2 Unix SMB/CIFS implementation.
4 implement the DSGetNCChanges call
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009-2010
8 Copyright (C) Andrew Bartlett 2010-2016
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "rpc_server/dcerpc_server.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "param/param.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30 #include "librpc/gen_ndr/ndr_security.h"
31 #include "libcli/security/security.h"
32 #include "libcli/security/session.h"
33 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
34 #include "../libcli/drsuapi/drsuapi.h"
35 #include "lib/util/binsearch.h"
36 #include "lib/util/tsort.h"
37 #include "auth/session.h"
38 #include "dsdb/common/util.h"
39 #include "lib/dbwrap/dbwrap.h"
40 #include "lib/dbwrap/dbwrap_rbt.h"
41 #include "librpc/gen_ndr/ndr_misc.h"
44 #define DBGC_CLASS DBGC_DRS_REPL
46 #define DRS_GUID_SIZE 16
47 #define DEFAULT_MAX_OBJECTS 1000
48 #define DEFAULT_MAX_LINKS 1500
51 * state of a partially-completed replication cycle. This state persists
52 * over multiple calls to dcesrv_drsuapi_DsGetNCChanges()
54 struct drsuapi_getncchanges_state
{
55 struct db_context
*obj_cache
;
58 uint32_t num_processed
;
59 struct ldb_dn
*ncRoot_dn
;
60 struct GUID ncRoot_guid
;
63 bool broken_samba_4_5_get_anc_emulation
;
67 struct drsuapi_DsReplicaHighWaterMark last_hwm
;
68 struct ldb_dn
*last_dn
;
69 struct drsuapi_DsReplicaHighWaterMark final_hwm
;
70 struct drsuapi_DsReplicaCursor2CtrEx
*final_udv
;
71 struct drsuapi_DsReplicaLinkedAttribute
*la_list
;
75 /* these are just used for debugging the replication's progress */
80 /* We must keep the GUIDs in NDR form for sorting */
81 struct la_for_sorting
{
82 const struct drsuapi_DsReplicaLinkedAttribute
*link
;
83 uint8_t target_guid
[DRS_GUID_SIZE
];
84 uint8_t source_guid
[DRS_GUID_SIZE
];
88 * stores the state for a chunk of replication data. This state information
89 * only exists for a single call to dcesrv_drsuapi_DsGetNCChanges()
91 struct getncchanges_repl_chunk
{
94 uint32_t tgt_la_count
;
95 bool immediate_link_sync
;
99 /* stores the objects to be sent in this chunk */
100 uint32_t object_count
;
101 struct drsuapi_DsReplicaObjectListItemEx
*object_list
;
103 /* the last object added to this replication chunk */
104 struct drsuapi_DsReplicaObjectListItemEx
*last_object
;
107 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark
*h1
,
108 const struct drsuapi_DsReplicaHighWaterMark
*h2
)
110 if (h1
->highest_usn
< h2
->highest_usn
) {
112 } else if (h1
->highest_usn
> h2
->highest_usn
) {
114 } else if (h1
->tmp_highest_usn
< h2
->tmp_highest_usn
) {
116 } else if (h1
->tmp_highest_usn
> h2
->tmp_highest_usn
) {
118 } else if (h1
->reserved_usn
< h2
->reserved_usn
) {
120 } else if (h1
->reserved_usn
> h2
->reserved_usn
) {
128 build a DsReplicaObjectIdentifier from a ldb msg
130 static struct drsuapi_DsReplicaObjectIdentifier
*get_object_identifier(TALLOC_CTX
*mem_ctx
,
131 const struct ldb_message
*msg
)
133 struct drsuapi_DsReplicaObjectIdentifier
*identifier
;
136 identifier
= talloc(mem_ctx
, struct drsuapi_DsReplicaObjectIdentifier
);
137 if (identifier
== NULL
) {
141 identifier
->dn
= ldb_dn_alloc_linearized(identifier
, msg
->dn
);
142 identifier
->guid
= samdb_result_guid(msg
, "objectGUID");
144 sid
= samdb_result_dom_sid(identifier
, msg
, "objectSid");
146 identifier
->sid
= *sid
;
148 ZERO_STRUCT(identifier
->sid
);
153 static int udv_compare(const struct GUID
*guid1
, struct GUID guid2
)
155 return GUID_compare(guid1
, &guid2
);
159 see if we can filter an attribute using the uptodateness_vector
161 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx
*udv
,
162 const struct GUID
*originating_invocation_id
,
163 uint64_t originating_usn
)
165 const struct drsuapi_DsReplicaCursor
*c
;
166 if (udv
== NULL
) return false;
167 BINARY_ARRAY_SEARCH(udv
->cursors
, udv
->count
, source_dsa_invocation_id
,
168 originating_invocation_id
, udv_compare
, c
);
169 if (c
&& originating_usn
<= c
->highest_usn
) {
175 static int uint32_t_cmp(uint32_t a1
, uint32_t a2
)
177 if (a1
== a2
) return 0;
178 return a1
> a2
? 1 : -1;
181 static int uint32_t_ptr_cmp(uint32_t *a1
, uint32_t *a2
)
183 if (*a1
== *a2
) return 0;
184 return *a1
> *a2
? 1 : -1;
187 static WERROR
getncchanges_attid_remote_to_local(const struct dsdb_schema
*schema
,
188 const struct dsdb_syntax_ctx
*ctx
,
189 enum drsuapi_DsAttributeId remote_attid_as_enum
,
190 enum drsuapi_DsAttributeId
*local_attid_as_enum
,
191 const struct dsdb_attribute
**_sa
)
194 const struct dsdb_attribute
*sa
= NULL
;
196 if (ctx
->pfm_remote
== NULL
) {
197 DEBUG(7, ("No prefixMap supplied, falling back to local prefixMap.\n"));
201 werr
= dsdb_attribute_drsuapi_remote_to_local(ctx
,
202 remote_attid_as_enum
,
205 if (!W_ERROR_IS_OK(werr
)) {
206 DEBUG(3, ("WARNING: Unable to resolve remote attid, falling back to local prefixMap.\n"));
213 sa
= dsdb_attribute_by_attributeID_id(schema
, remote_attid_as_enum
);
215 return WERR_DS_DRA_SCHEMA_MISMATCH
;
217 if (local_attid_as_enum
!= NULL
) {
218 *local_attid_as_enum
= sa
->attributeID_id
;
227 static WERROR
getncchanges_update_revealed_list(struct ldb_context
*sam_ctx
,
229 struct ldb_message
**msg
,
230 struct ldb_dn
*object_dn
,
231 const struct GUID
*object_guid
,
232 const struct dsdb_attribute
*sa
,
233 struct replPropertyMetaData1
*meta_data
,
234 struct ldb_message
*revealed_users
)
236 enum ndr_err_code ndr_err
;
238 char *attr_str
= NULL
;
239 char *attr_hex
= NULL
;
241 struct ldb_message_element
*existing
= NULL
, *el_add
= NULL
, *el_del
= NULL
;
242 const char * const * secret_attributes
= ldb_get_opaque(sam_ctx
, "LDB_SECRET_ATTRIBUTE_LIST");
244 if (!ldb_attr_in_list(secret_attributes
,
245 sa
->lDAPDisplayName
)) {
250 ndr_err
