?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "s4-dsdb: Remove strcasecmp() fallback in replmd_ldb_message_element_attid_sort"
[Samba/id10ts.git] / source4 / dsdb / samdb / ldb_modules / repl_meta_data.c
blob24dcc6f04dce79583fa5e78efeb904bcb51280df
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /*
25 * Name: ldb
26 *
27 * Component: ldb repl_meta_data module
28 *
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
33 *
34 * Author: Simo Sorce
35 * Author: Stefan Metzmacher
36 */
37
38 #include "includes.h"
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
52
53 /*
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
56 */
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
58
59 struct replmd_private {
60 TALLOC_CTX *la_ctx;
61 struct la_entry *la_list;
62 TALLOC_CTX *bl_ctx;
63 struct la_backlink *la_backlinks;
64 struct nc_entry {
65 struct nc_entry *prev, *next;
66 struct ldb_dn *dn;
67 uint64_t mod_usn;
68 uint64_t mod_usn_urgent;
69 } *ncs;
70 };
71
72 struct la_entry {
73 struct la_entry *next, *prev;
74 struct drsuapi_DsReplicaLinkedAttribute *la;
75 };
76
77 struct replmd_replicated_request {
78 struct ldb_module *module;
79 struct ldb_request *req;
80
81 const struct dsdb_schema *schema;
82
83 /* the controls we pass down */
84 struct ldb_control **controls;
85
86 /* details for the mode where we apply a bunch of inbound replication meessages */
87 bool apply_mode;
88 uint32_t index_current;
89 struct dsdb_extended_replicated_objects *objs;
90
91 struct ldb_message *search_msg;
92
93 uint64_t seq_num;
94 bool is_urgent;
95 };
96
97 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar);
98
99 enum urgent_situation {
100 REPL_URGENT_ON_CREATE = 1,
101 REPL_URGENT_ON_UPDATE = 2,
102 REPL_URGENT_ON_DELETE = 4
103 };
104
105
106 static const struct {
107 const char *update_name;
108 enum urgent_situation repl_situation;
109 } urgent_objects[] = {
110 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
111 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
112 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
113 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
114 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
115 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
116 {NULL, 0}
117 };
118
119 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
120 static const char *urgent_attrs[] = {
121 "lockoutTime",
122 "pwdLastSet",
123 "userAccountControl",
124 NULL
125 };
126
127
128 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
129 enum urgent_situation situation)
130 {
131 unsigned int i, j;
132 for (i=0; urgent_objects[i].update_name; i++) {
133
134 if ((situation & urgent_objects[i].repl_situation) == 0) {
135 continue;
136 }
137
138 for (j=0; j<objectclass_el->num_values; j++) {
139 const struct ldb_val *v = &objectclass_el->values[j];
140 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 return true;
142 }
143 }
144 }
145 return false;
146 }
147
148 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
149 {
150 if (ldb_attr_in_list(urgent_attrs, el->name)) {
151 return true;
152 }
153 return false;
154 }
155
156
157 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
158
159 /*
160 initialise the module
161 allocate the private structure and build the list
162 of partition DNs for use by replmd_notify()
163 */
164 static int replmd_init(struct ldb_module *module)
165 {
166 struct replmd_private *replmd_private;
167 struct ldb_context *ldb = ldb_module_get_ctx(module);
168
169 replmd_private = talloc_zero(module, struct replmd_private);
170 if (replmd_private == NULL) {
171 ldb_oom(ldb);
172 return LDB_ERR_OPERATIONS_ERROR;
173 }
174 ldb_module_set_private(module, replmd_private);
175
176 return ldb_next_init(module);
177 }
178
179 /*
180 cleanup our per-transaction contexts
181 */
182 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
183 {
184 talloc_free(replmd_private->la_ctx);
185 replmd_private->la_list = NULL;
186 replmd_private->la_ctx = NULL;
187
188 talloc_free(replmd_private->bl_ctx);
189 replmd_private->la_backlinks = NULL;
190 replmd_private->bl_ctx = NULL;
191 }
192
193
194 struct la_backlink {
195 struct la_backlink *next, *prev;
196 const char *attr_name;
197 struct GUID forward_guid, target_guid;
198 bool active;
199 };
200
201 /*
202 process a backlinks we accumulated during a transaction, adding and
203 deleting the backlinks from the target objects
204 */
205 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
206 {
207 struct ldb_dn *target_dn, *source_dn;
208 int ret;
209 struct ldb_context *ldb = ldb_module_get_ctx(module);
210 struct ldb_message *msg;
211 TALLOC_CTX *tmp_ctx = talloc_new(bl);
212 char *dn_string;
213
214 /*
215 - find DN of target
216 - find DN of source
217 - construct ldb_message
218 - either an add or a delete
219 */
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
221 if (ret != LDB_SUCCESS) {
222 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->target_guid)));
224 return LDB_SUCCESS;
225 }
226
227 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
228 if (ret != LDB_SUCCESS) {
229 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
230 GUID_string(bl, &bl->forward_guid));
231 talloc_free(tmp_ctx);
232 return ret;
233 }
234
235 msg = ldb_msg_new(tmp_ctx);
236 if (msg == NULL) {
237 ldb_module_oom(module);
238 talloc_free(tmp_ctx);
239 return LDB_ERR_OPERATIONS_ERROR;
240 }
241
242 /* construct a ldb_message for adding/deleting the backlink */
243 msg->dn = target_dn;
244 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
245 if (!dn_string) {
246 ldb_module_oom(module);
247 talloc_free(tmp_ctx);
248 return LDB_ERR_OPERATIONS_ERROR;
249 }
250 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
251 if (ret != LDB_SUCCESS) {
252 talloc_free(tmp_ctx);
253 return ret;
254 }
255 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
256
257 /* a backlink should never be single valued. Unfortunately the
258 exchange schema has a attribute
259 msExchBridgeheadedLocalConnectorsDNBL which is single
260 valued and a backlink. We need to cope with that by
261 ignoring the single value flag */
262 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
263
264 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
265 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
266 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
267 cope with possible corruption where the backlink has
268 already been removed */
269 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
270 ldb_dn_get_linearized(target_dn),
271 ldb_dn_get_linearized(source_dn),
272 ldb_errstring(ldb)));
273 ret = LDB_SUCCESS;
274 } else if (ret != LDB_SUCCESS) {
275 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
276 bl->active?"add":"remove",
277 ldb_dn_get_linearized(source_dn),
278 ldb_dn_get_linearized(target_dn),
279 ldb_errstring(ldb));
280 talloc_free(tmp_ctx);
281 return ret;
282 }
283 talloc_free(tmp_ctx);
284 return ret;
285 }
286
287 /*
288 add a backlink to the list of backlinks to add/delete in the prepare
289 commit
290 */
291 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
292 struct GUID *forward_guid, struct GUID *target_guid,
293 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
294 {
295 const struct dsdb_attribute *target_attr;
296 struct la_backlink *bl;
297 struct replmd_private *replmd_private =
298 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
299
300 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
301 if (!target_attr) {
302 /*
303 * windows 2003 has a broken schema where the
304 * definition of msDS-IsDomainFor is missing (which is
305 * supposed to be the backlink of the
306 * msDS-HasDomainNCs attribute
307 */
308 return LDB_SUCCESS;
309 }
310
311 /* see if its already in the list */
312 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
313 if (GUID_equal(forward_guid, &bl->forward_guid) &&
314 GUID_equal(target_guid, &bl->target_guid) &&
315 (target_attr->lDAPDisplayName == bl->attr_name ||
316 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
317 break;
318 }
319 }
320
321 if (bl) {
322 /* we found an existing one */
323 if (bl->active == active) {
324 return LDB_SUCCESS;
325 }
326 DLIST_REMOVE(replmd_private->la_backlinks, bl);
327 talloc_free(bl);
328 return LDB_SUCCESS;
329 }
330
331 if (replmd_private->bl_ctx == NULL) {
332 replmd_private->bl_ctx = talloc_new(replmd_private);
333 if (replmd_private->bl_ctx == NULL) {
334 ldb_module_oom(module);
335 return LDB_ERR_OPERATIONS_ERROR;
336 }
337 }
338
339 /* its a new one */
340 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
341 if (bl == NULL) {
342 ldb_module_oom(module);
343 return LDB_ERR_OPERATIONS_ERROR;
344 }
345
346 /* Ensure the schema does not go away before the bl->attr_name is used */
347 if (!talloc_reference(bl, schema)) {
348 talloc_free(bl);
349 ldb_module_oom(module);
350 return LDB_ERR_OPERATIONS_ERROR;
351 }
352
353 bl->attr_name = target_attr->lDAPDisplayName;
354 bl->forward_guid = *forward_guid;
355 bl->target_guid = *target_guid;
356 bl->active = active;
357
358 /* the caller may ask for this backlink to be processed
359 immediately */
360 if (immediate) {
361 int ret = replmd_process_backlink(module, bl, NULL);
362 talloc_free(bl);
363 return ret;
364 }
365
366 DLIST_ADD(replmd_private->la_backlinks, bl);
367
368 return LDB_SUCCESS;
369 }
370
371
372 /*
373 * Callback for most write operations in this module:
374 *
375 * notify the repl task that a object has changed. The notifies are
376 * gathered up in the replmd_private structure then written to the
377 * @REPLCHANGED object in each partition during the prepare_commit
378 */
379 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
380 {
381 int ret;
382 struct replmd_replicated_request *ac =
383 talloc_get_type_abort(req->context, struct replmd_replicated_request);
384 struct replmd_private *replmd_private =
385 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
386 struct nc_entry *modified_partition;
387 struct ldb_control *partition_ctrl;
388 const struct dsdb_control_current_partition *partition;
389
390 struct ldb_control **controls;
391
392 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
393
394 controls = ares->controls;
395 if (ldb_request_get_control(ac->req,
396 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
397 /*
398 * Remove the current partition control from what we pass up
399 * the chain if it hasn't been requested manually.
400 */
401 controls = ldb_controls_except_specified(ares->controls, ares,
402 partition_ctrl);
403 }
404
405 if (ares->error != LDB_SUCCESS) {
406 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
407 return ldb_module_done(ac->req, controls,
408 ares->response, ares->error);
409 }
410
411 if (ares->type != LDB_REPLY_DONE) {
412 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
413 return ldb_module_done(ac->req, NULL,
414 NULL, LDB_ERR_OPERATIONS_ERROR);
415 }
416
417 if (!partition_ctrl) {
418 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
419 return ldb_module_done(ac->req, NULL,
420 NULL, LDB_ERR_OPERATIONS_ERROR);
421 }
422
423 partition = talloc_get_type_abort(partition_ctrl->data,
424 struct dsdb_control_current_partition);
425
426 if (ac->seq_num > 0) {
427 for (modified_partition = replmd_private->ncs; modified_partition;
428 modified_partition = modified_partition->next) {
429 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
430 break;
431 }
432 }
433
434 if (modified_partition == NULL) {
435 modified_partition = talloc_zero(replmd_private, struct nc_entry);
436 if (!modified_partition) {
437 ldb_oom(ldb_module_get_ctx(ac->module));
438 return ldb_module_done(ac->req, NULL,
439 NULL, LDB_ERR_OPERATIONS_ERROR);
440 }
441 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
442 if (!modified_partition->dn) {
443 ldb_oom(ldb_module_get_ctx(ac->module));
444 return ldb_module_done(ac->req, NULL,
445 NULL, LDB_ERR_OPERATIONS_ERROR);
446 }
447 DLIST_ADD(replmd_private->ncs, modified_partition);
448 }
449
450 if (ac->seq_num > modified_partition->mod_usn) {
451 modified_partition->mod_usn = ac->seq_num;
452 if (ac->is_urgent) {
453 modified_partition->mod_usn_urgent = ac->seq_num;
454 }
455 }
456 }
457
458 if (ac->apply_mode) {
459 talloc_free(ares);
460 ac->index_current++;
461
462 ret = replmd_replicated_apply_next(ac);
463 if (ret != LDB_SUCCESS) {
464 return ldb_module_done(ac->req, NULL, NULL, ret);
465 }
466 return ret;
467 } else {
468 /* free the partition control container here, for the
469 * common path. Other cases will have it cleaned up
470 * eventually with the ares */
471 talloc_free(partition_ctrl);
472 return ldb_module_done(ac->req, controls,
473 ares->response, LDB_SUCCESS);
474 }
475 }
476
477
478 /*
479 * update a @REPLCHANGED record in each partition if there have been
480 * any writes of replicated data in the partition
481 */
482 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
483 {
484 struct replmd_private *replmd_private =
485 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
486
487 while (replmd_private->ncs) {
488 int ret;
489 struct nc_entry *modified_partition = replmd_private->ncs;
490
491 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
492 modified_partition->mod_usn,
493 modified_partition->mod_usn_urgent, parent);
494 if (ret != LDB_SUCCESS) {
495 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
496 ldb_dn_get_linearized(modified_partition->dn)));
497 return ret;
498 }
499 DLIST_REMOVE(replmd_private->ncs, modified_partition);
500 talloc_free(modified_partition);
501 }
502
503 return LDB_SUCCESS;
504 }
505
506
507 /*
508 created a replmd_replicated_request context
509 */
510 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
511 struct ldb_request *req)
512 {
513 struct ldb_context *ldb;
514 struct replmd_replicated_request *ac;
515
516 ldb = ldb_module_get_ctx(module);
517
518 ac = talloc_zero(req, struct replmd_replicated_request);
519 if (ac == NULL) {
520 ldb_oom(ldb);
521 return NULL;
522 }
523
524 ac->module = module;
525 ac->req = req;
526
527 ac->schema = dsdb_get_schema(ldb, ac);
528 if (!ac->schema) {
529 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
530 "replmd_modify: no dsdb_schema loaded");
531 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
532 return NULL;
533 }
534
535 return ac;
536 }
537
538 /*
539 add a time element to a record
540 */
541 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
542 {
543 struct ldb_message_element *el;
544 char *s;
545 int ret;
546
547 if (ldb_msg_find_element(msg, attr) != NULL) {
548 return LDB_SUCCESS;
549 }
550
551 s = ldb_timestring(msg, t);
552 if (s == NULL) {
553 return LDB_ERR_OPERATIONS_ERROR;
554 }
555
556 ret = ldb_msg_add_string(msg, attr, s);
557 if (ret != LDB_SUCCESS) {
558 return ret;
559 }
560
561 el = ldb_msg_find_element(msg, attr);
562 /* always set as replace. This works because on add ops, the flag
563 is ignored */
564 el->flags = LDB_FLAG_MOD_REPLACE;
565
566 return LDB_SUCCESS;
567 }
568
569 /*
570 add a uint64_t element to a record
571 */
572 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
573 const char *attr, uint64_t v)
574 {
575 struct ldb_message_element *el;
576 int ret;
577
578 if (ldb_msg_find_element(msg, attr) != NULL) {
579 return LDB_SUCCESS;
580 }
581
582 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
583 if (ret != LDB_SUCCESS) {
584 return ret;
585 }
586
587 el = ldb_msg_find_element(msg, attr);
588 /* always set as replace. This works because on add ops, the flag
589 is ignored */
590 el->flags = LDB_FLAG_MOD_REPLACE;
591
592 return LDB_SUCCESS;
593 }
594
595 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
596 const struct replPropertyMetaData1 *m2,
597 const uint32_t *rdn_attid)
598 {
599 if (m1->attid == m2->attid) {
600 return 0;
601 }
602
603 /*
604 * the rdn attribute should be at the end!
605 * so we need to return a value greater than zero
606 * which means m1 is greater than m2
607 */
608 if (m1->attid == *rdn_attid) {
609 return 1;
610 }
611
612 /*
613 * the rdn attribute should be at the end!
614 * so we need to return a value less than zero
615 * which means m2 is greater than m1
616 */
617 if (m2->attid == *rdn_attid) {
618 return -1;
619 }
620
621 return m1->attid > m2->attid ? 1 : -1;
622 }
623
624 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
625 const struct dsdb_schema *schema,
626 struct ldb_dn *dn)
627 {
628 const char *rdn_name;
629 const struct dsdb_attribute *rdn_sa;
630
631 rdn_name = ldb_dn_get_rdn_name(dn);
632 if (!rdn_name) {
633 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
634 return LDB_ERR_OPERATIONS_ERROR;
635 }
636
637 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
638 if (rdn_sa == NULL) {
639 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
640 return LDB_ERR_OPERATIONS_ERROR;
641 }
642
643 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
644 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
645
646 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
647
648 return LDB_SUCCESS;
649 }
650
651 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
652 const struct ldb_message_element *e2,
653 const struct dsdb_schema *schema)
654 {
655 const struct dsdb_attribute *a1;
656 const struct dsdb_attribute *a2;
657
658 /*
659 * TODO: make this faster by caching the dsdb_attribute pointer
660 * on the ldb_messag_element
661 */
662
663 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
664 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
665
666 /*
667 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
668 * in the schema
669 */
670 if (!a1 || !a2) {
671 return strcasecmp(e1->name, e2->name);
672 }
673 if (a1->attributeID_id == a2->attributeID_id) {
674 return 0;
675 }
676 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
677 }
678
679 static void replmd_ldb_message_sort(struct ldb_message *msg,
680 const struct dsdb_schema *schema)
681 {
682 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
683 }
684
685 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
686 const struct GUID *invocation_id, uint64_t seq_num,
687 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
688
689
690 /*
691 fix up linked attributes in replmd_add.
