?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-dsdb: Provide a way to handle conflicts due to rename
[Samba.git] / source4 / dsdb / samdb / ldb_modules / repl_meta_data.c
blob03248c28dd15dc66f60fb34eb6fb291f52ded308
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /*
25 * Name: ldb
26 *
27 * Component: ldb repl_meta_data module
28 *
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
33 *
34 * Author: Simo Sorce
35 * Author: Stefan Metzmacher
36 */
37
38 #include "includes.h"
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
52
53 /*
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
56 */
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
58
59 struct replmd_private {
60 TALLOC_CTX *la_ctx;
61 struct la_entry *la_list;
62 TALLOC_CTX *bl_ctx;
63 struct la_backlink *la_backlinks;
64 struct nc_entry {
65 struct nc_entry *prev, *next;
66 struct ldb_dn *dn;
67 uint64_t mod_usn;
68 uint64_t mod_usn_urgent;
69 } *ncs;
70 };
71
72 struct la_entry {
73 struct la_entry *next, *prev;
74 struct drsuapi_DsReplicaLinkedAttribute *la;
75 };
76
77 struct replmd_replicated_request {
78 struct ldb_module *module;
79 struct ldb_request *req;
80
81 const struct dsdb_schema *schema;
82
83 /* the controls we pass down */
84 struct ldb_control **controls;
85
86 /* details for the mode where we apply a bunch of inbound replication meessages */
87 bool apply_mode;
88 uint32_t index_current;
89 struct dsdb_extended_replicated_objects *objs;
90
91 struct ldb_message *search_msg;
92
93 uint64_t seq_num;
94 bool is_urgent;
95 };
96
97 enum urgent_situation {
98 REPL_URGENT_ON_CREATE = 1,
99 REPL_URGENT_ON_UPDATE = 2,
100 REPL_URGENT_ON_DELETE = 4
101 };
102
103
104 static const struct {
105 const char *update_name;
106 enum urgent_situation repl_situation;
107 } urgent_objects[] = {
108 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
109 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
110 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
111 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
113 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
114 {NULL, 0}
115 };
116
117 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
118 static const char *urgent_attrs[] = {
119 "lockoutTime",
120 "pwdLastSet",
121 "userAccountControl",
122 NULL
123 };
124
125
126 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
127 enum urgent_situation situation)
128 {
129 unsigned int i, j;
130 for (i=0; urgent_objects[i].update_name; i++) {
131
132 if ((situation & urgent_objects[i].repl_situation) == 0) {
133 continue;
134 }
135
136 for (j=0; j<objectclass_el->num_values; j++) {
137 const struct ldb_val *v = &objectclass_el->values[j];
138 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
139 return true;
140 }
141 }
142 }
143 return false;
144 }
145
146 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
147 {
148 if (ldb_attr_in_list(urgent_attrs, el->name)) {
149 return true;
150 }
151 return false;
152 }
153
154
155 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
156
157 /*
158 initialise the module
159 allocate the private structure and build the list
160 of partition DNs for use by replmd_notify()
161 */
162 static int replmd_init(struct ldb_module *module)
163 {
164 struct replmd_private *replmd_private;
165 struct ldb_context *ldb = ldb_module_get_ctx(module);
166
167 replmd_private = talloc_zero(module, struct replmd_private);
168 if (replmd_private == NULL) {
169 ldb_oom(ldb);
170 return LDB_ERR_OPERATIONS_ERROR;
171 }
172 ldb_module_set_private(module, replmd_private);
173
174 return ldb_next_init(module);
175 }
176
177 /*
178 cleanup our per-transaction contexts
179 */
180 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
181 {
182 talloc_free(replmd_private->la_ctx);
183 replmd_private->la_list = NULL;
184 replmd_private->la_ctx = NULL;
185
186 talloc_free(replmd_private->bl_ctx);
187 replmd_private->la_backlinks = NULL;
188 replmd_private->bl_ctx = NULL;
189 }
190
191
192 struct la_backlink {
193 struct la_backlink *next, *prev;
194 const char *attr_name;
195 struct GUID forward_guid, target_guid;
196 bool active;
197 };
198
199 /*
200 process a backlinks we accumulated during a transaction, adding and
201 deleting the backlinks from the target objects
202 */
203 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
204 {
205 struct ldb_dn *target_dn, *source_dn;
206 int ret;
207 struct ldb_context *ldb = ldb_module_get_ctx(module);
208 struct ldb_message *msg;
209 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 char *dn_string;
211
212 /*
213 - find DN of target
214 - find DN of source
215 - construct ldb_message
216 - either an add or a delete
217 */
218 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
219 if (ret != LDB_SUCCESS) {
220 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
221 GUID_string(bl, &bl->target_guid)));
222 return LDB_SUCCESS;
223 }
224
225 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
226 if (ret != LDB_SUCCESS) {
227 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
228 GUID_string(bl, &bl->forward_guid));
229 talloc_free(tmp_ctx);
230 return ret;
231 }
232
233 msg = ldb_msg_new(tmp_ctx);
234 if (msg == NULL) {
235 ldb_module_oom(module);
236 talloc_free(tmp_ctx);
237 return LDB_ERR_OPERATIONS_ERROR;
238 }
239
240 /* construct a ldb_message for adding/deleting the backlink */
241 msg->dn = target_dn;
242 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
243 if (!dn_string) {
244 ldb_module_oom(module);
245 talloc_free(tmp_ctx);
246 return LDB_ERR_OPERATIONS_ERROR;
247 }
248 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
249 if (ret != LDB_SUCCESS) {
250 talloc_free(tmp_ctx);
251 return ret;
252 }
253 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
254
255 /* a backlink should never be single valued. Unfortunately the
256 exchange schema has a attribute
257 msExchBridgeheadedLocalConnectorsDNBL which is single
258 valued and a backlink. We need to cope with that by
259 ignoring the single value flag */
260 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
261
262 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
263 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
264 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
265 cope with possible corruption where the backlink has
266 already been removed */
267 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
268 ldb_dn_get_linearized(target_dn),
269 ldb_dn_get_linearized(source_dn),
270 ldb_errstring(ldb)));
271 ret = LDB_SUCCESS;
272 } else if (ret != LDB_SUCCESS) {
273 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
274 bl->active?"add":"remove",
275 ldb_dn_get_linearized(source_dn),
276 ldb_dn_get_linearized(target_dn),
277 ldb_errstring(ldb));
278 talloc_free(tmp_ctx);
279 return ret;
280 }
281 talloc_free(tmp_ctx);
282 return ret;
283 }
284
285 /*
286 add a backlink to the list of backlinks to add/delete in the prepare
287 commit
288 */
289 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
290 struct GUID *forward_guid, struct GUID *target_guid,
291 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
292 {
293 const struct dsdb_attribute *target_attr;
294 struct la_backlink *bl;
295 struct replmd_private *replmd_private =
296 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
297
298 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
299 if (!target_attr) {
300 /*
301 * windows 2003 has a broken schema where the
302 * definition of msDS-IsDomainFor is missing (which is
303 * supposed to be the backlink of the
304 * msDS-HasDomainNCs attribute
305 */
306 return LDB_SUCCESS;
307 }
308
309 /* see if its already in the list */
310 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
311 if (GUID_equal(forward_guid, &bl->forward_guid) &&
312 GUID_equal(target_guid, &bl->target_guid) &&
313 (target_attr->lDAPDisplayName == bl->attr_name ||
314 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
315 break;
316 }
317 }
318
319 if (bl) {
320 /* we found an existing one */
321 if (bl->active == active) {
322 return LDB_SUCCESS;
323 }
324 DLIST_REMOVE(replmd_private->la_backlinks, bl);
325 talloc_free(bl);
326 return LDB_SUCCESS;
327 }
328
329 if (replmd_private->bl_ctx == NULL) {
330 replmd_private->bl_ctx = talloc_new(replmd_private);
331 if (replmd_private->bl_ctx == NULL) {
332 ldb_module_oom(module);
333 return LDB_ERR_OPERATIONS_ERROR;
334 }
335 }
336
337 /* its a new one */
338 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
339 if (bl == NULL) {
340 ldb_module_oom(module);
341 return LDB_ERR_OPERATIONS_ERROR;
342 }
343
344 /* Ensure the schema does not go away before the bl->attr_name is used */
345 if (!talloc_reference(bl, schema)) {
346 talloc_free(bl);
347 ldb_module_oom(module);
348 return LDB_ERR_OPERATIONS_ERROR;
349 }
350
351 bl->attr_name = target_attr->lDAPDisplayName;
352 bl->forward_guid = *forward_guid;
353 bl->target_guid = *target_guid;
354 bl->active = active;
355
356 /* the caller may ask for this backlink to be processed
357 immediately */
358 if (immediate) {
359 int ret = replmd_process_backlink(module, bl, NULL);
360 talloc_free(bl);
361 return ret;
362 }
363
364 DLIST_ADD(replmd_private->la_backlinks, bl);
365
366 return LDB_SUCCESS;
367 }
368
369
370 /*
371 * Callback for most write operations in this module:
372 *
373 * notify the repl task that a object has changed. The notifies are
374 * gathered up in the replmd_private structure then written to the
375 * @REPLCHANGED object in each partition during the prepare_commit
376 */
377 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
378 {
379 int ret;
380 struct replmd_replicated_request *ac =
381 talloc_get_type_abort(req->context, struct replmd_replicated_request);
382 struct replmd_private *replmd_private =
383 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
384 struct nc_entry *modified_partition;
385 struct ldb_control *partition_ctrl;
386 const struct dsdb_control_current_partition *partition;
387
388 struct ldb_control **controls;
389
390 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
391
392 controls = ares->controls;
393 if (ldb_request_get_control(ac->req,
394 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
395 /*
396 * Remove the current partition control from what we pass up
397 * the chain if it hasn't been requested manually.
398 */
399 controls = ldb_controls_except_specified(ares->controls, ares,
400 partition_ctrl);
401 }
402
403 if (ares->error != LDB_SUCCESS) {
404 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
405 return ldb_module_done(ac->req, controls,
406 ares->response, ares->error);
407 }
408
409 if (ares->type != LDB_REPLY_DONE) {
410 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
411 return ldb_module_done(ac->req, NULL,
412 NULL, LDB_ERR_OPERATIONS_ERROR);
413 }
414
415 if (!partition_ctrl) {
416 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
417 return ldb_module_done(ac->req, NULL,
418 NULL, LDB_ERR_OPERATIONS_ERROR);
419 }
420
421 partition = talloc_get_type_abort(partition_ctrl->data,
422 struct dsdb_control_current_partition);
423
424 if (ac->seq_num > 0) {
425 for (modified_partition = replmd_private->ncs; modified_partition;
426 modified_partition = modified_partition->next) {
427 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
428 break;
429 }
430 }
431
432 if (modified_partition == NULL) {
433 modified_partition = talloc_zero(replmd_private, struct nc_entry);
434 if (!modified_partition) {
435 ldb_oom(ldb_module_get_ctx(ac->module));
436 return ldb_module_done(ac->req, NULL,
437 NULL, LDB_ERR_OPERATIONS_ERROR);
438 }
439 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
440 if (!modified_partition->dn) {
441 ldb_oom(ldb_module_get_ctx(ac->module));
442 return ldb_module_done(ac->req, NULL,
443 NULL, LDB_ERR_OPERATIONS_ERROR);
444 }
445 DLIST_ADD(replmd_private->ncs, modified_partition);
446 }
447
448 if (ac->seq_num > modified_partition->mod_usn) {
449 modified_partition->mod_usn = ac->seq_num;
450 if (ac->is_urgent) {
451 modified_partition->mod_usn_urgent = ac->seq_num;
452 }
453 }
454 }
455
456 if (ac->apply_mode) {
457 talloc_free(ares);
458 ac->index_current++;
459
460 ret = replmd_replicated_apply_next(ac);
461 if (ret != LDB_SUCCESS) {
462 return ldb_module_done(ac->req, NULL, NULL, ret);
463 }
464 return ret;
465 } else {
466 /* free the partition control container here, for the
467 * common path. Other cases will have it cleaned up
468 * eventually with the ares */
469 talloc_free(partition_ctrl);
470 return ldb_module_done(ac->req, controls,
471 ares->response, LDB_SUCCESS);
472 }
473 }
474
475
476 /*
477 * update a @REPLCHANGED record in each partition if there have been
478 * any writes of replicated data in the partition
479 */
480 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
481 {
482 struct replmd_private *replmd_private =
483 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
484
485 while (replmd_private->ncs) {
486 int ret;
487 struct nc_entry *modified_partition = replmd_private->ncs;
488
489 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
490 modified_partition->mod_usn,
491 modified_partition->mod_usn_urgent, parent);
492 if (ret != LDB_SUCCESS) {
493 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
494 ldb_dn_get_linearized(modified_partition->dn)));
495 return ret;
496 }
497 DLIST_REMOVE(replmd_private->ncs, modified_partition);
498 talloc_free(modified_partition);
499 }
500
501 return LDB_SUCCESS;
502 }
503
504
505 /*
506 created a replmd_replicated_request context
507 */
508 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
509 struct ldb_request *req)
510 {
511 struct ldb_context *ldb;
512 struct replmd_replicated_request *ac;
513
514 ldb = ldb_module_get_ctx(module);
515
516 ac = talloc_zero(req, struct replmd_replicated_request);
517 if (ac == NULL) {
518 ldb_oom(ldb);
519 return NULL;
520 }
521
522 ac->module = module;
523 ac->req = req;
524
525 ac->schema = dsdb_get_schema(ldb, ac);
526 if (!ac->schema) {
527 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
528 "replmd_modify: no dsdb_schema loaded");
529 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
530 return NULL;
531 }
532
533 return ac;
534 }
535
536 /*
537 add a time element to a record
538 */
539 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
540 {
541 struct ldb_message_element *el;
542 char *s;
543 int ret;
544
545 if (ldb_msg_find_element(msg, attr) != NULL) {
546 return LDB_SUCCESS;
547 }
548
549 s = ldb_timestring(msg, t);
550 if (s == NULL) {
551 return LDB_ERR_OPERATIONS_ERROR;
552 }
553
554 ret = ldb_msg_add_string(msg, attr, s);
555 if (ret != LDB_SUCCESS) {
556 return ret;
557 }
558
559 el = ldb_msg_find_element(msg, attr);
560 /* always set as replace. This works because on add ops, the flag
561 is ignored */
562 el->flags = LDB_FLAG_MOD_REPLACE;
563
564 return LDB_SUCCESS;
565 }
566
567 /*
568 add a uint64_t element to a record
569 */
570 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
571 const char *attr, uint64_t v)
572 {
573 struct ldb_message_element *el;
574 int ret;
575
576 if (ldb_msg_find_element(msg, attr) != NULL) {
577 return LDB_SUCCESS;
578 }
579
580 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
581 if (ret != LDB_SUCCESS) {
582 return ret;
583 }
584
585 el = ldb_msg_find_element(msg, attr);
586 /* always set as replace. This works because on add ops, the flag
587 is ignored */
588 el->flags = LDB_FLAG_MOD_REPLACE;
589
590 return LDB_SUCCESS;
591 }
592
593 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
594 const struct replPropertyMetaData1 *m2,
595 const uint32_t *rdn_attid)
596 {
597 if (m1->attid == m2->attid) {
598 return 0;
599 }
600
601 /*
602 * the rdn attribute should be at the end!
603 * so we need to return a value greater than zero
604 * which means m1 is greater than m2
605 */
606 if (m1->attid == *rdn_attid) {
607 return 1;
608 }
609
610 /*
611 * the rdn attribute should be at the end!
612 * so we need to return a value less than zero
613 * which means m2 is greater than m1
614 */
615 if (m2->attid == *rdn_attid) {
616 return -1;
617 }
618
619 return m1->attid > m2->attid ? 1 : -1;
620 }
621
622 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
623 const struct dsdb_schema *schema,
624 struct ldb_dn *dn)
625 {
626 const char *rdn_name;
627 const struct dsdb_attribute *rdn_sa;
628
629 rdn_name = ldb_dn_get_rdn_name(dn);
630 if (!rdn_name) {
631 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
632 return LDB_ERR_OPERATIONS_ERROR;
633 }
634
635 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
636 if (rdn_sa == NULL) {
637 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
638 return LDB_ERR_OPERATIONS_ERROR;
639 }
640
641 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
642 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
643
644 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
645
646 return LDB_SUCCESS;
647 }
648
649 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
650 const struct ldb_message_element *e2,
651 const struct dsdb_schema *schema)
652 {
653 const struct dsdb_attribute *a1;
654 const struct dsdb_attribute *a2;
655
656 /*
657 * TODO: make this faster by caching the dsdb_attribute pointer
658 * on the ldb_messag_element
659 */
660
661 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
662 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
663
664 /*
665 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
666 * in the schema
667 */
668 if (!a1 || !a2) {
669 return strcasecmp(e1->name, e2->name);
670 }
671 if (a1->attributeID_id == a2->attributeID_id) {
672 return 0;
673 }
674 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
675 }
676
677 static void replmd_ldb_message_sort(struct ldb_message *msg,
678 const struct dsdb_schema *schema)
679 {
680 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
681 }
682
683 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
684 const struct GUID *invocation_id, uint64_t seq_num,
685 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
686
687
688 /*
689 fix up linked attributes in replmd_add.