= ndr_push_struct_blob(&attr_blob
, mem_ctx
, meta_data
, (ndr_push_flags_fn_t
)ndr_push_replPropertyMetaData1
);
251 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
252 return WERR_DS_DRA_INTERNAL_ERROR
;
255 attr_hex
= hex_encode_talloc(mem_ctx
, attr_blob
.data
, attr_blob
.length
);
256 if (attr_hex
== NULL
) {
257 return WERR_NOT_ENOUGH_MEMORY
;
260 attr_str
= talloc_asprintf(mem_ctx
, "B:%zd:%s:%s", attr_blob
.length
*2, attr_hex
, ldb_dn_get_linearized(object_dn
));
261 if (attr_str
== NULL
) {
262 return WERR_NOT_ENOUGH_MEMORY
;
265 existing
= ldb_msg_find_element(revealed_users
, "msDS-RevealedUsers");
266 if (existing
!= NULL
) {
267 /* Replace the old value (if one exists) with the current one */
268 struct parsed_dn
*link_dns
;
269 struct parsed_dn
*exact
= NULL
, *unused
= NULL
;
271 DATA_BLOB partial_meta
;
273 ldb_err
= get_parsed_dns_trusted(mem_ctx
, existing
, &link_dns
);
274 if (ldb_err
!= LDB_SUCCESS
) {
275 return WERR_DS_DRA_INTERNAL_ERROR
;
278 /* Construct a partial metadata blob to match on in the DB */
279 SIVAL(attid
, 0, sa
->attributeID_id
);
280 partial_meta
.length
= 4;
281 partial_meta
.data
= attid
;
283 /* Binary search using GUID and attribute id for uniqueness */
284 ldb_err
= parsed_dn_find(sam_ctx
, link_dns
, existing
->num_values
,
285 object_guid
, object_dn
,
288 DSDB_SYNTAX_BINARY_DN
, true);
290 if (ldb_err
!= LDB_SUCCESS
) {
291 DEBUG(0,(__location__
": Failed parsed DN find - %s\n",
292 ldb_errstring(sam_ctx
)));
293 return WERR_DS_DRA_INTERNAL_ERROR
;
297 /* Perform some verification of the blob */
298 struct replPropertyMetaData1 existing_meta_data
;
299 ndr_err
= ndr_pull_struct_blob_all_noalloc(&exact
->dsdb_dn
->extra_part
,
301 (ndr_pull_flags_fn_t
)ndr_pull_replPropertyMetaData1
);
302 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
303 return WERR_DS_DRA_INTERNAL_ERROR
;
306 if (existing_meta_data
.attid
== sa
->attributeID_id
) {
307 ldb_err
= ldb_msg_add_empty(*msg
, "msDS-RevealedUsers", LDB_FLAG_MOD_DELETE
, &el_del
);
308 if (ldb_err
!= LDB_SUCCESS
) {
309 return WERR_DS_DRA_INTERNAL_ERROR
;
312 el_del
->values
= talloc_array((*msg
)->elements
, struct ldb_val
, 1);
313 if (el_del
->values
== NULL
) {
314 return WERR_NOT_ENOUGH_MEMORY
;
316 el_del
->values
[0] = *exact
->v
;
317 el_del
->num_values
= 1;
319 return WERR_DS_DRA_INTERNAL_ERROR
;
324 ldb_err
= ldb_msg_add_empty(*msg
, "msDS-RevealedUsers", LDB_FLAG_MOD_ADD
, &el_add
);
325 if (ldb_err
!= LDB_SUCCESS
) {
326 return WERR_DS_DRA_INTERNAL_ERROR
;
329 el_add
->values
= talloc_array((*msg
)->elements
, struct ldb_val
, 1);
330 if (el_add
->values
== NULL
) {
331 return WERR_NOT_ENOUGH_MEMORY
;
335 el_add
->values
[0] = data_blob_string_const(attr_str
);
336 el_add
->num_values
= 1;
342 * This function filter attributes for build_object based on the
343 * uptodatenessvector and partial attribute set.
345 * Any secret attributes are forced here for REPL_SECRET, and audited at this
346 * point with msDS-RevealedUsers.
348 static WERROR
get_nc_changes_filter_attrs(struct drsuapi_DsReplicaObjectListItemEx
*obj
,
349 struct replPropertyMetaDataBlob md
,
350 struct ldb_context
*sam_ctx
,
351 const struct ldb_message
*msg
,
352 const struct GUID
*guid
,
354 uint64_t highest_usn
,
355 const struct dsdb_attribute
*rdn_sa
,
356 struct dsdb_schema
*schema
,
357 struct drsuapi_DsReplicaCursorCtrEx
*uptodateness_vector
,
358 struct drsuapi_DsPartialAttributeSet
*partial_attribute_set
,
362 struct ldb_message
**revealed_list_msg
,
363 struct ldb_message
*existing_revealed_list_msg
)
367 for (n
=i
=0; i
<md
.ctr
.ctr1
.count
; i
++) {
368 const struct dsdb_attribute
*sa
;
369 bool force_attribute
= false;
371 /* if the attribute has not changed, and it is not the
372 instanceType then don't include it */
373 if (md
.ctr
.ctr1
.array
[i
].local_usn
< highest_usn
&&
375 md
.ctr
.ctr1
.array
[i
].attid
!= DRSUAPI_ATTID_instanceType
) continue;
377 /* don't include the rDN */
378 if (md
.ctr
.ctr1
.array
[i
].attid
== rdn_sa
->attributeID_id
) continue;
380 sa
= dsdb_attribute_by_attributeID_id(schema
, md
.ctr
.ctr1
.array
[i
].attid
);
382 DEBUG(0,(__location__
": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
383 (unsigned int)md
.ctr
.ctr1
.array
[i
].attid
,
384 ldb_dn_get_linearized(msg
->dn
)));
385 return WERR_DS_DRA_INTERNAL_ERROR
;
389 struct ldb_message_element
*el
;
390 el
= ldb_msg_find_element(msg
, sa
->lDAPDisplayName
);
391 if (el
&& el
->num_values
&& dsdb_dn_is_upgraded_link_val(&el
->values
[0])) {
392 /* don't send upgraded links inline */
398 !dsdb_attr_in_rodc_fas(sa
)) {
399 force_attribute
= true;
400 DEBUG(4,("Forcing attribute %s in %s\n",
401 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
402 werr
= getncchanges_update_revealed_list(sam_ctx
, obj
,
405 &md
.ctr
.ctr1
.array
[i
],
406 existing_revealed_list_msg
);
407 if (!W_ERROR_IS_OK(werr
)) {
412 /* filter by uptodateness_vector */
413 if (md
.ctr
.ctr1
.array
[i
].attid
!= DRSUAPI_ATTID_instanceType
&&
415 udv_filter(uptodateness_vector
,
416 &md
.ctr
.ctr1
.array
[i
].originating_invocation_id
,
417 md
.ctr
.ctr1
.array
[i
].originating_usn
)) {
421 /* filter by partial_attribute_set */
422 if (partial_attribute_set
&& !force_attribute
) {
423 uint32_t *result
= NULL
;
424 BINARY_ARRAY_SEARCH_V(local_pas
, partial_attribute_set
->num_attids
, sa
->attributeID_id
,
425 uint32_t_cmp
, result
);
426 if (result
== NULL
) {
431 obj
->meta_data_ctr
->meta_data
[n
].originating_change_time
= md
.ctr
.ctr1
.array
[i
].originating_change_time
;
432 obj
->meta_data_ctr
->meta_data
[n
].version
= md
.ctr
.ctr1
.array
[i
].version
;
433 obj
->meta_data_ctr
->meta_data
[n
].originating_invocation_id
= md
.ctr
.ctr1
.array
[i
].originating_invocation_id
;
434 obj
->meta_data_ctr