692 This involves setting up the right meta-data in extended DN
693 components, and creating backlinks to the object
694 */
695 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
696 uint64_t seq_num, const struct GUID *invocationId, time_t t,
697 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
698 {
699 unsigned int i;
700 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
701 struct ldb_context *ldb = ldb_module_get_ctx(module);
702
703 /* We will take a reference to the schema in replmd_add_backlink */
704 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
705 NTTIME now;
706
707 unix_to_nt_time(&now, t);
708
709 for (i=0; i<el->num_values; i++) {
710 struct ldb_val *v = &el->values[i];
711 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
712 struct GUID target_guid;
713 NTSTATUS status;
714 int ret;
715
716 /* note that the DN already has the extended
717 components from the extended_dn_store module */
718 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
719 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
720 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
721 if (ret != LDB_SUCCESS) {
722 talloc_free(tmp_ctx);
723 return ret;
724 }
725 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
726 if (ret != LDB_SUCCESS) {
727 talloc_free(tmp_ctx);
728 return ret;
729 }
730 }
731
732 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
733 seq_num, seq_num, now, 0, false);
734 if (ret != LDB_SUCCESS) {
735 talloc_free(tmp_ctx);
736 return ret;
737 }
738
739 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
740 if (ret != LDB_SUCCESS) {
741 talloc_free(tmp_ctx);
742 return ret;
743 }
744 }
745
746 talloc_free(tmp_ctx);
747 return LDB_SUCCESS;
748 }
749
750
751 /*
752 intercept add requests
753 */
754 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
755 {
756 struct samldb_msds_intid_persistant *msds_intid_struct;
757 struct ldb_context *ldb;
758 struct ldb_control *control;
759 struct replmd_replicated_request *ac;
760 enum ndr_err_code ndr_err;
761 struct ldb_request *down_req;
762 struct ldb_message *msg;
763 const DATA_BLOB *guid_blob;
764 struct GUID guid;
765 struct replPropertyMetaDataBlob nmd;
766 struct ldb_val nmd_value;
767 const struct GUID *our_invocation_id;
768 time_t t = time(NULL);
769 NTTIME now;
770 char *time_str;
771 int ret;
772 unsigned int i;
773 unsigned int functional_level;
774 uint32_t ni=0;
775 bool allow_add_guid = false;
776 bool remove_current_guid = false;
777 bool is_urgent = false;
778 struct ldb_message_element *objectclass_el;
779
780 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
781 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
782 if (control) {
783 allow_add_guid = true;
784 }
785
786 /* do not manipulate our control entries */
787 if (ldb_dn_is_special(req->op.add.message->dn)) {
788 return ldb_next_request(module, req);
789 }
790
791 ldb = ldb_module_get_ctx(module);
792
793 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
794
795 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
796 if (guid_blob != NULL) {
797 if (!allow_add_guid) {
798 ldb_set_errstring(ldb,
799 "replmd_add: it's not allowed to add an object with objectGUID!");
800 return LDB_ERR_UNWILLING_TO_PERFORM;
801 } else {
802 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
803 if (!NT_STATUS_IS_OK(status)) {
804 ldb_set_errstring(ldb,
805 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
806 return LDB_ERR_UNWILLING_TO_PERFORM;
807 }
808 /* we remove this attribute as it can be a string and
809 * will not be treated correctly and then we will re-add
810 * it later on in the good format */
811 remove_current_guid = true;
812 }
813 } else {
814 /* a new GUID */
815 guid = GUID_random();
816 }
817
818 ac = replmd_ctx_init(module, req);
819 if (ac == NULL) {
820 return ldb_module_oom(module);
821 }
822
823 functional_level = dsdb_functional_level(ldb);
824
825 /* Get a sequence number from the backend */
826 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
827 if (ret != LDB_SUCCESS) {
828 talloc_free(ac);
829 return ret;
830 }
831
832 /* get our invocationId */
833 our_invocation_id = samdb_ntds_invocation_id(ldb);
834 if (!our_invocation_id) {
835 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
836 "replmd_add: unable to find invocationId\n");
837 talloc_free(ac);
838 return LDB_ERR_OPERATIONS_ERROR;
839 }
840
841 /* we have to copy the message as the caller might have it as a const */
842 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
843 if (msg == NULL) {
844 ldb_oom(ldb);
845 talloc_free(ac);
846 return LDB_ERR_OPERATIONS_ERROR;
847 }
848
849 /* generated times */
850 unix_to_nt_time(&now, t);
851 time_str = ldb_timestring(msg, t);
852 if (!time_str) {
853 ldb_oom(ldb);
854 talloc_free(ac);
855 return LDB_ERR_OPERATIONS_ERROR;
856 }
857 if (remove_current_guid) {
858 ldb_msg_remove_attr(msg,"objectGUID");
859 }
860
861 /*
862 * remove autogenerated attributes
863 */
864 ldb_msg_remove_attr(msg, "whenCreated");
865 ldb_msg_remove_attr(msg, "whenChanged");
866 ldb_msg_remove_attr(msg, "uSNCreated");
867 ldb_msg_remove_attr(msg, "uSNChanged");
868 ldb_msg_remove_attr(msg, "replPropertyMetaData");
869
870 /*
871 * readd replicated attributes
872 */
873 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
874 if (ret != LDB_SUCCESS) {
875 ldb_oom(ldb);
876 talloc_free(ac);
877 return ret;
878 }
879
880 /* build the replication meta_data */
881 ZERO_STRUCT(nmd);
882 nmd.version = 1;
883 nmd.ctr.ctr1.count = msg->num_elements;
884 nmd.ctr.ctr1.array = talloc_array(msg,
885 struct replPropertyMetaData1,
886 nmd.ctr.ctr1.count);
887 if (!nmd.ctr.ctr1.array) {
888 ldb_oom(ldb);
889 talloc_free(ac);
890 return LDB_ERR_OPERATIONS_ERROR;
891 }
892
893 for (i=0; i < msg->num_elements; i++) {
894 struct ldb_message_element *e = &msg->elements[i];
895 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
896 const struct dsdb_attribute *sa;
897
898 if (e->name[0] == '@') continue;
899
900 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
901 if (!sa) {
902 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
903 "replmd_add: attribute '%s' not defined in schema\n",
904 e->name);
905 talloc_free(ac);
906 return LDB_ERR_NO_SUCH_ATTRIBUTE;
907 }
908
909 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
910 /* if the attribute is not replicated (0x00000001)
911 * or constructed (0x00000004) it has no metadata
912 */
913 continue;
914 }
915
916 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
917 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
918 if (ret != LDB_SUCCESS) {
919 talloc_free(ac);
920 return ret;
921 }
922 /* linked attributes are not stored in
923 replPropertyMetaData in FL above w2k */
924 continue;
925 }
926
927 m->attid = sa->attributeID_id;
928 m->version = 1;
929 if (m->attid == 0x20030) {
930 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
931 const char* rdn;
932
933 if (rdn_val == NULL) {
934 ldb_oom(ldb);
935 talloc_free(ac);
936 return LDB_ERR_OPERATIONS_ERROR;
937 }
938
939 rdn = (const char*)rdn_val->data;
940 if (strcmp(rdn, "Deleted Objects") == 0) {
941 /*
942 * Set the originating_change_time to 29/12/9999 at 23:59:59
943 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
944 */
945 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
946 } else {
947 m->originating_change_time = now;
948 }
949 } else {
950 m->originating_change_time = now;
951 }
952 m->originating_invocation_id = *our_invocation_id;
953 m->originating_usn = ac->seq_num;
954 m->local_usn = ac->seq_num;
955 ni++;
956 }
957
958 /* fix meta data count */
959 nmd.ctr.ctr1.count = ni;
960
961 /*
962 * sort meta data array, and move the rdn attribute entry to the end
963 */
964 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
965 if (ret != LDB_SUCCESS) {
966 talloc_free(ac);
967 return ret;
968 }
969
970 /* generated NDR encoded values */
971 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
972 &nmd,
973 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
974 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
975 ldb_oom(ldb);
976 talloc_free(ac);
977 return LDB_ERR_OPERATIONS_ERROR;
978 }
979
980 /*
981 * add the autogenerated values
982 */
983 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
984 if (ret != LDB_SUCCESS) {
985 ldb_oom(ldb);
986 talloc_free(ac);
987 return ret;
988 }
989 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
990 if (ret != LDB_SUCCESS) {
991 ldb_oom(ldb);
992 talloc_free(ac);
993 return ret;
994 }
995 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
996 if (ret != LDB_SUCCESS) {
997 ldb_oom(ldb);
998 talloc_free(ac);
999 return ret;
1000 }
1001 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1002 if (ret != LDB_SUCCESS) {
1003 ldb_oom(ldb);
1004 talloc_free(ac);
1005 return ret;
1006 }
1007 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1008 if (ret != LDB_SUCCESS) {
1009 ldb_oom(ldb);
1010 talloc_free(ac);
1011 return ret;
1012 }
1013
1014 /*
1015 * sort the attributes by attid before storing the object
1016 */
1017 replmd_ldb_message_sort(msg, ac->schema);
1018
1019 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1020 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1021 REPL_URGENT_ON_CREATE);
1022
1023 ac->is_urgent = is_urgent;
1024 ret = ldb_build_add_req(&down_req, ldb, ac,
1025 msg,
1026 req->controls,
1027 ac, replmd_op_callback,
1028 req);
1029
1030 LDB_REQ_SET_LOCATION(down_req);
1031 if (ret != LDB_SUCCESS) {
1032 talloc_free(ac);
1033 return ret;
1034 }
1035
1036 /* current partition control is needed by "replmd_op_callback" */
1037 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1038 ret = ldb_request_add_control(down_req,
1039 DSDB_CONTROL_CURRENT_PARTITION_OID,
1040 false, NULL);
1041 if (ret != LDB_SUCCESS) {
1042 talloc_free(ac);
1043 return ret;
1044 }
1045 }
1046
1047 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1048 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1049 if (ret != LDB_SUCCESS) {
1050 talloc_free(ac);
1051 return ret;
1052 }
1053 }
1054
1055 /* mark the control done */
1056 if (control) {
1057 control->critical = 0;
1058 }
1059 if (ldb_dn_compare_base(ac->schema->base_dn, req->op.add.message->dn) != 0) {
1060
1061 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
1062 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1063 if (msds_intid_struct) {
1064 msds_intid_struct->usn = ac->seq_num;
1065 }
1066 }
1067 /* go on with the call chain */
1068 return ldb_next_request(module, down_req);
1069 }
1070
1071
1072 /*
1073 * update the replPropertyMetaData for one element
1074 */
1075 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1076 struct ldb_message *msg,
1077 struct ldb_message_element *el,
1078 struct ldb_message_element *old_el,
1079 struct replPropertyMetaDataBlob *omd,
1080 const struct dsdb_schema *schema,
1081 uint64_t *seq_num,
1082 const struct GUID *our_invocation_id,
1083 NTTIME now,
1084 struct ldb_request *req)
1085 {
1086 uint32_t i;
1087 const struct dsdb_attribute *a;
1088 struct replPropertyMetaData1 *md1;
1089
1090 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1091 if (a == NULL) {
1092 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1093 /* allow this to make it possible for dbcheck
1094 to remove bad attributes */
1095 return LDB_SUCCESS;
1096 }
1097
1098 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1099 el->name));
1100 return LDB_ERR_OPERATIONS_ERROR;
1101 }
1102
1103 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1104 return LDB_SUCCESS;
1105 }
1106
1107 /* if the attribute's value haven't changed then return LDB_SUCCESS
1108 * Unless we have the provision control or if the attribute is
1109 * interSiteTopologyGenerator as this page explain: http://support.microsoft.com/kb/224815
1110 * this attribute is periodicaly written by the DC responsible for the intersite generation
1111 * in a given site
1112 */
1113 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1114 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1115 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1116 /*
1117 * allow this to make it possible for dbcheck
1118 * to rebuild broken metadata
1119 */
1120 return LDB_SUCCESS;
1121 }
1122 }
1123
1124 for (i=0; i<omd->ctr.ctr1.count; i++) {
1125 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1126 }
1127
1128 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1129 /* linked attributes are not stored in
1130 replPropertyMetaData in FL above w2k, but we do
1131 raise the seqnum for the object */
1132 if (*seq_num == 0 &&
1133 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1134 return LDB_ERR_OPERATIONS_ERROR;
1135 }
1136 return LDB_SUCCESS;
1137 }
1138
1139 if (i == omd->ctr.ctr1.count) {
1140 /* we need to add a new one */
1141 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1142 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1143 if (omd->ctr.ctr1.array == NULL) {
1144 ldb_oom(ldb);
1145 return LDB_ERR_OPERATIONS_ERROR;
1146 }
1147 omd->ctr.ctr1.count++;
1148 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1149 }
1150
1151 /* Get a new sequence number from the backend. We only do this
1152 * if we have a change that requires a new
1153 * replPropertyMetaData element
1154 */
1155 if (*seq_num == 0) {
1156 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1157 if (ret != LDB_SUCCESS) {
1158 return LDB_ERR_OPERATIONS_ERROR;
1159 }
1160 }
1161
1162 md1 = &omd->ctr.ctr1.array[i];
1163 md1->version++;
1164 md1->attid = a->attributeID_id;
1165 if (md1->attid == 0x20030) {
1166 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1167 const char* rdn;
1168
1169 if (rdn_val == NULL) {
1170 ldb_oom(ldb);
1171 return LDB_ERR_OPERATIONS_ERROR;
1172 }
1173
1174 rdn = (const char*)rdn_val->data;
1175 if (strcmp(rdn, "Deleted Objects") == 0) {
1176 /*
1177 * Set the originating_change_time to 29/12/9999 at 23:59:59
1178 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1179 */
1180 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1181 } else {
1182 md1->originating_change_time = now;
1183 }
1184 } else {
1185 md1->originating_change_time = now;
1186 }
1187 md1->originating_invocation_id = *our_invocation_id;
1188 md1->originating_usn = *seq_num;
1189 md1->local_usn = *seq_num;
1190
1191 return LDB_SUCCESS;
1192 }
1193
1194 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1195 {
1196 uint32_t count = omd.ctr.ctr1.count;
1197 uint64_t max = 0;
1198 uint32_t i;
1199 for (i=0; i < count; i++) {
1200 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1201 if (max < m.local_usn) {
1202 max = m.local_usn;
1203 }
1204 }
1205 return max;
1206 }
1207
1208 /*
1209 * update the replPropertyMetaData object each time we modify an
1210 * object. This is needed for DRS replication, as the merge on the
1211 * client is based on this object
1212 */
1213 static int replmd_update_rpmd(struct ldb_module *module,
1214 const struct dsdb_schema *schema,
1215 struct ldb_request *req,
1216 const char * const *rename_attrs,
1217 struct ldb_message *msg, uint64_t *seq_num,
1218 time_t t,
1219 bool *is_urgent, bool *rodc)
1220 {
1221 const struct ldb_val *omd_value;
1222 enum ndr_err_code ndr_err;
1223 struct replPropertyMetaDataBlob omd;
1224 unsigned int i;
1225 NTTIME now;
1226 const struct GUID *our_invocation_id;
1227 int ret;
1228 const char * const *attrs = NULL;
1229 const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1230 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1231 struct ldb_result *res;
1232 struct ldb_context *ldb;
1233 struct ldb_message_element *objectclass_el;
1234 enum urgent_situation situation;
1235 bool rmd_is_provided;
1236
1237 if (rename_attrs) {
1238 attrs = rename_attrs;
1239 } else {
1240 attrs = attrs1;
1241 }
1242
1243 ldb = ldb_module_get_ctx(module);
1244
1245 our_invocation_id = samdb_ntds_invocation_id(ldb);
1246 if (!our_invocation_id) {
1247 /* this happens during an initial vampire while
1248 updating the schema */
1249 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1250 return LDB_SUCCESS;
1251 }
1252
1253 unix_to_nt_time(&now, t);
1254
1255 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1256 rmd_is_provided = true;
1257 } else {
1258 rmd_is_provided = false;
1259 }
1260
1261 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1262 * otherwise we consider we are updating */
1263 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1264 situation = REPL_URGENT_ON_DELETE;
1265 } else if (rename_attrs) {
1266 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1267 } else {
1268 situation = REPL_URGENT_ON_UPDATE;
1269 }
1270
1271 if (rmd_is_provided) {
1272 /* In this case the change_replmetadata control was supplied */
1273 /* We check that it's the only attribute that is provided
1274 * (it's a rare case so it's better to keep the code simplier)
1275 * We also check that the highest local_usn is bigger than
1276 * uSNChanged. */
1277 uint64_t db_seq;
1278 if( msg->num_elements != 1 ||
1279 strncmp(msg->elements[0].name,
1280 "replPropertyMetaData", 20) ) {
1281 DEBUG(0,(__location__ ": changereplmetada control called without "\
1282 "a specified replPropertyMetaData attribute or with others\n"));
1283 return LDB_ERR_OPERATIONS_ERROR;
1284 }
1285 if (situation != REPL_URGENT_ON_UPDATE) {
1286 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1287 return LDB_ERR_OPERATIONS_ERROR;
1288 }
1289 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1290 if (!omd_value) {
1291 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1292 ldb_dn_get_linearized(msg->dn)));
1293 return LDB_ERR_OPERATIONS_ERROR;
1294 }
1295 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1296 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1297 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1298 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1299 ldb_dn_get_linearized(msg->dn)));
1300 return LDB_ERR_OPERATIONS_ERROR;
1301 }
1302 *seq_num = find_max_local_usn(omd);
1303
1304 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1305 DSDB_FLAG_NEXT_MODULE |
1306 DSDB_SEARCH_SHOW_RECYCLED |
1307 DSDB_SEARCH_SHOW_EXTENDED_DN |
1308 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1309 DSDB_SEARCH_REVEAL_INTERNALS, req);
1310
1311 if (ret != LDB_SUCCESS) {
1312 return ret;
1313 }
1314
1315 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1316 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1317 situation)) {
1318 *is_urgent = true;
1319 }
1320
1321 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1322 if (*seq_num <= db_seq) {
1323 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1324 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1325 (long long)*seq_num, (long long)db_seq));
1326 return LDB_ERR_OPERATIONS_ERROR;
1327 }
1328
1329 } else {
1330 /* search for the existing replPropertyMetaDataBlob. We need
1331 * to use REVEAL and ask for DNs in storage format to support
1332 * the check for values being the same in
1333 * replmd_update_rpmd_element()
1334 */
1335 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1336 DSDB_FLAG_NEXT_MODULE |
1337 DSDB_SEARCH_SHOW_RECYCLED |
1338 DSDB_SEARCH_SHOW_EXTENDED_DN |
1339 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1340 DSDB_SEARCH_REVEAL_INTERNALS, req);
1341 if (ret != LDB_SUCCESS) {
1342 return ret;
1343 }
1344
1345 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1346 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1347 situation)) {
1348 *is_urgent = true;
1349 }
1350
1351 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1352 if (!omd_value) {
1353 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1354 ldb_dn_get_linearized(msg->dn)));
1355 return LDB_ERR_OPERATIONS_ERROR;
1356 }
1357
1358 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1359 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1360 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1361 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1362 ldb_dn_get_linearized(msg->dn)));
1363 return LDB_ERR_OPERATIONS_ERROR;
1364 }
1365
1366 if (omd.version != 1) {
1367 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1368 omd.version, ldb_dn_get_linearized(msg->dn)));
1369 return LDB_ERR_OPERATIONS_ERROR;
1370 }
1371
1372 for (i=0; i<msg->num_elements; i++) {
1373 struct ldb_message_element *old_el;
1374 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1375 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1376 our_invocation_id, now, req);
1377 if (ret != LDB_SUCCESS) {
1378 return ret;
1379 }
1380
1381 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1382 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1383 }
1384
1385 }
1386 }
1387 /*
1388 * replmd_update_rpmd_element has done an update if the
1389 * seq_num is set
