_SUCCESS) {
3048 talloc_free(tmp_ctx);
3049 ldb_module_oom(module);
3050 return ret;
3051 }
3052
3053 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3054 if (ret != LDB_SUCCESS) {
3055 talloc_free(tmp_ctx);
3056 ldb_module_oom(module);
3057 return ret;
3058 }
3059
3060 break;
3061
3062 case OBJECT_RECYCLED:
3063 case OBJECT_TOMBSTONE:
3064
3065 /*
3066 * we also mark it as recycled, meaning this object can't be
3067 * recovered (we are stripping its attributes).
3068 * This is done only if we have this schema object of course ...
3069 * This behavior is identical to the one of Windows 2008R2 which
3070 * always set the isRecycled attribute, even if the recycle-bin is
3071 * not activated and what ever the forest level is.
3072 */
3073 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3074 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3075 if (ret != LDB_SUCCESS) {
3076 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3077 ldb_module_oom(module);
3078 talloc_free(tmp_ctx);
3079 return ret;
3080 }
3081 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3082 }
3083
3084 /* work out which of the old attributes we will be removing */
3085 for (i=0; i<old_msg->num_elements; i++) {
3086 const struct dsdb_attribute *sa;
3087 el = &old_msg->elements[i];
3088 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3089 if (!sa) {
3090 talloc_free(tmp_ctx);
3091 return LDB_ERR_OPERATIONS_ERROR;
3092 }
3093 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3094 /* don't remove the rDN */
3095 continue;
3096 }
3097 if (sa->linkID && (sa->linkID & 1)) {
3098 /*
3099 we have a backlink in this object
3100 that needs to be removed. We're not
3101 allowed to remove it directly
3102 however, so we instead setup a
3103 modify to delete the corresponding
3104 forward link
3105 */
3106 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3107 if (ret != LDB_SUCCESS) {
3108 talloc_free(tmp_ctx);
3109 return LDB_ERR_OPERATIONS_ERROR;
3110 }
3111 /* now we continue, which means we
3112 won't remove this backlink
3113 directly
3114 */
3115 continue;
3116 }
3117 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
3118 continue;
3119 }
3120 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3121 if (ret != LDB_SUCCESS) {
3122 talloc_free(tmp_ctx);
3123 ldb_module_oom(module);
3124 return ret;
3125 }
3126 }
3127 break;
3128
3129 default:
3130 break;
3131 }
3132
3133 if (deletion_state == OBJECT_NOT_DELETED) {
3134 const struct dsdb_attribute *sa;
3135
3136 /* work out what the new rdn value is, for updating the
3137 rDN and name fields */
3138 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3139 if (new_rdn_value == NULL) {
3140 talloc_free(tmp_ctx);
3141 return ldb_operr(ldb);
3142 }
3143
3144 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3145 if (!sa) {
3146 talloc_free(tmp_ctx);
3147 return LDB_ERR_OPERATIONS_ERROR;
3148 }
3149
3150 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3151 &el);
3152 if (ret != LDB_SUCCESS) {
3153 talloc_free(tmp_ctx);
3154 return ret;
3155 }
3156 el->flags = LDB_FLAG_MOD_REPLACE;
3157
3158 el = ldb_msg_find_element(old_msg, "name");
3159 if (el) {
3160 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3161 if (ret != LDB_SUCCESS) {
3162 talloc_free(tmp_ctx);
3163 return ret;
3164 }
3165 el->flags = LDB_FLAG_MOD_REPLACE;
3166 }
3167 }
3168
3169 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3170 if (ret != LDB_SUCCESS) {
3171 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3172 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3173 talloc_free(tmp_ctx);
3174 return ret;
3175 }
3176
3177 if (deletion_state == OBJECT_NOT_DELETED) {
3178 /* now rename onto the new DN */
3179 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3180 if (ret != LDB_SUCCESS){
3181 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3182 ldb_dn_get_linearized(old_dn),
3183 ldb_dn_get_linearized(new_dn),
3184 ldb_errstring(ldb)));
3185 talloc_free(tmp_ctx);
3186 return ret;
3187 }
3188 }
3189
3190 talloc_free(tmp_ctx);
3191
3192 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3193 }
3194
3195
3196
3197 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3198 {
3199 return ret;
3200 }
3201
3202 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3203 {
3204 int ret = LDB_ERR_OTHER;
3205 /* TODO: do some error mapping */
3206 return ret;
3207 }
3208
3209
3210 static struct replPropertyMetaData1 *
3211 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3212 enum drsuapi_DsAttributeId attid)
3213 {
3214 uint32_t i;
3215 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3216
3217 for (i = 0; i < rpmd_ctr->count; i++) {
3218 if (rpmd_ctr->array[i].attid == attid) {
3219 return &rpmd_ctr->array[i];
3220 }
3221 }
3222 return NULL;
3223 }
3224
3225
3226 /*
3227 return true if an update is newer than an existing entry
3228 see section 5.11 of MS-ADTS
3229 */
3230 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3231 const struct GUID *update_invocation_id,
3232 uint32_t current_version,
3233 uint32_t update_version,
3234 NTTIME current_change_time,
3235 NTTIME update_change_time)
3236 {
3237 if (update_version != current_version) {
3238 return update_version > current_version;
3239 }
3240 if (update_change_time != current_change_time) {
3241 return update_change_time > current_change_time;
3242 }
3243 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3244 }
3245
3246 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3247 struct replPropertyMetaData1 *new_m)
3248 {
3249 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3250 &new_m->originating_invocation_id,
3251 cur_m->version,
3252 new_m->version,
3253 cur_m->originating_change_time,
3254 new_m->originating_change_time);
3255 }
3256
3257
3258 /*
3259 form a conflict DN
3260 */
3261 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3262 {
3263 const struct ldb_val *rdn_val;
3264 const char *rdn_name;
3265 struct ldb_dn *new_dn;
3266
3267 rdn_val = ldb_dn_get_rdn_val(dn);
3268 rdn_name = ldb_dn_get_rdn_name(dn);
3269 if (!rdn_val || !rdn_name) {
3270 return NULL;
3271 }
3272
3273 new_dn = ldb_dn_copy(mem_ctx, dn);
3274 if (!new_dn) {
3275 return NULL;
3276 }
3277
3278 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3279 return NULL;
3280 }
3281
3282 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3283 rdn_name,
3284 ldb_dn_escape_value(new_dn, *rdn_val),
3285 GUID_string(new_dn, guid))) {
3286 return NULL;
3287 }
3288
3289 return new_dn;
3290 }
3291
3292
3293 /*
3294 perform a modify operation which sets the rDN and name attributes to
3295 their current values. This has the effect of changing these
3296 attributes to have been last updated by the current DC. This is
3297 needed to ensure that renames performed as part of conflict
3298 resolution are propogated to other DCs
3299 */
3300 static int replmd_name_modify(struct replmd_replicated_request *ar,
3301 struct ldb_request *req, struct ldb_dn *dn)
3302 {
3303 struct ldb_message *msg;
3304 const char *rdn_name;
3305 const struct ldb_val *rdn_val;
3306 const struct dsdb_attribute *rdn_attr;
3307 int ret;
3308
3309 msg = ldb_msg_new(req);
3310 if (msg == NULL) {
3311 goto failed;
3312 }
3313 msg->dn = dn;
3314
3315 rdn_name = ldb_dn_get_rdn_name(dn);
3316 if (rdn_name == NULL) {
3317 goto failed;
3318 }
3319
3320 /* normalize the rdn attribute name */
3321 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3322 if (rdn_attr == NULL) {
3323 goto failed;
3324 }
3325 rdn_name = rdn_attr->lDAPDisplayName;
3326
3327 rdn_val = ldb_dn_get_rdn_val(dn);
3328 if (rdn_val == NULL) {
3329 goto failed;
3330 }
3331
3332 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3333 goto failed;
3334 }
3335 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3336 goto failed;
3337 }
3338 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3339 goto failed;
3340 }
3341 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3342 goto failed;
3343 }
3344
3345 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3346 if (ret != LDB_SUCCESS) {
3347 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3348 ldb_dn_get_linearized(dn),
3349 ldb_errstring(ldb_module_get_ctx(ar->module))));
3350 return ret;
3351 }
3352
3353 talloc_free(msg);
3354
3355 return LDB_SUCCESS;
3356
3357 failed:
3358 talloc_free(msg);
3359 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3360 ldb_dn_get_linearized(dn)));
3361 return LDB_ERR_OPERATIONS_ERROR;
3362 }
3363
3364
3365 /*
3366 callback for conflict DN handling where we have renamed the incoming
3367 record. After renaming it, we need to ensure the change of name and
3368 rDN for the incoming record is seen as an originating update by this DC.