->meta_data
[n
].originating_usn
= md
.ctr
.ctr1
.array
[i
].originating_usn
;
435 attids
[n
] = md
.ctr
.ctr1
.array
[i
].attid
;
446 drsuapi_DsGetNCChanges for one object
448 static WERROR
get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx
*obj
,
449 const struct ldb_message
*msg
,
450 struct ldb_context
*sam_ctx
,
451 struct drsuapi_getncchanges_state
*getnc_state
,
452 struct dsdb_schema
*schema
,
453 DATA_BLOB
*session_key
,
454 struct drsuapi_DsGetNCChangesRequest10
*req10
,
455 bool force_object_return
,
457 struct ldb_dn
*machine_dn
,
458 const struct GUID
*guid
)
460 const struct ldb_val
*md_value
;
462 struct replPropertyMetaDataBlob md
;
465 enum ndr_err_code ndr_err
;
468 const struct dsdb_attribute
*rdn_sa
;
470 unsigned int instanceType
;
471 struct dsdb_syntax_ctx syntax_ctx
;
472 struct ldb_result
*res
= NULL
;
475 uint32_t replica_flags
= req10
->replica_flags
;
476 struct drsuapi_DsPartialAttributeSet
*partial_attribute_set
=
477 req10
->partial_attribute_set
;
478 struct drsuapi_DsReplicaCursorCtrEx
*uptodateness_vector
=
479 req10
->uptodateness_vector
;
480 enum drsuapi_DsExtendedOperation extended_op
= req10
->extended_op
;
481 bool is_schema_nc
= getnc_state
->is_schema_nc
;
482 uint64_t highest_usn
= getnc_state
->min_usn
;
484 /* make dsdb sytanx context for conversions */
485 dsdb_syntax_ctx_init(&syntax_ctx
, sam_ctx
, schema
);
486 syntax_ctx
.is_schema_nc
= is_schema_nc
;
488 uSNChanged
= ldb_msg_find_attr_as_uint64(msg
, "uSNChanged", 0);
489 instanceType
= ldb_msg_find_attr_as_uint(msg
, "instanceType", 0);
490 if (instanceType
& INSTANCE_TYPE_IS_NC_HEAD
) {
491 obj
->is_nc_prefix
= true;
492 obj
->parent_object_guid
= NULL
;
494 obj
->is_nc_prefix
= false;
495 obj
->parent_object_guid
= talloc(obj
, struct GUID
);
496 if (obj
->parent_object_guid
== NULL
) {
497 return WERR_DS_DRA_INTERNAL_ERROR
;
499 *obj
->parent_object_guid
= samdb_result_guid(msg
, "parentGUID");
500 if (GUID_all_zero(obj
->parent_object_guid
)) {
501 DEBUG(0,(__location__
": missing parentGUID for %s\n",
502 ldb_dn_get_linearized(msg
->dn
)));
503 return WERR_DS_DRA_INTERNAL_ERROR
;
506 obj
->next_object
= NULL
;
508 md_value
= ldb_msg_find_ldb_val(msg
, "replPropertyMetaData");
510 /* nothing to send */
514 if (instanceType
& INSTANCE_TYPE_UNINSTANT
) {
515 /* don't send uninstantiated objects */
519 if (uSNChanged
<= highest_usn
) {
520 /* nothing to send */
524 ndr_err
= ndr_pull_struct_blob(md_value
, obj
, &md
,
525 (ndr_pull_flags_fn_t
)ndr_pull_replPropertyMetaDataBlob
);
526 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
527 return WERR_DS_DRA_INTERNAL_ERROR
;
530 if (md
.version
!= 1) {
531 return WERR_DS_DRA_INTERNAL_ERROR
;
534 rdn
= ldb_dn_get_rdn_name(msg
->dn
);
536 DEBUG(0,(__location__
": No rDN for %s\n", ldb_dn_get_linearized(msg
->dn
)));
537 return WERR_DS_DRA_INTERNAL_ERROR
;
540 rdn_sa
= dsdb_attribute_by_lDAPDisplayName(schema
, rdn
);
541 if (rdn_sa
== NULL
) {
542 DEBUG(0,(__location__
": Can't find dsds_attribute for rDN %s in %s\n",
543 rdn
, ldb_dn_get_linearized(msg
->dn
)));
544 return WERR_DS_DRA_INTERNAL_ERROR
;
547 obj
->meta_data_ctr
= talloc(obj
, struct drsuapi_DsReplicaMetaDataCtr
);
548 attids
= talloc_array(obj
, uint32_t, md
.ctr
.ctr1
.count
);
550 obj
->object
.identifier
= get_object_identifier(obj
, msg
);
551 if (obj
->object
.identifier
== NULL
) {
552 return WERR_NOT_ENOUGH_MEMORY
;
554 dom_sid_split_rid(NULL
, &obj
->object
.identifier
->sid
, NULL
, &rid
);
556 obj
->meta_data_ctr
->meta_data
= talloc_array(obj
, struct drsuapi_DsReplicaMetaData
, md
.ctr
.ctr1
.count
);
558 if (extended_op
== DRSUAPI_EXOP_REPL_SECRET
) {
559 /* Get the existing revealed users for the destination */
560 struct ldb_message
*revealed_list_msg
= NULL
;
561 struct ldb_message
*existing_revealed_list_msg
= NULL
;
562 const char *machine_attrs
[] = {
563 "msDS-RevealedUsers",
567 revealed_list_msg
= ldb_msg_new(sam_ctx
);
568 if (revealed_list_msg
== NULL
) {
569 return WERR_NOT_ENOUGH_MEMORY
;
571 revealed_list_msg
->dn
= machine_dn
;
573 ret
= ldb_transaction_start(sam_ctx
);
574 if (ret
!= LDB_SUCCESS
) {
575 DEBUG(0,(__location__
": Failed transaction start - %s\n",
576 ldb_errstring(sam_ctx
)));
577 return WERR_DS_DRA_INTERNAL_ERROR
;
580 ldb_err
= dsdb_search_dn(sam_ctx
, obj
, &res
, machine_dn
, machine_attrs
, DSDB_SEARCH_SHOW_EXTENDED_DN
);
581 if (ldb_err
!= LDB_SUCCESS
|| res
->count
!= 1) {
582 ldb_transaction_cancel(sam_ctx
);
583 return WERR_DS_DRA_INTERNAL_ERROR
;
586 existing_revealed_list_msg
= res
->msgs
[0];
588 werr
= get_nc_changes_filter_attrs(obj
, md
, sam_ctx
, msg
,
589 guid
, &n
, highest_usn
,
592 partial_attribute_set
, local_pas
,
596 existing_revealed_list_msg
);
597 if (!W_ERROR_IS_OK(werr
)) {
598 ldb_transaction_cancel(sam_ctx
);
602 if (revealed_list_msg
!= NULL
) {
603 ret
= ldb_modify(sam_ctx
, revealed_list_msg
);
604 if (ret
!= LDB_SUCCESS
) {
605 DEBUG(0,(__location__
": Failed to alter revealed links - %s\n",
606 ldb_errstring(sam_ctx
)));
607 ldb_transaction_cancel(sam_ctx
);
608 return WERR_DS_DRA_INTERNAL_ERROR
;
612 ret
= ldb_transaction_commit(sam_ctx
);
613 if (ret
!= LDB_SUCCESS
) {
614 DEBUG(0,(__location__
": Failed transaction commit - %s\n",
615 ldb_errstring(sam_ctx
)));
616 return WERR_DS_DRA_INTERNAL_ERROR
;
619 werr
= get_nc_changes_filter_attrs(obj
, md
, sam_ctx
, msg
, guid
,
620 &n
, highest_usn
, rdn_sa
,
621 schema
, uptodateness_vector
,
622 partial_attribute_set
, local_pas
,
627 if (!W_ERROR_IS_OK(werr
)) {
632 /* ignore it if its an empty change. Note that renames always
633 * change the 'name' attribute, so they won't be ignored by
636 * the force_object_return check is used to force an empty
637 * object return when we timeout in the getncchanges loop.