1390 */
1391 if (*seq_num != 0) {
1392 struct ldb_val *md_value;
1393 struct ldb_message_element *el;
1394
1395 /*if we are RODC and this is a DRSR update then its ok*/
1396 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1397 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1398 unsigned instanceType;
1399
1400 ret = samdb_rodc(ldb, rodc);
1401 if (ret != LDB_SUCCESS) {
1402 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1403 } else if (*rodc) {
1404 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1405 return LDB_ERR_REFERRAL;
1406 }
1407
1408 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1409 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1410 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1411 "cannot change replicated attribute on partial replica");
1412 }
1413 }
1414
1415 md_value = talloc(msg, struct ldb_val);
1416 if (md_value == NULL) {
1417 ldb_oom(ldb);
1418 return LDB_ERR_OPERATIONS_ERROR;
1419 }
1420
1421 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1422 if (ret != LDB_SUCCESS) {
1423 return ret;
1424 }
1425
1426 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1427 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1428 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1429 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1430 ldb_dn_get_linearized(msg->dn)));
1431 return LDB_ERR_OPERATIONS_ERROR;
1432 }
1433
1434 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1435 if (ret != LDB_SUCCESS) {
1436 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1437 ldb_dn_get_linearized(msg->dn)));
1438 return ret;
1439 }
1440
1441 el->num_values = 1;
1442 el->values = md_value;
1443 }
1444
1445 return LDB_SUCCESS;
1446 }
1447
1448 struct parsed_dn {
1449 struct dsdb_dn *dsdb_dn;
1450 struct GUID *guid;
1451 struct ldb_val *v;
1452 };
1453
1454 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1455 {
1456 return GUID_compare(pdn1->guid, pdn2->guid);
1457 }
1458
1459 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1460 unsigned int count, struct GUID *guid,
1461 struct ldb_dn *dn)
1462 {
1463 struct parsed_dn *ret;
1464 unsigned int i;
1465 if (dn && GUID_all_zero(guid)) {
1466 /* when updating a link using DRS, we sometimes get a
1467 NULL GUID. We then need to try and match by DN */
1468 for (i=0; i<count; i++) {
1469 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1470 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1471 return &pdn[i];
1472 }
1473 }
1474 return NULL;
1475 }
1476 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1477 return ret;
1478 }
1479
1480 /*
1481 get a series of message element values as an array of DNs and GUIDs
1482 the result is sorted by GUID
1483 */
1484 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1485 struct ldb_message_element *el, struct parsed_dn **pdn,
1486 const char *ldap_oid, struct ldb_request *parent)
1487 {
1488 unsigned int i;
1489 struct ldb_context *ldb = ldb_module_get_ctx(module);
1490
1491 if (el == NULL) {
1492 *pdn = NULL;
1493 return LDB_SUCCESS;
1494 }
1495
1496 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1497 if (!*pdn) {
1498 ldb_module_oom(module);
1499 return LDB_ERR_OPERATIONS_ERROR;
1500 }
1501
1502 for (i=0; i<el->num_values; i++) {
1503 struct ldb_val *v = &el->values[i];
1504 NTSTATUS status;
1505 struct ldb_dn *dn;
1506 struct parsed_dn *p;
1507
1508 p = &(*pdn)[i];
1509
1510 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1511 if (p->dsdb_dn == NULL) {
1512 return LDB_ERR_INVALID_DN_SYNTAX;
1513 }
1514
1515 dn = p->dsdb_dn->dn;
1516
1517 p->guid = talloc(*pdn, struct GUID);
1518 if (p->guid == NULL) {
1519 ldb_module_oom(module);
1520 return LDB_ERR_OPERATIONS_ERROR;
1521 }
1522
1523 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1524 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1525 /* we got a DN without a GUID - go find the GUID */
1526 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1527 if (ret != LDB_SUCCESS) {
1528 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1529 ldb_dn_get_linearized(dn));
1530 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1531 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1532 ldb_attr_cmp(el->name, "member") == 0) {
1533 return LDB_ERR_UNWILLING_TO_PERFORM;
1534 }
1535 return ret;
1536 }
1537 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1538 if (ret != LDB_SUCCESS) {
1539 return ret;
1540 }
1541 } else if (!NT_STATUS_IS_OK(status)) {
1542 return LDB_ERR_OPERATIONS_ERROR;
1543 }
1544
1545 /* keep a pointer to the original ldb_val */
1546 p->v = v;
1547 }
1548
1549 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1550
1551 return LDB_SUCCESS;
1552 }
1553
1554 /*
1555 build a new extended DN, including all meta data fields
1556
1557 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1558 RMD_ADDTIME = originating_add_time
1559 RMD_INVOCID = originating_invocation_id
1560 RMD_CHANGETIME = originating_change_time
1561 RMD_ORIGINATING_USN = originating_usn
1562 RMD_LOCAL_USN = local_usn
1563 RMD_VERSION = version
1564 */
1565 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1566 const struct GUID *invocation_id, uint64_t seq_num,
1567 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1568 {
1569 struct ldb_dn *dn = dsdb_dn->dn;
1570 const char *tstring, *usn_string, *flags_string;
1571 struct ldb_val tval;
1572 struct ldb_val iid;
1573 struct ldb_val usnv, local_usnv;
1574 struct ldb_val vers, flagsv;
1575 NTSTATUS status;
1576 int ret;
1577 const char *dnstring;
1578 char *vstring;
1579 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1580
1581 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1582 if (!tstring) {
1583 return LDB_ERR_OPERATIONS_ERROR;
1584 }
1585 tval = data_blob_string_const(tstring);
1586
1587 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1588 if (!usn_string) {
1589 return LDB_ERR_OPERATIONS_ERROR;
1590 }
1591 usnv = data_blob_string_const(usn_string);
1592
1593 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1594 if (!usn_string) {
1595 return LDB_ERR_OPERATIONS_ERROR;
1596 }
1597 local_usnv = data_blob_string_const(usn_string);
1598
1599 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1600 if (!vstring) {
1601 return LDB_ERR_OPERATIONS_ERROR;
1602 }
1603 vers = data_blob_string_const(vstring);
1604
1605 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1606 if (!NT_STATUS_IS_OK(status)) {
1607 return LDB_ERR_OPERATIONS_ERROR;
1608 }
1609
1610 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1611 if (!flags_string) {
1612 return LDB_ERR_OPERATIONS_ERROR;
1613 }
1614 flagsv = data_blob_string_const(flags_string);
1615
1616 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1617 if (ret != LDB_SUCCESS) return ret;
1618 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1619 if (ret != LDB_SUCCESS) return ret;
1620 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1621 if (ret != LDB_SUCCESS) return ret;
1622 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1623 if (ret != LDB_SUCCESS) return ret;
1624 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1625 if (ret != LDB_SUCCESS) return ret;
1626 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1627 if (ret != LDB_SUCCESS) return ret;
1628 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1629 if (ret != LDB_SUCCESS) return ret;
1630
1631 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1632 if (dnstring == NULL) {
1633 return LDB_ERR_OPERATIONS_ERROR;
1634 }
1635 *v = data_blob_string_const(dnstring);
1636
1637 return LDB_SUCCESS;
1638 }
1639
1640 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1641 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1642 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1643 uint32_t version, bool deleted);
1644
1645 /*
1646 check if any links need upgrading from w2k format
1647
1648 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1649 */
1650 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1651 {
1652 uint32_t i;
1653 for (i=0; i<count; i++) {
1654 NTSTATUS status;
1655 uint32_t version;
1656 int ret;
1657
1658 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1659 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1660 continue;
1661 }
1662
1663 /* it's an old one that needs upgrading */
1664 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1665 1, 1, 0, 0, false);
1666 if (ret != LDB_SUCCESS) {
1667 return ret;
1668 }
1669 }
1670 return LDB_SUCCESS;
1671 }
1672
1673 /*
1674 update an extended DN, including all meta data fields
1675
1676 see replmd_build_la_val for value names
1677 */
1678 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1679 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1680 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1681 uint32_t version, bool deleted)
1682 {
1683 struct ldb_dn *dn = dsdb_dn->dn;
1684 const char *tstring, *usn_string, *flags_string;
1685 struct ldb_val tval;
1686 struct ldb_val iid;
1687 struct ldb_val usnv, local_usnv;
1688 struct ldb_val vers, flagsv;
1689 const struct ldb_val *old_addtime;
1690 uint32_t old_version;
1691 NTSTATUS status;
1692 int ret;
1693 const char *dnstring;
1694 char *vstring;
1695 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1696
1697 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1698 if (!tstring) {
1699 return LDB_ERR_OPERATIONS_ERROR;
1700 }
1701 tval = data_blob_string_const(tstring);
1702
1703 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1704 if (!usn_string) {
1705 return LDB_ERR_OPERATIONS_ERROR;
1706 }
1707 usnv = data_blob_string_const(usn_string);
1708
1709 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1710 if (!usn_string) {
1711 return LDB_ERR_OPERATIONS_ERROR;
1712 }
1713 local_usnv = data_blob_string_const(usn_string);
1714
1715 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1716 if (!NT_STATUS_IS_OK(status)) {
1717 return LDB_ERR_OPERATIONS_ERROR;
1718 }
1719
1720 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1721 if (!flags_string) {
1722 return LDB_ERR_OPERATIONS_ERROR;
1723 }
1724 flagsv = data_blob_string_const(flags_string);
1725
1726 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1727 if (ret != LDB_SUCCESS) return ret;
1728
1729 /* get the ADDTIME from the original */
1730 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1731 if (old_addtime == NULL) {
1732 old_addtime = &tval;
1733 }
1734 if (dsdb_dn != old_dsdb_dn ||
1735 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1736 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1737 if (ret != LDB_SUCCESS) return ret;
1738 }
1739
1740 /* use our invocation id */
1741 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1742 if (ret != LDB_SUCCESS) return ret;
1743
1744 /* changetime is the current time */
1745 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1746 if (ret != LDB_SUCCESS) return ret;
1747
1748 /* update the USN */
1749 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1750 if (ret != LDB_SUCCESS) return ret;
1751
1752 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1753 if (ret != LDB_SUCCESS) return ret;
1754
1755 /* increase the version by 1 */
1756 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1757 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1758 version = old_version+1;
1759 }
1760 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1761 vers = data_blob_string_const(vstring);
1762 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1763 if (ret != LDB_SUCCESS) return ret;
1764
1765 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1766 if (dnstring == NULL) {
1767 return LDB_ERR_OPERATIONS_ERROR;
1768 }
1769 *v = data_blob_string_const(dnstring);
1770
1771 return LDB_SUCCESS;
1772 }
1773
1774 /*
1775 handle adding a linked attribute
1776 */
1777 static int replmd_modify_la_add(struct ldb_module *module,
1778 const struct dsdb_schema *schema,
1779 struct ldb_message *msg,
1780 struct ldb_message_element *el,
1781 struct ldb_message_element *old_el,
1782 const struct dsdb_attribute *schema_attr,
1783 uint64_t seq_num,
1784 time_t t,
1785 struct GUID *msg_guid,
1786 struct ldb_request *parent)
1787 {
1788 unsigned int i;
1789 struct parsed_dn *dns, *old_dns;
1790 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1791 int ret;
1792 struct ldb_val *new_values = NULL;
1793 unsigned int num_new_values = 0;
1794 unsigned old_num_values = old_el?old_el->num_values:0;
1795 const struct GUID *invocation_id;
1796 struct ldb_context *ldb = ldb_module_get_ctx(module);
1797 NTTIME now;
1798
1799 unix_to_nt_time(&now, t);
1800
1801 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1802 if (ret != LDB_SUCCESS) {
1803 talloc_free(tmp_ctx);
1804 return ret;
1805 }
1806
1807 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1808 if (ret != LDB_SUCCESS) {
1809 talloc_free(tmp_ctx);
1810 return ret;
1811 }
1812
1813 invocation_id = samdb_ntds_invocation_id(ldb);
1814 if (!invocation_id) {
1815 talloc_free(tmp_ctx);
1816 return LDB_ERR_OPERATIONS_ERROR;
1817 }
1818
1819 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1820 if (ret != LDB_SUCCESS) {
1821 talloc_free(tmp_ctx);
1822 return ret;
1823 }
1824
1825 /* for each new value, see if it exists already with the same GUID */
1826 for (i=0; i<el->num_values; i++) {
1827 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1828 if (p == NULL) {
1829 /* this is a new linked attribute value */
1830 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1831 if (new_values == NULL) {
1832 ldb_module_oom(module);
1833 talloc_free(tmp_ctx);
1834 return LDB_ERR_OPERATIONS_ERROR;
1835 }
1836 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1837 invocation_id, seq_num, seq_num, now, 0, false);
1838 if (ret != LDB_SUCCESS) {
1839 talloc_free(tmp_ctx);
1840 return ret;
1841 }
1842 num_new_values++;
1843 } else {
1844 /* this is only allowed if the GUID was
1845 previously deleted. */
1846 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1847
1848 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1849 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1850 el->name, GUID_string(tmp_ctx, p->guid));
1851 talloc_free(tmp_ctx);
1852 /* error codes for 'member' need to be
1853 special cased */
1854 if (ldb_attr_cmp(el->name, "member") == 0) {
1855 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1856 } else {
1857 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1858 }
1859 }
1860 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1861 invocation_id, seq_num, seq_num, now, 0, false);
1862 if (ret != LDB_SUCCESS) {
1863 talloc_free(tmp_ctx);
1864 return ret;
1865 }
1866 }
1867
1868 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1869 if (ret != LDB_SUCCESS) {
1870 talloc_free(tmp_ctx);
1871 return ret;
1872 }
1873 }
1874
1875 /* add the new ones on to the end of the old values, constructing a new el->values */
1876 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1877 struct ldb_val,
1878 old_num_values+num_new_values);
1879 if (el->values == NULL) {
1880 ldb_module_oom(module);
1881 return LDB_ERR_OPERATIONS_ERROR;
1882 }
1883
1884 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1885 el->num_values = old_num_values + num_new_values;
1886
1887 talloc_steal(msg->elements, el->values);
1888 talloc_steal(el->values, new_values);
1889
1890 talloc_free(tmp_ctx);
1891
1892 /* we now tell the backend to replace all existing values
1893 with the one we have constructed */
1894 el->flags = LDB_FLAG_MOD_REPLACE;
1895
1896 return LDB_SUCCESS;
1897 }
1898
1899
1900 /*
1901 handle deleting all active linked attributes
1902 */
1903 static int replmd_modify_la_delete(struct ldb_module *module,
1904 const struct dsdb_schema *schema,
1905 struct ldb_message *msg,
1906 struct ldb_message_element *el,
1907 struct ldb_message_element *old_el,
1908 const struct dsdb_attribute *schema_attr,
1909 uint64_t seq_num,
1910 time_t t,
1911 struct GUID *msg_guid,
1912 struct ldb_request *parent)
1913 {
1914 unsigned int i;
1915 struct parsed_dn *dns, *old_dns;
1916 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1917 int ret;
1918 const struct GUID *invocation_id;
1919 struct ldb_context *ldb = ldb_module_get_ctx(module);
1920 NTTIME now;
1921
1922 unix_to_nt_time(&now, t);
1923
1924 /* check if there is nothing to delete */
1925 if ((!old_el || old_el->num_values == 0) &&
1926 el->num_values == 0) {
1927 return LDB_SUCCESS;
1928 }
1929
1930 if (!old_el || old_el->num_values == 0) {
1931 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1932 }
1933
1934 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1935 if (ret != LDB_SUCCESS) {
1936 talloc_free(tmp_ctx);
1937 return ret;
1938 }
1939
1940 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1941 if (ret != LDB_SUCCESS) {
1942 talloc_free(tmp_ctx);
1943 return ret;
1944 }
1945
1946 invocation_id = samdb_ntds_invocation_id(ldb);
1947 if (!invocation_id) {
1948 return LDB_ERR_OPERATIONS_ERROR;
1949 }
1950
1951 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1952 if (ret != LDB_SUCCESS) {
1953 talloc_free(tmp_ctx);
1954 return ret;
1955 }
1956
1957 el->values = NULL;
1958
1959 /* see if we are being asked to delete any links that
1960 don't exist or are already deleted */
1961 for (i=0; i<el->num_values; i++) {
1962 struct parsed_dn *p = &dns[i];
1963 struct parsed_dn *p2;
1964 uint32_t rmd_flags;
1965
1966 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1967 if (!p2) {
1968 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1969 el->name, GUID_string(tmp_ctx, p->guid));
1970 if (ldb_attr_cmp(el->name, "member") == 0) {
1971 return LDB_ERR_UNWILLING_TO_PERFORM;
1972 } else {
1973 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1974 }
1975 }
1976 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1977 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1978 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1979 el->name, GUID_string(tmp_ctx, p->guid));
1980 if (ldb_attr_cmp(el->name, "member") == 0) {
1981 return LDB_ERR_UNWILLING_TO_PERFORM;
1982 } else {
1983 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1984 }
1985 }
1986 }
1987
1988 /* for each new value, see if it exists already with the same GUID
1989 if it is not already deleted and matches the delete list then delete it
1990 */
1991 for (i=0; i<old_el->num_values; i++) {
1992 struct parsed_dn *p = &old_dns[i];
1993 uint32_t rmd_flags;
1994
1995 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1996 continue;
1997 }
1998
1999 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
2000 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2001
2002 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2003 invocation_id, seq_num, seq_num, now, 0, true);
2004 if (ret != LDB_SUCCESS) {
2005 talloc_free(tmp_ctx);
2006 return ret;
2007 }
2008
2009 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
2010 if (ret != LDB_SUCCESS) {
2011 talloc_free(tmp_ctx);
2012 return ret;
2013 }
2014 }
2015
2016 el->values = talloc_steal(msg->elements, old_el->values);
2017 el->num_values = old_el->num_values;
2018
2019 talloc_free(tmp_ctx);
2020
2021 /* we now tell the backend to replace all existing values
2022 with the one we have constructed */
2023 el->flags = LDB_FLAG_MOD_REPLACE;
2024
2025 return LDB_SUCCESS;
2026 }
2027
2028 /*
2029 handle replacing a linked attribute
2030 */
2031 static int replmd_modify_la_replace(struct ldb_module *module,
2032 const struct dsdb_schema *schema,
2033 struct ldb_message *msg,
2034 struct ldb_message_element *el,
2035 struct ldb_message_element *old_el,
2036 const struct dsdb_attribute *schema_attr,
2037 uint64_t seq_num,
2038 time_t t,
2039 struct GUID *msg_guid,
2040 struct ldb_request *parent)
2041 {
2042 unsigned int i;
2043 struct parsed_dn *dns, *old_dns;
2044 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2045 int ret;
2046 const struct GUID *invocation_id;
2047 struct ldb_context *ldb = ldb_module_get_ctx(module);
2048 struct ldb_val *new_values = NULL;
2049 unsigned int num_new_values = 0;
2050 unsigned int old_num_values = old_el?old_el->num_values:0;
2051 NTTIME now;
2052
2053 unix_to_nt_time(&now, t);
2054
2055 /* check if there is nothing to replace */
2056 if ((!old_el || old_el->num_values == 0) &&
2057 el->num_values == 0) {
2058 return LDB_SUCCESS;
2059 }
2060
2061 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2062 if (ret != LDB_SUCCESS) {
2063 talloc_free(tmp_ctx);
2064 return ret;
2065 }
2066
2067 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2068 if (ret != LDB_SUCCESS) {
2069 talloc_free(tmp_ctx);
2070 return ret;
2071 }
2072
2073 invocation_id = samdb_ntds_invocation_id(ldb);
2074 if (!invocation_id) {
2075 return LDB_ERR_OPERATIONS_ERROR;
2076 }
2077
2078 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2079 if (ret != LDB_SUCCESS) {