3369
3370 This also handles updating lastKnownParent for entries sent to lostAndFound
3371 */
3372 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3373 {
3374 struct replmd_replicated_request *ar =
3375 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3376 struct ldb_dn *conflict_dn;
3377 int ret;
3378
3379 if (ares->error != LDB_SUCCESS) {
3380 /* call the normal callback for everything except success */
3381 return replmd_op_callback(req, ares);
3382 }
3383
3384 switch (req->operation) {
3385 case LDB_ADD:
3386 conflict_dn = req->op.add.message->dn;
3387 break;
3388 case LDB_MODIFY:
3389 conflict_dn = req->op.mod.message->dn;
3390 break;
3391 default:
3392 smb_panic("replmd_op_name_modify_callback called in unknown circumstances");
3393 }
3394
3395 /* perform a modify of the rDN and name of the record */
3396 ret = replmd_name_modify(ar, req, conflict_dn);
3397 if (ret != LDB_SUCCESS) {
3398 ares->error = ret;
3399 return replmd_op_callback(req, ares);
3400 }
3401
3402 if (ar->objs->objects[ar->index_current].last_known_parent) {
3403 struct ldb_message *msg = ldb_msg_new(req);
3404 if (msg == NULL) {
3405 ldb_module_oom(ar->module);
3406 return LDB_ERR_OPERATIONS_ERROR;
3407 }
3408
3409 msg->dn = req->op.add.message->dn;
3410
3411 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3412 ldb_dn_get_extended_linearized(msg, ar->objs->objects[ar->index_current].last_known_parent, 1));
3413 if (ret != LDB_SUCCESS) {
3414 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3415 ldb_module_oom(ar->module);
3416 return ret;
3417 }
3418 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
3419
3420 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3421 if (ret != LDB_SUCCESS) {
3422 DEBUG(0,(__location__ ": Failed to modify lastKnownParent of lostAndFound DN '%s' - %s",
3423 ldb_dn_get_linearized(msg->dn),
3424 ldb_errstring(ldb_module_get_ctx(ar->module))));
3425 return ret;
3426 }
3427 TALLOC_FREE(msg);
3428 }
3429
3430 return replmd_op_callback(req, ares);
3431 }
3432
3433 /*
3434 callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
3435 This copes with the creation of conflict records in the case where
3436 the DN exists, but with a different objectGUID
3437 */
3438 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3439 {
3440 struct ldb_dn *conflict_dn;
3441 struct replmd_replicated_request *ar =
3442 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3443 struct ldb_result *res;
3444 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3445 int ret;
3446 const struct ldb_val *omd_value;
3447 struct replPropertyMetaDataBlob omd, *rmd;
3448 enum ndr_err_code ndr_err;
3449 bool rename_incoming_record, rodc;
3450 struct replPropertyMetaData1 *rmd_name, *omd_name;
3451 struct ldb_message *msg;
3452
3453 req->callback = callback;
3454
3455 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3456 /* call the normal callback for everything except
3457 conflicts */
3458 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3459 }
3460
3461 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3462 if (ret != LDB_SUCCESS) {
3463 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to determine if we are an RODC when attempting to form conflict DN: %s", ldb_errstring(ldb_module_get_ctx(ar->module)));
3464 return ldb_module_done(req, ares->controls, ares->response, LDB_ERR_OPERATIONS_ERROR);
3465 }
3466 /*
3467 * we have a conflict, and need to decide if we will keep the
3468 * new record or the old record
3469 */
3470
3471 msg = ar->objs->objects[ar->index_current].msg;
3472
3473 switch (req->operation) {
3474 case LDB_ADD:
3475 conflict_dn = msg->dn;
3476 break;
3477 case LDB_RENAME:
3478 conflict_dn = req->op.rename.newdn;
3479 break;
3480 default:
3481 return ldb_module_done(req, ares->controls, ares->response, ldb_module_operr(ar->module));
3482 }
3483
3484 if (rodc) {
3485 /*
3486 * We are on an RODC, or were a GC for this
3487 * partition, so we have to fail this until
3488 * someone who owns the partition sorts it
3489 * out
3490 */
3491 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3492 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3493 " - We must fail the operation until a master for this partition resolves the conflict",
3494 ldb_dn_get_linearized(conflict_dn));
3495 goto failed;
3496 }
3497
3498 /*
3499 * first we need the replPropertyMetaData attribute from the
3500 * old record
3501 */
3502 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3503 attrs,
3504 DSDB_FLAG_NEXT_MODULE |
3505 DSDB_SEARCH_SHOW_DELETED |
3506 DSDB_SEARCH_SHOW_RECYCLED, req);
3507 if (ret != LDB_SUCCESS) {
3508 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3509 ldb_dn_get_linearized(conflict_dn)));
3510 goto failed;
3511 }
3512
3513 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3514 if (omd_value == NULL) {
3515 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3516 ldb_dn_get_linearized(conflict_dn)));
3517 goto failed;
3518 }
3519
3520 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3521 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3522 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3523 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3524 ldb_dn_get_linearized(conflict_dn)));
3525 goto failed;
3526 }
3527
3528 rmd = ar->objs->objects[ar->index_current].meta_data;
3529
3530 /* we decide which is newer based on the RPMD on the name
3531 attribute. See [MS-DRSR] ResolveNameConflict */
3532 rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3533 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3534 if (!rmd_name || !omd_name) {
3535 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3536 ldb_dn_get_linearized(conflict_dn)));
3537 goto failed;
3538 }
3539
3540 rename_incoming_record = !(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) &&
3541 !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3542
3543 if (rename_incoming_record) {
3544 struct GUID guid;
3545 struct ldb_dn *new_dn;
3546 struct ldb_message *new_msg;
3547
3548 /*
3549 * We want to run the original callback here, which
3550 * will return LDB_ERR_ENTRY_ALREADY_EXISTS to the
3551 * caller, which will in turn know to rename the
3552 * incoming record. The error string is set in case
3553 * this isn't handled properly at some point in the
3554 * future.
3555 */
3556 if (req->operation == LDB_RENAME) {
3557 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3558 "Unable to handle incoming renames where this would "
3559 "create a conflict. Incoming record is %s (caller to handle)\n",
3560 ldb_dn_get_extended_linearized(req, conflict_dn, 1));
3561
3562 goto failed;
3563 }
3564
3565 guid = samdb_result_guid(msg, "objectGUID");
3566 if (GUID_all_zero(&guid)) {
3567 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3568 ldb_dn_get_linearized(conflict_dn)));
3569 goto failed;
3570 }
3571 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3572 if (new_dn == NULL) {
3573 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3574 ldb_dn_get_linearized(conflict_dn)));
3575 goto failed;
3576 }
3577
3578 DEBUG(2,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3579 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3580
3581 /* re-submit the request, but with a different
3582 callback, so we don't loop forever. */
3583 new_msg = ldb_msg_copy_shallow(req, msg);
3584 if (!new_msg) {
3585 goto failed;
3586 DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3587 ldb_dn_get_linearized(conflict_dn)));
3588 }
3589 new_msg->dn = new_dn;
3590 req->op.add.message = new_msg;
3591 req->callback = replmd_op_name_modify_callback;
3592
3593 return ldb_next_request(ar->module, req);
3594 } else {
3595 /* we are renaming the existing record */
3596 struct GUID guid;
3597 struct ldb_dn *new_dn;
3598
3599 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3600 if (GUID_all_zero(&guid)) {
3601 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3602 ldb_dn_get_linearized(conflict_dn)));
3603 goto failed;
3604 }
3605
3606 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3607 if (new_dn == NULL) {
3608 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3609 ldb_dn_get_linearized(conflict_dn)));
3610 goto failed;
3611 }
3612
3613 DEBUG(2,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3614 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3615
3616 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3617 DSDB_FLAG_OWN_MODULE, req);
3618 if (ret != LDB_SUCCESS) {
3619 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3620 ldb_dn_get_linearized(conflict_dn),
3621 ldb_dn_get_linearized(new_dn),
3622 ldb_errstring(ldb_module_get_ctx(ar->module))));
3623 goto failed;
3624 }
3625
3626 /*
3627 * now we need to ensure that the rename is seen as an
3628 * originating update. We do that with a modify.