638 * This allows us to return an empty object, which keeps the
639 * client happy while preventing timeouts
643 attids
[0] == DRSUAPI_ATTID_instanceType
&&
644 !force_object_return
)) {
645 talloc_free(obj
->meta_data_ctr
);
646 obj
->meta_data_ctr
= NULL
;
650 obj
->meta_data_ctr
->count
= n
;
652 obj
->object
.flags
= DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER
;
653 obj
->object
.attribute_ctr
.num_attributes
= obj
->meta_data_ctr
->count
;
654 obj
->object
.attribute_ctr
.attributes
= talloc_array(obj
, struct drsuapi_DsReplicaAttribute
,
655 obj
->object
.attribute_ctr
.num_attributes
);
656 if (obj
->object
.attribute_ctr
.attributes
== NULL
) {
657 return WERR_NOT_ENOUGH_MEMORY
;
661 * Note that the meta_data array and the attributes array must
662 * be the same size and in the same order
664 for (i
=0; i
<obj
->object
.attribute_ctr
.num_attributes
; i
++) {
665 struct ldb_message_element
*el
;
666 const struct dsdb_attribute
*sa
;
668 sa
= dsdb_attribute_by_attributeID_id(schema
, attids
[i
]);
670 DEBUG(0,("Unable to find attributeID %u in schema\n", attids
[i
]));
671 return WERR_DS_DRA_INTERNAL_ERROR
;
674 el
= ldb_msg_find_element(msg
, sa
->lDAPDisplayName
);
676 /* this happens for attributes that have been removed */
677 DEBUG(5,("No element '%s' for attributeID %u in message\n",
678 sa
->lDAPDisplayName
, attids
[i
]));
679 ZERO_STRUCT(obj
->object
.attribute_ctr
.attributes
[i
]);
680 obj
->object
.attribute_ctr
.attributes
[i
].attid
=
681 dsdb_attribute_get_attid(sa
, syntax_ctx
.is_schema_nc
);
683 werr
= sa
->syntax
->ldb_to_drsuapi(&syntax_ctx
, sa
, el
, obj
,
684 &obj
->object
.attribute_ctr
.attributes
[i
]);
685 if (!W_ERROR_IS_OK(werr
)) {
686 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
687 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
),
691 /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
692 * check if attribute is secret and send a null value
694 if (replica_flags
& DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING
) {
695 drsuapi_process_secret_attribute(&obj
->object
.attribute_ctr
.attributes
[i
],
696 &obj
->meta_data_ctr
->meta_data
[i
]);
698 /* some attributes needs to be encrypted
700 werr
= drsuapi_encrypt_attribute(obj
, session_key
, rid
,
701 &obj
->object
.attribute_ctr
.attributes
[i
]);
702 if (!W_ERROR_IS_OK(werr
)) {
703 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
704 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
),
709 if (attids
[i
] != obj
->object
.attribute_ctr
.attributes
[i
].attid
) {
710 DEBUG(0, ("Unable to replicate attribute %s on %s via DRS, incorrect attributeID: "
714 ldb_dn_get_linearized(msg
->dn
),
716 obj
->object
.attribute_ctr
.attributes
[i
].attid
));
717 return WERR_DS_DATABASE_ERROR
;
725 add one linked attribute from an object to the list of linked
726 attributes in a getncchanges request
728 static WERROR
get_nc_changes_add_la(TALLOC_CTX
*mem_ctx
,
729 struct ldb_context
*sam_ctx
,
730 const struct dsdb_schema
*schema
,
731 const struct dsdb_attribute
*sa
,
732 const struct ldb_message
*msg
,
733 struct dsdb_dn
*dsdb_dn
,
734 struct drsuapi_DsReplicaLinkedAttribute
**la_list
,
738 struct drsuapi_DsReplicaLinkedAttribute
*la
;
743 (*la_list
) = talloc_realloc(mem_ctx
, *la_list
, struct drsuapi_DsReplicaLinkedAttribute
, (*la_count
)+1);
744 W_ERROR_HAVE_NO_MEMORY(*la_list
);
746 la
= &(*la_list
)[*la_count
];
748 la
->identifier
= get_object_identifier(*la_list
, msg
);
749 W_ERROR_HAVE_NO_MEMORY(la
->identifier
);
751 active
= (dsdb_dn_rmd_flags(dsdb_dn
->dn
) & DSDB_RMD_FLAG_DELETED
) == 0;
754 /* We have to check that the inactive link still point to an existing object */
760 v
= ldb_msg_find_attr_as_string(msg
, "isDeleted", "FALSE");
761 if (strncmp(v
, "TRUE", 4) == 0) {
763 * Note: we skip the transmition of the deleted link even if the other part used to
764 * know about it because when we transmit the deletion of the object, the link will
765 * be deleted too due to deletion of object where link points and Windows do so.
767 if (dsdb_functional_level(sam_ctx
) >= DS_DOMAIN_FUNCTION_2008_R2
) {
768 v
= ldb_msg_find_attr_as_string(msg
, "isRecycled", "FALSE");
770 * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
771 * if it join an existing domain with deleted objets, it firsts impose to have a
772 * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
773 * either during initial replication or after the getNCChanges.
774 * Behavior of samba has been changed to always have this attribute if it's present in the schema.
776 * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
777 * If FL >=2K8R2 we are sure that this attribute will be here.
778 * For this kind of forest level we do not return the link if the object is recycled
779 * (isRecycled = true).
781 if (strncmp(v
, "TRUE", 4) == 0) {
782 DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
783 ldb_dn_get_linearized(msg
->dn
)));
790 status
= dsdb_get_extended_dn_guid(dsdb_dn
->dn
, &guid
, "GUID");
791 if (!NT_STATUS_IS_OK(status
)) {
792 DEBUG(0,(__location__
" Unable to extract GUID in linked attribute '%s' in '%s'\n",
793 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
794 return ntstatus_to_werror(status
);
796 ret
= dsdb_find_dn_by_guid(sam_ctx
, mem_ctx
, &guid
, 0, &tdn
);
797 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
798 DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
799 GUID_string(mem_ctx
, &guid
)));
801 } else if (ret
!= LDB_SUCCESS
) {
802 DEBUG(0, (__location__
" Search of guid %s failed with error code %d\n",
803 GUID_string(mem_ctx
, &guid
),
808 la
->attid
= dsdb_attribute_get_attid(sa
, is_schema_nc
);
809 la
->flags
= active
?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
:0;
811 status
= dsdb_get_extended_dn_uint32(dsdb_dn
->dn
, &la
->meta_data
.version
, "RMD_VERSION");
812 if (!NT_STATUS_IS_OK(status
)) {
813 DEBUG(0,(__location__
" No RMD_VERSION in linked attribute '%s' in '%s'\n",
814 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
815 return ntstatus_to_werror(status
);
817 status
= dsdb_get_extended_dn_nttime(dsdb_dn
->dn
, &la
->meta_data
.originating_change_time
, "RMD_CHANGETIME");
818 if (!NT_STATUS_IS_OK(status
)) {
819 DEBUG(0,(__location__
" No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
820 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
821 return ntstatus_to_werror(status
);
823 status
= dsdb_get_extended_dn_guid(dsdb_dn
->dn
, &la
->meta_data
.originating_invocation_id
, "RMD_INVOCID");