2080 talloc_free(tmp_ctx);
2081 return ret;
2082 }
2083
2084 /* mark all the old ones as deleted */
2085 for (i=0; i<old_num_values; i++) {
2086 struct parsed_dn *old_p = &old_dns[i];
2087 struct parsed_dn *p;
2088 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2089
2090 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2091
2092 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2093 if (ret != LDB_SUCCESS) {
2094 talloc_free(tmp_ctx);
2095 return ret;
2096 }
2097
2098 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2099 if (p) {
2100 /* we don't delete it if we are re-adding it */
2101 continue;
2102 }
2103
2104 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2105 invocation_id, seq_num, seq_num, now, 0, true);
2106 if (ret != LDB_SUCCESS) {
2107 talloc_free(tmp_ctx);
2108 return ret;
2109 }
2110 }
2111
2112 /* for each new value, either update its meta-data, or add it
2113 * to old_el
2114 */
2115 for (i=0; i<el->num_values; i++) {
2116 struct parsed_dn *p = &dns[i], *old_p;
2117
2118 if (old_dns &&
2119 (old_p = parsed_dn_find(old_dns,
2120 old_num_values, p->guid, NULL)) != NULL) {
2121 /* update in place */
2122 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2123 old_p->dsdb_dn, invocation_id,
2124 seq_num, seq_num, now, 0, false);
2125 if (ret != LDB_SUCCESS) {
2126 talloc_free(tmp_ctx);
2127 return ret;
2128 }
2129 } else {
2130 /* add a new one */
2131 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2132 num_new_values+1);
2133 if (new_values == NULL) {
2134 ldb_module_oom(module);
2135 talloc_free(tmp_ctx);
2136 return LDB_ERR_OPERATIONS_ERROR;
2137 }
2138 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2139 invocation_id, seq_num, seq_num, now, 0, false);
2140 if (ret != LDB_SUCCESS) {
2141 talloc_free(tmp_ctx);
2142 return ret;
2143 }
2144 num_new_values++;
2145 }
2146
2147 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2148 if (ret != LDB_SUCCESS) {
2149 talloc_free(tmp_ctx);
2150 return ret;
2151 }
2152 }
2153
2154 /* add the new values to the end of old_el */
2155 if (num_new_values != 0) {
2156 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2157 struct ldb_val, old_num_values+num_new_values);
2158 if (el->values == NULL) {
2159 ldb_module_oom(module);
2160 return LDB_ERR_OPERATIONS_ERROR;
2161 }
2162 memcpy(&el->values[old_num_values], &new_values[0],
2163 sizeof(struct ldb_val)*num_new_values);
2164 el->num_values = old_num_values + num_new_values;
2165 talloc_steal(msg->elements, new_values);
2166 } else {
2167 el->values = old_el->values;
2168 el->num_values = old_el->num_values;
2169 talloc_steal(msg->elements, el->values);
2170 }
2171
2172 talloc_free(tmp_ctx);
2173
2174 /* we now tell the backend to replace all existing values
2175 with the one we have constructed */
2176 el->flags = LDB_FLAG_MOD_REPLACE;
2177
2178 return LDB_SUCCESS;
2179 }
2180
2181
2182 /*
2183 handle linked attributes in modify requests
2184 */
2185 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2186 struct ldb_message *msg,
2187 uint64_t seq_num, time_t t,
2188 struct ldb_request *parent)
2189 {
2190 struct ldb_result *res;
2191 unsigned int i;
2192 int ret;
2193 struct ldb_context *ldb = ldb_module_get_ctx(module);
2194 struct ldb_message *old_msg;
2195
2196 const struct dsdb_schema *schema;
2197 struct GUID old_guid;
2198
2199 if (seq_num == 0) {
2200 /* there the replmd_update_rpmd code has already
2201 * checked and saw that there are no linked
2202 * attributes */
2203 return LDB_SUCCESS;
2204 }
2205
2206 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2207 /* don't do anything special for linked attributes */
2208 return LDB_SUCCESS;
2209 }
2210
2211 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2212 DSDB_FLAG_NEXT_MODULE |
2213 DSDB_SEARCH_SHOW_RECYCLED |
2214 DSDB_SEARCH_REVEAL_INTERNALS |
2215 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2216 parent);
2217 if (ret != LDB_SUCCESS) {
2218 return ret;
2219 }
2220 schema = dsdb_get_schema(ldb, res);
2221 if (!schema) {
2222 return LDB_ERR_OPERATIONS_ERROR;
2223 }
2224
2225 old_msg = res->msgs[0];
2226
2227 old_guid = samdb_result_guid(old_msg, "objectGUID");
2228
2229 for (i=0; i<msg->num_elements; i++) {
2230 struct ldb_message_element *el = &msg->elements[i];
2231 struct ldb_message_element *old_el, *new_el;
2232 const struct dsdb_attribute *schema_attr
2233 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2234 if (!schema_attr) {
2235 ldb_asprintf_errstring(ldb,
2236 "%s: attribute %s is not a valid attribute in schema",
2237 __FUNCTION__, el->name);
2238 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2239 }
2240 if (schema_attr->linkID == 0) {
2241 continue;
2242 }
2243 if ((schema_attr->linkID & 1) == 1) {
2244 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2245 continue;
2246 }
2247 /* Odd is for the target. Illegal to modify */
2248 ldb_asprintf_errstring(ldb,
2249 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2250 return LDB_ERR_UNWILLING_TO_PERFORM;
2251 }
2252 old_el = ldb_msg_find_element(old_msg, el->name);
2253 switch (el->flags & LDB_FLAG_MOD_MASK) {
2254 case LDB_FLAG_MOD_REPLACE:
2255 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2256 break;
2257 case LDB_FLAG_MOD_DELETE:
2258 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2259 break;
2260 case LDB_FLAG_MOD_ADD:
2261 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2262 break;
2263 default:
2264 ldb_asprintf_errstring(ldb,
2265 "invalid flags 0x%x for %s linked attribute",
2266 el->flags, el->name);
2267 return LDB_ERR_UNWILLING_TO_PERFORM;
2268 }
2269 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2270 ldb_asprintf_errstring(ldb,
2271 "Attribute %s is single valued but more than one value has been supplied",
2272 el->name);
2273 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2274 } else {
2275 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2276 }
2277
2278
2279
2280 if (ret != LDB_SUCCESS) {
2281 return ret;
2282 }
2283 if (old_el) {
2284 ldb_msg_remove_attr(old_msg, el->name);
2285 }
2286 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2287 new_el->num_values = el->num_values;
2288 new_el->values = talloc_steal(msg->elements, el->values);
2289
2290 /* TODO: this relises a bit too heavily on the exact
2291 behaviour of ldb_msg_find_element and
2292 ldb_msg_remove_element */
2293 old_el = ldb_msg_find_element(msg, el->name);
2294 if (old_el != el) {
2295 ldb_msg_remove_element(msg, old_el);
2296 i--;
2297 }
2298 }
2299
2300 talloc_free(res);
2301 return ret;
2302 }
2303
2304
2305
2306 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2307 {
2308 struct samldb_msds_intid_persistant *msds_intid_struct;
2309 struct ldb_context *ldb;
2310 struct replmd_replicated_request *ac;
2311 struct ldb_request *down_req;
2312 struct ldb_message *msg;
2313 time_t t = time(NULL);
2314 int ret;
2315 bool is_urgent = false, rodc = false;
2316 unsigned int functional_level;
2317 const DATA_BLOB *guid_blob;
2318 struct ldb_control *sd_propagation_control;
2319
2320 /* do not manipulate our control entries */
2321 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2322 return ldb_next_request(module, req);
2323 }
2324
2325 sd_propagation_control = ldb_request_get_control(req,
2326 DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
2327 if (sd_propagation_control != NULL) {
2328 if (req->op.mod.message->num_elements != 1) {
2329 return ldb_module_operr(module);
2330 }
2331 ret = strcmp(req->op.mod.message->elements[0].name,
2332 "nTSecurityDescriptor");
2333 if (ret != 0) {
2334 return ldb_module_operr(module);
2335 }
2336
2337 return ldb_next_request(module, req);
2338 }
2339
2340 ldb = ldb_module_get_ctx(module);
2341
2342 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2343
2344 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2345 if ( guid_blob != NULL ) {
2346 ldb_set_errstring(ldb,
2347 "replmd_modify: it's not allowed to change the objectGUID!");
2348 return LDB_ERR_CONSTRAINT_VIOLATION;
2349 }
2350
2351 ac = replmd_ctx_init(module, req);
2352 if (ac == NULL) {
2353 return ldb_module_oom(module);
2354 }
2355
2356 functional_level = dsdb_functional_level(ldb);
2357
2358 /* we have to copy the message as the caller might have it as a const */
2359 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2360 if (msg == NULL) {
2361 ldb_oom(ldb);
2362 talloc_free(ac);
2363 return LDB_ERR_OPERATIONS_ERROR;
2364 }
2365
2366 ldb_msg_remove_attr(msg, "whenChanged");
2367 ldb_msg_remove_attr(msg, "uSNChanged");
2368
2369 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2370 msg, &ac->seq_num, t, &is_urgent, &rodc);
2371 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2372 struct loadparm_context *lp_ctx;
2373 char *referral;
2374
2375 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2376 struct loadparm_context);
2377
2378 referral = talloc_asprintf(req,
2379 "ldap://%s/%s",
2380 lpcfg_dnsdomain(lp_ctx),
2381 ldb_dn_get_linearized(msg->dn));
2382 ret = ldb_module_send_referral(req, referral);
2383 talloc_free(ac);
2384 return ret;
2385 }
2386
2387 if (ret != LDB_SUCCESS) {
2388 talloc_free(ac);
2389 return ret;
2390 }
2391
2392 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2393 if (ret != LDB_SUCCESS) {
2394 talloc_free(ac);
2395 return ret;
2396 }
2397
2398 /* TODO:
2399 * - replace the old object with the newly constructed one
2400 */
2401
2402 ac->is_urgent = is_urgent;
2403
2404 ret = ldb_build_mod_req(&down_req, ldb, ac,
2405 msg,
2406 req->controls,
2407 ac, replmd_op_callback,
2408 req);
2409 LDB_REQ_SET_LOCATION(down_req);
2410 if (ret != LDB_SUCCESS) {
2411 talloc_free(ac);
2412 return ret;
2413 }
2414
2415 /* current partition control is needed by "replmd_op_callback" */
2416 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2417 ret = ldb_request_add_control(down_req,
2418 DSDB_CONTROL_CURRENT_PARTITION_OID,
2419 false, NULL);
2420 if (ret != LDB_SUCCESS) {
2421 talloc_free(ac);
2422 return ret;
2423 }
2424 }
2425
2426 /* If we are in functional level 2000, then
2427 * replmd_modify_handle_linked_attribs will have done
2428 * nothing */
2429 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2430 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2431 if (ret != LDB_SUCCESS) {
2432 talloc_free(ac);
2433 return ret;
2434 }
2435 }
2436
2437 talloc_steal(down_req, msg);
2438
2439 /* we only change whenChanged and uSNChanged if the seq_num
2440 has changed */
2441 if (ac->seq_num != 0) {
2442 ret = add_time_element(msg, "whenChanged", t);
2443 if (ret != LDB_SUCCESS) {
2444 talloc_free(ac);
2445 ldb_operr(ldb);
2446 return ret;
2447 }
2448
2449 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2450 if (ret != LDB_SUCCESS) {
2451 talloc_free(ac);
2452 ldb_operr(ldb);
2453 return ret;
2454 }
2455 }
2456
2457 if (!ldb_dn_compare_base(ac->schema->base_dn, msg->dn)) {
2458 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
2459 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
2460 if (msds_intid_struct) {
2461 msds_intid_struct->usn = ac->seq_num;
2462 }
2463 }
2464
2465 /* go on with the call chain */
2466 return ldb_next_request(module, down_req);
2467 }
2468
2469 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2470
2471 /*
2472 handle a rename request
2473
2474 On a rename we need to do an extra ldb_modify which sets the
2475 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2476 */
2477 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2478 {
2479 struct ldb_context *ldb;
2480 struct replmd_replicated_request *ac;
2481 int ret;
2482 struct ldb_request *down_req;
2483
2484 /* do not manipulate our control entries */
2485 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2486 return ldb_next_request(module, req);
2487 }
2488
2489 ldb = ldb_module_get_ctx(module);
2490
2491 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2492
2493 ac = replmd_ctx_init(module, req);
2494 if (ac == NULL) {
2495 return ldb_module_oom(module);
2496 }
2497
2498 ret = ldb_build_rename_req(&down_req, ldb, ac,
2499 ac->req->op.rename.olddn,
2500 ac->req->op.rename.newdn,
2501 ac->req->controls,
2502 ac, replmd_rename_callback,
2503 ac->req);
2504 LDB_REQ_SET_LOCATION(down_req);
2505 if (ret != LDB_SUCCESS) {
2506 talloc_free(ac);
2507 return ret;
2508 }
2509
2510 /* go on with the call chain */
2511 return ldb_next_request(module, down_req);
2512 }
2513
2514 /* After the rename is compleated, update the whenchanged etc */
2515 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2516 {
2517 struct ldb_context *ldb;
2518 struct replmd_replicated_request *ac;
2519 struct ldb_request *down_req;
2520 struct ldb_message *msg;
2521 const struct dsdb_attribute *rdn_attr;
2522 const char *rdn_name;
2523 const struct ldb_val *rdn_val;
2524 const char *attrs[5] = { NULL, };
2525 time_t t = time(NULL);
2526 int ret;
2527 bool is_urgent = false, rodc = false;
2528
2529 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2530 ldb = ldb_module_get_ctx(ac->module);
2531
2532 if (ares->error != LDB_SUCCESS) {
2533 return ldb_module_done(ac->req, ares->controls,
2534 ares->response, ares->error);
2535 }
2536
2537 if (ares->type != LDB_REPLY_DONE) {
2538 ldb_set_errstring(ldb,
2539 "invalid ldb_reply_type in callback");
2540 talloc_free(ares);
2541 return ldb_module_done(ac->req, NULL, NULL,
2542 LDB_ERR_OPERATIONS_ERROR);
2543 }
2544
2545 /* TODO:
2546 * - replace the old object with the newly constructed one
2547 */
2548
2549 msg = ldb_msg_new(ac);
2550 if (msg == NULL) {
2551 ldb_oom(ldb);
2552 return LDB_ERR_OPERATIONS_ERROR;
2553 }
2554
2555 msg->dn = ac->req->op.rename.newdn;
2556
2557 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2558 if (rdn_name == NULL) {
2559 talloc_free(ares);
2560 return ldb_module_done(ac->req, NULL, NULL,
2561 ldb_operr(ldb));
2562 }
2563
2564 /* normalize the rdn attribute name */
2565 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2566 if (rdn_attr == NULL) {
2567 talloc_free(ares);
2568 return ldb_module_done(ac->req, NULL, NULL,
2569 ldb_operr(ldb));
2570 }
2571 rdn_name = rdn_attr->lDAPDisplayName;
2572
2573 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2574 if (rdn_val == NULL) {
2575 talloc_free(ares);
2576 return ldb_module_done(ac->req, NULL, NULL,
2577 ldb_operr(ldb));
2578 }
2579
2580 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2581 talloc_free(ares);
2582 return ldb_module_done(ac->req, NULL, NULL,
2583 ldb_oom(ldb));
2584 }
2585 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2586 talloc_free(ares);
2587 return ldb_module_done(ac->req, NULL, NULL,
2588 ldb_oom(ldb));
2589 }
2590 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2591 talloc_free(ares);
2592 return ldb_module_done(ac->req, NULL, NULL,
2593 ldb_oom(ldb));
2594 }
2595 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2596 talloc_free(ares);
2597 return ldb_module_done(ac->req, NULL, NULL,
2598 ldb_oom(ldb));
2599 }
2600
2601 /*
2602 * here we let replmd_update_rpmd() only search for
2603 * the existing "replPropertyMetaData" and rdn_name attributes.
2604 *
2605 * We do not want the existing "name" attribute as
2606 * the "name" attribute needs to get the version
2607 * updated on rename even if the rdn value hasn't changed.
2608 *
2609 * This is the diff of the meta data, for a moved user
2610 * on a w2k8r2 server:
2611 *
2612 * # record 1
2613 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2614 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2615 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2616 * version : 0x00000001 (1)
2617 * reserved : 0x00000000 (0)
2618 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2619 * local_usn : 0x00000000000037a5 (14245)
2620 * array: struct replPropertyMetaData1
2621 * attid : DRSUAPI_ATTID_name (0x90001)
2622 * - version : 0x00000001 (1)
2623 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2624 * + version : 0x00000002 (2)
2625 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2626 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2627 * - originating_usn : 0x00000000000037a5 (14245)
2628 * - local_usn : 0x00000000000037a5 (14245)
2629 * + originating_usn : 0x0000000000003834 (14388)
2630 * + local_usn : 0x0000000000003834 (14388)
2631 * array: struct replPropertyMetaData1
2632 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2633 * version : 0x00000004 (4)
2634 */
2635 attrs[0] = "replPropertyMetaData";
2636 attrs[1] = "objectClass";
2637 attrs[2] = "instanceType";
2638 attrs[3] = rdn_name;
2639 attrs[4] = NULL;
2640
2641 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2642 msg, &ac->seq_num, t, &is_urgent, &rodc);
2643 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2644 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2645 struct loadparm_context *lp_ctx;
2646 char *referral;
2647
2648 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2649 struct loadparm_context);
2650
2651 referral = talloc_asprintf(req,
2652 "ldap://%s/%s",
2653 lpcfg_dnsdomain(lp_ctx),
2654 ldb_dn_get_linearized(olddn));
2655 ret = ldb_module_send_referral(req, referral);
2656 talloc_free(ares);
2657 return ldb_module_done(req, NULL, NULL, ret);
2658 }
2659
2660 if (ret != LDB_SUCCESS) {
2661 talloc_free(ares);
2662 return ldb_module_done(ac->req, NULL, NULL, ret);
2663 }
2664
2665 if (ac->seq_num == 0) {
2666 talloc_free(ares);
2667 return ldb_module_done(ac->req, NULL, NULL,
2668 ldb_error(ldb, ret,
2669 "internal error seq_num == 0"));
2670 }
2671 ac->is_urgent = is_urgent;
2672
2673 ret = ldb_build_mod_req(&down_req, ldb, ac,
2674 msg,
2675 req->controls,
2676 ac, replmd_op_callback,
2677 req);
2678 LDB_REQ_SET_LOCATION(down_req);
2679 if (ret != LDB_SUCCESS) {
2680 talloc_free(ac);
2681 return ret;
2682 }
2683
2684 /* current partition control is needed by "replmd_op_callback" */
2685 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2686 ret = ldb_request_add_control(down_req,
2687 DSDB_CONTROL_CURRENT_PARTITION_OID,
2688 false, NULL);
2689 if (ret != LDB_SUCCESS) {
2690 talloc_free(ac);
2691 return ret;
2692 }
2693 }
2694
2695 talloc_steal(down_req, msg);
2696
2697 ret = add_time_element(msg, "whenChanged", t);
2698 if (ret != LDB_SUCCESS) {
2699 talloc_free(ac);
2700 ldb_operr(ldb);
2701 return ret;
2702 }
2703
2704 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2705 if (ret != LDB_SUCCESS) {
2706 talloc_free(ac);
2707 ldb_operr(ldb);
2708 return ret;
2709 }
2710
2711 /* go on with the call chain - do the modify after the rename */
2712 return ldb_next_request(ac->module, down_req);
2713 }
2714
2715 /*
2716 remove links from objects that point at this object when an object
2717 is deleted
2718 */
2719 static int replmd_delete_remove_link(struct ldb_module *module,
2720 const struct dsdb_schema *schema,
2721 struct ldb_dn *dn,
2722 struct ldb_message_element *el,
2723 const struct dsdb_attribute *sa,
2724 struct ldb_request *parent)
2725 {
2726 unsigned int i;
2727 TALLOC_CTX *tmp_ctx = talloc_new(module);
2728 struct ldb_context *ldb = ldb_module_get_ctx(module);
2729
2730 for (i=0; i<el->num_values; i++) {
2731 struct dsdb_dn *dsdb_dn;
2732 NTSTATUS status;
2733 int ret;
2734 struct GUID guid2;
2735 struct ldb_message *msg;
2736 const struct dsdb_attribute *target_attr;
2737 struct ldb_message_element *el2;
2738 struct ldb_val dn_val;
2739
2740 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2741 continue;
2742 }
2743
2744 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2745 if (!dsdb_dn) {
2746 talloc_free(tmp_ctx);
2747 return LDB_ERR_OPERATIONS_ERROR;
2748 }
2749
2750 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2751 if (!NT_STATUS_IS_OK(status)) {
2752 talloc_free(tmp_ctx);
2753 return LDB_ERR_OPERATIONS_ERROR;
2754 }
2755
2756 /* remove the link */
2757 msg = ldb_msg_new(tmp_ctx);
2758 if (!msg) {
2759 ldb_module_oom(module);
2760 talloc_free(tmp_ctx);
2761 return LDB_ERR_OPERATIONS_ERROR;
2762 }
2763
2764
2765 msg->dn = dsdb_dn->dn;
2766
2767 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2768 if (target_attr == NULL) {
2769 continue;
2770 }
2771
2772 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2773 if (ret != LDB_SUCCESS) {
2774 ldb_module_oom(module);
2775 talloc_free(tmp_ctx);
2776 return LDB_ERR_OPERATIONS_ERROR;
2777 }
2778 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2779 el2->values = &dn_val;
2780 el2->num_values = 1;
2781
2782 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2783 if (ret != LDB_SUCCESS) {
2784 talloc_free(tmp_ctx);
2785 return ret;
2786 }
2787 }
2788 talloc_free(tmp_ctx);
2789 return LDB_SUCCESS;
2790 }
2791
2792
2793 /*
2794 handle update of replication meta data for deletion of objects
2795
2796 This also handles the mapping of delete to a rename operation
2797 to allow deletes to be replicated.