690 This involves setting up the right meta-data in extended DN
691 components, and creating backlinks to the object
692 */
693 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
694 uint64_t seq_num, const struct GUID *invocationId, time_t t,
695 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
696 {
697 unsigned int i;
698 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
699 struct ldb_context *ldb = ldb_module_get_ctx(module);
700
701 /* We will take a reference to the schema in replmd_add_backlink */
702 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
703 NTTIME now;
704
705 unix_to_nt_time(&now, t);
706
707 for (i=0; i<el->num_values; i++) {
708 struct ldb_val *v = &el->values[i];
709 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
710 struct GUID target_guid;
711 NTSTATUS status;
712 int ret;
713
714 /* note that the DN already has the extended
715 components from the extended_dn_store module */
716 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
717 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
718 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
719 if (ret != LDB_SUCCESS) {
720 talloc_free(tmp_ctx);
721 return ret;
722 }
723 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
724 if (ret != LDB_SUCCESS) {
725 talloc_free(tmp_ctx);
726 return ret;
727 }
728 }
729
730 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
731 seq_num, seq_num, now, 0, false);
732 if (ret != LDB_SUCCESS) {
733 talloc_free(tmp_ctx);
734 return ret;
735 }
736
737 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
738 if (ret != LDB_SUCCESS) {
739 talloc_free(tmp_ctx);
740 return ret;
741 }
742 }
743
744 talloc_free(tmp_ctx);
745 return LDB_SUCCESS;
746 }
747
748
749 /*
750 intercept add requests
751 */
752 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
753 {
754 struct samldb_msds_intid_persistant *msds_intid_struct;
755 struct ldb_context *ldb;
756 struct ldb_control *control;
757 struct replmd_replicated_request *ac;
758 enum ndr_err_code ndr_err;
759 struct ldb_request *down_req;
760 struct ldb_message *msg;
761 const DATA_BLOB *guid_blob;
762 struct GUID guid;
763 struct replPropertyMetaDataBlob nmd;
764 struct ldb_val nmd_value;
765 const struct GUID *our_invocation_id;
766 time_t t = time(NULL);
767 NTTIME now;
768 char *time_str;
769 int ret;
770 unsigned int i;
771 unsigned int functional_level;
772 uint32_t ni=0;
773 bool allow_add_guid = false;
774 bool remove_current_guid = false;
775 bool is_urgent = false;
776 struct ldb_message_element *objectclass_el;
777
778 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
779 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
780 if (control) {
781 allow_add_guid = true;
782 }
783
784 /* do not manipulate our control entries */
785 if (ldb_dn_is_special(req->op.add.message->dn)) {
786 return ldb_next_request(module, req);
787 }
788
789 ldb = ldb_module_get_ctx(module);
790
791 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
792
793 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
794 if (guid_blob != NULL) {
795 if (!allow_add_guid) {
796 ldb_set_errstring(ldb,
797 "replmd_add: it's not allowed to add an object with objectGUID!");
798 return LDB_ERR_UNWILLING_TO_PERFORM;
799 } else {
800 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
801 if (!NT_STATUS_IS_OK(status)) {
802 ldb_set_errstring(ldb,
803 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
804 return LDB_ERR_UNWILLING_TO_PERFORM;
805 }
806 /* we remove this attribute as it can be a string and
807 * will not be treated correctly and then we will re-add
808 * it later on in the good format */
809 remove_current_guid = true;
810 }
811 } else {
812 /* a new GUID */
813 guid = GUID_random();
814 }
815
816 ac = replmd_ctx_init(module, req);
817 if (ac == NULL) {
818 return ldb_module_oom(module);
819 }
820
821 functional_level = dsdb_functional_level(ldb);
822
823 /* Get a sequence number from the backend */
824 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
825 if (ret != LDB_SUCCESS) {
826 talloc_free(ac);
827 return ret;
828 }
829
830 /* get our invocationId */
831 our_invocation_id = samdb_ntds_invocation_id(ldb);
832 if (!our_invocation_id) {
833 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
834 "replmd_add: unable to find invocationId\n");
835 talloc_free(ac);
836 return LDB_ERR_OPERATIONS_ERROR;
837 }
838
839 /* we have to copy the message as the caller might have it as a const */
840 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
841 if (msg == NULL) {
842 ldb_oom(ldb);
843 talloc_free(ac);
844 return LDB_ERR_OPERATIONS_ERROR;
845 }
846
847 /* generated times */
848 unix_to_nt_time(&now, t);
849 time_str = ldb_timestring(msg, t);
850 if (!time_str) {
851 ldb_oom(ldb);
852 talloc_free(ac);
853 return LDB_ERR_OPERATIONS_ERROR;
854 }
855 if (remove_current_guid) {
856 ldb_msg_remove_attr(msg,"objectGUID");
857 }
858
859 /*
860 * remove autogenerated attributes
861 */
862 ldb_msg_remove_attr(msg, "whenCreated");
863 ldb_msg_remove_attr(msg, "whenChanged");
864 ldb_msg_remove_attr(msg, "uSNCreated");
865 ldb_msg_remove_attr(msg, "uSNChanged");
866 ldb_msg_remove_attr(msg, "replPropertyMetaData");
867
868 /*
869 * readd replicated attributes
870 */
871 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
872 if (ret != LDB_SUCCESS) {
873 ldb_oom(ldb);
874 talloc_free(ac);
875 return ret;
876 }
877
878 /* build the replication meta_data */
879 ZERO_STRUCT(nmd);
880 nmd.version = 1;
881 nmd.ctr.ctr1.count = msg->num_elements;
882 nmd.ctr.ctr1.array = talloc_array(msg,
883 struct replPropertyMetaData1,
884 nmd.ctr.ctr1.count);
885 if (!nmd.ctr.ctr1.array) {
886 ldb_oom(ldb);
887 talloc_free(ac);
888 return LDB_ERR_OPERATIONS_ERROR;
889 }
890
891 for (i=0; i < msg->num_elements; i++) {
892 struct ldb_message_element *e = &msg->elements[i];
893 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
894 const struct dsdb_attribute *sa;
895
896 if (e->name[0] == '@') continue;
897
898 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
899 if (!sa) {
900 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
901 "replmd_add: attribute '%s' not defined in schema\n",
902 e->name);
903 talloc_free(ac);
904 return LDB_ERR_NO_SUCH_ATTRIBUTE;
905 }
906
907 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
908 /* if the attribute is not replicated (0x00000001)
909 * or constructed (0x00000004) it has no metadata
910 */
911 continue;
912 }
913
914 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
915 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
916 if (ret != LDB_SUCCESS) {
917 talloc_free(ac);
918 return ret;
919 }
920 /* linked attributes are not stored in
921 replPropertyMetaData in FL above w2k */
922 continue;
923 }
924
925 m->attid = sa->attributeID_id;
926 m->version = 1;
927 if (m->attid == 0x20030) {
928 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
929 const char* rdn;
930
931 if (rdn_val == NULL) {
932 ldb_oom(ldb);
933 talloc_free(ac);
934 return LDB_ERR_OPERATIONS_ERROR;
935 }
936
937 rdn = (const char*)rdn_val->data;
938 if (strcmp(rdn, "Deleted Objects") == 0) {
939 /*
940 * Set the originating_change_time to 29/12/9999 at 23:59:59
941 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
942 */
943 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
944 } else {
945 m->originating_change_time = now;
946 }
947 } else {
948 m->originating_change_time = now;
949 }
950 m->originating_invocation_id = *our_invocation_id;
951 m->originating_usn = ac->seq_num;
952 m->local_usn = ac->seq_num;
953 ni++;
954 }
955
956 /* fix meta data count */
957 nmd.ctr.ctr1.count = ni;
958
959 /*
960 * sort meta data array, and move the rdn attribute entry to the end
961 */
962 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
963 if (ret != LDB_SUCCESS) {
964 talloc_free(ac);
965 return ret;
966 }
967
968 /* generated NDR encoded values */
969 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
970 &nmd,
971 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
972 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
973 ldb_oom(ldb);
974 talloc_free(ac);
975 return LDB_ERR_OPERATIONS_ERROR;
976 }
977
978 /*
979 * add the autogenerated values
980 */
981 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
982 if (ret != LDB_SUCCESS) {
983 ldb_oom(ldb);
984 talloc_free(ac);
985 return ret;
986 }
987 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
988 if (ret != LDB_SUCCESS) {
989 ldb_oom(ldb);
990 talloc_free(ac);
991 return ret;
992 }
993 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
994 if (ret != LDB_SUCCESS) {
995 ldb_oom(ldb);
996 talloc_free(ac);
997 return ret;
998 }
999 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1000 if (ret != LDB_SUCCESS) {
1001 ldb_oom(ldb);
1002 talloc_free(ac);
1003 return ret;
1004 }
1005 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1006 if (ret != LDB_SUCCESS) {
1007 ldb_oom(ldb);
1008 talloc_free(ac);
1009 return ret;
1010 }
1011
1012 /*
1013 * sort the attributes by attid before storing the object
1014 */
1015 replmd_ldb_message_sort(msg, ac->schema);
1016
1017 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1018 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1019 REPL_URGENT_ON_CREATE);
1020
1021 ac->is_urgent = is_urgent;
1022 ret = ldb_build_add_req(&down_req, ldb, ac,
1023 msg,
1024 req->controls,
1025 ac, replmd_op_callback,
1026 req);
1027
1028 LDB_REQ_SET_LOCATION(down_req);
1029 if (ret != LDB_SUCCESS) {
1030 talloc_free(ac);
1031 return ret;
1032 }
1033
1034 /* current partition control is needed by "replmd_op_callback" */
1035 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1036 ret = ldb_request_add_control(down_req,
1037 DSDB_CONTROL_CURRENT_PARTITION_OID,
1038 false, NULL);
1039 if (ret != LDB_SUCCESS) {
1040 talloc_free(ac);
1041 return ret;
1042 }
1043 }
1044
1045 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1046 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1047 if (ret != LDB_SUCCESS) {
1048 talloc_free(ac);
1049 return ret;
1050 }
1051 }
1052
1053 /* mark the control done */
1054 if (control) {
1055 control->critical = 0;
1056 }
1057 if (ldb_dn_compare_base(ac->schema->base_dn, req->op.add.message->dn) != 0) {
1058
1059 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
1060 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1061 if (msds_intid_struct) {
1062 msds_intid_struct->usn = ac->seq_num;
1063 }
1064 }
1065 /* go on with the call chain */
1066 return ldb_next_request(module, down_req);
1067 }
1068
1069
1070 /*
1071 * update the replPropertyMetaData for one element
1072 */
1073 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1074 struct ldb_message *msg,
1075 struct ldb_message_element *el,
1076 struct ldb_message_element *old_el,
1077 struct replPropertyMetaDataBlob *omd,
1078 const struct dsdb_schema *schema,
1079 uint64_t *seq_num,
1080 const struct GUID *our_invocation_id,
1081 NTTIME now,
1082 struct ldb_request *req)
1083 {
1084 uint32_t i;
1085 const struct dsdb_attribute *a;
1086 struct replPropertyMetaData1 *md1;
1087
1088 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1089 if (a == NULL) {
1090 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1091 /* allow this to make it possible for dbcheck
1092 to remove bad attributes */
1093 return LDB_SUCCESS;
1094 }
1095
1096 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1097 el->name));
1098 return LDB_ERR_OPERATIONS_ERROR;
1099 }
1100
1101 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1102 return LDB_SUCCESS;
1103 }
1104
1105 /* if the attribute's value haven't changed then return LDB_SUCCESS
1106 * Unless we have the provision control or if the attribute is
1107 * interSiteTopologyGenerator as this page explain: http://support.microsoft.com/kb/224815
1108 * this attribute is periodicaly written by the DC responsible for the intersite generation
1109 * in a given site
1110 */
1111 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1112 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1113 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1114 /*
1115 * allow this to make it possible for dbcheck
1116 * to rebuild broken metadata
1117 */
1118 return LDB_SUCCESS;
1119 }
1120 }
1121
1122 for (i=0; i<omd->ctr.ctr1.count; i++) {
1123 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1124 }
1125
1126 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1127 /* linked attributes are not stored in
1128 replPropertyMetaData in FL above w2k, but we do
1129 raise the seqnum for the object */
1130 if (*seq_num == 0 &&
1131 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1132 return LDB_ERR_OPERATIONS_ERROR;
1133 }
1134 return LDB_SUCCESS;
1135 }
1136
1137 if (i == omd->ctr.ctr1.count) {
1138 /* we need to add a new one */
1139 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1140 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1141 if (omd->ctr.ctr1.array == NULL) {
1142 ldb_oom(ldb);
1143 return LDB_ERR_OPERATIONS_ERROR;
1144 }
1145 omd->ctr.ctr1.count++;
1146 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1147 }
1148
1149 /* Get a new sequence number from the backend. We only do this
1150 * if we have a change that requires a new
1151 * replPropertyMetaData element
1152 */
1153 if (*seq_num == 0) {
1154 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1155 if (ret != LDB_SUCCESS) {
1156 return LDB_ERR_OPERATIONS_ERROR;
1157 }
1158 }
1159
1160 md1 = &omd->ctr.ctr1.array[i];
1161 md1->version++;
1162 md1->attid = a->attributeID_id;
1163 if (md1->attid == 0x20030) {
1164 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1165 const char* rdn;
1166
1167 if (rdn_val == NULL) {
1168 ldb_oom(ldb);
1169 return LDB_ERR_OPERATIONS_ERROR;
1170 }
1171
1172 rdn = (const char*)rdn_val->data;
1173 if (strcmp(rdn, "Deleted Objects") == 0) {
1174 /*
1175 * Set the originating_change_time to 29/12/9999 at 23:59:59
1176 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1177 */
1178 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1179 } else {
1180 md1->originating_change_time = now;
1181 }
1182 } else {
1183 md1->originating_change_time = now;
1184 }
1185 md1->originating_invocation_id = *our_invocation_id;
1186 md1->originating_usn = *seq_num;
1187 md1->local_usn = *seq_num;
1188
1189 return LDB_SUCCESS;
1190 }
1191
1192 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1193 {
1194 uint32_t count = omd.ctr.ctr1.count;
1195 uint64_t max = 0;
1196 uint32_t i;
1197 for (i=0; i < count; i++) {
1198 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1199 if (max < m.local_usn) {
1200 max = m.local_usn;
1201 }
1202 }
1203 return max;
1204 }
1205
1206 /*
1207 * update the replPropertyMetaData object each time we modify an
1208 * object. This is needed for DRS replication, as the merge on the
1209 * client is based on this object
1210 */
1211 static int replmd_update_rpmd(struct ldb_module *module,
1212 const struct dsdb_schema *schema,
1213 struct ldb_request *req,
1214 const char * const *rename_attrs,
1215 struct ldb_message *msg, uint64_t *seq_num,
1216 time_t t,
1217 bool *is_urgent, bool *rodc)
1218 {
1219 const struct ldb_val *omd_value;
1220 enum ndr_err_code ndr_err;
1221 struct replPropertyMetaDataBlob omd;
1222 unsigned int i;
1223 NTTIME now;
1224 const struct GUID *our_invocation_id;
1225 int ret;
1226 const char * const *attrs = NULL;
1227 const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1228 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1229 struct ldb_result *res;
1230 struct ldb_context *ldb;
1231 struct ldb_message_element *objectclass_el;
1232 enum urgent_situation situation;
1233 bool rmd_is_provided;
1234
1235 if (rename_attrs) {
1236 attrs = rename_attrs;
1237 } else {
1238 attrs = attrs1;
1239 }
1240
1241 ldb = ldb_module_get_ctx(module);
1242
1243 our_invocation_id = samdb_ntds_invocation_id(ldb);
1244 if (!our_invocation_id) {
1245 /* this happens during an initial vampire while
1246 updating the schema */
1247 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1248 return LDB_SUCCESS;
1249 }
1250
1251 unix_to_nt_time(&now, t);
1252
1253 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1254 rmd_is_provided = true;
1255 } else {
1256 rmd_is_provided = false;
1257 }
1258
1259 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1260 * otherwise we consider we are updating */
1261 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1262 situation = REPL_URGENT_ON_DELETE;
1263 } else if (rename_attrs) {
1264 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1265 } else {
1266 situation = REPL_URGENT_ON_UPDATE;
1267 }
1268
1269 if (rmd_is_provided) {
1270 /* In this case the change_replmetadata control was supplied */
1271 /* We check that it's the only attribute that is provided
1272 * (it's a rare case so it's better to keep the code simplier)
1273 * We also check that the highest local_usn is bigger than
1274 * uSNChanged. */
1275 uint64_t db_seq;
1276 if( msg->num_elements != 1 ||
1277 strncmp(msg->elements[0].name,
1278 "replPropertyMetaData", 20) ) {
1279 DEBUG(0,(__location__ ": changereplmetada control called without "\
1280 "a specified replPropertyMetaData attribute or with others\n"));
1281 return LDB_ERR_OPERATIONS_ERROR;
1282 }
1283 if (situation != REPL_URGENT_ON_UPDATE) {
1284 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1285 return LDB_ERR_OPERATIONS_ERROR;
1286 }
1287 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1288 if (!omd_value) {
1289 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1290 ldb_dn_get_linearized(msg->dn)));
1291 return LDB_ERR_OPERATIONS_ERROR;
1292 }
1293 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1294 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1295 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1296 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1297 ldb_dn_get_linearized(msg->dn)));
1298 return LDB_ERR_OPERATIONS_ERROR;
1299 }
1300 *seq_num = find_max_local_usn(omd);
1301
1302 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1303 DSDB_FLAG_NEXT_MODULE |
1304 DSDB_SEARCH_SHOW_RECYCLED |
1305 DSDB_SEARCH_SHOW_EXTENDED_DN |
1306 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1307 DSDB_SEARCH_REVEAL_INTERNALS, req);
1308
1309 if (ret != LDB_SUCCESS) {
1310 return ret;
1311 }
1312
1313 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1314 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1315 situation)) {
1316 *is_urgent = true;
1317 }
1318
1319 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1320 if (*seq_num <= db_seq) {
1321 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1322 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1323 (long long)*seq_num, (long long)db_seq));
1324 return LDB_ERR_OPERATIONS_ERROR;