824 if (!NT_STATUS_IS_OK(status
)) {
825 DEBUG(0,(__location__
" No RMD_INVOCID in linked attribute '%s' in '%s'\n",
826 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
827 return ntstatus_to_werror(status
);
829 status
= dsdb_get_extended_dn_uint64(dsdb_dn
->dn
, &la
->meta_data
.originating_usn
, "RMD_ORIGINATING_USN");
830 if (!NT_STATUS_IS_OK(status
)) {
831 DEBUG(0,(__location__
" No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
832 sa
->lDAPDisplayName
, ldb_dn_get_linearized(msg
->dn
)));
833 return ntstatus_to_werror(status
);
836 status
= dsdb_get_extended_dn_nttime(dsdb_dn
->dn
, &la
->originating_add_time
, "RMD_ADDTIME");
837 if (!NT_STATUS_IS_OK(status
)) {
838 /* this is possible for upgraded links */
839 la
->originating_add_time
= la
->meta_data
.originating_change_time
;
842 werr
= dsdb_dn_la_to_blob(sam_ctx
, sa
, schema
, *la_list
, dsdb_dn
, &la
->value
.blob
);
843 W_ERROR_NOT_OK_RETURN(werr
);
851 add linked attributes from an object to the list of linked
852 attributes in a getncchanges request
854 static WERROR
get_nc_changes_add_links(struct ldb_context
*sam_ctx
,
857 struct dsdb_schema
*schema
,
858 uint64_t highest_usn
,
859 uint32_t replica_flags
,
860 const struct ldb_message
*msg
,
861 struct drsuapi_DsReplicaLinkedAttribute
**la_list
,
863 struct drsuapi_DsReplicaCursorCtrEx
*uptodateness_vector
)
866 TALLOC_CTX
*tmp_ctx
= NULL
;
867 uint64_t uSNChanged
= ldb_msg_find_attr_as_uint64(msg
, "uSNChanged", 0);
868 bool is_critical
= ldb_msg_find_attr_as_bool(msg
, "isCriticalSystemObject", false);
870 if (replica_flags
& DRSUAPI_DRS_CRITICAL_ONLY
) {
876 if (uSNChanged
<= highest_usn
) {
880 tmp_ctx
= talloc_new(mem_ctx
);
881 if (tmp_ctx
== NULL
) {
882 return WERR_NOT_ENOUGH_MEMORY
;
885 for (i
=0; i
<msg
->num_elements
; i
++) {
886 struct ldb_message_element
*el
= &msg
->elements
[i
];
887 const struct dsdb_attribute
*sa
;
890 sa
= dsdb_attribute_by_lDAPDisplayName(schema
, el
->name
);
892 if (!sa
|| sa
->linkID
== 0 || (sa
->linkID
& 1)) {
893 /* we only want forward links */
897 if (el
->num_values
&& !dsdb_dn_is_upgraded_link_val(&el
->values
[0])) {
898 /* its an old style link, it will have been
899 * sent in the main replication data */
903 for (j
=0; j
<el
->num_values
; j
++) {
904 struct dsdb_dn
*dsdb_dn
;
906 uint64_t originating_usn
;
907 NTSTATUS status
, status2
;
909 struct GUID originating_invocation_id
;
911 dsdb_dn
= dsdb_dn_parse(tmp_ctx
, sam_ctx
, &el
->values
[j
], sa
->syntax
->ldap_oid
);
912 if (dsdb_dn
== NULL
) {
913 DEBUG(1,(__location__
": Failed to parse DN for %s in %s\n",
914 el
->name
, ldb_dn_get_linearized(msg
->dn
)));
915 talloc_free(tmp_ctx
);
916 return WERR_DS_DRA_INTERNAL_ERROR
;
919 status
= dsdb_get_extended_dn_uint64(dsdb_dn
->dn
, &local_usn
, "RMD_LOCAL_USN");
920 if (!NT_STATUS_IS_OK(status
)) {
921 /* this can happen for attributes
922 given to us with old style meta
927 if (local_usn
> uSNChanged
) {
928 DEBUG(1,(__location__
": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
929 el
->name
, ldb_dn_get_linearized(msg
->dn
)));
930 talloc_free(tmp_ctx
);
931 return WERR_DS_DRA_INTERNAL_ERROR
;
934 if (local_usn
<= highest_usn
) {
938 status
= dsdb_get_extended_dn_guid(dsdb_dn
->dn
,
939 &originating_invocation_id
,
941 status2
= dsdb_get_extended_dn_uint64(dsdb_dn
->dn
,
943 "RMD_ORIGINATING_USN");
945 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(status2
)) {
946 if (udv_filter(uptodateness_vector
,
947 &originating_invocation_id
,
953 werr
= get_nc_changes_add_la(mem_ctx
, sam_ctx
, schema
,
954 sa
, msg
, dsdb_dn
, la_list
,
955 la_count
, is_schema_nc
);
956 if (!W_ERROR_IS_OK(werr
)) {
957 talloc_free(tmp_ctx
);
963 talloc_free(tmp_ctx
);
968 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
970 static WERROR
get_nc_changes_udv(struct ldb_context
*sam_ctx
,
971 struct ldb_dn
*ncRoot_dn
,
972 struct drsuapi_DsReplicaCursor2CtrEx
*udv
)
980 ret
= dsdb_load_udv_v2(sam_ctx
, ncRoot_dn
, udv
, &udv
->cursors
, &udv
->count
);
981 if (ret
!= LDB_SUCCESS
) {
982 DEBUG(0,(__location__
": Failed to load UDV for %s - %s\n",
983 ldb_dn_get_linearized(ncRoot_dn
), ldb_errstring(sam_ctx
)));
984 return WERR_DS_DRA_INTERNAL_ERROR
;
991 /* comparison function for linked attributes - see CompareLinks() in
992 * MS-DRSR section 4.1.10.5.17 */
993 static int linked_attribute_compare(const struct la_for_sorting
*la1
,
994 const struct la_for_sorting
*la2
)
997 c
= memcmp(la1
->source_guid
,
998 la2
->source_guid
, sizeof(la2
->source_guid
));
1003 if (la1
->link
->attid
!= la2
->link
->attid
) {
1004 return la1
->link
->attid
< la2
->link
->attid
? -1:1;
1007 if ((la1
->link
->flags
& DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
) !=
1008 (la2
->link
->flags
& DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
)) {
1009 return (la1
->link
->flags
&
1010 DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
)? 1:-1;
1013 return memcmp(la1
->target_guid
,
1014 la2
->target_guid
, sizeof(la2
->target_guid
));
1017 struct drsuapi_changed_objects
{
1025 sort the objects we send by tree order (Samba 4.5 emulation)
1027 static int site_res_cmp_anc_order(struct drsuapi_changed_objects
*m1
,
1028 struct drsuapi_changed_objects
*m2
,
1029 struct drsuapi_getncchanges_state
*getnc_state
)
1031 return ldb_dn_compare(m2
->dn
, m1
->dn
);
1035 sort the objects we send first by uSNChanged
1037 static int site_res_cmp_usn_order(struct drsuapi_changed_objects
*m1
,
1038 struct drsuapi_changed_objects
*m2
,
1039 struct drsuapi_getncchanges_state
*getnc_state
)
1043 ret
= ldb_dn_compare(getnc_state
->ncRoot_dn
, m1
->dn
);
1048 ret
= ldb_dn_compare(getnc_state
->ncRoot_dn
, m2
->dn
);
1053 if (m1
->usn
== m2
->usn
) {
1054 return ldb_dn_compare(m2
->dn
, m1
->dn
);
1057 if (m1
->usn
< m2
->usn
) {
1066 handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
1068 static WERROR
getncchanges_rid_alloc(struct drsuapi_bind_state
*b_state
,
1069 TALLOC_CTX
*mem_ctx
,
1070 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1071 struct drsuapi_DsGetNCChangesCtr6
*ctr6
,
1072 struct ldb_dn
**rid_manager_dn
)
1074 struct ldb_dn
*req_dn
, *ntds_dn
= NULL
;
1076 struct ldb_context
*ldb
= b_state
->sam_ctx
;
1077 struct ldb_result
*ext_res
;
1078 struct dsdb_fsmo_extended_op
*exop
;
1083 - verify that the DN being asked for is the RID Manager DN
1084 - verify that we are the RID Manager
1087 /* work out who is the RID Manager, also return to caller */
1088 ret
= samdb_rid_manager_dn(ldb
, mem_ctx
, rid_manager_dn
);
1089 if (ret