2798 */
2799 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2800 {
2801 int ret = LDB_ERR_OTHER;
2802 bool retb, disallow_move_on_delete;
2803 struct ldb_dn *old_dn, *new_dn;
2804 const char *rdn_name;
2805 const struct ldb_val *rdn_value, *new_rdn_value;
2806 struct GUID guid;
2807 struct ldb_context *ldb = ldb_module_get_ctx(module);
2808 const struct dsdb_schema *schema;
2809 struct ldb_message *msg, *old_msg;
2810 struct ldb_message_element *el;
2811 TALLOC_CTX *tmp_ctx;
2812 struct ldb_result *res, *parent_res;
2813 const char *preserved_attrs[] = {
2814 /* yes, this really is a hard coded list. See MS-ADTS
2815 section 3.1.1.5.5.1.1 */
2816 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2817 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2818 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2819 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2820 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2821 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2822 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2823 "whenChanged", NULL};
2824 unsigned int i, el_count = 0;
2825 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2826 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2827 enum deletion_state deletion_state, next_deletion_state;
2828 bool enabled;
2829
2830 if (ldb_dn_is_special(req->op.del.dn)) {
2831 return ldb_next_request(module, req);
2832 }
2833
2834 tmp_ctx = talloc_new(ldb);
2835 if (!tmp_ctx) {
2836 ldb_oom(ldb);
2837 return LDB_ERR_OPERATIONS_ERROR;
2838 }
2839
2840 schema = dsdb_get_schema(ldb, tmp_ctx);
2841 if (!schema) {
2842 return LDB_ERR_OPERATIONS_ERROR;
2843 }
2844
2845 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2846
2847 /* we need the complete msg off disk, so we can work out which
2848 attributes need to be removed */
2849 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2850 DSDB_FLAG_NEXT_MODULE |
2851 DSDB_SEARCH_SHOW_RECYCLED |
2852 DSDB_SEARCH_REVEAL_INTERNALS |
2853 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2854 if (ret != LDB_SUCCESS) {
2855 talloc_free(tmp_ctx);
2856 return ret;
2857 }
2858 old_msg = res->msgs[0];
2859
2860
2861 ret = dsdb_recyclebin_enabled(module, &enabled);
2862 if (ret != LDB_SUCCESS) {
2863 talloc_free(tmp_ctx);
2864 return ret;
2865 }
2866
2867 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2868 if (!enabled) {
2869 deletion_state = OBJECT_TOMBSTONE;
2870 next_deletion_state = OBJECT_REMOVED;
2871 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2872 deletion_state = OBJECT_RECYCLED;
2873 next_deletion_state = OBJECT_REMOVED;
2874 } else {
2875 deletion_state = OBJECT_DELETED;
2876 next_deletion_state = OBJECT_RECYCLED;
2877 }
2878 } else {
2879 deletion_state = OBJECT_NOT_DELETED;
2880 if (enabled) {
2881 next_deletion_state = OBJECT_DELETED;
2882 } else {
2883 next_deletion_state = OBJECT_TOMBSTONE;
2884 }
2885 }
2886
2887 if (next_deletion_state == OBJECT_REMOVED) {
2888 struct auth_session_info *session_info =
2889 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2890 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2891 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2892 ldb_dn_get_linearized(old_msg->dn));
2893 return LDB_ERR_UNWILLING_TO_PERFORM;
2894 }
2895
2896 /* it is already deleted - really remove it this time */
2897 talloc_free(tmp_ctx);
2898 return ldb_next_request(module, req);
2899 }
2900
2901 rdn_name = ldb_dn_get_rdn_name(old_dn);
2902 rdn_value = ldb_dn_get_rdn_val(old_dn);
2903 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2904 talloc_free(tmp_ctx);
2905 return ldb_operr(ldb);
2906 }
2907
2908 msg = ldb_msg_new(tmp_ctx);
2909 if (msg == NULL) {
2910 ldb_module_oom(module);
2911 talloc_free(tmp_ctx);
2912 return LDB_ERR_OPERATIONS_ERROR;
2913 }
2914
2915 msg->dn = old_dn;
2916
2917 if (deletion_state == OBJECT_NOT_DELETED){
2918 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2919 disallow_move_on_delete =
2920 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2921 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2922
2923 /* work out where we will be renaming this object to */
2924 if (!disallow_move_on_delete) {
2925 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2926 &new_dn);
2927 if (ret != LDB_SUCCESS) {
2928 /* this is probably an attempted delete on a partition
2929 * that doesn't allow delete operations, such as the
2930 * schema partition */
2931 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2932 ldb_dn_get_linearized(old_dn));
2933 talloc_free(tmp_ctx);
2934 return LDB_ERR_UNWILLING_TO_PERFORM;
2935 }
2936 } else {
2937 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2938 if (new_dn == NULL) {
2939 ldb_module_oom(module);
2940 talloc_free(tmp_ctx);
2941 return LDB_ERR_OPERATIONS_ERROR;
2942 }
2943 }
2944
2945 /* get the objects GUID from the search we just did */
2946 guid = samdb_result_guid(old_msg, "objectGUID");
2947
2948 /* Add a formatted child */
2949 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2950 rdn_name,
2951 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2952 GUID_string(tmp_ctx, &guid));
2953 if (!retb) {
2954 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2955 ldb_dn_get_linearized(new_dn)));
2956 talloc_free(tmp_ctx);
2957 return LDB_ERR_OPERATIONS_ERROR;
2958 }
2959
2960 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2961 if (ret != LDB_SUCCESS) {
2962 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2963 ldb_module_oom(module);
2964 talloc_free(tmp_ctx);
2965 return ret;
2966 }
2967 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2968 }
2969
2970 /*
2971 now we need to modify the object in the following ways:
2972
2973 - add isDeleted=TRUE
2974 - update rDN and name, with new rDN
2975 - remove linked attributes
2976 - remove objectCategory and sAMAccountType
2977 - remove attribs not on the preserved list
2978 - preserved if in above list, or is rDN
2979 - remove all linked attribs from this object
2980 - remove all links from other objects to this object
2981 - add lastKnownParent
2982 - update replPropertyMetaData?
2983
2984 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2985 */
2986
2987 /* we need the storage form of the parent GUID */
2988 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2989 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2990 DSDB_FLAG_NEXT_MODULE |
2991 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2992 DSDB_SEARCH_REVEAL_INTERNALS|
2993 DSDB_SEARCH_SHOW_RECYCLED, req);
2994 if (ret != LDB_SUCCESS) {
2995 talloc_free(tmp_ctx);
2996 return ret;
2997 }
2998
2999 if (deletion_state == OBJECT_NOT_DELETED){
3000 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3001 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
3002 if (ret != LDB_SUCCESS) {
3003 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3004 ldb_module_oom(module);
3005 talloc_free(tmp_ctx);
3006 return ret;
3007 }
3008 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3009 }
3010
3011 switch (next_deletion_state){
3012
3013 case OBJECT_DELETED:
3014
3015 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
3016 if (ret != LDB_SUCCESS) {
3017 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
3018 ldb_module_oom(module);
3019 talloc_free(tmp_ctx);
3020 return ret;
3021 }
3022 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3023
3024 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3025 if (ret != LDB_SUCCESS) {
3026 talloc_free(tmp_ctx);
3027 ldb_module_oom(module);
3028 return ret;
3029 }
3030
3031 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3032 if (ret != LDB_SUCCESS) {
3033 talloc_free(tmp_ctx);
3034 ldb_module_oom(module);
3035 return ret;
3036 }
3037
3038 break;
3039
3040 case OBJECT_RECYCLED:
3041 case OBJECT_TOMBSTONE:
3042
3043 /*
3044 * we also mark it as recycled, meaning this object can't be
3045 * recovered (we are stripping its attributes).
3046 * This is done only if we have this schema object of course ...
3047 * This behavior is identical to the one of Windows 2008R2 which
3048 * always set the isRecycled attribute, even if the recycle-bin is
3049 * not activated and what ever the forest level is.
3050 */
3051 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3052 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3053 if (ret != LDB_SUCCESS) {
3054 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3055 ldb_module_oom(module);
3056 talloc_free(tmp_ctx);
3057 return ret;
3058 }
3059 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3060 }
3061
3062 /* work out which of the old attributes we will be removing */
3063 for (i=0; i<old_msg->num_elements; i++) {
3064 const struct dsdb_attribute *sa;
3065 el = &old_msg->elements[i];
3066 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3067 if (!sa) {
3068 talloc_free(tmp_ctx);
3069 return LDB_ERR_OPERATIONS_ERROR;
3070 }
3071 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3072 /* don't remove the rDN */
3073 continue;
3074 }
3075 if (sa->linkID && (sa->linkID & 1)) {
3076 /*
3077 we have a backlink in this object
3078 that needs to be removed. We're not
3079 allowed to remove it directly
3080 however, so we instead setup a
3081 modify to delete the corresponding
3082 forward link
3083 */
3084 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3085 if (ret != LDB_SUCCESS) {
3086 talloc_free(tmp_ctx);
3087 return LDB_ERR_OPERATIONS_ERROR;
3088 }
3089 /* now we continue, which means we
3090 won't remove this backlink
3091 directly
3092 */
3093 continue;
3094 }
3095 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
3096 continue;
3097 }
3098 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3099 if (ret != LDB_SUCCESS) {
3100 talloc_free(tmp_ctx);
3101 ldb_module_oom(module);
3102 return ret;
3103 }
3104 }
3105 break;
3106
3107 default:
3108 break;
3109 }
3110
3111 if (deletion_state == OBJECT_NOT_DELETED) {
3112 const struct dsdb_attribute *sa;
3113
3114 /* work out what the new rdn value is, for updating the
3115 rDN and name fields */
3116 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3117 if (new_rdn_value == NULL) {
3118 talloc_free(tmp_ctx);
3119 return ldb_operr(ldb);
3120 }
3121
3122 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3123 if (!sa) {
3124 talloc_free(tmp_ctx);
3125 return LDB_ERR_OPERATIONS_ERROR;
3126 }
3127
3128 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3129 &el);
3130 if (ret != LDB_SUCCESS) {
3131 talloc_free(tmp_ctx);
3132 return ret;
3133 }
3134 el->flags = LDB_FLAG_MOD_REPLACE;
3135
3136 el = ldb_msg_find_element(old_msg, "name");
3137 if (el) {
3138 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3139 if (ret != LDB_SUCCESS) {
3140 talloc_free(tmp_ctx);
3141 return ret;
3142 }
3143 el->flags = LDB_FLAG_MOD_REPLACE;
3144 }
3145 }
3146
3147 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3148 if (ret != LDB_SUCCESS) {
3149 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3150 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3151 talloc_free(tmp_ctx);
3152 return ret;
3153 }
3154
3155 if (deletion_state == OBJECT_NOT_DELETED) {
3156 /* now rename onto the new DN */
3157 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3158 if (ret != LDB_SUCCESS){
3159 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3160 ldb_dn_get_linearized(old_dn),
3161 ldb_dn_get_linearized(new_dn),
3162 ldb_errstring(ldb)));
3163 talloc_free(tmp_ctx);
3164 return ret;
3165 }
3166 }
3167
3168 talloc_free(tmp_ctx);
3169
3170 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3171 }
3172
3173
3174
3175 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3176 {
3177 return ret;
3178 }
3179
3180 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3181 {
3182 int ret = LDB_ERR_OTHER;
3183 /* TODO: do some error mapping */
3184 return ret;
3185 }
3186
3187
3188 static struct replPropertyMetaData1 *
3189 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3190 enum drsuapi_DsAttributeId attid)
3191 {
3192 uint32_t i;
3193 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3194
3195 for (i = 0; i < rpmd_ctr->count; i++) {
3196 if (rpmd_ctr->array[i].attid == attid) {
3197 return &rpmd_ctr->array[i];
3198 }
3199 }
3200 return NULL;
3201 }
3202
3203
3204 /*
3205 return true if an update is newer than an existing entry
3206 see section 5.11 of MS-ADTS
3207 */
3208 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3209 const struct GUID *update_invocation_id,
3210 uint32_t current_version,
3211 uint32_t update_version,
3212 NTTIME current_change_time,
3213 NTTIME update_change_time)
3214 {
3215 if (update_version != current_version) {
3216 return update_version > current_version;
3217 }
3218 if (update_change_time != current_change_time) {
3219 return update_change_time > current_change_time;
3220 }
3221 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3222 }
3223
3224 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3225 struct replPropertyMetaData1 *new_m)
3226 {
3227 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3228 &new_m->originating_invocation_id,
3229 cur_m->version,
3230 new_m->version,
3231 cur_m->originating_change_time,
3232 new_m->originating_change_time);
3233 }
3234
3235
3236 /*
3237 form a conflict DN
3238 */
3239 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3240 {
3241 const struct ldb_val *rdn_val;
3242 const char *rdn_name;
3243 struct ldb_dn *new_dn;
3244
3245 rdn_val = ldb_dn_get_rdn_val(dn);
3246 rdn_name = ldb_dn_get_rdn_name(dn);
3247 if (!rdn_val || !rdn_name) {
3248 return NULL;
3249 }
3250
3251 new_dn = ldb_dn_copy(mem_ctx, dn);
3252 if (!new_dn) {
3253 return NULL;
3254 }
3255
3256 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3257 return NULL;
3258 }
3259
3260 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3261 rdn_name,
3262 ldb_dn_escape_value(new_dn, *rdn_val),
3263 GUID_string(new_dn, guid))) {
3264 return NULL;
3265 }
3266
3267 return new_dn;
3268 }
3269
3270
3271 /*
3272 perform a modify operation which sets the rDN and name attributes to
3273 their current values. This has the effect of changing these
3274 attributes to have been last updated by the current DC. This is
3275 needed to ensure that renames performed as part of conflict
3276 resolution are propogated to other DCs
3277 */
3278 static int replmd_name_modify(struct replmd_replicated_request *ar,
3279 struct ldb_request *req, struct ldb_dn *dn)
3280 {
3281 struct ldb_message *msg;
3282 const char *rdn_name;
3283 const struct ldb_val *rdn_val;
3284 const struct dsdb_attribute *rdn_attr;
3285 int ret;
3286
3287 msg = ldb_msg_new(req);
3288 if (msg == NULL) {
3289 goto failed;
3290 }
3291 msg->dn = dn;
3292
3293 rdn_name = ldb_dn_get_rdn_name(dn);
3294 if (rdn_name == NULL) {
3295 goto failed;
3296 }
3297
3298 /* normalize the rdn attribute name */
3299 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3300 if (rdn_attr == NULL) {
3301 goto failed;
3302 }
3303 rdn_name = rdn_attr->lDAPDisplayName;
3304
3305 rdn_val = ldb_dn_get_rdn_val(dn);
3306 if (rdn_val == NULL) {
3307 goto failed;
3308 }
3309
3310 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3311 goto failed;
3312 }
3313 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3314 goto failed;
3315 }
3316 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3317 goto failed;
3318 }
3319 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3320 goto failed;
3321 }
3322
3323 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3324 if (ret != LDB_SUCCESS) {
3325 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3326 ldb_dn_get_linearized(dn),
3327 ldb_errstring(ldb_module_get_ctx(ar->module))));
3328 return ret;
3329 }
3330
3331 talloc_free(msg);
3332
3333 return LDB_SUCCESS;
3334
3335 failed:
3336 talloc_free(msg);
3337 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3338 ldb_dn_get_linearized(dn)));
3339 return LDB_ERR_OPERATIONS_ERROR;
3340 }
3341
3342
3343 /*
3344 callback for conflict DN handling where we have renamed the incoming
3345 record. After renaming it, we need to ensure the change of name and
3346 rDN for the incoming record is seen as an originating update by this DC.