3629 */
3630 ret = replmd_name_modify(ar, req, new_dn);
3631 if (ret != LDB_SUCCESS) {
3632 goto failed;
3633 }
3634
3635 return ldb_next_request(ar->module, req);
3636 }
3637
3638 failed:
3639 /* on failure do the original callback. This means replication
3640 * will stop with an error, but there is not much else we can
3641 * do
3642 */
3643 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3644 }
3645
3646 /*
3647 callback for replmd_replicated_apply_add()
3648 This copes with the creation of conflict records in the case where
3649 the DN exists, but with a different objectGUID
3650 */
3651 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3652 {
3653 struct replmd_replicated_request *ar =
3654 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3655
3656 if (ar->objs->objects[ar->index_current].last_known_parent) {
3657 /* This is like a conflict DN, where we put the object in LostAndFound
3658 see MS-DRSR 4.1.10.6.10 FindBestParentObject */
3659 return replmd_op_possible_conflict_callback(req, ares, replmd_op_name_modify_callback);
3660 }
3661
3662 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
3663 }
3664
3665 /*
3666 callback for replmd_replicated_handle_rename()
3667 This copes with the creation of conflict records in the case where
3668 the DN exists, but with a different objectGUID
3669 */
3670 static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
3671 {
3672 return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
3673 }
3674
3675 /*
3676 this is called when a new object comes in over DRS
3677 */
3678 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3679 {
3680 struct ldb_context *ldb;
3681 struct ldb_request *change_req;
3682 enum ndr_err_code ndr_err;
3683 struct ldb_message *msg;
3684 struct replPropertyMetaDataBlob *md;
3685 struct ldb_val md_value;
3686 unsigned int i;
3687 int ret;
3688 bool remote_isDeleted = false;
3689
3690 ldb = ldb_module_get_ctx(ar->module);
3691 msg = ar->objs->objects[ar->index_current].msg;
3692 md = ar->objs->objects[ar->index_current].meta_data;
3693
3694 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3695 if (ret != LDB_SUCCESS) {
3696 return replmd_replicated_request_error(ar, ret);
3697 }
3698
3699 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3700 if (ret != LDB_SUCCESS) {
3701 return replmd_replicated_request_error(ar, ret);
3702 }
3703
3704 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3705 if (ret != LDB_SUCCESS) {
3706 return replmd_replicated_request_error(ar, ret);
3707 }
3708
3709 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3710 if (ret != LDB_SUCCESS) {
3711 return replmd_replicated_request_error(ar, ret);
3712 }
3713
3714 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3715 if (ret != LDB_SUCCESS) {
3716 return replmd_replicated_request_error(ar, ret);
3717 }
3718
3719 /* remove any message elements that have zero values */
3720 for (i=0; i<msg->num_elements; i++) {
3721 struct ldb_message_element *el = &msg->elements[i];
3722
3723 if (el->num_values == 0) {
3724 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3725 el->name));
3726 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3727 msg->num_elements--;
3728 i--;
3729 continue;
3730 }
3731 }
3732
3733 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
3734 "isDeleted", false);
3735
3736 /*
3737 * the meta data array is already sorted by the caller
3738 */
3739 for (i=0; i < md->ctr.ctr1.count; i++) {
3740 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3741 }
3742 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3743 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3744 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3745 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3746 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3747 }
3748 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3749 if (ret != LDB_SUCCESS) {
3750 return replmd_replicated_request_error(ar, ret);
3751 }
3752
3753 replmd_ldb_message_sort(msg, ar->schema);
3754
3755 if (!remote_isDeleted) {
3756 ret = dsdb_module_schedule_sd_propagation(ar->module,
3757 ar->objs->partition_dn,
3758 msg->dn, true);
3759 if (ret != LDB_SUCCESS) {
3760 return replmd_replicated_request_error(ar, ret);
3761 }
3762 }
3763
3764 if (DEBUGLVL(4)) {
3765 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3766 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3767 talloc_free(s);
3768 }
3769
3770 ret = ldb_build_add_req(&change_req,
3771 ldb,
3772 ar,
3773 msg,
3774 ar->controls,
3775 ar,
3776 replmd_op_add_callback,
3777 ar->req);
3778 LDB_REQ_SET_LOCATION(change_req);
3779 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3780
3781 /* current partition control needed by "repmd_op_callback" */
3782 ret = ldb_request_add_control(change_req,
3783 DSDB_CONTROL_CURRENT_PARTITION_OID,
3784 false, NULL);
3785 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3786
3787 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
3788 /* this tells the partition module to make it a
3789 partial replica if creating an NC */
3790 ret = ldb_request_add_control(change_req,
3791 DSDB_CONTROL_PARTIAL_REPLICA,
3792 false, NULL);
3793 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3794 }
3795
3796 return ldb_next_request(ar->module, change_req);
3797 }
3798
3799 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
3800 struct ldb_reply *ares)
3801 {
3802 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3803 struct replmd_replicated_request);
3804 int ret;
3805
3806 if (!ares) {
3807 return ldb_module_done(ar->req, NULL, NULL,
3808 LDB_ERR_OPERATIONS_ERROR);
3809 }
3810 if (ares->error != LDB_SUCCESS &&
3811 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3812 /*
3813 * TODO: deal with the above error that the parent object doesn't exist
3814 */
3815
3816 return ldb_module_done(ar->req, ares->controls,
3817 ares->response, ares->error);
3818 }
3819
3820 switch (ares->type) {
3821 case LDB_REPLY_ENTRY:
3822 {
3823 struct ldb_message *parent_msg = ares->message;
3824 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
3825 struct ldb_dn *parent_dn;
3826 int comp_num;
3827
3828 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
3829 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
3830 /* Per MS-DRSR 4.1.10.6.10
3831 * FindBestParentObject we need to move this
3832 * new object under a deleted object to
3833 * lost-and-found */
3834 struct ldb_dn *nc_root;
3835
3836 ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
3837 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3838 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3839 "No suitable NC root found for %s. "
3840 "We need to move this object because parent object %s "
3841 "is deleted, but this object is not.",
3842 ldb_dn_get_linearized(msg->dn),
3843 ldb_dn_get_linearized(parent_msg->dn));
3844 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3845 } else if (ret != LDB_SUCCESS) {
3846 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3847 "Unable to find NC root for %s: %s. "
3848 "We need to move this object because parent object %s "
3849 "is deleted, but this object is not.",
3850 ldb_dn_get_linearized(msg->dn),
3851 ldb_errstring(ldb_module_get_ctx(ar->module)),
3852 ldb_dn_get_linearized(parent_msg->dn));
3853 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3854 }
3855
3856 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
3857 nc_root,
3858 DS_GUID_LOSTANDFOUND_CONTAINER,
3859 &parent_dn);
3860 if (ret != LDB_SUCCESS) {
3861 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3862 "Unable to find LostAndFound Container for %s "
3863 "in partition %s: %s. "
3864 "We need to move this object because parent object %s "
3865 "is deleted, but this object is not.",
3866 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
3867 ldb_errstring(ldb_module_get_ctx(ar->module)),
3868 ldb_dn_get_linearized(parent_msg->dn));
3869 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3870 }
3871 ar->objs->objects[ar->index_current].last_known_parent
3872 = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
3873 } else {
3874 parent_dn = parent_msg->dn;
3875 }
3876
3877 comp_num = ldb_dn_get_comp_num(msg->dn);
3878 if (comp_num > 1) {
3879 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
3880 talloc_free(ares);
3881 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3882 }
3883 }
3884 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
3885 talloc_free(ares);
3886 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3887 }
3888 break;
3889 }
3890 case LDB_REPLY_REFERRAL:
3891 /* we ignore referrals */
3892 break;
3893
3894 case LDB_REPLY_DONE:
3895 if (ar->search_msg != NULL) {
3896 ret = replmd_replicated_apply_merge(ar);
3897 } else {
3898 ret = replmd_replicated_apply_add(ar);
3899 }
3900 if (ret != LDB_SUCCESS) {
3901 return ldb_module_done(ar->req, NULL, NULL, ret);
3902 }
3903 }
3904
3905 talloc_free(ares);
3906 return LDB_SUCCESS;
3907 }
3908
3909 /*
3910 * Look for the parent object, so we put the new object in the right place
3911 */