1325 }
1326
1327 } else {
1328 /* search for the existing replPropertyMetaDataBlob. We need
1329 * to use REVEAL and ask for DNs in storage format to support
1330 * the check for values being the same in
1331 * replmd_update_rpmd_element()
1332 */
1333 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1334 DSDB_FLAG_NEXT_MODULE |
1335 DSDB_SEARCH_SHOW_RECYCLED |
1336 DSDB_SEARCH_SHOW_EXTENDED_DN |
1337 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1338 DSDB_SEARCH_REVEAL_INTERNALS, req);
1339 if (ret != LDB_SUCCESS) {
1340 return ret;
1341 }
1342
1343 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1344 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1345 situation)) {
1346 *is_urgent = true;
1347 }
1348
1349 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1350 if (!omd_value) {
1351 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1352 ldb_dn_get_linearized(msg->dn)));
1353 return LDB_ERR_OPERATIONS_ERROR;
1354 }
1355
1356 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1357 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1358 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1359 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1360 ldb_dn_get_linearized(msg->dn)));
1361 return LDB_ERR_OPERATIONS_ERROR;
1362 }
1363
1364 if (omd.version != 1) {
1365 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1366 omd.version, ldb_dn_get_linearized(msg->dn)));
1367 return LDB_ERR_OPERATIONS_ERROR;
1368 }
1369
1370 for (i=0; i<msg->num_elements; i++) {
1371 struct ldb_message_element *old_el;
1372 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1373 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1374 our_invocation_id, now, req);
1375 if (ret != LDB_SUCCESS) {
1376 return ret;
1377 }
1378
1379 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1380 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1381 }
1382
1383 }
1384 }
1385 /*
1386 * replmd_update_rpmd_element has done an update if the
1387 * seq_num is set
1388 */
1389 if (*seq_num != 0) {
1390 struct ldb_val *md_value;
1391 struct ldb_message_element *el;
1392
1393 /*if we are RODC and this is a DRSR update then its ok*/
1394 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1395 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1396 unsigned instanceType;
1397
1398 ret = samdb_rodc(ldb, rodc);
1399 if (ret != LDB_SUCCESS) {
1400 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1401 } else if (*rodc) {
1402 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1403 return LDB_ERR_REFERRAL;
1404 }
1405
1406 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1407 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1408 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1409 "cannot change replicated attribute on partial replica");
1410 }
1411 }
1412
1413 md_value = talloc(msg, struct ldb_val);
1414 if (md_value == NULL) {
1415 ldb_oom(ldb);
1416 return LDB_ERR_OPERATIONS_ERROR;
1417 }
1418
1419 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1420 if (ret != LDB_SUCCESS) {
1421 return ret;
1422 }
1423
1424 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1425 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1426 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1427 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1428 ldb_dn_get_linearized(msg->dn)));
1429 return LDB_ERR_OPERATIONS_ERROR;
1430 }
1431
1432 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1433 if (ret != LDB_SUCCESS) {
1434 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1435 ldb_dn_get_linearized(msg->dn)));
1436 return ret;
1437 }
1438
1439 el->num_values = 1;
1440 el->values = md_value;
1441 }
1442
1443 return LDB_SUCCESS;
1444 }
1445
1446 struct parsed_dn {
1447 struct dsdb_dn *dsdb_dn;
1448 struct GUID *guid;
1449 struct ldb_val *v;
1450 };
1451
1452 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1453 {
1454 return GUID_compare(pdn1->guid, pdn2->guid);
1455 }
1456
1457 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1458 unsigned int count, struct GUID *guid,
1459 struct ldb_dn *dn)
1460 {
1461 struct parsed_dn *ret;
1462 unsigned int i;
1463 if (dn && GUID_all_zero(guid)) {
1464 /* when updating a link using DRS, we sometimes get a
1465 NULL GUID. We then need to try and match by DN */
1466 for (i=0; i<count; i++) {
1467 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1468 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1469 return &pdn[i];
1470 }
1471 }
1472 return NULL;
1473 }
1474 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1475 return ret;
1476 }
1477
1478 /*
1479 get a series of message element values as an array of DNs and GUIDs
1480 the result is sorted by GUID
1481 */
1482 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1483 struct ldb_message_element *el, struct parsed_dn **pdn,
1484 const char *ldap_oid, struct ldb_request *parent)
1485 {
1486 unsigned int i;
1487 struct ldb_context *ldb = ldb_module_get_ctx(module);
1488
1489 if (el == NULL) {
1490 *pdn = NULL;
1491 return LDB_SUCCESS;
1492 }
1493
1494 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1495 if (!*pdn) {
1496 ldb_module_oom(module);
1497 return LDB_ERR_OPERATIONS_ERROR;
1498 }
1499
1500 for (i=0; i<el->num_values; i++) {
1501 struct ldb_val *v = &el->values[i];
1502 NTSTATUS status;
1503 struct ldb_dn *dn;
1504 struct parsed_dn *p;
1505
1506 p = &(*pdn)[i];
1507
1508 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1509 if (p->dsdb_dn == NULL) {
1510 return LDB_ERR_INVALID_DN_SYNTAX;
1511 }
1512
1513 dn = p->dsdb_dn->dn;
1514
1515 p->guid = talloc(*pdn, struct GUID);
1516 if (p->guid == NULL) {
1517 ldb_module_oom(module);
1518 return LDB_ERR_OPERATIONS_ERROR;
1519 }
1520
1521 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1522 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1523 /* we got a DN without a GUID - go find the GUID */
1524 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1525 if (ret != LDB_SUCCESS) {
1526 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1527 ldb_dn_get_linearized(dn));
1528 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1529 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1530 ldb_attr_cmp(el->name, "member") == 0) {
1531 return LDB_ERR_UNWILLING_TO_PERFORM;
1532 }
1533 return ret;
1534 }
1535 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1536 if (ret != LDB_SUCCESS) {
1537 return ret;
1538 }
1539 } else if (!NT_STATUS_IS_OK(status)) {
1540 return LDB_ERR_OPERATIONS_ERROR;
1541 }
1542
1543 /* keep a pointer to the original ldb_val */
1544 p->v = v;
1545 }
1546
1547 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1548
1549 return LDB_SUCCESS;
1550 }
1551
1552 /*
1553 build a new extended DN, including all meta data fields
1554
1555 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1556 RMD_ADDTIME = originating_add_time
1557 RMD_INVOCID = originating_invocation_id
1558 RMD_CHANGETIME = originating_change_time
1559 RMD_ORIGINATING_USN = originating_usn
1560 RMD_LOCAL_USN = local_usn
1561 RMD_VERSION = version
1562 */
1563 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1564 const struct GUID *invocation_id, uint64_t seq_num,
1565 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1566 {
1567 struct ldb_dn *dn = dsdb_dn->dn;
1568 const char *tstring, *usn_string, *flags_string;
1569 struct ldb_val tval;
1570 struct ldb_val iid;
1571 struct ldb_val usnv, local_usnv;
1572 struct ldb_val vers, flagsv;
1573 NTSTATUS status;
1574 int ret;
1575 const char *dnstring;
1576 char *vstring;
1577 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1578
1579 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1580 if (!tstring) {
1581 return LDB_ERR_OPERATIONS_ERROR;
1582 }
1583 tval = data_blob_string_const(tstring);
1584
1585 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1586 if (!usn_string) {
1587 return LDB_ERR_OPERATIONS_ERROR;
1588 }
1589 usnv = data_blob_string_const(usn_string);
1590
1591 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1592 if (!usn_string) {
1593 return LDB_ERR_OPERATIONS_ERROR;
1594 }
1595 local_usnv = data_blob_string_const(usn_string);
1596
1597 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1598 if (!vstring) {
1599 return LDB_ERR_OPERATIONS_ERROR;
1600 }
1601 vers = data_blob_string_const(vstring);
1602
1603 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1604 if (!NT_STATUS_IS_OK(status)) {
1605 return LDB_ERR_OPERATIONS_ERROR;
1606 }
1607
1608 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1609 if (!flags_string) {
1610 return LDB_ERR_OPERATIONS_ERROR;
1611 }
1612 flagsv = data_blob_string_const(flags_string);
1613
1614 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1615 if (ret != LDB_SUCCESS) return ret;
1616 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1617 if (ret != LDB_SUCCESS) return ret;
1618 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1619 if (ret != LDB_SUCCESS) return ret;
1620 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1621 if (ret != LDB_SUCCESS) return ret;
1622 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1623 if (ret != LDB_SUCCESS) return ret;
1624 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1625 if (ret != LDB_SUCCESS) return ret;
1626 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1627 if (ret != LDB_SUCCESS) return ret;
1628
1629 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1630 if (dnstring == NULL) {
1631 return LDB_ERR_OPERATIONS_ERROR;
1632 }
1633 *v = data_blob_string_const(dnstring);
1634
1635 return LDB_SUCCESS;
1636 }
1637
1638 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1639 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1640 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1641 uint32_t version, bool deleted);
1642
1643 /*
1644 check if any links need upgrading from w2k format
1645
1646 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1647 */
1648 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1649 {
1650 uint32_t i;
1651 for (i=0; i<count; i++) {
1652 NTSTATUS status;
1653 uint32_t version;
1654 int ret;
1655
1656 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1657 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1658 continue;
1659 }
1660
1661 /* it's an old one that needs upgrading */
1662 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1663 1, 1, 0, 0, false);
1664 if (ret != LDB_SUCCESS) {
1665 return ret;
1666 }
1667 }
1668 return LDB_SUCCESS;
1669 }
1670
1671 /*
1672 update an extended DN, including all meta data fields
1673
1674 see replmd_build_la_val for value names
1675 */
1676 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1677 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1678 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1679 uint32_t version, bool deleted)
1680 {
1681 struct ldb_dn *dn = dsdb_dn->dn;
1682 const char *tstring, *usn_string, *flags_string;
1683 struct ldb_val tval;
1684 struct ldb_val iid;
1685 struct ldb_val usnv, local_usnv;
1686 struct ldb_val vers, flagsv;
1687 const struct ldb_val *old_addtime;
1688 uint32_t old_version;
1689 NTSTATUS status;
1690 int ret;
1691 const char *dnstring;
1692 char *vstring;
1693 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1694
1695 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1696 if (!tstring) {
1697 return LDB_ERR_OPERATIONS_ERROR;
1698 }
1699 tval = data_blob_string_const(tstring);
1700
1701 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1702 if (!usn_string) {
1703 return LDB_ERR_OPERATIONS_ERROR;
1704 }
1705 usnv = data_blob_string_const(usn_string);
1706
1707 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1708 if (!usn_string) {
1709 return LDB_ERR_OPERATIONS_ERROR;
1710 }
1711 local_usnv = data_blob_string_const(usn_string);
1712
1713 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1714 if (!NT_STATUS_IS_OK(status)) {
1715 return LDB_ERR_OPERATIONS_ERROR;
1716 }
1717
1718 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1719 if (!flags_string) {
1720 return LDB_ERR_OPERATIONS_ERROR;
1721 }
1722 flagsv = data_blob_string_const(flags_string);
1723
1724 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1725 if (ret != LDB_SUCCESS) return ret;
1726
1727 /* get the ADDTIME from the original */
1728 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1729 if (old_addtime == NULL) {
1730 old_addtime = &tval;
1731 }
1732 if (dsdb_dn != old_dsdb_dn ||
1733 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1734 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1735 if (ret != LDB_SUCCESS) return ret;
1736 }
1737
1738 /* use our invocation id */
1739 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1740 if (ret != LDB_SUCCESS) return ret;
1741
1742 /* changetime is the current time */
1743 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1744 if (ret != LDB_SUCCESS) return ret;
1745
1746 /* update the USN */
1747 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1748 if (ret != LDB_SUCCESS) return ret;
1749
1750 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1751 if (ret != LDB_SUCCESS) return ret;
1752
1753 /* increase the version by 1 */
1754 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1755 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1756 version = old_version+1;
1757 }
1758 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1759 vers = data_blob_string_const(vstring);
1760 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1761 if (ret != LDB_SUCCESS) return ret;
1762
1763 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1764 if (dnstring == NULL) {
1765 return LDB_ERR_OPERATIONS_ERROR;
1766 }
1767 *v = data_blob_string_const(dnstring);
1768
1769 return LDB_SUCCESS;
1770 }
1771
1772 /*
1773 handle adding a linked attribute
1774 */
1775 static int replmd_modify_la_add(struct ldb_module *module,
1776 const struct dsdb_schema *schema,
1777 struct ldb_message *msg,
1778 struct ldb_message_element *el,
1779 struct ldb_message_element *old_el,
1780 const struct dsdb_attribute *schema_attr,
1781 uint64_t seq_num,
1782 time_t t,
1783 struct GUID *msg_guid,
1784 struct ldb_request *parent)
1785 {
1786 unsigned int i;
1787 struct parsed_dn *dns, *old_dns;
1788 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1789 int ret;
1790 struct ldb_val *new_values = NULL;
1791 unsigned int num_new_values = 0;
1792 unsigned old_num_values = old_el?old_el->num_values:0;
1793 const struct GUID *invocation_id;
1794 struct ldb_context *ldb = ldb_module_get_ctx(module);
1795 NTTIME now;
1796
1797 unix_to_nt_time(&now, t);
1798
1799 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1800 if (ret != LDB_SUCCESS) {
1801 talloc_free(tmp_ctx);
1802 return ret;
1803 }
1804
1805 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1806 if (ret != LDB_SUCCESS) {
1807 talloc_free(tmp_ctx);
1808 return ret;
1809 }
1810
1811 invocation_id = samdb_ntds_invocation_id(ldb);
1812 if (!invocation_id) {
1813 talloc_free(tmp_ctx);
1814 return LDB_ERR_OPERATIONS_ERROR;
1815 }
1816
1817 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1818 if (ret != LDB_SUCCESS) {
1819 talloc_free(tmp_ctx);
1820 return ret;
1821 }
1822
1823 /* for each new value, see if it exists already with the same GUID */
1824 for (i=0; i<el->num_values; i++) {
1825 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1826 if (p == NULL) {
1827 /* this is a new linked attribute value */
1828 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1829 if (new_values == NULL) {
1830 ldb_module_oom(module);
1831 talloc_free(tmp_ctx);
1832 return LDB_ERR_OPERATIONS_ERROR;
1833 }
1834 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1835 invocation_id, seq_num, seq_num, now, 0, false);
1836 if (ret != LDB_SUCCESS) {
1837 talloc_free(tmp_ctx);
1838 return ret;
1839 }
1840 num_new_values++;
1841 } else {
1842 /* this is only allowed if the GUID was
1843 previously deleted. */
1844 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1845
1846 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1847 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1848 el->name, GUID_string(tmp_ctx, p->guid));
1849 talloc_free(tmp_ctx);
1850 /* error codes for 'member' need to be
1851 special cased */
1852 if (ldb_attr_cmp(el->name, "member") == 0) {
1853 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1854 } else {
1855 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1856 }
1857 }
1858 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1859 invocation_id, seq_num, seq_num, now, 0, false);
1860 if (ret != LDB_SUCCESS) {
1861 talloc_free(tmp_ctx);
1862 return ret;
1863 }
1864 }
1865
1866 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1867 if (ret != LDB_SUCCESS) {
1868 talloc_free(tmp_ctx);
1869 return ret;
1870 }
1871 }
1872
1873 /* add the new ones on to the end of the old values, constructing a new el->values */
1874 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1875 struct ldb_val,
1876 old_num_values+num_new_values);
1877 if (el->values == NULL) {
1878 ldb_module_oom(module);
1879 return LDB_ERR_OPERATIONS_ERROR;
1880 }
1881
1882 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1883 el->num_values = old_num_values + num_new_values;
1884
1885 talloc_steal(msg->elements, el->values);
1886 talloc_steal(el->values, new_values);
1887
1888 talloc_free(tmp_ctx);
1889
1890 /* we now tell the backend to replace all existing values
1891 with the one we have constructed */
1892 el->flags = LDB_FLAG_MOD_REPLACE;
1893
1894 return LDB_SUCCESS;
1895 }
1896
1897
1898 /*
1899 handle deleting all active linked attributes
1900 */
1901 static int replmd_modify_la_delete(struct ldb_module *module,
1902 const struct dsdb_schema *schema,
1903 struct ldb_message *msg,
1904 struct ldb_message_element *el,
1905 struct ldb_message_element *old_el,
1906 const struct dsdb_attribute *schema_attr,
1907 uint64_t seq_num,
1908 time_t t,
1909 struct GUID *msg_guid,
1910 struct ldb_request *parent)
1911 {
1912 unsigned int i;
1913 struct parsed_dn *dns, *old_dns;
1914 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1915 int ret;
1916 const struct GUID *invocation_id;
1917 struct ldb_context *ldb = ldb_module_get_ctx(module);
1918 NTTIME now;
1919
1920 unix_to_nt_time(&now, t);
1921
1922 /* check if there is nothing to delete */
1923 if ((!old_el || old_el->num_values == 0) &&
1924 el->num_values == 0) {
1925 return LDB_SUCCESS;
1926 }
1927
1928 if (!old_el || old_el->num_values == 0) {
1929 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1930 }
1931
1932 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1933 if (ret != LDB_SUCCESS) {
1934 talloc_free(tmp_ctx);
1935 return ret;
1936 }
1937
1938 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1939 if (ret != LDB_SUCCESS) {