!= LDB_SUCCESS
) {
1090 DEBUG(0, (__location__
": Failed to find RID Manager object - %s\n", ldb_errstring(ldb
)));
1091 return WERR_DS_DRA_INTERNAL_ERROR
;
1094 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(mem_ctx
,
1096 req10
->naming_context
,
1099 if (ret
!= LDB_SUCCESS
) {
1100 DBG_ERR("RID Alloc request for invalid DN %s: %s\n",
1101 drs_ObjectIdentifier_to_debug_string(mem_ctx
, req10
->naming_context
),
1103 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_MISMATCH
;
1107 if (ldb_dn_compare(req_dn
, *rid_manager_dn
) != 0) {
1108 /* that isn't the RID Manager DN */
1109 DBG_ERR("RID Alloc request for wrong DN %s\n",
1110 drs_ObjectIdentifier_to_debug_string(mem_ctx
,
1111 req10
->naming_context
));
1112 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_MISMATCH
;
1116 /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1117 ret
= dsdb_find_dn_by_guid(ldb
, mem_ctx
, &req10
->destination_dsa_guid
, 0, &ntds_dn
);
1118 if (ret
!= LDB_SUCCESS
) {
1119 DEBUG(0, (__location__
": Unable to find NTDS object for guid %s - %s\n",
1120 GUID_string(mem_ctx
, &req10
->destination_dsa_guid
), ldb_errstring(ldb
)));
1121 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_UNKNOWN_CALLER
;
1125 /* find the DN of the RID Manager */
1126 ret
= samdb_reference_dn_is_our_ntdsa(ldb
, *rid_manager_dn
, "fSMORoleOwner", &is_us
);
1127 if (ret
!= LDB_SUCCESS
) {
1128 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1129 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER
;
1130 return WERR_DS_DRA_INTERNAL_ERROR
;
1134 /* we're not the RID Manager - go away */
1135 DEBUG(0,(__location__
": RID Alloc request when not RID Manager\n"));
1136 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER
;
1140 exop
= talloc(mem_ctx
, struct dsdb_fsmo_extended_op
);
1141 W_ERROR_HAVE_NO_MEMORY(exop
);
1143 exop
->fsmo_info
= req10
->fsmo_info
;
1144 exop
->destination_dsa_guid
= req10
->destination_dsa_guid
;
1146 ret
= ldb_transaction_start(ldb
);
1147 if (ret
!= LDB_SUCCESS
) {
1148 DEBUG(0,(__location__
": Failed transaction start - %s\n",
1149 ldb_errstring(ldb
)));
1150 return WERR_DS_DRA_INTERNAL_ERROR
;
1153 ret
= ldb_extended(ldb
, DSDB_EXTENDED_ALLOCATE_RID_POOL
, exop
, &ext_res
);
1154 if (ret
!= LDB_SUCCESS
) {
1155 DEBUG(0,(__location__
": Failed extended allocation RID pool operation - %s\n",
1156 ldb_errstring(ldb
)));
1157 ldb_transaction_cancel(ldb
);
1158 return WERR_DS_DRA_INTERNAL_ERROR
;
1161 ret
= ldb_transaction_commit(ldb
);
1162 if (ret
!= LDB_SUCCESS
) {
1163 DEBUG(0,(__location__
": Failed transaction commit - %s\n",
1164 ldb_errstring(ldb
)));
1165 return WERR_DS_DRA_INTERNAL_ERROR
;
1168 talloc_free(ext_res
);
1170 DEBUG(2,("Allocated RID pool for server %s\n",
1171 GUID_string(mem_ctx
, &req10
->destination_dsa_guid
)));
1173 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_SUCCESS
;
1179 handle a DRSUAPI_EXOP_REPL_SECRET call
1181 static WERROR
getncchanges_repl_secret(struct drsuapi_bind_state
*b_state
,
1182 TALLOC_CTX
*mem_ctx
,
1183 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1184 struct dom_sid
*user_sid
,
1185 struct drsuapi_DsGetNCChangesCtr6
*ctr6
,
1186 bool has_get_all_changes
,
1187 struct ldb_dn
**machine_dn
)
1189 struct drsuapi_DsReplicaObjectIdentifier
*ncRoot
= req10
->naming_context
;
1190 struct ldb_dn
*obj_dn
= NULL
;
1191 struct ldb_message
*ntds_msg
= NULL
;
1192 struct ldb_dn
*ntds_dn
= NULL
, *server_dn
= NULL
;
1193 struct ldb_dn
*rodc_dn
, *krbtgt_link_dn
;
1195 const char *ntds_attrs
[] = { NULL
};
1196 const char *rodc_attrs
[] = { "msDS-KrbTgtLink",
1197 "msDS-NeverRevealGroup",
1198 "msDS-RevealOnDemandGroup",
1199 "userAccountControl",
1201 const char *obj_attrs
[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL
};
1202 struct ldb_result
*rodc_res
= NULL
, *obj_res
= NULL
;
1205 DEBUG(3,(__location__
": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
1206 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
)));
1209 * we need to work out if we will allow this DC to
1210 * replicate the secrets for this object
1212 * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
1216 if (b_state
->sam_ctx_system
== NULL
) {
1217 /* this operation needs system level access */
1218 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_ACCESS_DENIED
;
1219 return WERR_DS_DRA_ACCESS_DENIED
;
1223 * Before we accept or deny, fetch the machine DN for the destination
1226 * If we are the RODC, we will check that this matches the SID.
1228 ret
= samdb_get_ntds_obj_by_guid(mem_ctx
,
1229 b_state
->sam_ctx_system
,
1230 &req10
->destination_dsa_guid
,
1233 if (ret
!= LDB_SUCCESS
) {
1237 ntds_dn
= ntds_msg
->dn
;
1239 server_dn
= ldb_dn_get_parent(mem_ctx
, ntds_dn
);
1240 if (server_dn
== NULL
) {
1244 ret
= samdb_reference_dn(b_state
->sam_ctx_system
, mem_ctx
, server_dn
,
1245 "serverReference", machine_dn
);
1247 if (ret
!= LDB_SUCCESS
) {
1252 * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
1254 * The pseudo code indicate
1255 * revealsecrets = true
1256 * if IsRevealSecretRequest(msgIn) then
1257 * if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
1259 * if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
1260 * <... check if this account is ok to be replicated on this DC ...>
1261 * <... and if not reveal secrets = no ...>
1263 * reveal secrets = false
1268 * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
1269 * then you can do EXOP_REPL_SECRETS
1271 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(mem_ctx
,
1272 b_state
->sam_ctx_system
,
1276 if (ret
!= LDB_SUCCESS
) {
1277 DBG_ERR("RevealSecretRequest for for invalid DN %s\n",
1278 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
));
1282 if (!ldb_dn_validate(obj_dn
)) goto failed
;
1284 if (has_get_all_changes
) {
1288 rodc_dn
= ldb_dn_new_fmt(mem_ctx
, b_state
->sam_ctx_system
, "<SID=%s>",
1289 dom_sid_string(mem_ctx
, user_sid
));
1290 if (!ldb_dn_validate(rodc_dn
)) goto failed
;
1293 * do the two searches we need
1294 * We need DSDB_SEARCH_SHOW_EXTENDED_DN as we get a SID lists
1295 * out of the extended DNs
1297 ret
= dsdb_search_dn(b_state
->sam_ctx_system
, mem_ctx
, &rodc_res
, rodc_dn
, rodc_attrs
,
1298 DSDB_SEARCH_SHOW_EXTENDED_DN
);
1299 if (ret
!= LDB_SUCCESS
|| rodc_res
->count
!= 1) goto failed
;
1301 ret
= dsdb_search_dn(b_state
->sam_ctx_system
, mem_ctx
, &obj_res
, obj_dn
, obj_attrs
, 0);
1302 if (ret
!= LDB_SUCCESS
|| obj_res
->count
!= 1) goto failed
;
1305 * Must be an RODC account at this point, verify machine DN matches the