3912
3913 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
3914 {
3915 struct ldb_context *ldb;
3916 int ret;
3917 char *tmp_str;
3918 char *filter;
3919 struct ldb_request *search_req;
3920 static const char *attrs[] = {"isDeleted", NULL};
3921
3922 ldb = ldb_module_get_ctx(ar->module);
3923
3924 if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
3925 if (ar->search_msg != NULL) {
3926 return replmd_replicated_apply_merge(ar);
3927 } else {
3928 return replmd_replicated_apply_add(ar);
3929 }
3930 }
3931
3932 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
3933 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3934
3935 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3936 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3937 talloc_free(tmp_str);
3938
3939 ret = ldb_build_search_req(&search_req,
3940 ldb,
3941 ar,
3942 ar->objs->partition_dn,
3943 LDB_SCOPE_SUBTREE,
3944 filter,
3945 attrs,
3946 NULL,
3947 ar,
3948 replmd_replicated_apply_search_for_parent_callback,
3949 ar->req);
3950 LDB_REQ_SET_LOCATION(search_req);
3951
3952 ret = dsdb_request_add_controls(search_req,
3953 DSDB_SEARCH_SHOW_RECYCLED|
3954 DSDB_SEARCH_SHOW_DELETED|
3955 DSDB_SEARCH_SHOW_EXTENDED_DN);
3956 if (ret != LDB_SUCCESS) {
3957 return ret;
3958 }
3959
3960 return ldb_next_request(ar->module, search_req);
3961 }
3962
3963 /*
3964 handle renames that come in over DRS replication
3965 */
3966 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3967 struct ldb_message *msg,
3968 struct ldb_request *parent)
3969 {
3970 struct ldb_request *req;
3971 int ret;
3972 TALLOC_CTX *tmp_ctx = talloc_new(msg);
3973 struct ldb_result *res;
3974
3975 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3976 ldb_dn_get_linearized(ar->search_msg->dn),
3977 ldb_dn_get_linearized(msg->dn)));
3978
3979
3980 res = talloc_zero(tmp_ctx, struct ldb_result);
3981 if (!res) {
3982 talloc_free(tmp_ctx);
3983 return ldb_oom(ldb_module_get_ctx(ar->module));
3984 }
3985
3986 /* pass rename to the next module
3987 * so it doesn't appear as an originating update */
3988 ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
3989 ar->search_msg->dn, msg->dn,
3990 NULL,
3991 ar,
3992 replmd_op_rename_callback,
3993 parent);
3994 LDB_REQ_SET_LOCATION(req);
3995 if (ret != LDB_SUCCESS) {
3996 talloc_free(tmp_ctx);
3997 return ret;
3998 }
3999
4000 ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
4001 if (ret != LDB_SUCCESS) {
4002 talloc_free(tmp_ctx);
4003 return ret;
4004 }
4005
4006 ret = ldb_next_request(ar->module, req);
4007
4008 if (ret == LDB_SUCCESS) {
4009 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
4010 }
4011
4012 talloc_free(tmp_ctx);
4013 return ret;
4014 }
4015
4016
4017 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
4018 {
4019 struct ldb_context *ldb;
4020 struct ldb_request *change_req;
4021 enum ndr_err_code ndr_err;
4022 struct ldb_message *msg;
4023 struct replPropertyMetaDataBlob *rmd;
4024 struct replPropertyMetaDataBlob omd;
4025 const struct ldb_val *omd_value;
4026 struct replPropertyMetaDataBlob nmd;
4027 struct ldb_val nmd_value;
4028 unsigned int i;
4029 uint32_t j,ni=0;
4030 unsigned int removed_attrs = 0;
4031 int ret;
4032 int (*callback)(struct ldb_request *req, struct ldb_reply *ares) = replmd_op_callback;
4033 bool isDeleted = false;
4034 bool local_isDeleted = false;
4035 bool remote_isDeleted = false;
4036 bool take_remote_isDeleted = false;
4037 bool sd_updated = false;
4038 bool renamed = false;
4039
4040 ldb = ldb_module_get_ctx(ar->module);
4041 msg = ar->objs->objects[ar->index_current].msg;
4042
4043 rmd = ar->objs->objects[ar->index_current].meta_data;
4044 ZERO_STRUCT(omd);
4045 omd.version = 1;
4046
4047 /* find existing meta data */
4048 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4049 if (omd_value) {
4050 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4051 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4052 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4053 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4054 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4055 }
4056
4057 if (omd.version != 1) {
4058 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4059 }
4060 }
4061
4062 local_isDeleted = ldb_msg_find_attr_as_bool(ar->search_msg,
4063 "isDeleted", false);
4064 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
4065 "isDeleted", false);
4066
4067 if (strcmp(ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ar->search_msg->dn)) == 0) {
4068 ret = LDB_SUCCESS;
4069 } else {
4070 /*
4071 * handle renames, even just by case that come in over
4072 * DRS. Changes in the parent DN don't hit us here,
4073 * because the search for a parent will clean up those
4074 * components.
4075 *
4076 * We also have already filtered out the case where
4077 * the peer has an older name to what we have (see
4078 * replmd_replicated_apply_search_callback())
4079 */
4080 renamed = true;
4081 ret = replmd_replicated_handle_rename(ar, msg, ar->req);
4082 }
4083
4084 /*
4085 * This particular error code means that we already tried the
4086 * conflict algrorithm, and the existing record name was newer, so we
4087 * need to rename the incoming record
4088 */
4089 if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
4090 struct GUID guid;
4091 NTSTATUS status;
4092 struct ldb_dn *new_dn;
4093 status = GUID_from_ndr_blob(&ar->objs->objects[ar->index_current].guid_value, &guid);
4094 /* This really, really can't fail */
4095 SMB_ASSERT(NT_STATUS_IS_OK(status));
4096
4097 new_dn = replmd_conflict_dn(msg, msg->dn, &guid);
4098 if (new_dn == NULL) {
4099 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4100 "Failed to form conflict DN for %s\n",
4101 ldb_dn_get_linearized(msg->dn));
4102
4103 return replmd_replicated_request_werror(ar, WERR_NOMEM);
4104 }
4105
4106 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, new_dn,
4107 DSDB_FLAG_NEXT_MODULE, ar->req);
4108 if (ret != LDB_SUCCESS) {
4109 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4110 "Failed to rename incoming conflicting dn '%s' (was '%s') to '%s' - %s\n",
4111 ldb_dn_get_linearized(msg->dn),
4112 ldb_dn_get_linearized(ar->search_msg->dn),
4113 ldb_dn_get_linearized(new_dn),
4114 ldb_errstring(ldb_module_get_ctx(ar->module)));
4115 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4116 }
4117
4118 /* Set the callback to one that will fix up the name to be a conflict DN */
4119 callback = replmd_op_name_modify_callback;
4120 msg->dn = new_dn;
4121 renamed = true;
4122 } else if (ret != LDB_SUCCESS) {
4123 ldb_debug(ldb, LDB_DEBUG_FATAL,
4124 "replmd_replicated_request rename %s => %s failed - %s\n",
4125 ldb_dn_get_linearized(ar->search_msg->dn),
4126 ldb_dn_get_linearized(msg->dn),
4127 ldb_errstring(ldb));
4128 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4129 }
4130
4131 ZERO_STRUCT(nmd);
4132 nmd.version = 1;
4133 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
4134 nmd.ctr.ctr1.array = talloc_array(ar,
4135 struct replPropertyMetaData1,
4136 nmd.ctr.ctr1.count);
4137 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4138
4139 /* first copy the old meta data */
4140 for (i=0; i < omd.ctr.ctr1.count; i++) {
4141 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
4142 ni++;
4143 }
4144
4145 ar->seq_num = 0;
4146 /* now merge in the new meta data */
4147 for (i=0; i < rmd->ctr.ctr1.count; i++) {
4148 bool found = false;
4149
4150 for (j=0; j < ni; j++) {
4151 bool cmp;
4152
4153 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
4154 continue;
4155 }
4156
4157 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
4158 /* if we compare equal then do an
4159 update. This is used when a client
4160 asks for a FULL_SYNC, and can be
4161 used to recover a corrupt
4162 replica */
4163 cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
4164 &nmd.ctr.ctr1.array[j]);
4165 } else {
4166 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
4167 &rmd->ctr.ctr1.array[i]);
4168 }
4169 if (cmp) {
4170 /* replace the entry */
4171 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4172 if (ar->seq_num == 0) {
4173 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4174 if (ret != LDB_SUCCESS) {
4175 return replmd_replicated_request_error(ar, ret);
4176 }
4177 }
4178 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4179 switch (nmd.ctr.ctr1.array[j].attid) {
4180 case DRSUAPI_ATTID_ntSecurityDescriptor:
4181 sd_updated = true;
4182 break;
4183 case DRSUAPI_ATTID_isDeleted:
4184 take_remote_isDeleted = true;
4185 break;
4186 default:
4187 break;
4188 }
4189 found = true;
4190 break;
4191 }
4192
4193 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4194 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4195 msg->elements[i-removed_attrs].name,
4196 ldb_dn_get_linearized(msg->dn),
4197 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4198 }
4199
4200 /* we don't want to apply this change so remove the attribute */
4201 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4202 removed_attrs++;
4203
4204 found = true;
4205 break;