3347
3348 This also handles updating lastKnownParent for entries sent to lostAndFound
3349 */
3350 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3351 {
3352 struct replmd_replicated_request *ar =
3353 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3354 struct ldb_dn *conflict_dn;
3355 int ret;
3356
3357 if (ares->error != LDB_SUCCESS) {
3358 /* call the normal callback for everything except success */
3359 return replmd_op_callback(req, ares);
3360 }
3361
3362 switch (req->operation) {
3363 case LDB_ADD:
3364 conflict_dn = req->op.add.message->dn;
3365 break;
3366 case LDB_MODIFY:
3367 conflict_dn = req->op.mod.message->dn;
3368 break;
3369 default:
3370 smb_panic("replmd_op_name_modify_callback called in unknown circumstances");
3371 }
3372
3373 /* perform a modify of the rDN and name of the record */
3374 ret = replmd_name_modify(ar, req, conflict_dn);
3375 if (ret != LDB_SUCCESS) {
3376 ares->error = ret;
3377 return replmd_op_callback(req, ares);
3378 }
3379
3380 if (ar->objs->objects[ar->index_current].last_known_parent) {
3381 struct ldb_message *msg = ldb_msg_new(req);
3382 if (msg == NULL) {
3383 ldb_module_oom(ar->module);
3384 return LDB_ERR_OPERATIONS_ERROR;
3385 }
3386
3387 msg->dn = req->op.add.message->dn;
3388
3389 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3390 ldb_dn_get_extended_linearized(msg, ar->objs->objects[ar->index_current].last_known_parent, 1));
3391 if (ret != LDB_SUCCESS) {
3392 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3393 ldb_module_oom(ar->module);
3394 return ret;
3395 }
3396 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
3397
3398 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3399 if (ret != LDB_SUCCESS) {
3400 DEBUG(0,(__location__ ": Failed to modify lastKnownParent of lostAndFound DN '%s' - %s",
3401 ldb_dn_get_linearized(msg->dn),
3402 ldb_errstring(ldb_module_get_ctx(ar->module))));
3403 return ret;
3404 }
3405 TALLOC_FREE(msg);
3406 }
3407
3408 return replmd_op_callback(req, ares);
3409 }
3410
3411 /*
3412 callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
3413 This copes with the creation of conflict records in the case where
3414 the DN exists, but with a different objectGUID
3415 */
3416 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3417 {
3418 struct ldb_dn *conflict_dn;
3419 struct replmd_replicated_request *ar =
3420 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3421 struct ldb_result *res;
3422 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3423 int ret;
3424 const struct ldb_val *omd_value;
3425 struct replPropertyMetaDataBlob omd, *rmd;
3426 enum ndr_err_code ndr_err;
3427 bool rename_incoming_record, rodc;
3428 struct replPropertyMetaData1 *rmd_name, *omd_name;
3429 struct ldb_message *msg;
3430
3431 req->callback = callback;
3432
3433 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3434 /* call the normal callback for everything except
3435 conflicts */
3436 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3437 }
3438
3439 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3440 if (ret != LDB_SUCCESS) {
3441 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to determine if we are an RODC when attempting to form conflict DN: %s", ldb_errstring(ldb_module_get_ctx(ar->module)));
3442 return ldb_module_done(req, ares->controls, ares->response, LDB_ERR_OPERATIONS_ERROR);
3443 }
3444 /*
3445 * we have a conflict, and need to decide if we will keep the
3446 * new record or the old record
3447 */
3448
3449 msg = ar->objs->objects[ar->index_current].msg;
3450
3451 switch (req->operation) {
3452 case LDB_ADD:
3453 conflict_dn = msg->dn;
3454 break;
3455 case LDB_RENAME:
3456 conflict_dn = req->op.rename.newdn;
3457 break;
3458 default:
3459 return ldb_module_done(req, ares->controls, ares->response, ldb_module_operr(ar->module));
3460 }
3461
3462 if (rodc) {
3463 /*
3464 * We are on an RODC, or were a GC for this
3465 * partition, so we have to fail this until
3466 * someone who owns the partition sorts it
3467 * out
3468 */
3469 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3470 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3471 " - We must fail the operation until a master for this partition resolves the conflict",
3472 ldb_dn_get_linearized(conflict_dn));
3473 goto failed;
3474 }
3475
3476 /*
3477 * first we need the replPropertyMetaData attribute from the
3478 * old record
3479 */
3480 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3481 attrs,
3482 DSDB_FLAG_NEXT_MODULE |
3483 DSDB_SEARCH_SHOW_DELETED |
3484 DSDB_SEARCH_SHOW_RECYCLED, req);
3485 if (ret != LDB_SUCCESS) {
3486 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3487 ldb_dn_get_linearized(conflict_dn)));
3488 goto failed;
3489 }
3490
3491 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3492 if (omd_value == NULL) {
3493 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3494 ldb_dn_get_linearized(conflict_dn)));
3495 goto failed;
3496 }
3497
3498 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3499 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3500 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3501 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3502 ldb_dn_get_linearized(conflict_dn)));
3503 goto failed;
3504 }
3505
3506 rmd = ar->objs->objects[ar->index_current].meta_data;
3507
3508 /* we decide which is newer based on the RPMD on the name
3509 attribute. See [MS-DRSR] ResolveNameConflict */
3510 rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3511 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3512 if (!rmd_name || !omd_name) {
3513 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3514 ldb_dn_get_linearized(conflict_dn)));
3515 goto failed;
3516 }
3517
3518 rename_incoming_record = !(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) &&
3519 !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3520
3521 if (rename_incoming_record) {
3522 struct GUID guid;
3523 struct ldb_dn *new_dn;
3524 struct ldb_message *new_msg;
3525
3526 /*
3527 * We want to run the original callback here, which
3528 * will return LDB_ERR_ENTRY_ALREADY_EXISTS to the
3529 * caller, which will in turn know to rename the
3530 * incoming record. The error string is set in case
3531 * this isn't handled properly at some point in the
3532 * future.
3533 */
3534 if (req->operation == LDB_RENAME) {
3535 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3536 "Unable to handle incoming renames where this would "
3537 "create a conflict. Incoming record is %s (caller to handle)\n",
3538 ldb_dn_get_extended_linearized(req, conflict_dn, 1));
3539
3540 goto failed;
3541 }
3542
3543 guid = samdb_result_guid(msg, "objectGUID");
3544 if (GUID_all_zero(&guid)) {
3545 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3546 ldb_dn_get_linearized(conflict_dn)));
3547 goto failed;
3548 }
3549 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3550 if (new_dn == NULL) {
3551 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3552 ldb_dn_get_linearized(conflict_dn)));
3553 goto failed;
3554 }
3555
3556 DEBUG(2,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3557 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3558
3559 /* re-submit the request, but with a different
3560 callback, so we don't loop forever. */
3561 new_msg = ldb_msg_copy_shallow(req, msg);
3562 if (!new_msg) {
3563 goto failed;
3564 DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3565 ldb_dn_get_linearized(conflict_dn)));
3566 }
3567 new_msg->dn = new_dn;
3568 req->op.add.message = new_msg;
3569 req->callback = replmd_op_name_modify_callback;
3570
3571 return ldb_next_request(ar->module, req);
3572 } else {
3573 /* we are renaming the existing record */
3574 struct GUID guid;
3575 struct ldb_dn *new_dn;
3576
3577 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3578 if (GUID_all_zero(&guid)) {
3579 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3580 ldb_dn_get_linearized(conflict_dn)));
3581 goto failed;
3582 }
3583
3584 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3585 if (new_dn == NULL) {
3586 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3587 ldb_dn_get_linearized(conflict_dn)));
3588 goto failed;
3589 }
3590
3591 DEBUG(2,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3592 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3593
3594 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3595 DSDB_FLAG_OWN_MODULE, req);
3596 if (ret != LDB_SUCCESS) {
3597 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3598 ldb_dn_get_linearized(conflict_dn),
3599 ldb_dn_get_linearized(new_dn),
3600 ldb_errstring(ldb_module_get_ctx(ar->module))));
3601 goto failed;
3602 }
3603
3604 /*
3605 * now we need to ensure that the rename is seen as an
3606 * originating update. We do that with a modify.
3607 */
3608 ret = replmd_name_modify(ar, req, new_dn);
3609 if (ret != LDB_SUCCESS) {
3610 goto failed;
3611 }
3612
3613 return ldb_next_request(ar->module, req);
3614 }
3615
3616 failed:
3617 /* on failure do the original callback. This means replication
3618 * will stop with an error, but there is not much else we can
3619 * do
3620 */
3621 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3622 }
3623
3624 /*
3625 callback for replmd_replicated_apply_add()
3626 This copes with the creation of conflict records in the case where
3627 the DN exists, but with a different objectGUID
3628 */
3629 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3630 {
3631 struct replmd_replicated_request *ar =
3632 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3633
3634 if (ar->objs->objects[ar->index_current].last_known_parent) {
3635 /* This is like a conflict DN, where we put the object in LostAndFound
3636 see MS-DRSR 4.1.10.6.10 FindBestParentObject */
3637 return replmd_op_possible_conflict_callback(req, ares, replmd_op_name_modify_callback);
3638 }
3639
3640 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
3641 }
3642
3643 /*
3644 callback for replmd_replicated_handle_rename()
3645 This copes with the creation of conflict records in the case where
3646 the DN exists, but with a different objectGUID
3647 */
3648 static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
3649 {
3650 return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
3651 }
3652
3653 /*
3654 this is called when a new object comes in over DRS
3655 */
3656 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3657 {
3658 struct ldb_context *ldb;
3659 struct ldb_request *change_req;
3660 enum ndr_err_code ndr_err;
3661 struct ldb_message *msg;
3662 struct replPropertyMetaDataBlob *md;
3663 struct ldb_val md_value;
3664 unsigned int i;
3665 int ret;
3666 bool remote_isDeleted = false;
3667
3668 ldb = ldb_module_get_ctx(ar->module);
3669 msg = ar->objs->objects[ar->index_current].msg;
3670 md = ar->objs->objects[ar->index_current].meta_data;
3671
3672 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3673 if (ret != LDB_SUCCESS) {
3674 return replmd_replicated_request_error(ar, ret);
3675 }
3676
3677 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3678 if (ret != LDB_SUCCESS) {
3679 return replmd_replicated_request_error(ar, ret);
3680 }
3681
3682 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3683 if (ret != LDB_SUCCESS) {
3684 return replmd_replicated_request_error(ar, ret);
3685 }
3686
3687 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3688 if (ret != LDB_SUCCESS) {
3689 return replmd_replicated_request_error(ar, ret);
3690 }
3691
3692 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3693 if (ret != LDB_SUCCESS) {
3694 return replmd_replicated_request_error(ar, ret);
3695 }
3696
3697 /* remove any message elements that have zero values */
3698 for (i=0; i<msg->num_elements; i++) {
3699 struct ldb_message_element *el = &msg->elements[i];
3700
3701 if (el->num_values == 0) {
3702 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3703 el->name));
3704 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3705 msg->num_elements--;
3706 i--;
3707 continue;
3708 }
3709 }
3710
3711 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
3712 "isDeleted", false);
3713
3714 /*
3715 * the meta data array is already sorted by the caller
3716 */
3717 for (i=0; i < md->ctr.ctr1.count; i++) {
3718 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3719 }
3720 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3721 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3722 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3723 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3724 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3725 }
3726 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3727 if (ret != LDB_SUCCESS) {
3728 return replmd_replicated_request_error(ar, ret);
3729 }
3730
3731 replmd_ldb_message_sort(msg, ar->schema);
3732
3733 if (!remote_isDeleted) {
3734 ret = dsdb_module_schedule_sd_propagation(ar->module,
3735 ar->objs->partition_dn,
3736 msg->dn, true);
3737 if (ret != LDB_SUCCESS) {
3738 return replmd_replicated_request_error(ar, ret);
3739 }
3740 }
3741
3742 if (DEBUGLVL(4)) {
3743 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3744 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3745 talloc_free(s);
3746 }
3747
3748 ret = ldb_build_add_req(&change_req,
3749 ldb,
3750 ar,
3751 msg,
3752 ar->controls,
3753 ar,
3754 replmd_op_add_callback,
3755 ar->req);
3756 LDB_REQ_SET_LOCATION(change_req);
3757 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3758
3759 /* current partition control needed by "repmd_op_callback" */
3760 ret = ldb_request_add_control(change_req,
3761 DSDB_CONTROL_CURRENT_PARTITION_OID,
3762 false, NULL);
3763 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3764
3765 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
3766 /* this tells the partition module to make it a
3767 partial replica if creating an NC */
3768 ret = ldb_request_add_control(change_req,
3769 DSDB_CONTROL_PARTIAL_REPLICA,
3770 false, NULL);
3771 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3772 }
3773
3774 return ldb_next_request(ar->module, change_req);
3775 }
3776
3777 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
3778 struct ldb_reply *ares)
3779 {
3780 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3781 struct replmd_replicated_request);
3782 int ret;
3783
3784 if (!ares) {
3785 return ldb_module_done(ar->req, NULL, NULL,
3786 LDB_ERR_OPERATIONS_ERROR);
3787 }
3788 if (ares->error != LDB_SUCCESS &&
3789 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3790 /*
3791 * TODO: deal with the above error that the parent object doesn't exist
3792 */
3793
3794 return ldb_module_done(ar->req, ares->controls,
3795 ares->response, ares->error);
3796 }
3797
3798 switch (ares->type) {
3799 case LDB_REPLY_ENTRY:
3800 {
3801 struct ldb_message *parent_msg = ares->message;
3802 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
3803 struct ldb_dn *parent_dn;
3804 int comp_num;
3805
3806 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
3807 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
3808 /* Per MS-DRSR 4.1.10.6.10
3809 * FindBestParentObject we need to move this
3810 * new object under a deleted object to
3811 * lost-and-found */
3812 struct ldb_dn *nc_root;
3813
3814 ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
3815 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3816 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3817 "No suitable NC root found for %s. "
3818 "We need to move this object because parent object %s "
3819 "is deleted, but this object is not.",
3820 ldb_dn_get_linearized(msg->dn),
3821 ldb_dn_get_linearized(parent_msg->dn));
3822 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3823 } else if (ret != LDB_SUCCESS) {
3824 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3825 "Unable to find NC root for %s: %s. "
3826 "We need to move this object because parent object %s "
3827 "is deleted, but this object is not.",
3828 ldb_dn_get_linearized(msg->dn),
3829 ldb_errstring(ldb_module_get_ctx(ar->module)),
3830 ldb_dn_get_linearized(parent_msg->dn));
3831 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3832 }
3833
3834 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
3835 nc_root,
3836 DS_GUID_LOSTANDFOUND_CONTAINER,
3837 &parent_dn);
3838 if (ret != LDB_SUCCESS) {
3839 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3840 "Unable to find LostAndFound Container for %s "
3841 "in partition %s: %s. "
3842 "We need to move this object because parent object %s "
3843 "is deleted, but this object is not.",
3844 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
3845 ldb_errstring(ldb_module_get_ctx(ar->module)),
3846 ldb_dn_get_linearized(parent_msg->dn));
3847 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3848 }
3849 ar->objs->objects[ar->index_current].last_known_parent
3850 = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
3851 } else {
3852 parent_dn = parent_msg->dn;
3853 }
3854
3855 comp_num = ldb_dn_get_comp_num(msg->dn);
3856 if (comp_num > 1) {
3857 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
3858 talloc_free(ares);
3859 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3860 }
3861 }
3862 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
3863 talloc_free(ares);
3864 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3865 }
3866 break;
3867 }
3868 case LDB_REPLY_REFERRAL:
3869 /* we ignore referrals */
3870 break;
3871
3872 case LDB_REPLY_DONE:
3873 if (ar->search_msg != NULL) {
3874 ret = replmd_replicated_apply_merge(ar);
3875 } else {
3876 ret = replmd_replicated_apply_add(ar);
3877 }
3878 if (ret != LDB_SUCCESS) {
3879 return ldb_module_done(ar->req, NULL, NULL, ret);
3880 }
3881 }
3882
3883 talloc_free(ares);
3884 return LDB_SUCCESS;
3885 }
3886
3887 /*
3888 * Look for the parent object, so we put the new object in the right place
3889 */
3890
3891 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
3892 {
3893 struct ldb_context *ldb;
3894 int ret;
3895 char *tmp_str;
3896 char *filter;
3897 struct ldb_request *search_req;
3898 static const char *attrs[] = {"isDeleted", NULL};
3899
3900 ldb = ldb_module_get_ctx(ar->module);
3901
3902 if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
3903 if (ar->search_msg != NULL) {
3904 return replmd_replicated_apply_merge(ar);
3905 } else {
3906 return replmd_replicated_apply_add(ar);
3907 }
3908 }
3909
3910 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
3911 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3912
3913 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3914 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3915 talloc_free(tmp_str);
3916
3917 ret = ldb_build_search_req(&search_req,
3918 ldb,
3919 ar,
3920 ar->objs->partition_dn,
3921 LDB_SCOPE_SUBTREE,
3922 filter,
3923 attrs,
3924 NULL,
3925 ar,
3926 replmd_replicated_apply_search_for_parent_callback,
3927 ar->req);
3928 LDB_REQ_SET_LOCATION(search_req);
3929
3930 ret = dsdb_request_add_controls(search_req,
3931 DSDB_SEARCH_SHOW_RECYCLED|
3932 DSDB_SEARCH_SHOW_DELETED|
3933 DSDB_SEARCH_SHOW_EXTENDED_DN);
3934 if (ret != LDB_SUCCESS) {
3935 return ret;
3936 }
3937
3938 return ldb_next_request(ar->module, search_req);
3939 }
3940
3941 /*
3942 handle renames that come in over DRS replication
3943 */
3944 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3945 struct ldb_message *msg,
3946 struct ldb_request *parent)
3947 {
3948 struct ldb_request *req;
3949 int ret;
3950 TALLOC_CTX *tmp_ctx = talloc_new(msg);
3951 struct ldb_result *res;
3952
3953 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3954 ldb_dn_get_linearized(ar->search_msg->dn),
3955 ldb_dn_get_linearized(msg->dn)));
3956
3957
3958 res = talloc_zero(tmp_ctx, struct ldb_result);
3959 if (!res) {
3960 talloc_free(tmp_ctx);
3961 return ldb_oom(ldb_module_get_ctx(ar->module));
3962 }
3963
3964 /* pass rename to the next module
3965 * so it doesn't appear as an originating update */
3966 ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
3967 ar->search_msg->dn, msg->dn,
3968 NULL,
3969 ar,
3970 replmd_op_rename_callback,
3971 parent);
3972 LDB_REQ_SET_LOCATION(req);
3973 if (ret != LDB_SUCCESS) {
3974 talloc_free(tmp_ctx);
3975 return ret;
3976 }
3977
3978 ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
3979 if (ret != LDB_SUCCESS) {
3980 talloc_free(tmp_ctx);
3981 return ret;
3982 }
3983
3984 ret = ldb_next_request(ar->module, req);
3985
3986 if (ret == LDB_SUCCESS) {
3987 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
3988 }
3989
3990 talloc_free(tmp_ctx);
3991 return ret;
3992 }
3993
3994
3995 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3996 {
3997 struct ldb_context *ldb;
3998 struct ldb_request *change_req;
3999 enum ndr_err_code ndr_err;
4000 struct ldb_message *msg;
4001 struct replPropertyMetaDataBlob *rmd;
4002 struct replPropertyMetaDataBlob omd;
4003 const struct ldb_val *omd_value;
4004 struct replPropertyMetaDataBlob nmd;
4005 struct ldb_val nmd_value;
4006 unsigned int i;
4007 uint32_t j,ni=0;
4008 unsigned int removed_attrs = 0;
4009 int ret;
4010 int (*callback)(struct ldb_request *req, struct ldb_reply *ares) = replmd_op_callback;
4011 bool isDeleted = false;
4012 bool local_isDeleted = false;
4013 bool remote_isDeleted = false;
4014 bool take_remote_isDeleted = false;
4015 bool sd_updated = false;
4016 bool renamed = false;
4017
4018 ldb = ldb_module_get_ctx(ar->module);
4019 msg = ar->objs->objects[ar->index_current].msg;
4020
4021 rmd = ar->objs->objects[ar->index_current].meta_data;
4022 ZERO_STRUCT(omd);
4023 omd.version = 1;
4024
4025 /* find existing meta data */
4026 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4027 if (omd_value) {
4028 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4029 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4030 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4031 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4032 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4033 }
4034
4035 if (omd.version != 1) {
4036 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4037 }
4038 }
4039
4040 local_isDeleted = ldb_msg_find_attr_as_bool(ar->search_msg,
4041 "isDeleted", false);
4042 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
4043 "isDeleted", false);
4044
4045 if (strcmp(ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ar->search_msg->dn)) == 0) {
4046 ret = LDB_SUCCESS;
4047 } else {
4048 /*
4049 * handle renames, even just by case that come in over
4050 * DRS. Changes in the parent DN don't hit us here,
4051 * because the search for a parent will clean up those
4052 * components.