1308 if (ldb_dn_compare(rodc_res
->msgs
[0]->dn
, *machine_dn
) != 0) {
1312 /* an RODC is allowed to get its own krbtgt account secrets */
1313 krbtgt_link_dn
= samdb_result_dn(b_state
->sam_ctx_system
, mem_ctx
,
1314 rodc_res
->msgs
[0], "msDS-KrbTgtLink", NULL
);
1315 if (krbtgt_link_dn
!= NULL
&&
1316 ldb_dn_compare(obj_dn
, krbtgt_link_dn
) == 0) {
1320 werr
= samdb_confirm_rodc_allowed_to_repl_to(b_state
->sam_ctx_system
,
1325 if (W_ERROR_IS_OK(werr
)) {
1331 DEBUG(2,(__location__
": Denied single object with secret replication for %s by RODC %s\n",
1332 ldb_dn_get_linearized(obj_dn
), ldb_dn_get_linearized(rodc_res
->msgs
[0]->dn
)));
1333 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_NONE
;
1334 return WERR_DS_DRA_SECRETS_DENIED
;
1337 DEBUG(2,(__location__
": Allowed single object with secret replication for %s by %s %s\n",
1338 ldb_dn_get_linearized(obj_dn
), has_get_all_changes
?"RWDC":"RODC",
1339 ldb_dn_get_linearized(*machine_dn
)));
1340 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_SUCCESS
;
1341 req10
->highwatermark
.highest_usn
= 0;
1345 DEBUG(2,(__location__
": Failed single secret replication for %s by RODC %s\n",
1346 ldb_dn_get_linearized(obj_dn
), dom_sid_string(mem_ctx
, user_sid
)));
1347 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_NONE
;
1348 return WERR_DS_DRA_BAD_DN
;
1352 handle a DRSUAPI_EXOP_REPL_OBJ call
1354 static WERROR
getncchanges_repl_obj(struct drsuapi_bind_state
*b_state
,
1355 TALLOC_CTX
*mem_ctx
,
1356 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1357 struct dom_sid
*user_sid
,
1358 struct drsuapi_DsGetNCChangesCtr6
*ctr6
)
1360 struct drsuapi_DsReplicaObjectIdentifier
*ncRoot
= req10
->naming_context
;
1362 DEBUG(3,(__location__
": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1363 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
)));
1365 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_SUCCESS
;
1371 handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1372 DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1373 and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1375 static WERROR
getncchanges_change_master(struct drsuapi_bind_state
*b_state
,
1376 TALLOC_CTX
*mem_ctx
,
1377 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1378 struct drsuapi_DsGetNCChangesCtr6
*ctr6
)
1380 struct ldb_dn
*req_dn
, *ntds_dn
;
1383 struct ldb_context
*ldb
= b_state
->sam_ctx
;
1384 struct ldb_message
*msg
;
1389 - verify that the client dn exists
1390 - verify that we are the current master
1393 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(mem_ctx
, ldb
, req10
->naming_context
,
1395 if (ret
!= LDB_SUCCESS
) {
1396 /* that is not a valid dn */
1397 DBG_ERR("FSMO role transfer request for invalid DN %s: %s\n",
1398 drs_ObjectIdentifier_to_debug_string(mem_ctx
, req10
->naming_context
),
1400 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_MISMATCH
;
1404 /* find the DN of the current role owner */
1405 ret
= samdb_reference_dn_is_our_ntdsa(ldb
, req_dn
, "fSMORoleOwner", &is_us
);
1406 if (ret
!= LDB_SUCCESS
) {
1407 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1408 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER
;
1409 return WERR_DS_DRA_INTERNAL_ERROR
;
1413 /* we're not the RID Manager or role owner - go away */
1414 DEBUG(0,(__location__
": FSMO role or RID manager transfer owner request when not role owner\n"));
1415 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER
;
1419 /* change the current master */
1420 msg
= ldb_msg_new(ldb
);
1421 W_ERROR_HAVE_NO_MEMORY(msg
);
1422 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(msg
, ldb
, req10
->naming_context
,
1424 if (ret
!= LDB_SUCCESS
) {
1425 /* that is not a valid dn */
1426 DBG_ERR("FSMO role transfer request for invalid DN %s: %s\n",
1427 drs_ObjectIdentifier_to_debug_string(mem_ctx
, req10
->naming_context
),
1429 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_MISMATCH
;
1433 /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1434 ret
= dsdb_find_dn_by_guid(ldb
, msg
, &req10
->destination_dsa_guid
, 0, &ntds_dn
);
1435 if (ret
!= LDB_SUCCESS
) {
1436 DEBUG(0, (__location__
": Unable to find NTDS object for guid %s - %s\n",
1437 GUID_string(mem_ctx
, &req10
->destination_dsa_guid
), ldb_errstring(ldb
)));
1439 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_UNKNOWN_CALLER
;
1443 ret
= ldb_msg_add_string(msg
, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn
));
1446 return WERR_DS_DRA_INTERNAL_ERROR
;
1449 for (i
=0;i
<msg
->num_elements
;i
++) {
1450 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
1453 ret
= ldb_transaction_start(ldb
);
1454 if (ret
!= LDB_SUCCESS
) {
1455 DEBUG(0,(__location__
": Failed transaction start - %s\n",
1456 ldb_errstring(ldb
)));
1457 return WERR_DS_DRA_INTERNAL_ERROR
;
1460 ret
= ldb_modify(ldb
, msg
);
1461 if (ret
!= LDB_SUCCESS
) {
1462 DEBUG(0,(__location__
": Failed to change current owner - %s\n",
1463 ldb_errstring(ldb
)));
1464 ldb_transaction_cancel(ldb
);
1465 return WERR_DS_DRA_INTERNAL_ERROR
;
1468 ret
= ldb_transaction_commit(ldb
);
1469 if (ret
!= LDB_SUCCESS
) {
1470 DEBUG(0,(__location__
": Failed transaction commit - %s\n",
1471 ldb_errstring(ldb
)));
1472 return WERR_DS_DRA_INTERNAL_ERROR
;
1475 ctr6
->extended_ret
= DRSUAPI_EXOP_ERR_SUCCESS
;
1481 see if this getncchanges request includes a request to reveal secret information
1483 static WERROR
dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state
*b_state
,
1484 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1485 struct dsdb_schema_prefixmap
*pfm_remote
,
1486 bool *is_secret_request
)
1488 enum drsuapi_DsExtendedOperation exop
;
1490 struct dsdb_schema
*schema
;
1491 struct dsdb_syntax_ctx syntax_ctx
;
1493 *is_secret_request
= true;
1495 exop
= req10
->extended_op
;
1498 case DRSUAPI_EXOP_FSMO_REQ_ROLE
:
1499 case DRSUAPI_EXOP_FSMO_RID_ALLOC
:
1500 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE
:
1501 case DRSUAPI_EXOP_FSMO_REQ_PDC
:
1502 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE
:
1503 /* FSMO exops can reveal secrets */
1504 *is_secret_request
= true;
1506 case DRSUAPI_EXOP_REPL_SECRET
:
1507 case DRSUAPI_EXOP_REPL_OBJ
:
1508 case DRSUAPI_EXOP_NONE
:
1512 if (req10
->replica_flags
& DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING
) {
1513 *is_secret_request
= false;
1517 if (exop
== DRSUAPI_EXOP_REPL_SECRET
||
1518 req10
->partial_attribute_set
== NULL
) {
1519 /* they want secrets */
1520 *is_secret_request