4206 }
4207
4208 if (found) continue;
4209
4210 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4211 if (ar->seq_num == 0) {
4212 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4213 if (ret != LDB_SUCCESS) {
4214 return replmd_replicated_request_error(ar, ret);
4215 }
4216 }
4217 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4218 switch (nmd.ctr.ctr1.array[ni].attid) {
4219 case DRSUAPI_ATTID_ntSecurityDescriptor:
4220 sd_updated = true;
4221 break;
4222 case DRSUAPI_ATTID_isDeleted:
4223 take_remote_isDeleted = true;
4224 break;
4225 default:
4226 break;
4227 }
4228 ni++;
4229 }
4230
4231 /*
4232 * finally correct the size of the meta_data array
4233 */
4234 nmd.ctr.ctr1.count = ni;
4235
4236 /*
4237 * the rdn attribute (the alias for the name attribute),
4238 * 'cn' for most objects is the last entry in the meta data array
4239 * we have stored
4240 *
4241 * sort the new meta data array
4242 */
4243 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
4244 if (ret != LDB_SUCCESS) {
4245 return ret;
4246 }
4247
4248 /*
4249 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4250 */
4251 if (msg->num_elements == 0) {
4252 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4253 ar->index_current);
4254
4255 ar->index_current++;
4256 return replmd_replicated_apply_next(ar);
4257 }
4258
4259 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4260 ar->index_current, msg->num_elements);
4261
4262 if (take_remote_isDeleted) {
4263 isDeleted = remote_isDeleted;
4264 } else {
4265 isDeleted = local_isDeleted;
4266 }
4267
4268 if (renamed) {
4269 sd_updated = true;
4270 }
4271
4272 if (sd_updated && !isDeleted) {
4273 ret = dsdb_module_schedule_sd_propagation(ar->module,
4274 ar->objs->partition_dn,
4275 msg->dn, true);
4276 if (ret != LDB_SUCCESS) {
4277 return ldb_operr(ldb);
4278 }
4279 }
4280
4281 /* create the meta data value */
4282 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4283 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4284 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4285 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4286 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4287 }
4288
4289 /*
4290 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4291 * and replPopertyMetaData attributes
4292 */
4293 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4294 if (ret != LDB_SUCCESS) {
4295 return replmd_replicated_request_error(ar, ret);
4296 }
4297 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4298 if (ret != LDB_SUCCESS) {
4299 return replmd_replicated_request_error(ar, ret);
4300 }
4301 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4302 if (ret != LDB_SUCCESS) {
4303 return replmd_replicated_request_error(ar, ret);
4304 }
4305
4306 replmd_ldb_message_sort(msg, ar->schema);
4307
4308 /* we want to replace the old values */
4309 for (i=0; i < msg->num_elements; i++) {
4310 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4311 }
4312
4313 if (DEBUGLVL(4)) {
4314 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4315 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
4316 talloc_free(s);
4317 }
4318
4319 ret = ldb_build_mod_req(&change_req,
4320 ldb,
4321 ar,
4322 msg,
4323 ar->controls,
4324 ar,
4325 callback,
4326 ar->req);
4327 LDB_REQ_SET_LOCATION(change_req);
4328 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4329
4330 /* current partition control needed by "repmd_op_callback" */
4331 ret = ldb_request_add_control(change_req,
4332 DSDB_CONTROL_CURRENT_PARTITION_OID,
4333 false, NULL);
4334 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4335
4336 return ldb_next_request(ar->module, change_req);
4337 }
4338
4339 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
4340 struct ldb_reply *ares)
4341 {
4342 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4343 struct replmd_replicated_request);
4344 int ret;
4345
4346 if (!ares) {
4347 return ldb_module_done(ar->req, NULL, NULL,
4348 LDB_ERR_OPERATIONS_ERROR);
4349 }
4350 if (ares->error != LDB_SUCCESS &&
4351 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4352 return ldb_module_done(ar->req, ares->controls,
4353 ares->response, ares->error);
4354 }
4355
4356 switch (ares->type) {
4357 case LDB_REPLY_ENTRY:
4358 ar->search_msg = talloc_steal(ar, ares->message);
4359 break;
4360
4361 case LDB_REPLY_REFERRAL:
4362 /* we ignore referrals */
4363 break;
4364
4365 case LDB_REPLY_DONE:
4366 {
4367 struct replPropertyMetaData1 *md_remote;
4368 struct replPropertyMetaData1 *md_local;
4369
4370 struct replPropertyMetaDataBlob omd;
4371 const struct ldb_val *omd_value;
4372 struct replPropertyMetaDataBlob *rmd;
4373 struct ldb_message *msg;
4374
4375 ar->objs->objects[ar->index_current].last_known_parent = NULL;
4376
4377 /*
4378 * This is the ADD case, find the appropriate parent,
4379 * as this object doesn't exist locally:
4380 */
4381 if (ar->search_msg == NULL) {
4382 ret = replmd_replicated_apply_search_for_parent(ar);
4383 if (ret != LDB_SUCCESS) {
4384 return ldb_module_done(ar->req, NULL, NULL, ret);
4385 }
4386 talloc_free(ares);
4387 return LDB_SUCCESS;
4388 }
4389
4390 /*
4391 * Otherwise, in the MERGE case, work out if we are
4392 * attempting a rename, and if so find the parent the
4393 * newly renamed object wants to belong under (which
4394 * may not be the parent in it's attached string DN
4395 */
4396 rmd = ar->objs->objects[ar->index_current].meta_data;
4397 ZERO_STRUCT(omd);
4398 omd.version = 1;
4399
4400 /* find existing meta data */
4401 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4402 if (omd_value) {
4403 enum ndr_err_code ndr_err;
4404 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4405 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4406 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4407 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4408 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4409 }
4410
4411 if (omd.version != 1) {
4412 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4413 }
4414 }
4415
4416 /*
4417 * now we need to check for double renames. We could have a
4418 * local rename pending which our replication partner hasn't
4419 * received yet. We choose which one wins by looking at the
4420 * attribute stamps on the two objects, the newer one wins
4421 */
4422 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
4423 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
4424 /* if there is no name attribute then we have to assume the
4425 object we've received is in fact newer */
4426 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING ||
4427 !md_remote || !md_local ||
4428 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
4429 ret = replmd_replicated_apply_search_for_parent(ar);
4430 } else {
4431 msg = ar->objs->objects[ar->index_current].msg;
4432
4433 /* Otherwise, just merge on the existing object, force no rename */
4434 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
4435 ldb_dn_get_linearized(ar->search_msg->dn),
4436 ldb_dn_get_linearized(msg->dn)));
4437
4438 /*
4439 * This assignment ensures that the strcmp()
4440 * in replmd_replicated_apply_merge() avoids
4441 * the rename call
4442 */
4443 msg->dn = ar->search_msg->dn;
4444 ret = replmd_replicated_apply_merge(ar);
4445 }
4446 if (ret != LDB_SUCCESS) {
4447 return ldb_module_done(ar->req, NULL, NULL, ret);
4448 }
4449 }
4450 }
4451
4452 talloc_free(ares);
4453 return LDB_SUCCESS;
4454 }
4455
4456 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
4457
4458 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
4459 {
4460 struct ldb_context *ldb;
4461 int ret;
4462 char *tmp_str;
4463 char *filter;
4464 struct ldb_request *search_req;
4465 struct ldb_search_options_control *options;
4466
4467 if (ar->index_current >= ar->objs->num_objects) {
4468 /* done with it, go to next stage */
4469 return replmd_replicated_uptodate_vector(ar);
4470 }
4471
4472 ldb = ldb_module_get_ctx(ar->module);
4473 ar->search_msg = NULL;
4474
4475 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
4476 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4477
4478 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4479 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4480 talloc_free(tmp_str);
4481
4482 ret = ldb_build_search_req(&search_req,
4483 ldb,
4484 ar,
4485 NULL,
4486 LDB_SCOPE_SUBTREE,
4487 filter,
4488 NULL,
4489 NULL,
4490 ar,
4491 replmd_replicated_apply_search_callback,
4492 ar->req);
4493 LDB_REQ_SET_LOCATION(search_req);
4494
4495 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
4496 true, NULL);
4497 if (ret != LDB_SUCCESS) {
4498 return ret;
4499 }
4500
4501 /* we need to cope with cross-partition links, so search for
4502 the GUID over all partitions */
4503 options = talloc(search_req, struct ldb_search_options_control);
4504 if (options == NULL) {
4505 DEBUG(0, (__location__ ": out of memory\n"));
4506 return LDB_ERR_OPERATIONS_ERROR;
4507 }
4508 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
4509
4510 ret = ldb_request_add_control(search_req,