1940 talloc_free(tmp_ctx);
1941 return ret;
1942 }
1943
1944 invocation_id = samdb_ntds_invocation_id(ldb);
1945 if (!invocation_id) {
1946 return LDB_ERR_OPERATIONS_ERROR;
1947 }
1948
1949 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1950 if (ret != LDB_SUCCESS) {
1951 talloc_free(tmp_ctx);
1952 return ret;
1953 }
1954
1955 el->values = NULL;
1956
1957 /* see if we are being asked to delete any links that
1958 don't exist or are already deleted */
1959 for (i=0; i<el->num_values; i++) {
1960 struct parsed_dn *p = &dns[i];
1961 struct parsed_dn *p2;
1962 uint32_t rmd_flags;
1963
1964 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1965 if (!p2) {
1966 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1967 el->name, GUID_string(tmp_ctx, p->guid));
1968 if (ldb_attr_cmp(el->name, "member") == 0) {
1969 return LDB_ERR_UNWILLING_TO_PERFORM;
1970 } else {
1971 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1972 }
1973 }
1974 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1975 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1976 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1977 el->name, GUID_string(tmp_ctx, p->guid));
1978 if (ldb_attr_cmp(el->name, "member") == 0) {
1979 return LDB_ERR_UNWILLING_TO_PERFORM;
1980 } else {
1981 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1982 }
1983 }
1984 }
1985
1986 /* for each new value, see if it exists already with the same GUID
1987 if it is not already deleted and matches the delete list then delete it
1988 */
1989 for (i=0; i<old_el->num_values; i++) {
1990 struct parsed_dn *p = &old_dns[i];
1991 uint32_t rmd_flags;
1992
1993 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1994 continue;
1995 }
1996
1997 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1998 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1999
2000 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2001 invocation_id, seq_num, seq_num, now, 0, true);
2002 if (ret != LDB_SUCCESS) {
2003 talloc_free(tmp_ctx);
2004 return ret;
2005 }
2006
2007 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
2008 if (ret != LDB_SUCCESS) {
2009 talloc_free(tmp_ctx);
2010 return ret;
2011 }
2012 }
2013
2014 el->values = talloc_steal(msg->elements, old_el->values);
2015 el->num_values = old_el->num_values;
2016
2017 talloc_free(tmp_ctx);
2018
2019 /* we now tell the backend to replace all existing values
2020 with the one we have constructed */
2021 el->flags = LDB_FLAG_MOD_REPLACE;
2022
2023 return LDB_SUCCESS;
2024 }
2025
2026 /*
2027 handle replacing a linked attribute
2028 */
2029 static int replmd_modify_la_replace(struct ldb_module *module,
2030 const struct dsdb_schema *schema,
2031 struct ldb_message *msg,
2032 struct ldb_message_element *el,
2033 struct ldb_message_element *old_el,
2034 const struct dsdb_attribute *schema_attr,
2035 uint64_t seq_num,
2036 time_t t,
2037 struct GUID *msg_guid,
2038 struct ldb_request *parent)
2039 {
2040 unsigned int i;
2041 struct parsed_dn *dns, *old_dns;
2042 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2043 int ret;
2044 const struct GUID *invocation_id;
2045 struct ldb_context *ldb = ldb_module_get_ctx(module);
2046 struct ldb_val *new_values = NULL;
2047 unsigned int num_new_values = 0;
2048 unsigned int old_num_values = old_el?old_el->num_values:0;
2049 NTTIME now;
2050
2051 unix_to_nt_time(&now, t);
2052
2053 /* check if there is nothing to replace */
2054 if ((!old_el || old_el->num_values == 0) &&
2055 el->num_values == 0) {
2056 return LDB_SUCCESS;
2057 }
2058
2059 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2060 if (ret != LDB_SUCCESS) {
2061 talloc_free(tmp_ctx);
2062 return ret;
2063 }
2064
2065 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2066 if (ret != LDB_SUCCESS) {
2067 talloc_free(tmp_ctx);
2068 return ret;
2069 }
2070
2071 invocation_id = samdb_ntds_invocation_id(ldb);
2072 if (!invocation_id) {
2073 return LDB_ERR_OPERATIONS_ERROR;
2074 }
2075
2076 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2077 if (ret != LDB_SUCCESS) {
2078 talloc_free(tmp_ctx);
2079 return ret;
2080 }
2081
2082 /* mark all the old ones as deleted */
2083 for (i=0; i<old_num_values; i++) {
2084 struct parsed_dn *old_p = &old_dns[i];
2085 struct parsed_dn *p;
2086 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2087
2088 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2089
2090 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2091 if (ret != LDB_SUCCESS) {
2092 talloc_free(tmp_ctx);
2093 return ret;
2094 }
2095
2096 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2097 if (p) {
2098 /* we don't delete it if we are re-adding it */
2099 continue;
2100 }
2101
2102 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2103 invocation_id, seq_num, seq_num, now, 0, true);
2104 if (ret != LDB_SUCCESS) {
2105 talloc_free(tmp_ctx);
2106 return ret;
2107 }
2108 }
2109
2110 /* for each new value, either update its meta-data, or add it
2111 * to old_el
2112 */
2113 for (i=0; i<el->num_values; i++) {
2114 struct parsed_dn *p = &dns[i], *old_p;
2115
2116 if (old_dns &&
2117 (old_p = parsed_dn_find(old_dns,
2118 old_num_values, p->guid, NULL)) != NULL) {
2119 /* update in place */
2120 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2121 old_p->dsdb_dn, invocation_id,
2122 seq_num, seq_num, now, 0, false);
2123 if (ret != LDB_SUCCESS) {
2124 talloc_free(tmp_ctx);
2125 return ret;
2126 }
2127 } else {
2128 /* add a new one */
2129 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2130 num_new_values+1);
2131 if (new_values == NULL) {
2132 ldb_module_oom(module);
2133 talloc_free(tmp_ctx);
2134 return LDB_ERR_OPERATIONS_ERROR;
2135 }
2136 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2137 invocation_id, seq_num, seq_num, now, 0, false);
2138 if (ret != LDB_SUCCESS) {
2139 talloc_free(tmp_ctx);
2140 return ret;
2141 }
2142 num_new_values++;
2143 }
2144
2145 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2146 if (ret != LDB_SUCCESS) {
2147 talloc_free(tmp_ctx);
2148 return ret;
2149 }
2150 }
2151
2152 /* add the new values to the end of old_el */
2153 if (num_new_values != 0) {
2154 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2155 struct ldb_val, old_num_values+num_new_values);
2156 if (el->values == NULL) {
2157 ldb_module_oom(module);
2158 return LDB_ERR_OPERATIONS_ERROR;
2159 }
2160 memcpy(&el->values[old_num_values], &new_values[0],
2161 sizeof(struct ldb_val)*num_new_values);
2162 el->num_values = old_num_values + num_new_values;
2163 talloc_steal(msg->elements, new_values);
2164 } else {
2165 el->values = old_el->values;
2166 el->num_values = old_el->num_values;
2167 talloc_steal(msg->elements, el->values);
2168 }
2169
2170 talloc_free(tmp_ctx);
2171
2172 /* we now tell the backend to replace all existing values
2173 with the one we have constructed */
2174 el->flags = LDB_FLAG_MOD_REPLACE;
2175
2176 return LDB_SUCCESS;
2177 }
2178
2179
2180 /*
2181 handle linked attributes in modify requests
2182 */
2183 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2184 struct ldb_message *msg,
2185 uint64_t seq_num, time_t t,
2186 struct ldb_request *parent)
2187 {
2188 struct ldb_result *res;
2189 unsigned int i;
2190 int ret;
2191 struct ldb_context *ldb = ldb_module_get_ctx(module);
2192 struct ldb_message *old_msg;
2193
2194 const struct dsdb_schema *schema;
2195 struct GUID old_guid;
2196
2197 if (seq_num == 0) {
2198 /* there the replmd_update_rpmd code has already
2199 * checked and saw that there are no linked
2200 * attributes */
2201 return LDB_SUCCESS;
2202 }
2203
2204 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2205 /* don't do anything special for linked attributes */
2206 return LDB_SUCCESS;
2207 }
2208
2209 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2210 DSDB_FLAG_NEXT_MODULE |
2211 DSDB_SEARCH_SHOW_RECYCLED |
2212 DSDB_SEARCH_REVEAL_INTERNALS |
2213 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2214 parent);
2215 if (ret != LDB_SUCCESS) {
2216 return ret;
2217 }
2218 schema = dsdb_get_schema(ldb, res);
2219 if (!schema) {
2220 return LDB_ERR_OPERATIONS_ERROR;
2221 }
2222
2223 old_msg = res->msgs[0];
2224
2225 old_guid = samdb_result_guid(old_msg, "objectGUID");
2226
2227 for (i=0; i<msg->num_elements; i++) {
2228 struct ldb_message_element *el = &msg->elements[i];
2229 struct ldb_message_element *old_el, *new_el;
2230 const struct dsdb_attribute *schema_attr
2231 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2232 if (!schema_attr) {
2233 ldb_asprintf_errstring(ldb,
2234 "%s: attribute %s is not a valid attribute in schema",
2235 __FUNCTION__, el->name);
2236 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2237 }
2238 if (schema_attr->linkID == 0) {
2239 continue;
2240 }
2241 if ((schema_attr->linkID & 1) == 1) {
2242 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2243 continue;
2244 }
2245 /* Odd is for the target. Illegal to modify */
2246 ldb_asprintf_errstring(ldb,
2247 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2248 return LDB_ERR_UNWILLING_TO_PERFORM;
2249 }
2250 old_el = ldb_msg_find_element(old_msg, el->name);
2251 switch (el->flags & LDB_FLAG_MOD_MASK) {
2252 case LDB_FLAG_MOD_REPLACE:
2253 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2254 break;
2255 case LDB_FLAG_MOD_DELETE:
2256 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2257 break;
2258 case LDB_FLAG_MOD_ADD:
2259 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2260 break;
2261 default:
2262 ldb_asprintf_errstring(ldb,
2263 "invalid flags 0x%x for %s linked attribute",
2264 el->flags, el->name);
2265 return LDB_ERR_UNWILLING_TO_PERFORM;
2266 }
2267 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2268 ldb_asprintf_errstring(ldb,
2269 "Attribute %s is single valued but more than one value has been supplied",
2270 el->name);
2271 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2272 } else {
2273 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2274 }
2275
2276
2277
2278 if (ret != LDB_SUCCESS) {
2279 return ret;
2280 }
2281 if (old_el) {
2282 ldb_msg_remove_attr(old_msg, el->name);
2283 }
2284 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2285 new_el->num_values = el->num_values;
2286 new_el->values = talloc_steal(msg->elements, el->values);
2287
2288 /* TODO: this relises a bit too heavily on the exact
2289 behaviour of ldb_msg_find_element and
2290 ldb_msg_remove_element */
2291 old_el = ldb_msg_find_element(msg, el->name);
2292 if (old_el != el) {
2293 ldb_msg_remove_element(msg, old_el);
2294 i--;
2295 }
2296 }
2297
2298 talloc_free(res);
2299 return ret;
2300 }
2301
2302
2303
2304 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2305 {
2306 struct samldb_msds_intid_persistant *msds_intid_struct;
2307 struct ldb_context *ldb;
2308 struct replmd_replicated_request *ac;
2309 struct ldb_request *down_req;
2310 struct ldb_message *msg;
2311 time_t t = time(NULL);
2312 int ret;
2313 bool is_urgent = false, rodc = false;
2314 unsigned int functional_level;
2315 const DATA_BLOB *guid_blob;
2316
2317 /* do not manipulate our control entries */
2318 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2319 return ldb_next_request(module, req);
2320 }
2321
2322 ldb = ldb_module_get_ctx(module);
2323
2324 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2325
2326 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2327 if ( guid_blob != NULL ) {
2328 ldb_set_errstring(ldb,
2329 "replmd_modify: it's not allowed to change the objectGUID!");
2330 return LDB_ERR_CONSTRAINT_VIOLATION;
2331 }
2332
2333 ac = replmd_ctx_init(module, req);
2334 if (ac == NULL) {
2335 return ldb_module_oom(module);
2336 }
2337
2338 functional_level = dsdb_functional_level(ldb);
2339
2340 /* we have to copy the message as the caller might have it as a const */
2341 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2342 if (msg == NULL) {
2343 ldb_oom(ldb);
2344 talloc_free(ac);
2345 return LDB_ERR_OPERATIONS_ERROR;
2346 }
2347
2348 ldb_msg_remove_attr(msg, "whenChanged");
2349 ldb_msg_remove_attr(msg, "uSNChanged");
2350
2351 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2352 msg, &ac->seq_num, t, &is_urgent, &rodc);
2353 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2354 struct loadparm_context *lp_ctx;
2355 char *referral;
2356
2357 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2358 struct loadparm_context);
2359
2360 referral = talloc_asprintf(req,
2361 "ldap://%s/%s",
2362 lpcfg_dnsdomain(lp_ctx),
2363 ldb_dn_get_linearized(msg->dn));
2364 ret = ldb_module_send_referral(req, referral);
2365 talloc_free(ac);
2366 return ret;
2367 }
2368
2369 if (ret != LDB_SUCCESS) {
2370 talloc_free(ac);
2371 return ret;
2372 }
2373
2374 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2375 if (ret != LDB_SUCCESS) {
2376 talloc_free(ac);
2377 return ret;
2378 }
2379
2380 /* TODO:
2381 * - replace the old object with the newly constructed one
2382 */
2383
2384 ac->is_urgent = is_urgent;
2385
2386 ret = ldb_build_mod_req(&down_req, ldb, ac,
2387 msg,
2388 req->controls,
2389 ac, replmd_op_callback,
2390 req);
2391 LDB_REQ_SET_LOCATION(down_req);
2392 if (ret != LDB_SUCCESS) {
2393 talloc_free(ac);
2394 return ret;
2395 }
2396
2397 /* current partition control is needed by "replmd_op_callback" */
2398 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2399 ret = ldb_request_add_control(down_req,
2400 DSDB_CONTROL_CURRENT_PARTITION_OID,
2401 false, NULL);
2402 if (ret != LDB_SUCCESS) {
2403 talloc_free(ac);
2404 return ret;
2405 }
2406 }
2407
2408 /* If we are in functional level 2000, then
2409 * replmd_modify_handle_linked_attribs will have done
2410 * nothing */
2411 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2412 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2413 if (ret != LDB_SUCCESS) {
2414 talloc_free(ac);
2415 return ret;
2416 }
2417 }
2418
2419 talloc_steal(down_req, msg);
2420
2421 /* we only change whenChanged and uSNChanged if the seq_num
2422 has changed */
2423 if (ac->seq_num != 0) {
2424 ret = add_time_element(msg, "whenChanged", t);
2425 if (ret != LDB_SUCCESS) {
2426 talloc_free(ac);
2427 ldb_operr(ldb);
2428 return ret;
2429 }
2430
2431 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2432 if (ret != LDB_SUCCESS) {
2433 talloc_free(ac);
2434 ldb_operr(ldb);
2435 return ret;
2436 }
2437 }
2438
2439 if (!ldb_dn_compare_base(ac->schema->base_dn, msg->dn)) {
2440 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
2441 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
2442 if (msds_intid_struct) {
2443 msds_intid_struct->usn = ac->seq_num;
2444 }
2445 }
2446
2447 /* go on with the call chain */
2448 return ldb_next_request(module, down_req);
2449 }
2450
2451 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2452
2453 /*
2454 handle a rename request
2455
2456 On a rename we need to do an extra ldb_modify which sets the
2457 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2458 */
2459 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2460 {
2461 struct ldb_context *ldb;
2462 struct replmd_replicated_request *ac;
2463 int ret;
2464 struct ldb_request *down_req;
2465
2466 /* do not manipulate our control entries */
2467 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2468 return ldb_next_request(module, req);
2469 }
2470
2471 ldb = ldb_module_get_ctx(module);
2472
2473 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2474
2475 ac = replmd_ctx_init(module, req);
2476 if (ac == NULL) {
2477 return ldb_module_oom(module);
2478 }
2479
2480 ret = ldb_build_rename_req(&down_req, ldb, ac,
2481 ac->req->op.rename.olddn,
2482 ac->req->op.rename.newdn,
2483 ac->req->controls,
2484 ac, replmd_rename_callback,
2485 ac->req);
2486 LDB_REQ_SET_LOCATION(down_req);
2487 if (ret != LDB_SUCCESS) {
2488 talloc_free(ac);
2489 return ret;
2490 }
2491
2492 /* go on with the call chain */
2493 return ldb_next_request(module, down_req);
2494 }
2495
2496 /* After the rename is compleated, update the whenchanged etc */
2497 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2498 {
2499 struct ldb_context *ldb;
2500 struct replmd_replicated_request *ac;
2501 struct ldb_request *down_req;
2502 struct ldb_message *msg;
2503 const struct dsdb_attribute *rdn_attr;
2504 const char *rdn_name;
2505 const struct ldb_val *rdn_val;
2506 const char *attrs[5] = { NULL, };
2507 time_t t = time(NULL);
2508 int ret;
2509 bool is_urgent = false, rodc = false;
2510
2511 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2512 ldb = ldb_module_get_ctx(ac->module);
2513
2514 if (ares->error != LDB_SUCCESS) {
2515 return ldb_module_done(ac->req, ares->controls,
2516 ares->response, ares->error);
2517 }
2518
2519 if (ares->type != LDB_REPLY_DONE) {
2520 ldb_set_errstring(ldb,
2521 "invalid ldb_reply_type in callback");
2522 talloc_free(ares);
2523 return ldb_module_done(ac->req, NULL, NULL,
2524 LDB_ERR_OPERATIONS_ERROR);
2525 }
2526
2527 /* TODO:
2528 * - replace the old object with the newly constructed one
2529 */
2530
2531 msg = ldb_msg_new(ac);
2532 if (msg == NULL) {
2533 ldb_oom(ldb);
2534 return LDB_ERR_OPERATIONS_ERROR;
2535 }
2536
2537 msg->dn = ac->req->op.rename.newdn;
2538
2539 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2540 if (rdn_name == NULL) {
2541 talloc_free(ares);
2542 return ldb_module_done(ac->req, NULL, NULL,
2543 ldb_operr(ldb));
2544 }
2545
2546 /* normalize the rdn attribute name */
2547 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2548 if (rdn_attr == NULL) {
2549 talloc_free(ares);
2550 return ldb_module_done(ac->req, NULL, NULL,
2551 ldb_operr(ldb));
2552 }
2553 rdn_name = rdn_attr->lDAPDisplayName;
2554
2555 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2556 if (rdn_val == NULL) {
2557 talloc_free(ares);
2558 return ldb_module_done(ac->req, NULL, NULL,
2559 ldb_operr(ldb));
2560 }
2561
2562 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2563 talloc_free(ares);
2564 return ldb_module_done(ac->req, NULL, NULL,
2565 ldb_oom(ldb));
2566 }
2567 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2568 talloc_free(ares);
2569 return ldb_module_done(ac->req, NULL, NULL,
2570 ldb_oom(ldb));
2571 }
2572 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2573 talloc_free(ares);
2574 return ldb_module_done(ac->req, NULL, NULL,
2575 ldb_oom(ldb));
2576 }
2577 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2578 talloc_free(ares);
2579 return ldb_module_done(ac->req, NULL, NULL,
2580 ldb_oom(ldb));
2581 }
2582
2583 /*
2584 * here we let replmd_update_rpmd() only search for
2585 * the existing "replPropertyMetaData" and rdn_name attributes.
2586 *
2587 * We do not want the existing "name" attribute as
2588 * the "name" attribute needs to get the version
2589 * updated on rename even if the rdn value hasn't changed.