4053 *
4054 * We also have already filtered out the case where
4055 * the peer has an older name to what we have (see
4056 * replmd_replicated_apply_search_callback())
4057 */
4058 renamed = true;
4059 ret = replmd_replicated_handle_rename(ar, msg, ar->req);
4060 }
4061
4062 /*
4063 * This particular error code means that we already tried the
4064 * conflict algrorithm, and the existing record name was newer, so we
4065 * need to rename the incoming record
4066 */
4067 if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
4068 struct GUID guid;
4069 NTSTATUS status;
4070 struct ldb_dn *new_dn;
4071 status = GUID_from_ndr_blob(&ar->objs->objects[ar->index_current].guid_value, &guid);
4072 /* This really, really can't fail */
4073 SMB_ASSERT(NT_STATUS_IS_OK(status));
4074
4075 new_dn = replmd_conflict_dn(msg, msg->dn, &guid);
4076 if (new_dn == NULL) {
4077 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4078 "Failed to form conflict DN for %s\n",
4079 ldb_dn_get_linearized(msg->dn));
4080
4081 return replmd_replicated_request_werror(ar, WERR_NOMEM);
4082 }
4083
4084 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, new_dn,
4085 DSDB_FLAG_NEXT_MODULE, ar->req);
4086 if (ret != LDB_SUCCESS) {
4087 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4088 "Failed to rename incoming conflicting dn '%s' (was '%s') to '%s' - %s\n",
4089 ldb_dn_get_linearized(msg->dn),
4090 ldb_dn_get_linearized(ar->search_msg->dn),
4091 ldb_dn_get_linearized(new_dn),
4092 ldb_errstring(ldb_module_get_ctx(ar->module)));
4093 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4094 }
4095
4096 /* Set the callback to one that will fix up the name to be a conflict DN */
4097 callback = replmd_op_name_modify_callback;
4098 msg->dn = new_dn;
4099 renamed = true;
4100 } else if (ret != LDB_SUCCESS) {
4101 ldb_debug(ldb, LDB_DEBUG_FATAL,
4102 "replmd_replicated_request rename %s => %s failed - %s\n",
4103 ldb_dn_get_linearized(ar->search_msg->dn),
4104 ldb_dn_get_linearized(msg->dn),
4105 ldb_errstring(ldb));
4106 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4107 }
4108
4109 ZERO_STRUCT(nmd);
4110 nmd.version = 1;
4111 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
4112 nmd.ctr.ctr1.array = talloc_array(ar,
4113 struct replPropertyMetaData1,
4114 nmd.ctr.ctr1.count);
4115 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4116
4117 /* first copy the old meta data */
4118 for (i=0; i < omd.ctr.ctr1.count; i++) {
4119 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
4120 ni++;
4121 }
4122
4123 ar->seq_num = 0;
4124 /* now merge in the new meta data */
4125 for (i=0; i < rmd->ctr.ctr1.count; i++) {
4126 bool found = false;
4127
4128 for (j=0; j < ni; j++) {
4129 bool cmp;
4130
4131 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
4132 continue;
4133 }
4134
4135 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
4136 /* if we compare equal then do an
4137 update. This is used when a client
4138 asks for a FULL_SYNC, and can be
4139 used to recover a corrupt
4140 replica */
4141 cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
4142 &nmd.ctr.ctr1.array[j]);
4143 } else {
4144 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
4145 &rmd->ctr.ctr1.array[i]);
4146 }
4147 if (cmp) {
4148 /* replace the entry */
4149 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4150 if (ar->seq_num == 0) {
4151 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4152 if (ret != LDB_SUCCESS) {
4153 return replmd_replicated_request_error(ar, ret);
4154 }
4155 }
4156 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4157 switch (nmd.ctr.ctr1.array[j].attid) {
4158 case DRSUAPI_ATTID_ntSecurityDescriptor:
4159 sd_updated = true;
4160 break;
4161 case DRSUAPI_ATTID_isDeleted:
4162 take_remote_isDeleted = true;
4163 break;
4164 default:
4165 break;
4166 }
4167 found = true;
4168 break;
4169 }
4170
4171 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4172 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4173 msg->elements[i-removed_attrs].name,
4174 ldb_dn_get_linearized(msg->dn),
4175 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4176 }
4177
4178 /* we don't want to apply this change so remove the attribute */
4179 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4180 removed_attrs++;
4181
4182 found = true;
4183 break;
4184 }
4185
4186 if (found) continue;
4187
4188 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4189 if (ar->seq_num == 0) {
4190 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4191 if (ret != LDB_SUCCESS) {
4192 return replmd_replicated_request_error(ar, ret);
4193 }
4194 }
4195 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4196 switch (nmd.ctr.ctr1.array[ni].attid) {
4197 case DRSUAPI_ATTID_ntSecurityDescriptor:
4198 sd_updated = true;
4199 break;
4200 case DRSUAPI_ATTID_isDeleted:
4201 take_remote_isDeleted = true;
4202 break;
4203 default:
4204 break;
4205 }
4206 ni++;
4207 }
4208
4209 /*
4210 * finally correct the size of the meta_data array
4211 */
4212 nmd.ctr.ctr1.count = ni;
4213
4214 /*
4215 * the rdn attribute (the alias for the name attribute),
4216 * 'cn' for most objects is the last entry in the meta data array
4217 * we have stored
4218 *
4219 * sort the new meta data array
4220 */
4221 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
4222 if (ret != LDB_SUCCESS) {
4223 return ret;
4224 }
4225
4226 /*
4227 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4228 */
4229 if (msg->num_elements == 0) {
4230 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4231 ar->index_current);
4232
4233 ar->index_current++;
4234 return replmd_replicated_apply_next(ar);
4235 }
4236
4237 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4238 ar->index_current, msg->num_elements);
4239
4240 if (take_remote_isDeleted) {
4241 isDeleted = remote_isDeleted;
4242 } else {
4243 isDeleted = local_isDeleted;
4244 }
4245
4246 if (renamed) {
4247 sd_updated = true;
4248 }
4249
4250 if (sd_updated && !isDeleted) {
4251 ret = dsdb_module_schedule_sd_propagation(ar->module,
4252 ar->objs->partition_dn,
4253 msg->dn, true);
4254 if (ret != LDB_SUCCESS) {
4255 return ldb_operr(ldb);
4256 }
4257 }
4258
4259 /* create the meta data value */
4260 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4261 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4262 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4263 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4264 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4265 }
4266
4267 /*
4268 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4269 * and replPopertyMetaData attributes
4270 */
4271 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4272 if (ret != LDB_SUCCESS) {
4273 return replmd_replicated_request_error(ar, ret);
4274 }
4275 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4276 if (ret != LDB_SUCCESS) {
4277 return replmd_replicated_request_error(ar, ret);
4278 }
4279 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4280 if (ret != LDB_SUCCESS) {
4281 return replmd_replicated_request_error(ar, ret);
4282 }
4283
4284 replmd_ldb_message_sort(msg, ar->schema);
4285
4286 /* we want to replace the old values */
4287 for (i=0; i < msg->num_elements; i++) {
4288 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4289 }
4290
4291 if (DEBUGLVL(4)) {
4292 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4293 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
4294 talloc_free(s);
4295 }
4296
4297 ret = ldb_build_mod_req(&change_req,
4298 ldb,
4299 ar,
4300 msg,
4301 ar->controls,
4302 ar,
4303 callback,
4304 ar->req);
4305 LDB_REQ_SET_LOCATION(change_req);
4306 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4307
4308 /* current partition control needed by "repmd_op_callback" */
4309 ret = ldb_request_add_control(change_req,
4310 DSDB_CONTROL_CURRENT_PARTITION_OID,
4311 false, NULL);
4312 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4313
4314 return ldb_next_request(ar->module, change_req);
4315 }
4316
4317 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
4318 struct ldb_reply *ares)
4319 {
4320 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4321 struct replmd_replicated_request);
4322 int ret;
4323
4324 if (!ares) {
4325 return ldb_module_done(ar->req, NULL, NULL,
4326 LDB_ERR_OPERATIONS_ERROR);
4327 }
4328 if (ares->error != LDB_SUCCESS &&
4329 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4330 return ldb_module_done(ar->req, ares->controls,
4331 ares->response, ares->error);
4332 }
4333
4334 switch (ares->type) {
4335 case LDB_REPLY_ENTRY:
4336 ar->search_msg = talloc_steal(ar, ares->message);
4337 break;
4338
4339 case LDB_REPLY_REFERRAL:
4340 /* we ignore referrals */
4341 break;
4342
4343 case LDB_REPLY_DONE:
4344 {
4345 struct replPropertyMetaData1 *md_remote;
4346 struct replPropertyMetaData1 *md_local;
4347
4348 struct replPropertyMetaDataBlob omd;
4349 const struct ldb_val *omd_value;
4350 struct replPropertyMetaDataBlob *rmd;
4351 struct ldb_message *msg;
4352
4353 ar->objs->objects[ar->index_current].last_known_parent = NULL;
4354
4355 /*
4356 * This is the ADD case, find the appropriate parent,
4357 * as this object doesn't exist locally:
4358 */
4359 if (ar->search_msg == NULL) {
4360 ret = replmd_replicated_apply_search_for_parent(ar);
4361 if (ret != LDB_SUCCESS) {
4362 return ldb_module_done(ar->req, NULL, NULL, ret);
4363 }
4364 talloc_free(ares);
4365 return LDB_SUCCESS;
4366 }
4367
4368 /*
4369 * Otherwise, in the MERGE case, work out if we are
4370 * attempting a rename, and if so find the parent the
4371 * newly renamed object wants to belong under (which
4372 * may not be the parent in it's attached string DN
4373 */
4374 rmd = ar->objs->objects[ar->index_current].meta_data;
4375 ZERO_STRUCT(omd);
4376 omd.version = 1;
4377
4378 /* find existing meta data */
4379 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4380 if (omd_value) {
4381 enum ndr_err_code ndr_err;
4382 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4383 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4384 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4385 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4386 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4387 }
4388
4389 if (omd.version != 1) {
4390 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4391 }
4392 }
4393
4394 /*
4395 * now we need to check for double renames. We could have a
4396 * local rename pending which our replication partner hasn't
4397 * received yet. We choose which one wins by looking at the
4398 * attribute stamps on the two objects, the newer one wins
4399 */
4400 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
4401 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
4402 /* if there is no name attribute then we have to assume the
4403 object we've received is in fact newer */
4404 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING ||
4405 !md_remote || !md_local ||
4406 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
4407 ret = replmd_replicated_apply_search_for_parent(ar);
4408 } else {
4409 msg = ar->objs->objects[ar->index_current].msg;
4410
4411 /* Otherwise, just merge on the existing object, force no rename */
4412 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
4413 ldb_dn_get_linearized(ar->search_msg->dn),
4414 ldb_dn_get_linearized(msg->dn)));
4415
4416 /*
4417 * This assignment ensures that the strcmp()
4418 * in replmd_replicated_apply_merge() avoids
4419 * the rename call
4420 */
4421 msg->dn = ar->search_msg->dn;
4422 ret = replmd_replicated_apply_merge(ar);
4423 }
4424 if (ret != LDB_SUCCESS) {
4425 return ldb_module_done(ar->req, NULL, NULL, ret);
4426 }
4427 }
4428 }
4429
4430 talloc_free(ares);
4431 return LDB_SUCCESS;
4432 }
4433
4434 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
4435
4436 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
4437 {
4438 struct ldb_context *ldb;
4439 int ret;
4440 char *tmp_str;
4441 char *filter;
4442 struct ldb_request *search_req;
4443 struct ldb_search_options_control *options;
4444
4445 if (ar->index_current >= ar->objs->num_objects) {
4446 /* done with it, go to next stage */
4447 return replmd_replicated_uptodate_vector(ar);
4448 }
4449
4450 ldb = ldb_module_get_ctx(ar->module);
4451 ar->search_msg = NULL;
4452
4453 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
4454 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4455
4456 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4457 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4458 talloc_free(tmp_str);
4459
4460 ret = ldb_build_search_req(&search_req,
4461 ldb,
4462 ar,
4463 NULL,
4464 LDB_SCOPE_SUBTREE,
4465 filter,
4466 NULL,
4467 NULL,
4468 ar,
4469 replmd_replicated_apply_search_callback,
4470 ar->req);
4471 LDB_REQ_SET_LOCATION(search_req);
4472
4473 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
4474 true, NULL);
4475 if (ret != LDB_SUCCESS) {
4476 return ret;
4477 }
4478
4479 /* we need to cope with cross-partition links, so search for
4480 the GUID over all partitions */
4481 options = talloc(search_req, struct ldb_search_options_control);
4482 if (options == NULL) {
4483 DEBUG(0, (__location__ ": out of memory\n"));
4484 return LDB_ERR_OPERATIONS_ERROR;
4485 }
4486 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
4487
4488 ret = ldb_request_add_control(search_req,
4489 LDB_CONTROL_SEARCH_OPTIONS_OID,
4490 true, options);
4491 if (ret != LDB_SUCCESS) {
4492 return ret;
4493 }
4494
4495 return ldb_next_request(ar->module, search_req);
4496 }
4497
4498 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
4499 struct ldb_reply *ares)
4500 {
4501 struct ldb_context *ldb;
4502 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4503 struct replmd_replicated_request);
4504 ldb = ldb_module_get_ctx(ar->module);
4505
4506 if (!ares) {
4507 return ldb_module_done(ar->req, NULL, NULL,
4508 LDB_ERR_OPERATIONS_ERROR);
4509 }
4510 if (ares->error != LDB_SUCCESS) {
4511 return ldb_module_done(ar->req, ares->controls,
4512 ares->response, ares->error);
4513 }
4514
4515 if (ares->type != LDB_REPLY_DONE) {
4516 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
4517 return ldb_module_done(ar->req, NULL, NULL,
4518 LDB_ERR_OPERATIONS_ERROR);
4519 }
4520
4521 talloc_free(ares);
4522
4523 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4524 }
4525
4526 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
4527 {
4528 struct ldb_context *ldb;
4529 struct ldb_request *change_req;
4530 enum ndr_err_code ndr_err;
4531 struct ldb_message *msg;
4532 struct replUpToDateVectorBlob ouv;
4533 const struct ldb_val *ouv_value;
4534 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
4535 struct replUpToDateVectorBlob nuv;
4536 struct ldb_val nuv_value;
4537 struct ldb_message_element *nuv_el = NULL;
4538 const struct GUID *our_invocation_id;
4539 struct ldb_message_element *orf_el = NULL;
4540 struct repsFromToBlob nrf;
4541 struct ldb_val *nrf_value = NULL;
4542 struct ldb_message_element *nrf_el = NULL;
4543 unsigned int i;
4544 uint32_t j,ni=0;
4545 bool found = false;
4546 time_t t = time(NULL);
4547 NTTIME now;
4548 int ret;
4549 uint32_t instanceType;
4550
4551 ldb = ldb_module_get_ctx(ar->module);
4552 ruv = ar->objs->uptodateness_vector;
4553 ZERO_STRUCT(ouv);
4554 ouv.version = 2;
4555 ZERO_STRUCT(nuv);
4556 nuv.version = 2;
4557
4558 unix_to_nt_time(&now, t);
4559
4560 if (ar->search_msg == NULL) {
4561 /* this happens for a REPL_OBJ call where we are
4562 creating the target object by replicating it. The
4563 subdomain join code does this for the partition DN
4564 */
4565 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
4566 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4567 }
4568
4569 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
4570 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
4571 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
4572 ldb_dn_get_linearized(ar->search_msg->dn)));
4573 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4574 }
4575
4576 /*
4577 * first create the new replUpToDateVector
4578 */
4579 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
4580 if (ouv_value) {
4581 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
4582 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
4583 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4584 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4585 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4586 }
4587
4588 if (ouv.version != 2) {
4589 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4590 }
4591 }
4592
4593 /*
4594 * the new uptodateness vector will at least
4595 * contain 1 entry, one for the source_dsa
4596 *
4597 * plus optional values from our old vector and the one from the source_dsa
4598 */
4599 nuv.ctr.ctr2.count = ouv.ctr.ctr2.count;
4600 if (ruv) nuv.ctr.ctr2.count += ruv->count;
4601 nuv.ctr.ctr2.cursors = talloc_array(ar,
4602 struct drsuapi_DsReplicaCursor2,
4603 nuv.ctr.ctr2.count);
4604 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4605
4606 /* first copy the old vector */
4607 for (i=0; i < ouv.ctr.ctr2.count; i++) {
4608 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
4609 ni++;
4610 }
4611
4612 /* get our invocation_id if we have one already attached to the ldb */
4613 our_invocation_id = samdb_ntds_invocation_id(ldb);
4614
4615 /* merge in the source_dsa vector is available */
4616 for (i=0; (ruv && i < ruv->count); i++) {
4617 found = false;
4618
4619 if (our_invocation_id &&
4620 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4621 our_invocation_id)) {
4622 continue;
4623 }
4624
4625 for (j=0; j < ni; j++) {
4626 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4627 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4628 continue;
4629 }
4630
4631 found = true;
4632
4633 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4634 nuv.ctr.ctr2.cursors[j] = ruv->cursors[i];
4635 }
4636 break;
4637 }
4638
4639 if (found) continue;
4640
4641 /* if it's not there yet, add it */
4642 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4643 ni++;
4644 }
4645
4646 /*
4647 * finally correct the size of the cursors array
4648 */
4649 nuv.ctr.ctr2.count = ni;
4650
4651 /*
4652 * sort the cursors
4653 */
4654 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4655
4656 /*
4657 * create the change ldb_message
4658 */
4659 msg = ldb_msg_new(ar);
4660 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4661 msg->dn = ar->search_msg->dn;
4662
4663 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4664 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4665 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4666 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4667 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4668 }
4669 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4670 if (ret != LDB_SUCCESS) {
4671 return replmd_replicated_request_error(ar, ret);
4672 }
4673 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4674
4675 /*
4676 * now create the new repsFrom value from the given repsFromTo1 structure
4677 */
4678 ZERO_STRUCT(nrf);
4679 nrf.version = 1;
4680 nrf.ctr.ctr1 = *ar->objs->source_dsa;
4681 nrf.ctr.ctr1.last_attempt = now;
4682 nrf.ctr.ctr1.last_success = now;
4683 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
4684
4685 /*
4686 * first see if we already have a repsFrom value for the current source dsa
4687 * if so we'll later replace this value
4688 */
4689 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4690 if (orf_el) {
4691 for (i=0; i < orf_el->num_values; i++) {
4692 struct repsFromToBlob *trf;
4693
4694 trf = talloc(ar, struct repsFromToBlob);
4695 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4696
4697 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4698 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4699 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4700 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4701 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4702 }
4703
4704 if (trf->version != 1) {
4705 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4706 }
4707
4708 /*
4709 * we compare the source dsa objectGUID not the invocation_id
4710 * because we want only one repsFrom value per source dsa