4511 LDB_CONTROL_SEARCH_OPTIONS_OID,
4512 true, options);
4513 if (ret != LDB_SUCCESS) {
4514 return ret;
4515 }
4516
4517 return ldb_next_request(ar->module, search_req);
4518 }
4519
4520 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
4521 struct ldb_reply *ares)
4522 {
4523 struct ldb_context *ldb;
4524 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4525 struct replmd_replicated_request);
4526 ldb = ldb_module_get_ctx(ar->module);
4527
4528 if (!ares) {
4529 return ldb_module_done(ar->req, NULL, NULL,
4530 LDB_ERR_OPERATIONS_ERROR);
4531 }
4532 if (ares->error != LDB_SUCCESS) {
4533 return ldb_module_done(ar->req, ares->controls,
4534 ares->response, ares->error);
4535 }
4536
4537 if (ares->type != LDB_REPLY_DONE) {
4538 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
4539 return ldb_module_done(ar->req, NULL, NULL,
4540 LDB_ERR_OPERATIONS_ERROR);
4541 }
4542
4543 talloc_free(ares);
4544
4545 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4546 }
4547
4548 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
4549 {
4550 struct ldb_context *ldb;
4551 struct ldb_request *change_req;
4552 enum ndr_err_code ndr_err;
4553 struct ldb_message *msg;
4554 struct replUpToDateVectorBlob ouv;
4555 const struct ldb_val *ouv_value;
4556 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
4557 struct replUpToDateVectorBlob nuv;
4558 struct ldb_val nuv_value;
4559 struct ldb_message_element *nuv_el = NULL;
4560 const struct GUID *our_invocation_id;
4561 struct ldb_message_element *orf_el = NULL;
4562 struct repsFromToBlob nrf;
4563 struct ldb_val *nrf_value = NULL;
4564 struct ldb_message_element *nrf_el = NULL;
4565 unsigned int i;
4566 uint32_t j,ni=0;
4567 bool found = false;
4568 time_t t = time(NULL);
4569 NTTIME now;
4570 int ret;
4571 uint32_t instanceType;
4572
4573 ldb = ldb_module_get_ctx(ar->module);
4574 ruv = ar->objs->uptodateness_vector;
4575 ZERO_STRUCT(ouv);
4576 ouv.version = 2;
4577 ZERO_STRUCT(nuv);
4578 nuv.version = 2;
4579
4580 unix_to_nt_time(&now, t);
4581
4582 if (ar->search_msg == NULL) {
4583 /* this happens for a REPL_OBJ call where we are
4584 creating the target object by replicating it. The
4585 subdomain join code does this for the partition DN
4586 */
4587 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
4588 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4589 }
4590
4591 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
4592 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
4593 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
4594 ldb_dn_get_linearized(ar->search_msg->dn)));
4595 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4596 }
4597
4598 /*
4599 * first create the new replUpToDateVector
4600 */
4601 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
4602 if (ouv_value) {
4603 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
4604 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
4605 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4606 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4607 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4608 }
4609
4610 if (ouv.version != 2) {
4611 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4612 }
4613 }
4614
4615 /*
4616 * the new uptodateness vector will at least
4617 * contain 1 entry, one for the source_dsa
4618 *
4619 * plus optional values from our old vector and the one from the source_dsa
4620 */
4621 nuv.ctr.ctr2.count = ouv.ctr.ctr2.count;
4622 if (ruv) nuv.ctr.ctr2.count += ruv->count;
4623 nuv.ctr.ctr2.cursors = talloc_array(ar,
4624 struct drsuapi_DsReplicaCursor2,
4625 nuv.ctr.ctr2.count);
4626 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4627
4628 /* first copy the old vector */
4629 for (i=0; i < ouv.ctr.ctr2.count; i++) {
4630 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
4631 ni++;
4632 }
4633
4634 /* get our invocation_id if we have one already attached to the ldb */
4635 our_invocation_id = samdb_ntds_invocation_id(ldb);
4636
4637 /* merge in the source_dsa vector is available */
4638 for (i=0; (ruv && i < ruv->count); i++) {
4639 found = false;
4640
4641 if (our_invocation_id &&
4642 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4643 our_invocation_id)) {
4644 continue;
4645 }
4646
4647 for (j=0; j < ni; j++) {
4648 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4649 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4650 continue;
4651 }
4652
4653 found = true;
4654
4655 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4656 nuv.ctr.ctr2.cursors[j] = ruv->cursors[i];
4657 }
4658 break;
4659 }
4660
4661 if (found) continue;
4662
4663 /* if it's not there yet, add it */
4664 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4665 ni++;
4666 }
4667
4668 /*
4669 * finally correct the size of the cursors array
4670 */
4671 nuv.ctr.ctr2.count = ni;
4672
4673 /*
4674 * sort the cursors
4675 */
4676 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4677
4678 /*
4679 * create the change ldb_message
4680 */
4681 msg = ldb_msg_new(ar);
4682 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4683 msg->dn = ar->search_msg->dn;
4684
4685 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4686 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4687 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4688 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4689 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4690 }
4691 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4692 if (ret != LDB_SUCCESS) {
4693 return replmd_replicated_request_error(ar, ret);
4694 }
4695 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4696
4697 /*
4698 * now create the new repsFrom value from the given repsFromTo1 structure
4699 */
4700 ZERO_STRUCT(nrf);
4701 nrf.version = 1;
4702 nrf.ctr.ctr1 = *ar->objs->source_dsa;
4703 nrf.ctr.ctr1.last_attempt = now;
4704 nrf.ctr.ctr1.last_success = now;
4705 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
4706
4707 /*
4708 * first see if we already have a repsFrom value for the current source dsa
4709 * if so we'll later replace this value
4710 */
4711 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4712 if (orf_el) {
4713 for (i=0; i < orf_el->num_values; i++) {
4714 struct repsFromToBlob *trf;
4715
4716 trf = talloc(ar, struct repsFromToBlob);
4717 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4718
4719 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4720 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4721 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4722 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4723 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4724 }
4725
4726 if (trf->version != 1) {
4727 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4728 }
4729
4730 /*
4731 * we compare the source dsa objectGUID not the invocation_id
4732 * because we want only one repsFrom value per source dsa
4733 * and when the invocation_id of the source dsa has changed we don't need
4734 * the old repsFrom with the old invocation_id
4735 */
4736 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4737 &ar->objs->source_dsa->source_dsa_obj_guid)) {
4738 talloc_free(trf);
4739 continue;
4740 }
4741
4742 talloc_free(trf);
4743 nrf_value = &orf_el->values[i];
4744 break;
4745 }
4746
4747 /*
4748 * copy over all old values to the new ldb_message
4749 */
4750 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4751 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4752 *nrf_el = *orf_el;
4753 }
4754
4755 /*
4756 * if we haven't found an old repsFrom value for the current source dsa
4757 * we'll add a new value
4758 */
4759 if (!nrf_value) {
4760 struct ldb_val zero_value;
4761 ZERO_STRUCT(zero_value);
4762 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4763 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4764
4765 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4766 }
4767
4768 /* we now fill the value which is already attached to ldb_message */
4769 ndr_err = ndr_push_struct_blob(nrf_value, msg,
4770 &nrf,
4771 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4772 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4773 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4774 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4775 }
4776
4777 /*
4778 * the ldb_message_element for the attribute, has all the old values and the new one
4779 * so we'll replace the whole attribute with all values
4780 */
4781 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4782
4783 if (CHECK_DEBUGLVL(4)) {
4784 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4785 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4786 talloc_free(s);
4787 }
4788
4789 /* prepare the ldb_modify() request */
4790 ret = ldb_build_mod_req(&change_req,
4791 ldb,
4792 ar,
4793 msg,
4794 ar->controls,
4795 ar,
4796 replmd_replicated_uptodate_modify_callback,
4797 ar->req);
4798 LDB_REQ_SET_LOCATION(change_req);
4799 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4800
4801 return ldb_next_request(ar->module, change_req);
4802 }
4803