2590 *
2591 * This is the diff of the meta data, for a moved user
2592 * on a w2k8r2 server:
2593 *
2594 * # record 1
2595 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2596 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2597 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2598 * version : 0x00000001 (1)
2599 * reserved : 0x00000000 (0)
2600 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2601 * local_usn : 0x00000000000037a5 (14245)
2602 * array: struct replPropertyMetaData1
2603 * attid : DRSUAPI_ATTID_name (0x90001)
2604 * - version : 0x00000001 (1)
2605 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2606 * + version : 0x00000002 (2)
2607 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2608 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2609 * - originating_usn : 0x00000000000037a5 (14245)
2610 * - local_usn : 0x00000000000037a5 (14245)
2611 * + originating_usn : 0x0000000000003834 (14388)
2612 * + local_usn : 0x0000000000003834 (14388)
2613 * array: struct replPropertyMetaData1
2614 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2615 * version : 0x00000004 (4)
2616 */
2617 attrs[0] = "replPropertyMetaData";
2618 attrs[1] = "objectClass";
2619 attrs[2] = "instanceType";
2620 attrs[3] = rdn_name;
2621 attrs[4] = NULL;
2622
2623 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2624 msg, &ac->seq_num, t, &is_urgent, &rodc);
2625 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2626 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2627 struct loadparm_context *lp_ctx;
2628 char *referral;
2629
2630 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2631 struct loadparm_context);
2632
2633 referral = talloc_asprintf(req,
2634 "ldap://%s/%s",
2635 lpcfg_dnsdomain(lp_ctx),
2636 ldb_dn_get_linearized(olddn));
2637 ret = ldb_module_send_referral(req, referral);
2638 talloc_free(ares);
2639 return ldb_module_done(req, NULL, NULL, ret);
2640 }
2641
2642 if (ret != LDB_SUCCESS) {
2643 talloc_free(ares);
2644 return ldb_module_done(ac->req, NULL, NULL, ret);
2645 }
2646
2647 if (ac->seq_num == 0) {
2648 talloc_free(ares);
2649 return ldb_module_done(ac->req, NULL, NULL,
2650 ldb_error(ldb, ret,
2651 "internal error seq_num == 0"));
2652 }
2653 ac->is_urgent = is_urgent;
2654
2655 ret = ldb_build_mod_req(&down_req, ldb, ac,
2656 msg,
2657 req->controls,
2658 ac, replmd_op_callback,
2659 req);
2660 LDB_REQ_SET_LOCATION(down_req);
2661 if (ret != LDB_SUCCESS) {
2662 talloc_free(ac);
2663 return ret;
2664 }
2665
2666 /* current partition control is needed by "replmd_op_callback" */
2667 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2668 ret = ldb_request_add_control(down_req,
2669 DSDB_CONTROL_CURRENT_PARTITION_OID,
2670 false, NULL);
2671 if (ret != LDB_SUCCESS) {
2672 talloc_free(ac);
2673 return ret;
2674 }
2675 }
2676
2677 talloc_steal(down_req, msg);
2678
2679 ret = add_time_element(msg, "whenChanged", t);
2680 if (ret != LDB_SUCCESS) {
2681 talloc_free(ac);
2682 ldb_operr(ldb);
2683 return ret;
2684 }
2685
2686 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2687 if (ret != LDB_SUCCESS) {
2688 talloc_free(ac);
2689 ldb_operr(ldb);
2690 return ret;
2691 }
2692
2693 /* go on with the call chain - do the modify after the rename */
2694 return ldb_next_request(ac->module, down_req);
2695 }
2696
2697 /*
2698 remove links from objects that point at this object when an object
2699 is deleted
2700 */
2701 static int replmd_delete_remove_link(struct ldb_module *module,
2702 const struct dsdb_schema *schema,
2703 struct ldb_dn *dn,
2704 struct ldb_message_element *el,
2705 const struct dsdb_attribute *sa,
2706 struct ldb_request *parent)
2707 {
2708 unsigned int i;
2709 TALLOC_CTX *tmp_ctx = talloc_new(module);
2710 struct ldb_context *ldb = ldb_module_get_ctx(module);
2711
2712 for (i=0; i<el->num_values; i++) {
2713 struct dsdb_dn *dsdb_dn;
2714 NTSTATUS status;
2715 int ret;
2716 struct GUID guid2;
2717 struct ldb_message *msg;
2718 const struct dsdb_attribute *target_attr;
2719 struct ldb_message_element *el2;
2720 struct ldb_val dn_val;
2721
2722 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2723 continue;
2724 }
2725
2726 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2727 if (!dsdb_dn) {
2728 talloc_free(tmp_ctx);
2729 return LDB_ERR_OPERATIONS_ERROR;
2730 }
2731
2732 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2733 if (!NT_STATUS_IS_OK(status)) {
2734 talloc_free(tmp_ctx);
2735 return LDB_ERR_OPERATIONS_ERROR;
2736 }
2737
2738 /* remove the link */
2739 msg = ldb_msg_new(tmp_ctx);
2740 if (!msg) {
2741 ldb_module_oom(module);
2742 talloc_free(tmp_ctx);
2743 return LDB_ERR_OPERATIONS_ERROR;
2744 }
2745
2746
2747 msg->dn = dsdb_dn->dn;
2748
2749 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2750 if (target_attr == NULL) {
2751 continue;
2752 }
2753
2754 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2755 if (ret != LDB_SUCCESS) {
2756 ldb_module_oom(module);
2757 talloc_free(tmp_ctx);
2758 return LDB_ERR_OPERATIONS_ERROR;
2759 }
2760 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2761 el2->values = &dn_val;
2762 el2->num_values = 1;
2763
2764 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2765 if (ret != LDB_SUCCESS) {
2766 talloc_free(tmp_ctx);
2767 return ret;
2768 }
2769 }
2770 talloc_free(tmp_ctx);
2771 return LDB_SUCCESS;
2772 }
2773
2774
2775 /*
2776 handle update of replication meta data for deletion of objects
2777
2778 This also handles the mapping of delete to a rename operation
2779 to allow deletes to be replicated.
2780 */
2781 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2782 {
2783 int ret = LDB_ERR_OTHER;
2784 bool retb, disallow_move_on_delete;
2785 struct ldb_dn *old_dn, *new_dn;
2786 const char *rdn_name;
2787 const struct ldb_val *rdn_value, *new_rdn_value;
2788 struct GUID guid;
2789 struct ldb_context *ldb = ldb_module_get_ctx(module);
2790 const struct dsdb_schema *schema;
2791 struct ldb_message *msg, *old_msg;
2792 struct ldb_message_element *el;
2793 TALLOC_CTX *tmp_ctx;
2794 struct ldb_result *res, *parent_res;
2795 const char *preserved_attrs[] = {
2796 /* yes, this really is a hard coded list. See MS-ADTS
2797 section 3.1.1.5.5.1.1 */
2798 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2799 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2800 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2801 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2802 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2803 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2804 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2805 "whenChanged", NULL};
2806 unsigned int i, el_count = 0;
2807 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2808 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2809 enum deletion_state deletion_state, next_deletion_state;
2810 bool enabled;
2811
2812 if (ldb_dn_is_special(req->op.del.dn)) {
2813 return ldb_next_request(module, req);
2814 }
2815
2816 tmp_ctx = talloc_new(ldb);
2817 if (!tmp_ctx) {
2818 ldb_oom(ldb);
2819 return LDB_ERR_OPERATIONS_ERROR;
2820 }
2821
2822 schema = dsdb_get_schema(ldb, tmp_ctx);
2823 if (!schema) {
2824 return LDB_ERR_OPERATIONS_ERROR;
2825 }
2826
2827 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2828
2829 /* we need the complete msg off disk, so we can work out which
2830 attributes need to be removed */
2831 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2832 DSDB_FLAG_NEXT_MODULE |
2833 DSDB_SEARCH_SHOW_RECYCLED |
2834 DSDB_SEARCH_REVEAL_INTERNALS |
2835 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2836 if (ret != LDB_SUCCESS) {
2837 talloc_free(tmp_ctx);
2838 return ret;
2839 }
2840 old_msg = res->msgs[0];
2841
2842
2843 ret = dsdb_recyclebin_enabled(module, &enabled);
2844 if (ret != LDB_SUCCESS) {
2845 talloc_free(tmp_ctx);
2846 return ret;
2847 }
2848
2849 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2850 if (!enabled) {
2851 deletion_state = OBJECT_TOMBSTONE;
2852 next_deletion_state = OBJECT_REMOVED;
2853 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2854 deletion_state = OBJECT_RECYCLED;
2855 next_deletion_state = OBJECT_REMOVED;
2856 } else {
2857 deletion_state = OBJECT_DELETED;
2858 next_deletion_state = OBJECT_RECYCLED;
2859 }
2860 } else {
2861 deletion_state = OBJECT_NOT_DELETED;
2862 if (enabled) {
2863 next_deletion_state = OBJECT_DELETED;
2864 } else {
2865 next_deletion_state = OBJECT_TOMBSTONE;
2866 }
2867 }
2868
2869 if (next_deletion_state == OBJECT_REMOVED) {
2870 struct auth_session_info *session_info =
2871 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2872 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2873 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2874 ldb_dn_get_linearized(old_msg->dn));
2875 return LDB_ERR_UNWILLING_TO_PERFORM;
2876 }
2877
2878 /* it is already deleted - really remove it this time */
2879 talloc_free(tmp_ctx);
2880 return ldb_next_request(module, req);
2881 }
2882
2883 rdn_name = ldb_dn_get_rdn_name(old_dn);
2884 rdn_value = ldb_dn_get_rdn_val(old_dn);
2885 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2886 talloc_free(tmp_ctx);
2887 return ldb_operr(ldb);
2888 }
2889
2890 msg = ldb_msg_new(tmp_ctx);
2891 if (msg == NULL) {
2892 ldb_module_oom(module);
2893 talloc_free(tmp_ctx);
2894 return LDB_ERR_OPERATIONS_ERROR;
2895 }
2896
2897 msg->dn = old_dn;
2898
2899 if (deletion_state == OBJECT_NOT_DELETED){
2900 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2901 disallow_move_on_delete =
2902 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2903 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2904
2905 /* work out where we will be renaming this object to */
2906 if (!disallow_move_on_delete) {
2907 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2908 &new_dn);
2909 if (ret != LDB_SUCCESS) {
2910 /* this is probably an attempted delete on a partition
2911 * that doesn't allow delete operations, such as the
2912 * schema partition */
2913 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2914 ldb_dn_get_linearized(old_dn));
2915 talloc_free(tmp_ctx);
2916 return LDB_ERR_UNWILLING_TO_PERFORM;
2917 }
2918 } else {
2919 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2920 if (new_dn == NULL) {
2921 ldb_module_oom(module);
2922 talloc_free(tmp_ctx);
2923 return LDB_ERR_OPERATIONS_ERROR;
2924 }
2925 }
2926
2927 /* get the objects GUID from the search we just did */
2928 guid = samdb_result_guid(old_msg, "objectGUID");
2929
2930 /* Add a formatted child */
2931 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2932 rdn_name,
2933 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2934 GUID_string(tmp_ctx, &guid));
2935 if (!retb) {
2936 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2937 ldb_dn_get_linearized(new_dn)));
2938 talloc_free(tmp_ctx);
2939 return LDB_ERR_OPERATIONS_ERROR;
2940 }
2941
2942 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2943 if (ret != LDB_SUCCESS) {
2944 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2945 ldb_module_oom(module);
2946 talloc_free(tmp_ctx);
2947 return ret;
2948 }
2949 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2950 }
2951
2952 /*
2953 now we need to modify the object in the following ways:
2954
2955 - add isDeleted=TRUE
2956 - update rDN and name, with new rDN
2957 - remove linked attributes
2958 - remove objectCategory and sAMAccountType
2959 - remove attribs not on the preserved list
2960 - preserved if in above list, or is rDN
2961 - remove all linked attribs from this object
2962 - remove all links from other objects to this object
2963 - add lastKnownParent
2964 - update replPropertyMetaData?
2965
2966 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2967 */
2968
2969 /* we need the storage form of the parent GUID */
2970 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2971 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2972 DSDB_FLAG_NEXT_MODULE |
2973 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2974 DSDB_SEARCH_REVEAL_INTERNALS|
2975 DSDB_SEARCH_SHOW_RECYCLED, req);
2976 if (ret != LDB_SUCCESS) {
2977 talloc_free(tmp_ctx);
2978 return ret;
2979 }
2980
2981 if (deletion_state == OBJECT_NOT_DELETED){
2982 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2983 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2984 if (ret != LDB_SUCCESS) {
2985 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2986 ldb_module_oom(module);
2987 talloc_free(tmp_ctx);
2988 return ret;
2989 }
2990 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2991 }
2992
2993 switch (next_deletion_state){
2994
2995 case OBJECT_DELETED:
2996
2997 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2998 if (ret != LDB_SUCCESS) {
2999 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
3000 ldb_module_oom(module);
3001 talloc_free(tmp_ctx);
3002 return ret;
3003 }
3004 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3005
3006 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3007 if (ret != LDB_SUCCESS) {
3008 talloc_free(tmp_ctx);
3009 ldb_module_oom(module);
3010 return ret;
3011 }
3012
3013 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3014 if (ret != LDB_SUCCESS) {
3015 talloc_free(tmp_ctx);
3016 ldb_module_oom(module);
3017 return ret;
3018 }
3019
3020 break;
3021
3022 case OBJECT_RECYCLED:
3023 case OBJECT_TOMBSTONE:
3024
3025 /*
3026 * we also mark it as recycled, meaning this object can't be
3027 * recovered (we are stripping its attributes).
3028 * This is done only if we have this schema object of course ...
3029 * This behavior is identical to the one of Windows 2008R2 which
3030 * always set the isRecycled attribute, even if the recycle-bin is
3031 * not activated and what ever the forest level is.
3032 */
3033 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3034 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3035 if (ret != LDB_SUCCESS) {
3036 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3037 ldb_module_oom(module);
3038 talloc_free(tmp_ctx);
3039 return ret;
3040 }
3041 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3042 }
3043
3044 /* work out which of the old attributes we will be removing */
3045 for (i=0; i<old_msg->num_elements; i++) {
3046 const struct dsdb_attribute *sa;
3047 el = &old_msg->elements[i];
3048 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3049 if (!sa) {
3050 talloc_free(tmp_ctx);
3051 return LDB_ERR_OPERATIONS_ERROR;
3052 }
3053 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3054 /* don't remove the rDN */
3055 continue;
3056 }
3057 if (sa->linkID && (sa->linkID & 1)) {
3058 /*
3059 we have a backlink in this object
3060 that needs to be removed. We're not
3061 allowed to remove it directly
3062 however, so we instead setup a
3063 modify to delete the corresponding
3064 forward link
3065 */
3066 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3067 if (ret != LDB_SUCCESS) {
3068 talloc_free(tmp_ctx);
3069 return LDB_ERR_OPERATIONS_ERROR;
3070 }
3071 /* now we continue, which means we
3072 won't remove this backlink
3073 directly
3074 */
3075 continue;
3076 }
3077 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
3078 continue;
3079 }
3080 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3081 if (ret != LDB_SUCCESS) {
3082 talloc_free(tmp_ctx);
3083 ldb_module_oom(module);
3084 return ret;
3085 }
3086 }
3087 break;
3088
3089 default:
3090 break;
3091 }
3092
3093 if (deletion_state == OBJECT_NOT_DELETED) {
3094 const struct dsdb_attribute *sa;
3095
3096 /* work out what the new rdn value is, for updating the
3097 rDN and name fields */
3098 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3099 if (new_rdn_value == NULL) {
3100 talloc_free(tmp_ctx);
3101 return ldb_operr(ldb);
3102 }
3103
3104 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3105 if (!sa) {
3106 talloc_free(tmp_ctx);
3107 return LDB_ERR_OPERATIONS_ERROR;
3108 }
3109
3110 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3111 &el);
3112 if (ret != LDB_SUCCESS) {
3113 talloc_free(tmp_ctx);
3114 return ret;
3115 }
3116 el->flags = LDB_FLAG_MOD_REPLACE;
3117
3118 el = ldb_msg_find_element(old_msg, "name");
3119 if (el) {
3120 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3121 if (ret != LDB_SUCCESS) {
3122 talloc_free(tmp_ctx);
3123 return ret;
3124 }
3125 el->flags = LDB_FLAG_MOD_REPLACE;
3126 }
3127 }
3128
3129 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3130 if (ret != LDB_SUCCESS) {
3131 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3132 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3133 talloc_free(tmp_ctx);
3134 return ret;
3135 }
3136
3137 if (deletion_state == OBJECT_NOT_DELETED) {
3138 /* now rename onto the new DN */
3139 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3140 if (ret != LDB_SUCCESS){
3141 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3142 ldb_dn_get_linearized(old_dn),
3143 ldb_dn_get_linearized(new_dn),
3144 ldb_errstring(ldb)));
3145 talloc_free(tmp_ctx);
3146 return ret;
3147 }
3148 }
3149
3150 talloc_free(tmp_ctx);
3151
3152 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3153 }
3154
3155
3156
3157 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3158 {
3159 return ret;
3160 }
3161
3162 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3163 {
3164 int ret = LDB_ERR_OTHER;
3165 /* TODO: do some error mapping */
3166 return ret;
3167 }
3168
3169
3170 static struct replPropertyMetaData1 *
3171 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3172 enum drsuapi_DsAttributeId attid)
3173 {
3174 uint32_t i;
3175 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3176
3177 for (i = 0; i < rpmd_ctr->count; i++) {
3178 if (rpmd_ctr->array[i].attid == attid) {
3179 return &rpmd_ctr->array[i];
3180 }
3181 }
3182 return NULL;
3183 }
3184
3185
3186 /*
3187 return true if an update is newer than an existing entry
3188 see section 5.11 of MS-ADTS
3189 */
3190 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3191 const struct GUID *update_invocation_id,
3192 uint32_t current_version,
3193 uint32_t update_version,
3194 NTTIME current_change_time,
3195 NTTIME update_change_time)
3196 {
3197 if (update_version != current_version) {
3198 return update_version > current_version;
3199 }
3200 if (update_change_time != current_change_time) {
3201 return update_change_time > current_change_time;
3202 }
3203 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3204 }
3205
3206 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3207 struct replPropertyMetaData1 *new_m)
3208 {
3209 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3210 &new_m->originating_invocation_id,
3211 cur_m->version,
3212 new_m->version,
3213 cur_m->originating_change_time,
3214 new_m->originating_change_time);
3215 }
3216
3217
3218 /*
3219 form a conflict DN
3220 */
3221 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3222 {
3223 const struct ldb_val *rdn_val;
3224 const char *rdn_name;
3225 struct ldb_dn *new_dn;
3226
3227 rdn_val = ldb_dn_get_rdn_val(dn);
3228 rdn_name = ldb_dn_get_rdn_name(dn);
3229 if (!rdn_val || !rdn_name) {
3230 return NULL;
3231 }
3232
3233 new_dn = ldb_dn_copy(mem_ctx, dn);
3234 if (!new_dn) {
3235 return NULL;
3236 }
3237
3238 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3239 return NULL;
3240 }
3241
3242 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3243 rdn_name,
3244 ldb_dn_escape_value(new_dn, *rdn_val),
3245 GUID_string(new_dn, guid))) {
3246 return NULL;
3247 }
3248
3249 return new_dn;
3250 }
3251
3252
3253 /*
3254 perform a modify operation which sets the rDN and name attributes to
3255 their current values. This has the effect of changing these
3256 attributes to have been last updated by the current DC. This is
3257 needed to ensure that renames performed as part of conflict
3258 resolution are propogated to other DCs
3259 */
3260 static int replmd_name_modify(struct replmd_replicated_request *ar,
3261 struct ldb_request *req, struct ldb_dn *dn)
3262 {
3263 struct ldb_message *msg;
3264 const char *rdn_name;
3265 const struct ldb_val *rdn_val;
3266 const struct dsdb_attribute *rdn_attr;
3267 int ret;
3268
3269 msg = ldb_msg_new(req);
3270 if (msg == NULL) {
3271 goto failed;
3272 }
3273 msg->dn = dn;
3274
3275 rdn_name = ldb_dn_get_rdn_name(dn);
3276 if (rdn_name == NULL) {
3277 goto failed;
3278 }
3279
3280 /* normalize the rdn attribute name */
3281 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3282 if (rdn_attr == NULL) {
3283 goto failed;
3284 }
3285 rdn_name = rdn_attr->lDAPDisplayName;
3286
3287 rdn_val = ldb_dn_get_rdn_val(dn);
3288 if (rdn_val == NULL) {
3289 goto failed;
3290 }
3291
3292 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3293 goto failed;
3294 }
3295 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3296 goto failed;
3297 }
3298 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3299 goto failed;
3300 }
3301 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3302 goto failed;
3303 }
3304
3305 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3306 if (ret != LDB_SUCCESS) {
3307 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3308 ldb_dn_get_linearized(dn),
3309 ldb_errstring(ldb_module_get_ctx(ar->module))));
3310 return ret;
3311 }
3312
3313 talloc_free(msg);
3314
3315 return LDB_SUCCESS;
3316
3317 failed:
3318 talloc_free(msg);
3319 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3320 ldb_dn_get_linearized(dn)));
3321 return LDB_ERR_OPERATIONS_ERROR;
3322 }
3323
3324
3325 /*
3326 callback for conflict DN handling where we have renamed the incoming
3327 record. After renaming it, we need to ensure the change of name and
3328 rDN for the incoming record is seen as an originating update by this DC.