4711 * and when the invocation_id of the source dsa has changed we don't need
4712 * the old repsFrom with the old invocation_id
4713 */
4714 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4715 &ar->objs->source_dsa->source_dsa_obj_guid)) {
4716 talloc_free(trf);
4717 continue;
4718 }
4719
4720 talloc_free(trf);
4721 nrf_value = &orf_el->values[i];
4722 break;
4723 }
4724
4725 /*
4726 * copy over all old values to the new ldb_message
4727 */
4728 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4729 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4730 *nrf_el = *orf_el;
4731 }
4732
4733 /*
4734 * if we haven't found an old repsFrom value for the current source dsa
4735 * we'll add a new value
4736 */
4737 if (!nrf_value) {
4738 struct ldb_val zero_value;
4739 ZERO_STRUCT(zero_value);
4740 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4741 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4742
4743 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4744 }
4745
4746 /* we now fill the value which is already attached to ldb_message */
4747 ndr_err = ndr_push_struct_blob(nrf_value, msg,
4748 &nrf,
4749 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4750 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4751 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4752 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4753 }
4754
4755 /*
4756 * the ldb_message_element for the attribute, has all the old values and the new one
4757 * so we'll replace the whole attribute with all values
4758 */
4759 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4760
4761 if (CHECK_DEBUGLVL(4)) {
4762 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4763 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4764 talloc_free(s);
4765 }
4766
4767 /* prepare the ldb_modify() request */
4768 ret = ldb_build_mod_req(&change_req,
4769 ldb,
4770 ar,
4771 msg,
4772 ar->controls,
4773 ar,
4774 replmd_replicated_uptodate_modify_callback,
4775 ar->req);
4776 LDB_REQ_SET_LOCATION(change_req);
4777 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4778
4779 return ldb_next_request(ar->module, change_req);
4780 }
4781
4782 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4783 struct ldb_reply *ares)
4784 {
4785 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4786 struct replmd_replicated_request);
4787 int ret;
4788
4789 if (!ares) {
4790 return ldb_module_done(ar->req, NULL, NULL,
4791 LDB_ERR_OPERATIONS_ERROR);
4792 }
4793 if (ares->error != LDB_SUCCESS &&
4794 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4795 return ldb_module_done(ar->req, ares->controls,
4796 ares->response, ares->error);
4797 }
4798
4799 switch (ares->type) {
4800 case LDB_REPLY_ENTRY:
4801 ar->search_msg = talloc_steal(ar, ares->message);
4802 break;
4803
4804 case LDB_REPLY_REFERRAL:
4805 /* we ignore referrals */
4806 break;
4807
4808 case LDB_REPLY_DONE:
4809 ret = replmd_replicated_uptodate_modify(ar);
4810 if (ret != LDB_SUCCESS) {
4811 return ldb_module_done(ar->req, NULL, NULL, ret);
4812 }
4813 }
4814
4815 talloc_free(ares);
4816 return LDB_SUCCESS;
4817 }
4818
4819
4820 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4821 {
4822 struct ldb_context *ldb;
4823 int ret;
4824 static const char *attrs[] = {
4825 "replUpToDateVector",
4826 "repsFrom",
4827 "instanceType",
4828 NULL
4829 };
4830 struct ldb_request *search_req;
4831
4832 ldb = ldb_module_get_ctx(ar->module);
4833 ar->search_msg = NULL;
4834
4835 ret = ldb_build_search_req(&search_req,
4836 ldb,
4837 ar,
4838 ar->objs->partition_dn,
4839 LDB_SCOPE_BASE,
4840 "(objectClass=*)",
4841 attrs,
4842 NULL,
4843 ar,
4844 replmd_replicated_uptodate_search_callback,
4845 ar->req);
4846 LDB_REQ_SET_LOCATION(search_req);
4847 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4848
4849 return ldb_next_request(ar->module, search_req);
4850 }
4851
4852
4853
4854 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4855 {
4856 struct ldb_context *ldb;
4857 struct dsdb_extended_replicated_objects *objs;
4858 struct replmd_replicated_request *ar;
4859 struct ldb_control **ctrls;
4860 int ret;
4861 uint32_t i;
4862 struct replmd_private *replmd_private =
4863 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4864 struct dsdb_control_replicated_update *rep_update;
4865
4866 ldb = ldb_module_get_ctx(module);
4867
4868 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4869
4870 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4871 if (!objs) {
4872 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4873 return LDB_ERR_PROTOCOL_ERROR;
4874 }
4875
4876 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4877 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4878 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4879 return LDB_ERR_PROTOCOL_ERROR;
4880 }
4881
4882 ar = replmd_ctx_init(module, req);
4883 if (!ar)
4884 return LDB_ERR_OPERATIONS_ERROR;
4885
4886 /* Set the flags to have the replmd_op_callback run over the full set of objects */
4887 ar->apply_mode = true;
4888 ar->objs = objs;
4889 ar->schema = dsdb_get_schema(ldb, ar);
4890 if (!ar->schema) {
4891 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4892 talloc_free(ar);
4893 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4894 return LDB_ERR_CONSTRAINT_VIOLATION;
4895 }
4896
4897 ctrls = req->controls;
4898
4899 if (req->controls) {
4900 req->controls = talloc_memdup(ar, req->controls,
4901 talloc_get_size(req->controls));
4902 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4903 }
4904
4905 /* This allows layers further down to know if a change came in
4906 over replication and what the replication flags were */
4907 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
4908 if (rep_update == NULL) {
4909 return ldb_module_oom(module);
4910 }
4911 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
4912
4913 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
4914 if (ret != LDB_SUCCESS) {
4915 return ret;
4916 }
4917
4918 /* If this change contained linked attributes in the body
4919 * (rather than in the links section) we need to update
4920 * backlinks in linked_attributes */
4921 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4922 if (ret != LDB_SUCCESS) {
4923 return ret;
4924 }
4925
4926 ar->controls = req->controls;
4927 req->controls = ctrls;
4928
4929 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4930
4931 /* save away the linked attributes for the end of the
4932 transaction */
4933 for (i=0; i<ar->objs->linked_attributes_count; i++) {
4934 struct la_entry *la_entry;
4935
4936 if (replmd_private->la_ctx == NULL) {
4937 replmd_private->la_ctx = talloc_new(replmd_private);
4938 }
4939 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4940 if (la_entry == NULL) {
4941 ldb_oom(ldb);
4942 return LDB_ERR_OPERATIONS_ERROR;
4943 }
4944 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4945 if (la_entry->la == NULL) {
4946 talloc_free(la_entry);
4947 ldb_oom(ldb);
4948 return LDB_ERR_OPERATIONS_ERROR;
4949 }
4950 *la_entry->la = ar->objs->linked_attributes[i];
4951
4952 /* we need to steal the non-scalars so they stay
4953 around until the end of the transaction */
4954 talloc_steal(la_entry->la, la_entry->la->identifier);
4955 talloc_steal(la_entry->la, la_entry->la->value.blob);
4956
4957 DLIST_ADD(replmd_private->la_list, la_entry);
4958 }
4959
4960 return replmd_replicated_apply_next(ar);
4961 }
4962
4963 /*
4964 process one linked attribute structure
4965 */
4966 static int replmd_process_linked_attribute(struct ldb_module *module,
4967 struct la_entry *la_entry,
4968 struct ldb_request *parent)
4969 {
4970 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4971 struct ldb_context *ldb = ldb_module_get_ctx(module);
4972 struct ldb_message *msg;
4973 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4974 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4975 int ret;
4976 const struct dsdb_attribute *attr;
4977 struct dsdb_dn *dsdb_dn;
4978 uint64_t seq_num = 0;
4979 struct ldb_message_element *old_el;
4980 WERROR status;
4981 time_t t = time(NULL);
4982 struct ldb_result *res;
4983 const char *attrs[2];
4984 struct parsed_dn *pdn_list, *pdn;
4985 struct GUID guid = GUID_zero();
4986 NTSTATUS ntstatus;
4987 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
4988 const struct GUID *our_invocation_id;
4989
4990 /*
4991 linked_attributes[0]:
4992 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
4993 identifier : *
4994 identifier: struct drsuapi_DsReplicaObjectIdentifier
4995 __ndr_size : 0x0000003a (58)
4996 __ndr_size_sid : 0x00000000 (0)
4997 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
4998 sid : S-0-0
4999 __ndr_size_dn : 0x00000000 (0)
5000 dn : ''
5001 attid : DRSUAPI_ATTID_member (0x1F)
5002 value: struct drsuapi_DsAttributeValue
5003 __ndr_size : 0x0000007e (126)
5004 blob : *
5005 blob : DATA_BLOB length=126
5006 flags : 0x00000001 (1)
5007 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
5008 originating_add_time : Wed Sep 2 22:20:01 2009 EST
5009 meta_data: struct drsuapi_DsReplicaMetaData
5010 version : 0x00000015 (21)
5011 originating_change_time : Wed Sep 2 23:39:07 2009 EST
5012 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
5013 originating_usn : 0x000000000001e19c (123292)
5014
5015 (for cases where the link is to a normal DN)
5016 &target: struct drsuapi_DsReplicaObjectIdentifier3
5017 __ndr_size : 0x0000007e (126)
5018 __ndr_size_sid : 0x0000001c (28)
5019 guid : 7639e594-db75-4086-b0d4-67890ae46031
5020 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
5021 __ndr_size_dn : 0x00000022 (34)
5022 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
5023 */
5024
5025 /* find the attribute being modified */
5026 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
5027 if (attr == NULL) {
5028 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
5029 talloc_free(tmp_ctx);
5030 return LDB_ERR_OPERATIONS_ERROR;
5031 }
5032
5033 attrs[0] = attr->lDAPDisplayName;
5034 attrs[1] = NULL;
5035
5036 /* get the existing message from the db for the object with
5037 this GUID, returning attribute being modified. We will then
5038 use this msg as the basis for a modify call */
5039 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
5040 DSDB_FLAG_NEXT_MODULE |
5041 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5042 DSDB_SEARCH_SHOW_RECYCLED |
5043 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
5044 DSDB_SEARCH_REVEAL_INTERNALS,
5045 parent,
5046 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
5047 if (ret != LDB_SUCCESS) {
5048 talloc_free(tmp_ctx);
5049 return ret;
5050 }
5051 if (res->count != 1) {
5052 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
5053 GUID_string(tmp_ctx, &la->identifier->guid));
5054 talloc_free(tmp_ctx);
5055 return LDB_ERR_NO_SUCH_OBJECT;
5056 }
5057 msg = res->msgs[0];
5058
5059 if (msg->num_elements == 0) {
5060 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
5061 if (ret != LDB_SUCCESS) {
5062 ldb_module_oom(module);
5063 talloc_free(tmp_ctx);
5064 return LDB_ERR_OPERATIONS_ERROR;
5065 }
5066 } else {
5067 old_el = &msg->elements[0];
5068 old_el->flags = LDB_FLAG_MOD_REPLACE;
5069 }
5070
5071 /* parse the existing links */
5072 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
5073 if (ret != LDB_SUCCESS) {
5074 talloc_free(tmp_ctx);
5075 return ret;
5076 }
5077
5078 /* get our invocationId */
5079 our_invocation_id = samdb_ntds_invocation_id(ldb);
5080 if (!our_invocation_id) {
5081 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
5082 talloc_free(tmp_ctx);
5083 return LDB_ERR_OPERATIONS_ERROR;
5084 }
5085
5086 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
5087 if (ret != LDB_SUCCESS) {
5088 talloc_free(tmp_ctx);
5089 return ret;
5090 }
5091
5092 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
5093 if (!W_ERROR_IS_OK(status)) {
5094 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
5095 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
5096 return LDB_ERR_OPERATIONS_ERROR;
5097 }
5098
5099 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
5100 if (!NT_STATUS_IS_OK(ntstatus) && active) {
5101 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
5102 old_el->name,
5103 ldb_dn_get_linearized(dsdb_dn->dn),
5104 ldb_dn_get_linearized(msg->dn));
5105 return LDB_ERR_OPERATIONS_ERROR;
5106 }
5107
5108 /* re-resolve the DN by GUID, as the DRS server may give us an
5109 old DN value */
5110 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
5111 if (ret != LDB_SUCCESS) {
5112 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
5113 GUID_string(tmp_ctx, &guid),
5114 ldb_dn_get_linearized(dsdb_dn->dn)));
5115 }
5116
5117 /* see if this link already exists */
5118 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
5119 if (pdn != NULL) {
5120 /* see if this update is newer than what we have already */
5121 struct GUID invocation_id = GUID_zero();
5122 uint32_t version = 0;
5123 uint32_t originating_usn = 0;
5124 NTTIME change_time = 0;
5125 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
5126
5127 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
5128 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
5129 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
5130 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
5131
5132 if (!replmd_update_is_newer(&invocation_id,
5133 &la->meta_data.originating_invocation_id,
5134 version,
5135 la->meta_data.version,
5136 change_time,
5137 la->meta_data.originating_change_time)) {
5138 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
5139 old_el->name, ldb_dn_get_linearized(msg->dn),
5140 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
5141 talloc_free(tmp_ctx);
5142 return LDB_SUCCESS;
5143 }
5144
5145 /* get a seq_num for this change */
5146 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5147 if (ret != LDB_SUCCESS) {
5148 talloc_free(tmp_ctx);
5149 return ret;
5150 }
5151
5152 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
5153 /* remove the existing backlink */
5154 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
5155 if (ret != LDB_SUCCESS) {
5156 talloc_free(tmp_ctx);
5157 return ret;
5158 }
5159 }
5160
5161 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
5162 &la->meta_data.originating_invocation_id,
5163 la->meta_data.originating_usn, seq_num,
5164 la->meta_data.originating_change_time,
5165 la->meta_data.version,
5166 !active);
5167 if (ret != LDB_SUCCESS) {
5168 talloc_free(tmp_ctx);
5169 return ret;
5170 }
5171
5172 if (active) {
5173 /* add the new backlink */
5174 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
5175 if (ret != LDB_SUCCESS) {
5176 talloc_free(tmp_ctx);
5177 return ret;
5178 }
5179 }
5180 } else {
5181 /* get a seq_num for this change */
5182 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5183 if (ret != LDB_SUCCESS) {
5184 talloc_free(tmp_ctx);
5185 return ret;
5186 }
5187
5188 old_el->values = talloc_realloc(msg->elements, old_el->values,
5189 struct ldb_val, old_el->num_values+1);
5190 if (!old_el->values) {
5191 ldb_module_oom(module);
5192 return LDB_ERR_OPERATIONS_ERROR;
5193 }
5194 old_el->num_values++;
5195
5196 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
5197 &la->meta_data.originating_invocation_id,
5198 la->meta_data.originating_usn, seq_num,
5199 la->meta_data.originating_change_time,
5200 la->meta_data.version,
5201 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
5202 if (ret != LDB_SUCCESS) {
5203 talloc_free(tmp_ctx);
5204 return ret;
5205 }
5206
5207 if (active) {
5208 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
5209 true, attr, false);
5210 if (ret != LDB_SUCCESS) {
5211 talloc_free(tmp_ctx);
5212 return ret;
5213 }
5214 }
5215 }
5216
5217 /* we only change whenChanged and uSNChanged if the seq_num
5218 has changed */
5219 ret = add_time_element(msg, "whenChanged", t);
5220 if (ret != LDB_SUCCESS) {
5221 talloc_free(tmp_ctx);
5222 ldb_operr(ldb);
5223 return ret;
5224 }
5225
5226 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
5227 if (ret != LDB_SUCCESS) {
5228 talloc_free(tmp_ctx);
5229 ldb_operr(ldb);
5230 return ret;
5231 }
5232
5233 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5234 if (old_el == NULL) {
5235 talloc_free(tmp_ctx);
5236 return ldb_operr(ldb);
5237 }
5238
5239 ret = dsdb_check_single_valued_link(attr, old_el);
5240 if (ret != LDB_SUCCESS) {
5241 talloc_free(tmp_ctx);
5242 return ret;
5243 }
5244
5245 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
5246
5247 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
5248 if (ret != LDB_SUCCESS) {
5249 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
5250 ldb_errstring(ldb),
5251 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
5252 talloc_free(tmp_ctx);
5253 return ret;
5254 }
5255
5256 talloc_free(tmp_ctx);
5257
5258 return ret;
5259 }
5260
5261 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
5262 {
5263 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
5264 return replmd_extended_replicated_objects(module, req);
5265 }
5266
5267 return ldb_next_request(module, req);
5268 }
5269
5270
5271 /*
5272 we hook into the transaction operations to allow us to
5273 perform the linked attribute updates at the end of the whole
5274 transaction. This allows a forward linked attribute to be created
5275 before the object is created. During a vampire, w2k8 sends us linked
5276 attributes before the objects they are part of.
5277 */
5278 static int replmd_start_transaction(struct ldb_module *module)
5279 {
5280 /* create our private structure for this transaction */
5281 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
5282 struct replmd_private);
5283 replmd_txn_cleanup(replmd_private);
5284
5285 /* free any leftover mod_usn records from cancelled
5286 transactions */
5287 while (replmd_private->ncs) {
5288 struct nc_entry *e = replmd_private->ncs;
5289 DLIST_REMOVE(replmd_private->ncs, e);
5290 talloc_free(e);
5291 }
5292
5293 return ldb_next_start_trans(module);
5294 }
5295
5296 /*
5297 on prepare commit we loop over our queued la_context structures and
5298 apply each of them
5299 */
5300 static int replmd_prepare_commit(struct ldb_module *module)
5301 {
5302 struct replmd_private *replmd_private =
5303 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5304 struct la_entry *la, *prev;
5305 struct la_backlink *bl;
5306 int ret;
5307
5308 /* walk the list backwards, to do the first entry first, as we
5309 * added the entries with DLIST_ADD() which puts them at the
5310 * start of the list */
5311 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
5312 prev = DLIST_PREV(la);
5313 DLIST_REMOVE(replmd_private->la_list, la);
5314 ret = replmd_process_linked_attribute(module, la, NULL);
5315 if (ret != LDB_SUCCESS) {
5316 replmd_txn_cleanup(replmd_private);
5317 return ret;
5318 }
5319 }
5320
5321 /* process our backlink list, creating and deleting backlinks
5322 as necessary */
5323 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
5324 ret = replmd_process_backlink(module, bl, NULL);
5325 if (ret != LDB_SUCCESS) {
5326 replmd_txn_cleanup(replmd_private);
5327 return ret;
5328 }
5329 }
5330
5331 replmd_txn_cleanup(replmd_private);
5332
5333 /* possibly change @REPLCHANGED */
5334 ret = replmd_notify_store(module, NULL);
5335 if (ret != LDB_SUCCESS) {
5336 return ret;
5337 }
5338
5339 return ldb_next_prepare_commit(module);
5340 }
5341
5342 static int replmd_del_transaction(struct ldb_module *module)
5343 {
5344 struct replmd_private *replmd_private =
5345 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5346 replmd_txn_cleanup(replmd_private);
5347
5348 return ldb_next_del_trans(module);
5349 }
5350
5351
5352 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
5353 .name = "repl_meta_data",
5354 .init_context = replmd_init,
5355 .add = replmd_add,
5356 .modify = replmd_modify,
5357 .rename = replmd_rename,
5358 .del = replmd_delete,
5359 .extended = replmd_extended,
5360 .start_transaction = replmd_start_transaction,
5361 .prepare_commit = replmd_prepare_commit,
5362 .del_transaction = replmd_del_transaction,
5363 };
5364
5365 int ldb_repl_meta_data_module_init(const char *version)
5366 {
5367 LDB_MODULE_CHECK_VERSION(version);
5368 return ldb_register_module(&ldb_repl_meta_data_module_ops);
5369 }
Working branch of Samba for id10ts