4804 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4805 struct ldb_reply *ares)
4806 {
4807 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4808 struct replmd_replicated_request);
4809 int ret;
4810
4811 if (!ares) {
4812 return ldb_module_done(ar->req, NULL, NULL,
4813 LDB_ERR_OPERATIONS_ERROR);
4814 }
4815 if (ares->error != LDB_SUCCESS &&
4816 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4817 return ldb_module_done(ar->req, ares->controls,
4818 ares->response, ares->error);
4819 }
4820
4821 switch (ares->type) {
4822 case LDB_REPLY_ENTRY:
4823 ar->search_msg = talloc_steal(ar, ares->message);
4824 break;
4825
4826 case LDB_REPLY_REFERRAL:
4827 /* we ignore referrals */
4828 break;
4829
4830 case LDB_REPLY_DONE:
4831 ret = replmd_replicated_uptodate_modify(ar);
4832 if (ret != LDB_SUCCESS) {
4833 return ldb_module_done(ar->req, NULL, NULL, ret);
4834 }
4835 }
4836
4837 talloc_free(ares);
4838 return LDB_SUCCESS;
4839 }
4840
4841
4842 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4843 {
4844 struct ldb_context *ldb;
4845 int ret;
4846 static const char *attrs[] = {
4847 "replUpToDateVector",
4848 "repsFrom",
4849 "instanceType",
4850 NULL
4851 };
4852 struct ldb_request *search_req;
4853
4854 ldb = ldb_module_get_ctx(ar->module);
4855 ar->search_msg = NULL;
4856
4857 ret = ldb_build_search_req(&search_req,
4858 ldb,
4859 ar,
4860 ar->objs->partition_dn,
4861 LDB_SCOPE_BASE,
4862 "(objectClass=*)",
4863 attrs,
4864 NULL,
4865 ar,
4866 replmd_replicated_uptodate_search_callback,
4867 ar->req);
4868 LDB_REQ_SET_LOCATION(search_req);
4869 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4870
4871 return ldb_next_request(ar->module, search_req);
4872 }
4873
4874
4875
4876 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4877 {
4878 struct ldb_context *ldb;
4879 struct dsdb_extended_replicated_objects *objs;
4880 struct replmd_replicated_request *ar;
4881 struct ldb_control **ctrls;
4882 int ret;
4883 uint32_t i;
4884 struct replmd_private *replmd_private =
4885 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4886 struct dsdb_control_replicated_update *rep_update;
4887
4888 ldb = ldb_module_get_ctx(module);
4889
4890 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4891
4892 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4893 if (!objs) {
4894 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4895 return LDB_ERR_PROTOCOL_ERROR;
4896 }
4897
4898 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4899 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4900 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4901 return LDB_ERR_PROTOCOL_ERROR;
4902 }
4903
4904 ar = replmd_ctx_init(module, req);
4905 if (!ar)
4906 return LDB_ERR_OPERATIONS_ERROR;
4907
4908 /* Set the flags to have the replmd_op_callback run over the full set of objects */
4909 ar->apply_mode = true;
4910 ar->objs = objs;
4911 ar->schema = dsdb_get_schema(ldb, ar);
4912 if (!ar->schema) {
4913 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4914 talloc_free(ar);
4915 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4916 return LDB_ERR_CONSTRAINT_VIOLATION;
4917 }
4918
4919 ctrls = req->controls;
4920
4921 if (req->controls) {
4922 req->controls = talloc_memdup(ar, req->controls,
4923 talloc_get_size(req->controls));
4924 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4925 }
4926
4927 /* This allows layers further down to know if a change came in
4928 over replication and what the replication flags were */
4929 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
4930 if (rep_update == NULL) {
4931 return ldb_module_oom(module);
4932 }
4933 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
4934
4935 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
4936 if (ret != LDB_SUCCESS) {
4937 return ret;
4938 }
4939
4940 /* If this change contained linked attributes in the body
4941 * (rather than in the links section) we need to update
4942 * backlinks in linked_attributes */
4943 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4944 if (ret != LDB_SUCCESS) {
4945 return ret;
4946 }
4947
4948 ar->controls = req->controls;
4949 req->controls = ctrls;
4950
4951 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4952
4953 /* save away the linked attributes for the end of the
4954 transaction */
4955 for (i=0; i<ar->objs->linked_attributes_count; i++) {
4956 struct la_entry *la_entry;
4957
4958 if (replmd_private->la_ctx == NULL) {
4959 replmd_private->la_ctx = talloc_new(replmd_private);
4960 }
4961 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4962 if (la_entry == NULL) {
4963 ldb_oom(ldb);
4964 return LDB_ERR_OPERATIONS_ERROR;
4965 }
4966 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4967 if (la_entry->la == NULL) {
4968 talloc_free(la_entry);
4969 ldb_oom(ldb);
4970 return LDB_ERR_OPERATIONS_ERROR;
4971 }
4972 *la_entry->la = ar->objs->linked_attributes[i];
4973
4974 /* we need to steal the non-scalars so they stay
4975 around until the end of the transaction */
4976 talloc_steal(la_entry->la, la_entry->la->identifier);
4977 talloc_steal(la_entry->la, la_entry->la->value.blob);
4978
4979 DLIST_ADD(replmd_private->la_list, la_entry);
4980 }
4981
4982 return replmd_replicated_apply_next(ar);
4983 }
4984
4985 /*
4986 process one linked attribute structure
4987 */
4988 static int replmd_process_linked_attribute(struct ldb_module *module,
4989 struct la_entry *la_entry,
4990 struct ldb_request *parent)
4991 {
4992 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4993 struct ldb_context *ldb = ldb_module_get_ctx(module);
4994 struct ldb_message *msg;
4995 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4996 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4997 int ret;
4998 const struct dsdb_attribute *attr;
4999 struct dsdb_dn *dsdb_dn;
5000 uint64_t seq_num = 0;
5001 struct ldb_message_element *old_el;
5002 WERROR status;
5003 time_t t = time(NULL);
5004 struct ldb_result *res;
5005 const char *attrs[2];
5006 struct parsed_dn *pdn_list, *pdn;
5007 struct GUID guid = GUID_zero();
5008 NTSTATUS ntstatus;
5009 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
5010 const struct GUID *our_invocation_id;
5011
5012 /*
5013 linked_attributes[0]:
5014 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
5015 identifier : *
5016 identifier: struct drsuapi_DsReplicaObjectIdentifier
5017 __ndr_size : 0x0000003a (58)
5018 __ndr_size_sid : 0x00000000 (0)
5019 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
5020 sid : S-0-0
5021 __ndr_size_dn : 0x00000000 (0)
5022 dn : ''
5023 attid : DRSUAPI_ATTID_member (0x1F)
5024 value: struct drsuapi_DsAttributeValue
5025 __ndr_size : 0x0000007e (126)
5026 blob : *
5027 blob : DATA_BLOB length=126
5028 flags : 0x00000001 (1)
5029 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
5030 originating_add_time : Wed Sep 2 22:20:01 2009 EST
5031 meta_data: struct drsuapi_DsReplicaMetaData
5032 version : 0x00000015 (21)
5033 originating_change_time : Wed Sep 2 23:39:07 2009 EST
5034 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
5035 originating_usn : 0x000000000001e19c (123292)
5036
5037 (for cases where the link is to a normal DN)
5038 &target: struct drsuapi_DsReplicaObjectIdentifier3
5039 __ndr_size : 0x0000007e (126)
5040 __ndr_size_sid : 0x0000001c (28)
5041 guid : 7639e594-db75-4086-b0d4-67890ae46031
5042 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
5043 __ndr_size_dn : 0x00000022 (34)
5044 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
5045 */
5046
5047 /* find the attribute being modified */
5048 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
5049 if (attr == NULL) {
5050 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
5051 talloc_free(tmp_ctx);
5052 return LDB_ERR_OPERATIONS_ERROR;
5053 }
5054
5055 attrs[0] = attr->lDAPDisplayName;
5056 attrs[1] = NULL;
5057
5058 /* get the existing message from the db for the object with
5059 this GUID, returning attribute being modified. We will then
5060 use this msg as the basis for a modify call */
5061 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
5062 DSDB_FLAG_NEXT_MODULE |
5063 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5064 DSDB_SEARCH_SHOW_RECYCLED |
5065 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
5066 DSDB_SEARCH_REVEAL_INTERNALS,
5067 parent,
5068 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
5069 if (ret != LDB_SUCCESS) {
5070 talloc_free(tmp_ctx);
5071 return ret;
5072 }
5073 if (res->count != 1) {
5074 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
5075 GUID_string(tmp_ctx, &la->identifier->guid));
5076 talloc_free(tmp_ctx);
5077 return LDB_ERR_NO_SUCH_OBJECT;
5078 }
5079 msg = res->msgs[0];
5080
5081 if (msg->num_elements == 0) {
5082 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
5083 if (ret != LDB_SUCCESS) {
5084 ldb_module_oom(module);
5085 talloc_free(tmp_ctx);
5086 return LDB_ERR_OPERATIONS_ERROR;
5087 }
5088 } else {
5089 old_el = &msg->elements[0];
5090 old_el->flags = LDB_FLAG_MOD_REPLACE;
5091 }
5092
5093 /* parse the existing links */