3329 */
3330 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3331 {
3332 struct replmd_replicated_request *ar =
3333 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3334 int ret;
3335
3336 if (ares->error != LDB_SUCCESS) {
3337 /* call the normal callback for everything except success */
3338 return replmd_op_callback(req, ares);
3339 }
3340
3341 /* perform a modify of the rDN and name of the record */
3342 ret = replmd_name_modify(ar, req, req->op.add.message->dn);
3343 if (ret != LDB_SUCCESS) {
3344 ares->error = ret;
3345 return replmd_op_callback(req, ares);
3346 }
3347
3348 return replmd_op_callback(req, ares);
3349 }
3350
3351 /*
3352 callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
3353 This copes with the creation of conflict records in the case where
3354 the DN exists, but with a different objectGUID
3355 */
3356 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3357 {
3358 struct ldb_dn *conflict_dn;
3359 struct replmd_replicated_request *ar =
3360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3361 struct ldb_result *res;
3362 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3363 int ret;
3364 const struct ldb_val *rmd_value, *omd_value;
3365 struct replPropertyMetaDataBlob omd, rmd;
3366 enum ndr_err_code ndr_err;
3367 bool rename_incoming_record, rodc;
3368 struct replPropertyMetaData1 *rmd_name, *omd_name;
3369
3370 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3371 /* call the normal callback for everything except
3372 conflicts */
3373 return callback(req, ares);
3374 }
3375
3376 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3377 if (ret != LDB_SUCCESS) {
3378 return ret;
3379 }
3380 /*
3381 * we have a conflict, and need to decide if we will keep the
3382 * new record or the old record
3383 */
3384
3385 switch (req->operation) {
3386 case LDB_ADD:
3387 conflict_dn = req->op.add.message->dn;
3388 break;
3389 case LDB_RENAME:
3390 conflict_dn = req->op.rename.newdn;
3391 break;
3392 default:
3393 return ldb_module_operr(ar->module);
3394 }
3395
3396 if (rodc) {
3397 /*
3398 * We are on an RODC, or were a GC for this
3399 * partition, so we have to fail this until
3400 * someone who owns the partition sorts it
3401 * out
3402 */
3403 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3404 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3405 " - We must fail the operation until a master for this partition resolves the conflict",
3406 ldb_dn_get_linearized(conflict_dn));
3407 goto failed;
3408 }
3409
3410 /*
3411 * first we need the replPropertyMetaData attribute from the
3412 * old record
3413 */
3414 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3415 attrs,
3416 DSDB_FLAG_NEXT_MODULE |
3417 DSDB_SEARCH_SHOW_DELETED |
3418 DSDB_SEARCH_SHOW_RECYCLED, req);
3419 if (ret != LDB_SUCCESS) {
3420 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3421 ldb_dn_get_linearized(conflict_dn)));
3422 goto failed;
3423 }
3424
3425 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3426 if (omd_value == NULL) {
3427 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3428 ldb_dn_get_linearized(conflict_dn)));
3429 goto failed;
3430 }
3431
3432 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3433 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3434 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3435 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3436 ldb_dn_get_linearized(conflict_dn)));
3437 goto failed;
3438 }
3439
3440 /*
3441 * and the replPropertyMetaData attribute from the
3442 * new record
3443 */
3444 rmd_value = ldb_msg_find_ldb_val(req->op.add.message, "replPropertyMetaData");
3445 if (rmd_value == NULL) {
3446 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for new record '%s'\n",
3447 ldb_dn_get_linearized(conflict_dn)));
3448 goto failed;
3449 }
3450
3451 ndr_err = ndr_pull_struct_blob(rmd_value, req, &rmd,
3452 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3453 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3454 DEBUG(0,(__location__ ": Failed to parse new replPropertyMetaData for %s\n",
3455 ldb_dn_get_linearized(conflict_dn)));
3456 goto failed;
3457 }
3458
3459 /* we decide which is newer based on the RPMD on the name
3460 attribute. See [MS-DRSR] ResolveNameConflict */
3461 rmd_name = replmd_replPropertyMetaData1_find_attid(&rmd, DRSUAPI_ATTID_name);
3462 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3463 if (!rmd_name || !omd_name) {
3464 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3465 ldb_dn_get_linearized(conflict_dn)));
3466 goto failed;
3467 }
3468
3469 rename_incoming_record = !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3470
3471 if (rename_incoming_record) {
3472 struct GUID guid;
3473 struct ldb_dn *new_dn;
3474 struct ldb_message *new_msg;
3475
3476 if (req->operation == LDB_RENAME) {
3477 DEBUG(0,(__location__ ": Unable to handle incoming renames where this would "
3478 "create a conflict. Incoming record is %s\n",
3479 ldb_dn_get_extended_linearized(req, conflict_dn, 1)));
3480 goto failed;
3481 }
3482
3483 guid = samdb_result_guid(req->op.add.message, "objectGUID");
3484 if (GUID_all_zero(&guid)) {
3485 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3486 ldb_dn_get_linearized(conflict_dn)));
3487 goto failed;
3488 }
3489 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3490 if (new_dn == NULL) {
3491 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3492 ldb_dn_get_linearized(conflict_dn)));
3493 goto failed;
3494 }
3495
3496 DEBUG(1,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3497 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3498
3499 switch (req->operation) {
3500 case LDB_ADD:
3501 /* re-submit the request, but with a different
3502 callback, so we don't loop forever. */
3503 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
3504 if (!new_msg) {
3505 goto failed;
3506 DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3507 ldb_dn_get_linearized(conflict_dn)));
3508 }
3509 new_msg->dn = new_dn;
3510 req->op.add.message = new_msg;
3511 req->callback = replmd_op_name_modify_callback;
3512 break;
3513 case LDB_RENAME:
3514 req->op.rename.newdn = new_dn;
3515 req->callback = callback;
3516 break;
3517 default:
3518 return ldb_module_operr(ar->module);
3519 }
3520
3521 return ldb_next_request(ar->module, req);
3522 } else {
3523 /* we are renaming the existing record */
3524 struct GUID guid;
3525 struct ldb_dn *new_dn;
3526
3527 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3528 if (GUID_all_zero(&guid)) {
3529 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3530 ldb_dn_get_linearized(conflict_dn)));
3531 goto failed;
3532 }
3533
3534 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3535 if (new_dn == NULL) {
3536 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3537 ldb_dn_get_linearized(conflict_dn)));
3538 goto failed;
3539 }
3540
3541 DEBUG(1,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3542 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3543
3544 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3545 DSDB_FLAG_OWN_MODULE, req);
3546 if (ret != LDB_SUCCESS) {
3547 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3548 ldb_dn_get_linearized(conflict_dn),
3549 ldb_dn_get_linearized(new_dn),
3550 ldb_errstring(ldb_module_get_ctx(ar->module))));
3551 goto failed;
3552 }
3553
3554 /*
3555 * now we need to ensure that the rename is seen as an
3556 * originating update. We do that with a modify.
3557 */
3558 ret = replmd_name_modify(ar, req, new_dn);
3559 if (ret != LDB_SUCCESS) {
3560 goto failed;
3561 }
3562
3563 req->callback = callback;
3564
3565 return ldb_next_request(ar->module, req);
3566 }
3567
3568 failed:
3569 /* on failure do the original callback. This means replication
3570 * will stop with an error, but there is not much else we can
3571 * do
3572 */
3573 return callback(req, ares);
3574 }
3575
3576 /*
3577 callback for replmd_replicated_apply_add()
3578 This copes with the creation of conflict records in the case where
3579 the DN exists, but with a different objectGUID
3580 */
3581 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3582 {
3583 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
3584 }
3585
3586 /*
3587 callback for replmd_replicated_handle_rename()
3588 This copes with the creation of conflict records in the case where
3589 the DN exists, but with a different objectGUID
3590 */
3591 static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
3592 {
3593 return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
3594 }
3595
3596 /*
3597 this is called when a new object comes in over DRS
3598 */
3599 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3600 {
3601 struct ldb_context *ldb;
3602 struct ldb_request *change_req;
3603 enum ndr_err_code ndr_err;
3604 struct ldb_message *msg;
3605 struct replPropertyMetaDataBlob *md;
3606 struct ldb_val md_value;
3607 unsigned int i;
3608 int ret;
3609
3610 /*
3611 * TODO: check if the parent object exist
3612 */
3613
3614 /*
3615 * TODO: handle the conflict case where an object with the
3616 * same name exist
3617 */
3618
3619 ldb = ldb_module_get_ctx(ar->module);
3620 msg = ar->objs->objects[ar->index_current].msg;
3621 md = ar->objs->objects[ar->index_current].meta_data;
3622
3623 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3624 if (ret != LDB_SUCCESS) {
3625 return replmd_replicated_request_error(ar, ret);
3626 }
3627
3628 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3629 if (ret != LDB_SUCCESS) {
3630 return replmd_replicated_request_error(ar, ret);
3631 }
3632
3633 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3634 if (ret != LDB_SUCCESS) {
3635 return replmd_replicated_request_error(ar, ret);
3636 }
3637
3638 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3639 if (ret != LDB_SUCCESS) {
3640 return replmd_replicated_request_error(ar, ret);
3641 }
3642
3643 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3644 if (ret != LDB_SUCCESS) {
3645 return replmd_replicated_request_error(ar, ret);
3646 }
3647
3648 /* remove any message elements that have zero values */
3649 for (i=0; i<msg->num_elements; i++) {
3650 struct ldb_message_element *el = &msg->elements[i];
3651
3652 if (el->num_values == 0) {
3653 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3654 el->name));
3655 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3656 msg->num_elements--;
3657 i--;
3658 continue;
3659 }
3660 }
3661
3662 /*
3663 * the meta data array is already sorted by the caller
3664 */
3665 for (i=0; i < md->ctr.ctr1.count; i++) {
3666 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3667 }
3668 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3669 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3670 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3671 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3672 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3673 }
3674 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3675 if (ret != LDB_SUCCESS) {
3676 return replmd_replicated_request_error(ar, ret);
3677 }
3678
3679 replmd_ldb_message_sort(msg, ar->schema);
3680
3681 if (DEBUGLVL(4)) {
3682 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3683 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3684 talloc_free(s);
3685 }
3686
3687 ret = ldb_build_add_req(&change_req,
3688 ldb,
3689 ar,
3690 msg,
3691 ar->controls,
3692 ar,
3693 replmd_op_add_callback,
3694 ar->req);
3695 LDB_REQ_SET_LOCATION(change_req);
3696 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3697
3698 /* current partition control needed by "repmd_op_callback" */
3699 ret = ldb_request_add_control(change_req,
3700 DSDB_CONTROL_CURRENT_PARTITION_OID,
3701 false, NULL);
3702 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3703
3704 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
3705 /* this tells the partition module to make it a
3706 partial replica if creating an NC */
3707 ret = ldb_request_add_control(change_req,
3708 DSDB_CONTROL_PARTIAL_REPLICA,
3709 false, NULL);
3710 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3711 }
3712
3713 return ldb_next_request(ar->module, change_req);
3714 }
3715
3716 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
3717 struct ldb_reply *ares)
3718 {
3719 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3720 struct replmd_replicated_request);
3721 int ret;
3722
3723 if (!ares) {
3724 return ldb_module_done(ar->req, NULL, NULL,
3725 LDB_ERR_OPERATIONS_ERROR);
3726 }
3727 if (ares->error != LDB_SUCCESS &&
3728 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3729 return ldb_module_done(ar->req, ares->controls,
3730 ares->response, ares->error);
3731 }
3732
3733 switch (ares->type) {
3734 case LDB_REPLY_ENTRY:
3735 {
3736 struct ldb_message *parent_msg = ares->message;
3737 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
3738 struct ldb_dn *parent_dn;
3739 int comp_num = ldb_dn_get_comp_num(msg->dn);
3740 if (comp_num > 1) {
3741 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
3742 talloc_free(ares);
3743 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3744 }
3745 }
3746 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
3747 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
3748 /* Per MS-DRSR 4.1.10.6.10
3749 * FindBestParentObject we need to move this
3750 * new object under a deleted object to
3751 * lost-and-found */
3752
3753 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
3754 ldb_get_default_basedn(ldb_module_get_ctx(ar->module)),
3755 DS_GUID_LOSTANDFOUND_CONTAINER,
3756 &parent_dn);
3757 if (ret != LDB_SUCCESS) {
3758 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3759 }
3760 } else {
3761 parent_dn = parent_msg->dn;
3762 }
3763 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
3764 talloc_free(ares);
3765 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3766 }
3767 break;
3768 }
3769 case LDB_REPLY_REFERRAL:
3770 /* we ignore referrals */
3771 break;
3772
3773 case LDB_REPLY_DONE:
3774 ret = replmd_replicated_apply_add(ar);
3775 if (ret != LDB_SUCCESS) {
3776 return ldb_module_done(ar->req, NULL, NULL, ret);
3777 }
3778 }
3779
3780 talloc_free(ares);
3781 return LDB_SUCCESS;
3782 }
3783
3784 /*
3785 * Look for the parent object, so we put the new object in the right place
3786 */
3787
3788 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
3789 {
3790 struct ldb_context *ldb;
3791 int ret;
3792 char *tmp_str;
3793 char *filter;
3794 struct ldb_request *search_req;
3795 static const char *attrs[] = {"isDeleted", NULL};
3796
3797 ldb = ldb_module_get_ctx(ar->module);
3798
3799 if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
3800 return replmd_replicated_apply_add(ar);
3801 }
3802
3803 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
3804 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3805
3806 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3807 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3808 talloc_free(tmp_str);
3809
3810 ret = ldb_build_search_req(&search_req,
3811 ldb,
3812 ar,
3813 ar->objs->partition_dn,
3814 LDB_SCOPE_SUBTREE,
3815 filter,
3816 attrs,
3817 NULL,
3818 ar,
3819 replmd_replicated_apply_search_for_parent_callback,
3820 ar->req);
3821 LDB_REQ_SET_LOCATION(search_req);
3822
3823 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3824 true, NULL);
3825 if (ret != LDB_SUCCESS) {
3826 return ret;
3827 }
3828
3829 return ldb_next_request(ar->module, search_req);
3830 }
3831
3832 /*
3833 handle renames that come in over DRS replication
3834 */
3835 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3836 struct ldb_message *msg,
3837 struct replPropertyMetaDataBlob *rmd,
3838 struct replPropertyMetaDataBlob *omd,
3839 struct ldb_request *parent)
3840 {
3841 struct replPropertyMetaData1 *md_remote;
3842 struct replPropertyMetaData1 *md_local;
3843
3844 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3845 /* no rename */
3846 return LDB_SUCCESS;
3847 }
3848
3849 /* now we need to check for double renames. We could have a
3850 * local rename pending which our replication partner hasn't
3851 * received yet. We choose which one wins by looking at the
3852 * attribute stamps on the two objects, the newer one wins
3853 */
3854 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3855 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3856 /* if there is no name attribute then we have to assume the
3857 object we've received is in fact newer */
3858 if (!md_remote || !md_local ||
3859 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3860 struct ldb_request *req;
3861 int ret;
3862 TALLOC_CTX *tmp_ctx = talloc_new(msg);
3863 struct ldb_result *res;
3864
3865 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3866 ldb_dn_get_linearized(ar->search_msg->dn),
3867 ldb_dn_get_linearized(msg->dn)));
3868
3869
3870 res = talloc_zero(tmp_ctx, struct ldb_result);
3871 if (!res) {
3872 talloc_free(tmp_ctx);
3873 return ldb_oom(ldb_module_get_ctx(ar->module));
3874 }
3875
3876 /* pass rename to the next module
3877 * so it doesn't appear as an originating update */
3878 ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
3879 ar->search_msg->dn, msg->dn,
3880 NULL,
3881 ar,
3882 replmd_op_rename_callback,
3883 parent);
3884 LDB_REQ_SET_LOCATION(req);
3885 if (ret != LDB_SUCCESS) {
3886 talloc_free(tmp_ctx);
3887 return ret;
3888 }
3889
3890 ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
3891 if (ret != LDB_SUCCESS) {
3892 talloc_free(tmp_ctx);
3893 return ret;
3894 }
3895
3896 ret = ldb_next_request(ar->module, req);
3897
3898 if (ret == LDB_SUCCESS) {
3899 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
3900 }
3901
3902 talloc_free(tmp_ctx);
3903 return ret;
3904 }
3905
3906 /* we're going to keep our old object */
3907 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3908 ldb_dn_get_linearized(ar->search_msg->dn),
3909 ldb_dn_get_linearized(msg->dn)));
3910 return LDB_SUCCESS;
3911 }
3912
3913
3914 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3915 {
3916 struct ldb_context *ldb;
3917 struct ldb_request *change_req;
3918 enum ndr_err_code ndr_err;
3919 struct ldb_message *msg;
3920 struct replPropertyMetaDataBlob *rmd;
3921 struct replPropertyMetaDataBlob omd;
3922 const struct ldb_val *omd_value;
3923 struct replPropertyMetaDataBlob nmd;
3924 struct ldb_val nmd_value;
3925 unsigned int i;
3926 uint32_t j,ni=0;
3927 unsigned int removed_attrs = 0;
3928 int ret;
3929
3930 ldb = ldb_module_get_ctx(ar->module);
3931 msg = ar->objs->objects[ar->index_current].msg;
3932 rmd = ar->objs->objects[ar->index_current].meta_data;
3933 ZERO_STRUCT(omd);
3934 omd.version = 1;
3935
3936 /* find existing meta data */
3937 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3938 if (omd_value) {
3939 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3940 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3941 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3942 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3943 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3944 }
3945
3946 if (omd.version != 1) {
3947 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3948 }
3949 }
3950
3951 /* handle renames that come in over DRS */
3952 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
3953 if (ret != LDB_SUCCESS) {
3954 ldb_debug(ldb, LDB_DEBUG_FATAL,
3955 "replmd_replicated_request rename %s => %s failed - %s\n",
3956 ldb_dn_get_linearized(ar->search_msg->dn),
3957 ldb_dn_get_linearized(msg->dn),
3958 ldb_errstring(ldb));
3959 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3960 }
3961
3962 ZERO_STRUCT(nmd);
3963 nmd.version = 1;
3964 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3965 nmd.ctr.ctr1.array = talloc_array(ar,
3966 struct replPropertyMetaData1,
3967 nmd.ctr.ctr1.count);
3968 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3969
3970 /* first copy the old meta data */
3971 for (i=0; i < omd.ctr.ctr1.count; i++) {
3972 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3973 ni++;
3974 }
3975
3976 ar->seq_num = 0;
3977 /* now merge in the new meta data */
3978 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3979 bool found = false;
3980
3981 for (j=0; j < ni; j++) {
3982 bool cmp;
3983
3984 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3985 continue;
3986 }
3987
3988 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
3989 /* if we compare equal then do an
3990 update. This is used when a client
3991 asks for a FULL_SYNC, and can be
3992 used to recover a corrupt
3993 replica */
3994 cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
3995 &nmd.ctr.ctr1.array[j]);
3996 } else {
3997 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3998 &rmd->ctr.ctr1.array[i]);
3999 }
4000 if (cmp) {
4001 /* replace the entry */
4002 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4003 if (ar->seq_num == 0) {
4004 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4005 if (ret != LDB_SUCCESS) {
4006 return replmd_replicated_request_error(ar, ret);
4007 }
4008 }
4009 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4010 found = true;
4011 break;
4012 }
4013
4014 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4015 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4016 msg->elements[i-removed_attrs].name,
4017 ldb_dn_get_linearized(msg->dn),
4018 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4019 }
4020
4021 /* we don't want to apply this change so remove the attribute */
4022 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4023 removed_attrs++;
4024
4025 found = true;
4026 break;
4027 }
4028
4029 if (found) continue;
4030
4031 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4032 if (ar->seq_num == 0) {
4033 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4034 if (ret != LDB_SUCCESS) {
4035 return replmd_replicated_request_error(ar, ret);
4036 }
4037 }
4038 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4039 ni++;
4040 }
4041
4042 /*
4043 * finally correct the size of the meta_data array
4044 */
4045 nmd.ctr.ctr1.count = ni;
4046
4047 /*
4048 * the rdn attribute (the alias for the name attribute),
4049 * 'cn' for most objects is the last entry in the meta data array
4050 * we have stored
4051 *
4052 * sort the new meta data array
4053 */
4054 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
4055 if (ret != LDB_SUCCESS) {
4056 return ret;
4057 }
4058
4059 /*
4060 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4061 */
4062 if (msg->num_elements == 0) {
4063 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4064 ar->index_current);
4065
4066 ar->index_current++;
4067 return replmd_replicated_apply_next(ar);
4068 }
4069
4070 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4071 ar->index_current, msg->num_elements);
4072
4073 /* create the meta data value */
4074 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4075 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4076 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4077 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4078 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4079 }
4080
4081 /*
4082 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4083 * and replPopertyMetaData attributes
4084 */
4085 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4086 if (ret != LDB_SUCCESS) {
4087 return replmd_replicated_request_error(ar, ret);
4088 }
4089 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4090 if (ret != LDB_SUCCESS) {
4091 return replmd_replicated_request_error(ar, ret);
4092 }
4093 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4094 if (ret != LDB_SUCCESS) {
4095 return replmd_replicated_request_error(ar, ret);
4096 }
4097
4098 replmd_ldb_message_sort(msg, ar->schema);
4099
4100 /* we want to replace the old values */
4101 for (i=0; i < msg->num_elements; i++) {
4102 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4103 }
4104
4105 if (DEBUGLVL(4)) {
4106 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4107 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
4108 talloc_free(s);
4109 }
4110
4111 ret = ldb_build_mod_req(&change_req,
4112 ldb,
4113 ar,
4114 msg,
4115 ar->controls,
4116 ar,
4117 replmd_op_callback,
4118 ar->req);
4119 LDB_REQ_SET_LOCATION(change_req);
4120 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4121
4122 /* current partition control needed by "repmd_op_callback" */
4123 ret = ldb_request_add_control(change_req,
4124 DSDB_CONTROL_CURRENT_PARTITION_OID,
4125 false, NULL);
4126 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4127
4128 return ldb_next_request(ar->module, change_req);
4129 }
4130
4131 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
4132 struct ldb_reply *ares)
4133 {
4134 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4135 struct replmd_replicated_request);
4136 int ret;
4137
4138 if (!ares) {
4139 return ldb_module_done(ar->req, NULL, NULL,
4140 LDB_ERR_OPERATIONS_ERROR);
4141 }
4142 if (ares->error != LDB_SUCCESS &&
4143 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4144 return ldb_module_done(ar->req, ares->controls,
4145 ares->response, ares->error);
4146 }
4147
4148 switch (ares->type) {
4149 case LDB_REPLY_ENTRY:
4150 ar->search_msg = talloc_steal(ar, ares->message);
4151 break;
4152
4153 case LDB_REPLY_REFERRAL:
4154 /* we ignore referrals */
4155 break;
4156
4157 case LDB_REPLY_DONE:
4158 if (ar->search_msg != NULL) {
4159 ret = replmd_replicated_apply_merge(ar);
4160 } else {
4161 ret = replmd_replicated_apply_search_for_parent(ar);
4162 }
4163 if (ret != LDB_SUCCESS) {
4164 return ldb_module_done(ar->req, NULL, NULL, ret);
4165 }
4166 }
4167
4168 talloc_free(ares);
4169 return LDB_SUCCESS;
4170 }
4171
4172 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
4173
4174 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
4175 {
4176 struct ldb_context *ldb;
4177 int ret;
4178 char *tmp_str;
4179 char *filter;
4180 struct ldb_request *search_req;
4181 struct ldb_search_options_control *options;
4182
4183 if (ar->index_current >= ar->objs->num_objects) {
4184 /* done with it, go to next stage */
4185 return replmd_replicated_uptodate_vector(ar);
4186 }
4187
4188 ldb = ldb_module_get_ctx(ar->module);
4189 ar->search_msg = NULL;
4190
4191 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
4192 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4193
4194 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4195 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4196 talloc_free(tmp_str);
4197
4198 ret = ldb_build_search_req(&search_req,
4199 ldb,
4200 ar,
4201 NULL,
4202 LDB_SCOPE_SUBTREE,
4203 filter,
4204 NULL,
4205 NULL,
4206 ar,
4207 replmd_replicated_apply_search_callback,
4208 ar->req);
4209 LDB_REQ_SET_LOCATION(search_req);
4210
4211 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
4212 true, NULL);
4213 if (ret != LDB_SUCCESS) {
4214 return ret;
4215 }
4216
4217 /* we need to cope with cross-partition links, so search for
4218 the GUID over all partitions */
4219 options = talloc(search_req, struct ldb_search_options_control);
4220 if (options == NULL) {
4221 DEBUG(0, (__location__ ": out of memory\n"));
4222 return LDB_ERR_OPERATIONS_ERROR;
4223 }
4224 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
4225
4226 ret = ldb_request_add_control(search_req,
4227 LDB_CONTROL_SEARCH_OPTIONS_OID,
4228 true, options);
4229 if (ret != LDB_SUCCESS) {
4230 return ret;
4231 }
4232
4233 return ldb_next_request(ar->module, search_req);
4234 }
4235
4236 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
4237 struct ldb_reply *ares)
4238 {
4239 struct ldb_context *ldb;
4240 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4241 struct replmd_replicated_request);
4242 ldb = ldb_module_get_ctx(ar->module);
4243
4244 if (!ares) {
4245 return ldb_module_done(ar->req, NULL, NULL,
4246 LDB_ERR_OPERATIONS_ERROR);
4247 }
4248 if (ares->error != LDB_SUCCESS) {
4249 return ldb_module_done(ar->req, ares->controls,
4250 ares->response, ares->error);
4251 }
4252
4253 if (ares->type != LDB_REPLY_DONE) {
4254 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
4255 return ldb_module_done(ar->req, NULL, NULL,
4256 LDB_ERR_OPERATIONS_ERROR);
4257 }
4258
4259 talloc_free(ares);
4260
4261 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4262 }
4263
4264 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
4265 {
4266 struct ldb_context *ldb;
4267 struct ldb_request *change_req;
4268 enum ndr_err_code ndr_err;
4269 struct ldb_message *msg;
4270 struct replUpToDateVectorBlob ouv;
4271 const struct ldb_val *ouv_value;
4272 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
4273 struct replUpToDateVectorBlob nuv;
4274 struct ldb_val nuv_value;
4275 struct ldb_message_element *nuv_el = NULL;
4276 const struct GUID *our_invocation_id;
4277 struct ldb_message_element *orf_el = NULL;
4278 struct repsFromToBlob nrf;
4279 struct ldb_val *nrf_value = NULL;
4280 struct ldb_message_element *nrf_el = NULL;
4281 unsigned int i;
4282 uint32_t j,ni=0;
4283 bool found = false;
4284 time_t t = time(NULL);
4285 NTTIME now;
4286 int ret;
4287 uint32_t instanceType;
4288
4289 ldb = ldb_module_get_ctx(ar->module);
4290 ruv = ar->objs->uptodateness_vector;
4291 ZERO_STRUCT(ouv);
4292 ouv.version = 2;
4293 ZERO_STRUCT(nuv);
4294 nuv.version = 2;
4295
4296 unix_to_nt_time(&now, t);
4297
4298 if (ar->search_msg == NULL) {
4299 /* this happens for a REPL_OBJ call where we are
4300 creating the target object by replicating it. The
4301 subdomain join code does this for the partition DN
4302 */
4303 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
4304 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4305 }
4306
4307 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
4308 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
4309 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
4310 ldb_dn_get_linearized(ar->search_msg->dn)));
4311 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4312 }
4313
4314 /*
4315 * first create the new replUpToDateVector
4316 */
4317 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
4318 if (ouv_value) {
4319 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
4320 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
4321 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4322 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4323 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4324 }
4325
4326 if (ouv.version != 2) {
4327 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4328 }
4329 }
4330
4331 /*
4332 * the new uptodateness vector will at least
4333 * contain 1 entry, one for the source_dsa
4334 *
4335 * plus optional values from our old vector and the one from the source_dsa
4336 */
4337 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
4338 if (ruv) nuv.ctr.ctr2.count += ruv->count;
4339 nuv.ctr.ctr2.cursors = talloc_array(ar,
4340 struct drsuapi_DsReplicaCursor2,
4341 nuv.ctr.ctr2.count);
4342 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4343
4344 /* first copy the old vector */
4345 for (i=0; i < ouv.ctr.ctr2.count; i++) {
4346 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
4347 ni++;
4348 }
4349
4350 /* get our invocation_id if we have one already attached to the ldb */
4351 our_invocation_id = samdb_ntds_invocation_id(ldb);
4352
4353 /* merge in the source_dsa vector is available */
4354 for (i=0; (ruv && i < ruv->count); i++) {
4355 found = false;
4356
4357 if (our_invocation_id &&
4358 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4359 our_invocation_id)) {
4360 continue;
4361 }
4362
4363 for (j=0; j < ni; j++) {
4364 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4365 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4366 continue;
4367 }
4368
4369 found = true;
4370
4371 /*
4372 * we update only the highest_usn and not the latest_sync_success time,
4373 * because the last success stands for direct replication
4374 */
4375 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4376 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
4377 }
4378 break;
4379 }
4380
4381 if (found) continue;
4382
4383 /* if it's not there yet, add it */
4384 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4385 ni++;
4386 }
4387
4388 /*
4389 * merge in the current highwatermark for the source_dsa
4390 */
4391 found = false;
4392 for (j=0; j < ni; j++) {
4393 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
4394 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4395 continue;
4396 }
4397
4398 found = true;
4399
4400 /*
4401 * here we update the highest_usn and last_sync_success time
4402 * because we're directly replicating from the source_dsa
4403 *
4404 * and use the tmp_highest_usn because this is what we have just applied
4405 * to our ldb
4406 */
4407 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4408 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
4409 break;
4410 }
4411 if (!found) {
4412 /*
4413 * here we update the highest_usn and last_sync_success time
4414 * because we're directly replicating from the source_dsa
4415 *
4416 * and use the tmp_highest_usn because this is what we have just applied
4417 * to our ldb
4418 */
4419 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
4420 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4421 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
4422 ni++;
4423 }
4424
4425 /*
4426 * finally correct the size of the cursors array
4427 */
4428 nuv.ctr.ctr2.count = ni;
4429
4430 /*
4431 * sort the cursors
4432 */
4433 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4434
4435 /*
4436 * create the change ldb_message
4437 */
4438 msg = ldb_msg_new(ar);
4439 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4440 msg->dn = ar->search_msg->dn;
4441
4442 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4443 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4444 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4445 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4446 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4447 }
4448 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4449 if (ret != LDB_SUCCESS) {
4450 return replmd_replicated_request_error(ar, ret);
4451 }
4452 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4453
4454 /*
4455 * now create the new repsFrom value from the given repsFromTo1 structure
4456 */
4457 ZERO_STRUCT(nrf);
4458 nrf.version = 1;
4459 nrf.ctr.ctr1 = *ar->objs->source_dsa;
4460 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
4461
4462 /*
4463 * first see if we already have a repsFrom value for the current source dsa
4464 * if so we'll later replace this value
4465 */
4466 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4467 if (orf_el) {
4468 for (i=0; i < orf_el->num_values; i++) {
4469 struct repsFromToBlob *trf;
4470
4471 trf = talloc(ar, struct repsFromToBlob);
4472 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4473
4474 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4475 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4476 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4477 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4478 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4479 }
4480
4481 if (trf->version != 1) {
4482 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4483 }
4484
4485 /*
4486 * we compare the source dsa objectGUID not the invocation_id
4487 * because we want only one repsFrom value per source dsa
4488 * and when the invocation_id of the source dsa has changed we don't need
4489 * the old repsFrom with the old invocation_id
4490 */
4491 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4492 &ar->objs->source_dsa->source_dsa_obj_guid)) {
4493 talloc_free(trf);
4494 continue;
4495 }
4496
4497 talloc_free(trf);
4498 nrf_value = &orf_el->values[i];
4499 break;
4500 }
4501
4502 /*
4503 * copy over all old values to the new ldb_message
4504 */
4505 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4506 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4507 *nrf_el = *orf_el;
4508 }
4509
4510 /*
4511 * if we haven't found an old repsFrom value for the current source dsa
4512 * we'll add a new value
4513 */
4514 if (!nrf_value) {
4515 struct ldb_val zero_value;
4516 ZERO_STRUCT(zero_value);
4517 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4518 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4519
4520 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4521 }
4522
4523 /* we now fill the value which is already attached to ldb_message */
4524 ndr_err = ndr_push_struct_blob(nrf_value, msg,
4525 &nrf,
4526 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4527 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4528 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4529 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4530 }
4531
4532 /*
4533 * the ldb_message_element for the attribute, has all the old values and the new one
4534 * so we'll replace the whole attribute with all values
4535 */
4536 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4537
4538 if (CHECK_DEBUGLVL(4)) {
4539 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4540 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4541 talloc_free(s);