5094 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
5095 if (ret != LDB_SUCCESS) {
5096 talloc_free(tmp_ctx);
5097 return ret;
5098 }
5099
5100 /* get our invocationId */
5101 our_invocation_id = samdb_ntds_invocation_id(ldb);
5102 if (!our_invocation_id) {
5103 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
5104 talloc_free(tmp_ctx);
5105 return LDB_ERR_OPERATIONS_ERROR;
5106 }
5107
5108 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
5109 if (ret != LDB_SUCCESS) {
5110 talloc_free(tmp_ctx);
5111 return ret;
5112 }
5113
5114 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
5115 if (!W_ERROR_IS_OK(status)) {
5116 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
5117 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
5118 return LDB_ERR_OPERATIONS_ERROR;
5119 }
5120
5121 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
5122 if (!NT_STATUS_IS_OK(ntstatus) && active) {
5123 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
5124 old_el->name,
5125 ldb_dn_get_linearized(dsdb_dn->dn),
5126 ldb_dn_get_linearized(msg->dn));
5127 return LDB_ERR_OPERATIONS_ERROR;
5128 }
5129
5130 /* re-resolve the DN by GUID, as the DRS server may give us an
5131 old DN value */
5132 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
5133 if (ret != LDB_SUCCESS) {
5134 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
5135 GUID_string(tmp_ctx, &guid),
5136 ldb_dn_get_linearized(dsdb_dn->dn)));
5137 }
5138
5139 /* see if this link already exists */
5140 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
5141 if (pdn != NULL) {
5142 /* see if this update is newer than what we have already */
5143 struct GUID invocation_id = GUID_zero();
5144 uint32_t version = 0;
5145 uint32_t originating_usn = 0;
5146 NTTIME change_time = 0;
5147 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
5148
5149 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
5150 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
5151 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
5152 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
5153
5154 if (!replmd_update_is_newer(&invocation_id,
5155 &la->meta_data.originating_invocation_id,
5156 version,
5157 la->meta_data.version,
5158 change_time,
5159 la->meta_data.originating_change_time)) {
5160 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
5161 old_el->name, ldb_dn_get_linearized(msg->dn),
5162 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
5163 talloc_free(tmp_ctx);
5164 return LDB_SUCCESS;
5165 }
5166
5167 /* get a seq_num for this change */
5168 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5169 if (ret != LDB_SUCCESS) {
5170 talloc_free(tmp_ctx);
5171 return ret;
5172 }
5173
5174 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
5175 /* remove the existing backlink */
5176 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
5177 if (ret != LDB_SUCCESS) {
5178 talloc_free(tmp_ctx);
5179 return ret;
5180 }
5181 }
5182
5183 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
5184 &la->meta_data.originating_invocation_id,
5185 la->meta_data.originating_usn, seq_num,
5186 la->meta_data.originating_change_time,
5187 la->meta_data.version,
5188 !active);
5189 if (ret != LDB_SUCCESS) {
5190 talloc_free(tmp_ctx);
5191 return ret;
5192 }
5193
5194 if (active) {
5195 /* add the new backlink */
5196 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
5197 if (ret != LDB_SUCCESS) {
5198 talloc_free(tmp_ctx);
5199 return ret;
5200 }
5201 }
5202 } else {
5203 /* get a seq_num for this change */
5204 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5205 if (ret != LDB_SUCCESS) {
5206 talloc_free(tmp_ctx);
5207 return ret;
5208 }
5209
5210 old_el->values = talloc_realloc(msg->elements, old_el->values,
5211 struct ldb_val, old_el->num_values+1);
5212 if (!old_el->values) {
5213 ldb_module_oom(module);
5214 return LDB_ERR_OPERATIONS_ERROR;
5215 }
5216 old_el->num_values++;
5217
5218 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
5219 &la->meta_data.originating_invocation_id,
5220 la->meta_data.originating_usn, seq_num,
5221 la->meta_data.originating_change_time,
5222 la->meta_data.version,
5223 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
5224 if (ret != LDB_SUCCESS) {
5225 talloc_free(tmp_ctx);
5226 return ret;
5227 }
5228
5229 if (active) {
5230 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
5231 true, attr, false);
5232 if (ret != LDB_SUCCESS) {
5233 talloc_free(tmp_ctx);
5234 return ret;
5235 }
5236 }
5237 }
5238
5239 /* we only change whenChanged and uSNChanged if the seq_num
5240 has changed */
5241 ret = add_time_element(msg, "whenChanged", t);
5242 if (ret != LDB_SUCCESS) {
5243 talloc_free(tmp_ctx);
5244 ldb_operr(ldb);
5245 return ret;
5246 }
5247
5248 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
5249 if (ret != LDB_SUCCESS) {
5250 talloc_free(tmp_ctx);
5251 ldb_operr(ldb);
5252 return ret;
5253 }
5254
5255 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5256 if (old_el == NULL) {
5257 talloc_free(tmp_ctx);
5258 return ldb_operr(ldb);
5259 }
5260
5261 ret = dsdb_check_single_valued_link(attr, old_el);
5262 if (ret != LDB_SUCCESS) {
5263 talloc_free(tmp_ctx);
5264 return ret;
5265 }
5266
5267 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
5268
5269 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
5270 if (ret != LDB_SUCCESS) {
5271 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
5272 ldb_errstring(ldb),
5273 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
5274 talloc_free(tmp_ctx);
5275 return ret;
5276 }
5277
5278 talloc_free(tmp_ctx);
5279
5280 return ret;
5281 }
5282
5283 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
5284 {
5285 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
5286 return replmd_extended_replicated_objects(module, req);
5287 }
5288
5289 return ldb_next_request(module, req);
5290 }
5291
5292
5293 /*
5294 we hook into the transaction operations to allow us to
5295 perform the linked attribute updates at the end of the whole
5296 transaction. This allows a forward linked attribute to be created
5297 before the object is created. During a vampire, w2k8 sends us linked
5298 attributes before the objects they are part of.
5299 */
5300 static int replmd_start_transaction(struct ldb_module *module)
5301 {
5302 /* create our private structure for this transaction */
5303 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
5304 struct replmd_private);
5305 replmd_txn_cleanup(replmd_private);
5306
5307 /* free any leftover mod_usn records from cancelled
5308 transactions */
5309 while (replmd_private->ncs) {
5310 struct nc_entry *e = replmd_private->ncs;
5311 DLIST_REMOVE(replmd_private->ncs, e);
5312 talloc_free(e);
5313 }
5314
5315 return ldb_next_start_trans(module);
5316 }
5317
5318 /*
5319 on prepare commit we loop over our queued la_context structures and
5320 apply each of them
5321 */
5322 static int replmd_prepare_commit(struct ldb_module *module)
5323 {
5324 struct replmd_private *replmd_private =
5325 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5326 struct la_entry *la, *prev;
5327 struct la_backlink *bl;
5328 int ret;
5329
5330 /* walk the list backwards, to do the first entry first, as we
5331 * added the entries with DLIST_ADD() which puts them at the
5332 * start of the list */
5333 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
5334 prev = DLIST_PREV(la);
5335 DLIST_REMOVE(replmd_private->la_list, la);
5336 ret = replmd_process_linked_attribute(module, la, NULL);
5337 if (ret != LDB_SUCCESS) {
5338 replmd_txn_cleanup(replmd_private);
5339 return ret;
5340 }
5341 }
5342
5343 /* process our backlink list, creating and deleting backlinks
5344 as necessary */
5345 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
5346 ret = replmd_process_backlink(module, bl, NULL);
5347 if (ret != LDB_SUCCESS) {
5348 replmd_txn_cleanup(replmd_private);
5349 return ret;
5350 }
5351 }
5352
5353 replmd_txn_cleanup(replmd_private);
5354
5355 /* possibly change @REPLCHANGED */
5356 ret = replmd_notify_store(module, NULL);
5357 if (ret != LDB_SUCCESS) {
5358 return ret;
5359 }
5360
5361 return ldb_next_prepare_commit(module);
5362 }
5363
5364 static int replmd_del_transaction(struct ldb_module *module)
5365 {
5366 struct replmd_private *replmd_private =
5367 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5368 replmd_txn_cleanup(replmd_private);
5369
5370 return ldb_next_del_trans(module);
5371 }
5372
5373
5374 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
5375 .name = "repl_meta_data",
5376 .init_context = replmd_init,
5377 .add = replmd_add,
5378 .modify = replmd_modify,
5379 .rename = replmd_rename,
5380 .del = replmd_delete,
5381 .extended = replmd_extended,
5382 .start_transaction = replmd_start_transaction,
5383 .prepare_commit = replmd_prepare_commit,
5384 .del_transaction = replmd_del_transaction,
5385 };
5386
5387 int ldb_repl_meta_data_module_init(const char *version)
5388 {
5389 LDB_MODULE_CHECK_VERSION(version);
5390 return ldb_register_module(&ldb_repl_meta_data_module_ops);
5391 }
stuff from bjacke