4542 }
4543
4544 /* prepare the ldb_modify() request */
4545 ret = ldb_build_mod_req(&change_req,
4546 ldb,
4547 ar,
4548 msg,
4549 ar->controls,
4550 ar,
4551 replmd_replicated_uptodate_modify_callback,
4552 ar->req);
4553 LDB_REQ_SET_LOCATION(change_req);
4554 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4555
4556 return ldb_next_request(ar->module, change_req);
4557 }
4558
4559 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4560 struct ldb_reply *ares)
4561 {
4562 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4563 struct replmd_replicated_request);
4564 int ret;
4565
4566 if (!ares) {
4567 return ldb_module_done(ar->req, NULL, NULL,
4568 LDB_ERR_OPERATIONS_ERROR);
4569 }
4570 if (ares->error != LDB_SUCCESS &&
4571 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4572 return ldb_module_done(ar->req, ares->controls,
4573 ares->response, ares->error);
4574 }
4575
4576 switch (ares->type) {
4577 case LDB_REPLY_ENTRY:
4578 ar->search_msg = talloc_steal(ar, ares->message);
4579 break;
4580
4581 case LDB_REPLY_REFERRAL:
4582 /* we ignore referrals */
4583 break;
4584
4585 case LDB_REPLY_DONE:
4586 ret = replmd_replicated_uptodate_modify(ar);
4587 if (ret != LDB_SUCCESS) {
4588 return ldb_module_done(ar->req, NULL, NULL, ret);
4589 }
4590 }
4591
4592 talloc_free(ares);
4593 return LDB_SUCCESS;
4594 }
4595
4596
4597 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4598 {
4599 struct ldb_context *ldb;
4600 int ret;
4601 static const char *attrs[] = {
4602 "replUpToDateVector",
4603 "repsFrom",
4604 "instanceType",
4605 NULL
4606 };
4607 struct ldb_request *search_req;
4608
4609 ldb = ldb_module_get_ctx(ar->module);
4610 ar->search_msg = NULL;
4611
4612 ret = ldb_build_search_req(&search_req,
4613 ldb,
4614 ar,
4615 ar->objs->partition_dn,
4616 LDB_SCOPE_BASE,
4617 "(objectClass=*)",
4618 attrs,
4619 NULL,
4620 ar,
4621 replmd_replicated_uptodate_search_callback,
4622 ar->req);
4623 LDB_REQ_SET_LOCATION(search_req);
4624 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4625
4626 return ldb_next_request(ar->module, search_req);
4627 }
4628
4629
4630
4631 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4632 {
4633 struct ldb_context *ldb;
4634 struct dsdb_extended_replicated_objects *objs;
4635 struct replmd_replicated_request *ar;
4636 struct ldb_control **ctrls;
4637 int ret;
4638 uint32_t i;
4639 struct replmd_private *replmd_private =
4640 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4641 struct dsdb_control_replicated_update *rep_update;
4642
4643 ldb = ldb_module_get_ctx(module);
4644
4645 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4646
4647 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4648 if (!objs) {
4649 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4650 return LDB_ERR_PROTOCOL_ERROR;
4651 }
4652
4653 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4654 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4655 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4656 return LDB_ERR_PROTOCOL_ERROR;
4657 }
4658
4659 ar = replmd_ctx_init(module, req);
4660 if (!ar)
4661 return LDB_ERR_OPERATIONS_ERROR;
4662
4663 /* Set the flags to have the replmd_op_callback run over the full set of objects */
4664 ar->apply_mode = true;
4665 ar->objs = objs;
4666 ar->schema = dsdb_get_schema(ldb, ar);
4667 if (!ar->schema) {
4668 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4669 talloc_free(ar);
4670 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4671 return LDB_ERR_CONSTRAINT_VIOLATION;
4672 }
4673
4674 ctrls = req->controls;
4675
4676 if (req->controls) {
4677 req->controls = talloc_memdup(ar, req->controls,
4678 talloc_get_size(req->controls));
4679 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4680 }
4681
4682 /* This allows layers further down to know if a change came in
4683 over replication and what the replication flags were */
4684 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
4685 if (rep_update == NULL) {
4686 return ldb_module_oom(module);
4687 }
4688 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
4689
4690 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
4691 if (ret != LDB_SUCCESS) {
4692 return ret;
4693 }
4694
4695 /* If this change contained linked attributes in the body
4696 * (rather than in the links section) we need to update
4697 * backlinks in linked_attributes */
4698 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4699 if (ret != LDB_SUCCESS) {
4700 return ret;
4701 }
4702
4703 ar->controls = req->controls;
4704 req->controls = ctrls;
4705
4706 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4707
4708 /* save away the linked attributes for the end of the
4709 transaction */
4710 for (i=0; i<ar->objs->linked_attributes_count; i++) {
4711 struct la_entry *la_entry;
4712
4713 if (replmd_private->la_ctx == NULL) {
4714 replmd_private->la_ctx = talloc_new(replmd_private);
4715 }
4716 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4717 if (la_entry == NULL) {
4718 ldb_oom(ldb);
4719 return LDB_ERR_OPERATIONS_ERROR;
4720 }
4721 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4722 if (la_entry->la == NULL) {
4723 talloc_free(la_entry);
4724 ldb_oom(ldb);
4725 return LDB_ERR_OPERATIONS_ERROR;
4726 }
4727 *la_entry->la = ar->objs->linked_attributes[i];
4728
4729 /* we need to steal the non-scalars so they stay
4730 around until the end of the transaction */
4731 talloc_steal(la_entry->la, la_entry->la->identifier);
4732 talloc_steal(la_entry->la, la_entry->la->value.blob);
4733
4734 DLIST_ADD(replmd_private->la_list, la_entry);
4735 }
4736
4737 return replmd_replicated_apply_next(ar);
4738 }
4739
4740 /*
4741 process one linked attribute structure
4742 */
4743 static int replmd_process_linked_attribute(struct ldb_module *module,
4744 struct la_entry *la_entry,
4745 struct ldb_request *parent)
4746 {
4747 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4748 struct ldb_context *ldb = ldb_module_get_ctx(module);
4749 struct ldb_message *msg;
4750 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4751 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4752 int ret;
4753 const struct dsdb_attribute *attr;
4754 struct dsdb_dn *dsdb_dn;
4755 uint64_t seq_num = 0;
4756 struct ldb_message_element *old_el;
4757 WERROR status;
4758 time_t t = time(NULL);
4759 struct ldb_result *res;
4760 const char *attrs[2];
4761 struct parsed_dn *pdn_list, *pdn;
4762 struct GUID guid = GUID_zero();
4763 NTSTATUS ntstatus;
4764 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
4765 const struct GUID *our_invocation_id;
4766
4767 /*
4768 linked_attributes[0]:
4769 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
4770 identifier : *
4771 identifier: struct drsuapi_DsReplicaObjectIdentifier
4772 __ndr_size : 0x0000003a (58)
4773 __ndr_size_sid : 0x00000000 (0)
4774 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
4775 sid : S-0-0
4776 __ndr_size_dn : 0x00000000 (0)
4777 dn : ''
4778 attid : DRSUAPI_ATTID_member (0x1F)
4779 value: struct drsuapi_DsAttributeValue
4780 __ndr_size : 0x0000007e (126)
4781 blob : *
4782 blob : DATA_BLOB length=126
4783 flags : 0x00000001 (1)
4784 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
4785 originating_add_time : Wed Sep 2 22:20:01 2009 EST
4786 meta_data: struct drsuapi_DsReplicaMetaData
4787 version : 0x00000015 (21)
4788 originating_change_time : Wed Sep 2 23:39:07 2009 EST
4789 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
4790 originating_usn : 0x000000000001e19c (123292)
4791
4792 (for cases where the link is to a normal DN)
4793 &target: struct drsuapi_DsReplicaObjectIdentifier3
4794 __ndr_size : 0x0000007e (126)
4795 __ndr_size_sid : 0x0000001c (28)
4796 guid : 7639e594-db75-4086-b0d4-67890ae46031
4797 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
4798 __ndr_size_dn : 0x00000022 (34)
4799 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
4800 */
4801
4802 /* find the attribute being modified */
4803 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
4804 if (attr == NULL) {
4805 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
4806 talloc_free(tmp_ctx);
4807 return LDB_ERR_OPERATIONS_ERROR;
4808 }
4809
4810 attrs[0] = attr->lDAPDisplayName;
4811 attrs[1] = NULL;
4812
4813 /* get the existing message from the db for the object with
4814 this GUID, returning attribute being modified. We will then
4815 use this msg as the basis for a modify call */
4816 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
4817 DSDB_FLAG_NEXT_MODULE |
4818 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
4819 DSDB_SEARCH_SHOW_RECYCLED |
4820 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
4821 DSDB_SEARCH_REVEAL_INTERNALS,
4822 parent,
4823 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
4824 if (ret != LDB_SUCCESS) {
4825 talloc_free(tmp_ctx);
4826 return ret;
4827 }
4828 if (res->count != 1) {
4829 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
4830 GUID_string(tmp_ctx, &la->identifier->guid));
4831 talloc_free(tmp_ctx);
4832 return LDB_ERR_NO_SUCH_OBJECT;
4833 }
4834 msg = res->msgs[0];
4835
4836 if (msg->num_elements == 0) {
4837 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
4838 if (ret != LDB_SUCCESS) {
4839 ldb_module_oom(module);
4840 talloc_free(tmp_ctx);
4841 return LDB_ERR_OPERATIONS_ERROR;
4842 }
4843 } else {
4844 old_el = &msg->elements[0];
4845 old_el->flags = LDB_FLAG_MOD_REPLACE;
4846 }
4847
4848 /* parse the existing links */
4849 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
4850 if (ret != LDB_SUCCESS) {
4851 talloc_free(tmp_ctx);
4852 return ret;
4853 }
4854
4855 /* get our invocationId */
4856 our_invocation_id = samdb_ntds_invocation_id(ldb);
4857 if (!our_invocation_id) {
4858 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
4859 talloc_free(tmp_ctx);
4860 return LDB_ERR_OPERATIONS_ERROR;
4861 }
4862
4863 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
4864 if (ret != LDB_SUCCESS) {
4865 talloc_free(tmp_ctx);
4866 return ret;
4867 }
4868
4869 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
4870 if (!W_ERROR_IS_OK(status)) {
4871 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
4872 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
4873 return LDB_ERR_OPERATIONS_ERROR;
4874 }
4875
4876 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
4877 if (!NT_STATUS_IS_OK(ntstatus) && active) {
4878 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
4879 old_el->name,
4880 ldb_dn_get_linearized(dsdb_dn->dn),
4881 ldb_dn_get_linearized(msg->dn));
4882 return LDB_ERR_OPERATIONS_ERROR;
4883 }
4884
4885 /* re-resolve the DN by GUID, as the DRS server may give us an
4886 old DN value */
4887 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
4888 if (ret != LDB_SUCCESS) {
4889 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
4890 GUID_string(tmp_ctx, &guid),
4891 ldb_dn_get_linearized(dsdb_dn->dn)));
4892 }
4893
4894 /* see if this link already exists */
4895 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
4896 if (pdn != NULL) {
4897 /* see if this update is newer than what we have already */
4898 struct GUID invocation_id = GUID_zero();
4899 uint32_t version = 0;
4900 uint32_t originating_usn = 0;
4901 NTTIME change_time = 0;
4902 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
4903
4904 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
4905 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
4906 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
4907 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
4908
4909 if (!replmd_update_is_newer(&invocation_id,
4910 &la->meta_data.originating_invocation_id,
4911 version,
4912 la->meta_data.version,
4913 change_time,
4914 la->meta_data.originating_change_time)) {
4915 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4916 old_el->name, ldb_dn_get_linearized(msg->dn),
4917 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4918 talloc_free(tmp_ctx);
4919 return LDB_SUCCESS;
4920 }
4921
4922 /* get a seq_num for this change */
4923 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4924 if (ret != LDB_SUCCESS) {
4925 talloc_free(tmp_ctx);
4926 return ret;
4927 }
4928
4929 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4930 /* remove the existing backlink */
4931 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4932 if (ret != LDB_SUCCESS) {
4933 talloc_free(tmp_ctx);
4934 return ret;
4935 }
4936 }
4937
4938 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4939 &la->meta_data.originating_invocation_id,
4940 la->meta_data.originating_usn, seq_num,
4941 la->meta_data.originating_change_time,
4942 la->meta_data.version,
4943 !active);
4944 if (ret != LDB_SUCCESS) {
4945 talloc_free(tmp_ctx);
4946 return ret;
4947 }
4948
4949 if (active) {
4950 /* add the new backlink */
4951 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4952 if (ret != LDB_SUCCESS) {
4953 talloc_free(tmp_ctx);
4954 return ret;
4955 }
4956 }
4957 } else {
4958 /* get a seq_num for this change */
4959 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4960 if (ret != LDB_SUCCESS) {
4961 talloc_free(tmp_ctx);
4962 return ret;
4963 }
4964
4965 old_el->values = talloc_realloc(msg->elements, old_el->values,
4966 struct ldb_val, old_el->num_values+1);
4967 if (!old_el->values) {
4968 ldb_module_oom(module);
4969 return LDB_ERR_OPERATIONS_ERROR;
4970 }
4971 old_el->num_values++;
4972
4973 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4974 &la->meta_data.originating_invocation_id,
4975 la->meta_data.originating_usn, seq_num,
4976 la->meta_data.originating_change_time,
4977 la->meta_data.version,
4978 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4979 if (ret != LDB_SUCCESS) {
4980 talloc_free(tmp_ctx);
4981 return ret;
4982 }
4983
4984 if (active) {
4985 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4986 true, attr, false);
4987 if (ret != LDB_SUCCESS) {
4988 talloc_free(tmp_ctx);
4989 return ret;
4990 }
4991 }
4992 }
4993
4994 /* we only change whenChanged and uSNChanged if the seq_num
4995 has changed */
4996 ret = add_time_element(msg, "whenChanged", t);
4997 if (ret != LDB_SUCCESS) {
4998 talloc_free(tmp_ctx);
4999 ldb_operr(ldb);
5000 return ret;
5001 }
5002
5003 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
5004 if (ret != LDB_SUCCESS) {
5005 talloc_free(tmp_ctx);
5006 ldb_operr(ldb);
5007 return ret;
5008 }
5009
5010 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5011 if (old_el == NULL) {
5012 talloc_free(tmp_ctx);
5013 return ldb_operr(ldb);
5014 }
5015
5016 ret = dsdb_check_single_valued_link(attr, old_el);
5017 if (ret != LDB_SUCCESS) {
5018 talloc_free(tmp_ctx);
5019 return ret;
5020 }
5021
5022 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
5023
5024 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
5025 if (ret != LDB_SUCCESS) {
5026 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
5027 ldb_errstring(ldb),
5028 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
5029 talloc_free(tmp_ctx);
5030 return ret;
5031 }
5032
5033 talloc_free(tmp_ctx);
5034
5035 return ret;
5036 }
5037
5038 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
5039 {
5040 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
5041 return replmd_extended_replicated_objects(module, req);
5042 }
5043
5044 return ldb_next_request(module, req);
5045 }
5046
5047
5048 /*
5049 we hook into the transaction operations to allow us to
5050 perform the linked attribute updates at the end of the whole
5051 transaction. This allows a forward linked attribute to be created
5052 before the object is created. During a vampire, w2k8 sends us linked
5053 attributes before the objects they are part of.
5054 */
5055 static int replmd_start_transaction(struct ldb_module *module)
5056 {
5057 /* create our private structure for this transaction */
5058 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
5059 struct replmd_private);
5060 replmd_txn_cleanup(replmd_private);
5061
5062 /* free any leftover mod_usn records from cancelled
5063 transactions */
5064 while (replmd_private->ncs) {
5065 struct nc_entry *e = replmd_private->ncs;
5066 DLIST_REMOVE(replmd_private->ncs, e);
5067 talloc_free(e);
5068 }
5069
5070 return ldb_next_start_trans(module);
5071 }
5072
5073 /*
5074 on prepare commit we loop over our queued la_context structures and
5075 apply each of them
5076 */
5077 static int replmd_prepare_commit(struct ldb_module *module)
5078 {
5079 struct replmd_private *replmd_private =
5080 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5081 struct la_entry *la, *prev;
5082 struct la_backlink *bl;
5083 int ret;
5084
5085 /* walk the list backwards, to do the first entry first, as we
5086 * added the entries with DLIST_ADD() which puts them at the
5087 * start of the list */
5088 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
5089 prev = DLIST_PREV(la);
5090 DLIST_REMOVE(replmd_private->la_list, la);
5091 ret = replmd_process_linked_attribute(module, la, NULL);
5092 if (ret != LDB_SUCCESS) {
5093 replmd_txn_cleanup(replmd_private);
5094 return ret;
5095 }
5096 }
5097
5098 /* process our backlink list, creating and deleting backlinks
5099 as necessary */
5100 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
5101 ret = replmd_process_backlink(module, bl, NULL);
5102 if (ret != LDB_SUCCESS) {
5103 replmd_txn_cleanup(replmd_private);
5104 return ret;
5105 }
5106 }
5107
5108 replmd_txn_cleanup(replmd_private);
5109
5110 /* possibly change @REPLCHANGED */
5111 ret = replmd_notify_store(module, NULL);
5112 if (ret != LDB_SUCCESS) {
5113 return ret;
5114 }
5115
5116 return ldb_next_prepare_commit(module);
5117 }
5118
5119 static int replmd_del_transaction(struct ldb_module *module)
5120 {
5121 struct replmd_private *replmd_private =
5122 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5123 replmd_txn_cleanup(replmd_private);
5124
5125 return ldb_next_del_trans(module);
5126 }
5127
5128
5129 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
5130 .name = "repl_meta_data",
5131 .init_context = replmd_init,
5132 .add = replmd_add,
5133 .modify = replmd_modify,
5134 .rename = replmd_rename,
5135 .del = replmd_delete,
5136 .extended = replmd_extended,
5137 .start_transaction = replmd_start_transaction,
5138 .prepare_commit = replmd_prepare_commit,
5139 .del_transaction = replmd_del_transaction,
5140 };
5141
5142 int ldb_repl_meta_data_module_init(const char *version)
5143 {
5144 LDB_MODULE_CHECK_VERSION(version);
5145 return ldb_register_module(&ldb_repl_meta_data_module_ops);
5146 }
Samba GIT mirror