= true;
1524 schema
= dsdb_get_schema(b_state
->sam_ctx
, NULL
);
1525 dsdb_syntax_ctx_init(&syntax_ctx
, b_state
->sam_ctx
, schema
);
1526 syntax_ctx
.pfm_remote
= pfm_remote
;
1528 /* check the attributes they asked for */
1529 for (i
=0; i
<req10
->partial_attribute_set
->num_attids
; i
++) {
1530 const struct dsdb_attribute
*sa
;
1531 WERROR werr
= getncchanges_attid_remote_to_local(schema
,
1533 req10
->partial_attribute_set
->attids
[i
],
1537 if (!W_ERROR_IS_OK(werr
)) {
1538 DEBUG(0,(__location__
": attid 0x%08X not found: %s\n",
1539 req10
->partial_attribute_set
->attids
[i
], win_errstr(werr
)));
1543 if (!dsdb_attr_in_rodc_fas(sa
)) {
1544 *is_secret_request
= true;
1549 if (req10
->partial_attribute_set_ex
) {
1550 /* check the extended attributes they asked for */
1551 for (i
=0; i
<req10
->partial_attribute_set_ex
->num_attids
; i
++) {
1552 const struct dsdb_attribute
*sa
;
1553 WERROR werr
= getncchanges_attid_remote_to_local(schema
,
1555 req10
->partial_attribute_set_ex
->attids
[i
],
1559 if (!W_ERROR_IS_OK(werr
)) {
1560 DEBUG(0,(__location__
": attid 0x%08X not found: %s\n",
1561 req10
->partial_attribute_set_ex
->attids
[i
], win_errstr(werr
)));
1565 if (!dsdb_attr_in_rodc_fas(sa
)) {
1566 *is_secret_request
= true;
1572 *is_secret_request
= false;
1577 see if this getncchanges request is only for attributes in the GC
1578 partial attribute set
1580 static WERROR
dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state
*b_state
,
1581 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1582 struct dsdb_schema_prefixmap
*pfm_remote
,
1583 bool *is_gc_pas_request
)
1585 enum drsuapi_DsExtendedOperation exop
;
1587 struct dsdb_schema
*schema
;
1588 struct dsdb_syntax_ctx syntax_ctx
;
1590 exop
= req10
->extended_op
;
1593 case DRSUAPI_EXOP_FSMO_REQ_ROLE
:
1594 case DRSUAPI_EXOP_FSMO_RID_ALLOC
:
1595 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE
:
1596 case DRSUAPI_EXOP_FSMO_REQ_PDC
:
1597 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE
:
1598 case DRSUAPI_EXOP_REPL_SECRET
:
1599 *is_gc_pas_request
= false;
1601 case DRSUAPI_EXOP_REPL_OBJ
:
1602 case DRSUAPI_EXOP_NONE
:
1606 if (req10
->partial_attribute_set
== NULL
) {
1607 /* they want it all */
1608 *is_gc_pas_request
= false;
1612 schema
= dsdb_get_schema(b_state
->sam_ctx
, NULL
);
1613 dsdb_syntax_ctx_init(&syntax_ctx
, b_state
->sam_ctx
, schema
);
1614 syntax_ctx
.pfm_remote
= pfm_remote
;
1616 /* check the attributes they asked for */
1617 for (i
=0; i
<req10
->partial_attribute_set
->num_attids
; i
++) {
1618 const struct dsdb_attribute
*sa
;
1619 WERROR werr
= getncchanges_attid_remote_to_local(schema
,
1621 req10
->partial_attribute_set
->attids
[i
],
1625 if (!W_ERROR_IS_OK(werr
)) {
1626 DEBUG(0,(__location__
": attid 0x%08X not found: %s\n",
1627 req10
->partial_attribute_set
->attids
[i
], win_errstr(werr
)));
1631 if (!sa
->isMemberOfPartialAttributeSet
) {
1632 *is_gc_pas_request
= false;
1637 if (req10
->partial_attribute_set_ex
) {
1638 /* check the extended attributes they asked for */
1639 for (i
=0; i
<req10
->partial_attribute_set_ex
->num_attids
; i
++) {
1640 const struct dsdb_attribute
*sa
;
1641 WERROR werr
= getncchanges_attid_remote_to_local(schema
,
1643 req10
->partial_attribute_set_ex
->attids
[i
],
1647 if (!W_ERROR_IS_OK(werr
)) {
1648 DEBUG(0,(__location__
": attid 0x%08X not found: %s\n",
1649 req10
->partial_attribute_set_ex
->attids
[i
], win_errstr(werr
)));
1653 if (!sa
->isMemberOfPartialAttributeSet
) {
1654 *is_gc_pas_request
= false;
1660 *is_gc_pas_request
= true;
1666 map from req8 to req10
1668 static struct drsuapi_DsGetNCChangesRequest10
*
1669 getncchanges_map_req8(TALLOC_CTX
*mem_ctx
,
1670 struct drsuapi_DsGetNCChangesRequest8
*req8
)
1672 struct drsuapi_DsGetNCChangesRequest10
*req10
= talloc_zero(mem_ctx
,
1673 struct drsuapi_DsGetNCChangesRequest10
);
1674 if (req10
== NULL
) {
1678 req10
->destination_dsa_guid
= req8
->destination_dsa_guid
;
1679 req10
->source_dsa_invocation_id
= req8
->source_dsa_invocation_id
;
1680 req10
->naming_context
= req8
->naming_context
;
1681 req10
->highwatermark
= req8
->highwatermark
;
1682 req10
->uptodateness_vector
= req8
->uptodateness_vector
;
1683 req10
->replica_flags
= req8
->replica_flags
;
1684 req10
->max_object_count
= req8
->max_object_count
;
1685 req10
->max_ndr_size
= req8
->max_ndr_size
;
1686 req10
->extended_op
= req8
->extended_op
;
1687 req10
->fsmo_info
= req8
->fsmo_info
;
1688 req10
->partial_attribute_set
= req8
->partial_attribute_set
;
1689 req10
->partial_attribute_set_ex
= req8
->partial_attribute_set_ex
;
1690 req10
->mapping_ctr
= req8
->mapping_ctr
;
1695 static const char *collect_objects_attrs
[] = { "uSNChanged",
1700 * Collects object for normal replication cycle.
1702 static WERROR
getncchanges_collect_objects(struct drsuapi_bind_state
*b_state
,
1703 TALLOC_CTX
*mem_ctx
,
1704 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1705 struct ldb_dn
*search_dn
,
1706 const char *extra_filter
,
1707 struct ldb_result
**search_res
)
1710 char* search_filter
;
1711 enum ldb_scope scope
= LDB_SCOPE_SUBTREE
;
1712 struct drsuapi_getncchanges_state
*getnc_state
= b_state
->getncchanges_state
;
1713 bool critical_only
= false;
1715 if (req10
->replica_flags
& DRSUAPI_DRS_CRITICAL_ONLY
) {
1716 critical_only
= true;
1719 if (req10
->extended_op
== DRSUAPI_EXOP_REPL_OBJ
||
1720 req10
->extended_op
== DRSUAPI_EXOP_REPL_SECRET
) {
1721 scope
= LDB_SCOPE_BASE
;
1722 critical_only
= false;
1725 /* Construct response. */
1726 search_filter
= talloc_asprintf(mem_ctx
,
1727 "(uSNChanged>=%llu)",
1728 (unsigned long long)(getnc_state
->min_usn
+1));
1731 search_filter
= talloc_asprintf(mem_ctx
, "(&%s(%s))", search_filter
, extra_filter
);
1734 if (critical_only
) {
1735 search_filter
= talloc_asprintf(mem_ctx
,
1736 "(&%s(isCriticalSystemObject=TRUE))",
1740 if (req10
->replica_flags
& DRSUAPI_DRS_ASYNC_REP
) {
1741 scope
= LDB_SCOPE_BASE
;
1745 search_dn
= getnc_state
->ncRoot_dn
;
1748 DEBUG(2,(__location__
": getncchanges on %s using filter %s\n",
1749 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
), search_filter
));
1750 ret
= drsuapi_search_with_extended_dn(b_state
->sam_ctx
, getnc_state
, search_res
,
1752 collect_objects_attrs
,
1754 if (ret
!= LDB_SUCCESS
) {
1755 return WERR_DS_DRA_INTERNAL_ERROR
;
1762 * Collects object for normal replication cycle.
1764 static WERROR
getncchanges_collect_objects_exop(struct drsuapi_bind_state
*b_state
,
1765 TALLOC_CTX
*mem_ctx
,
1766 struct drsuapi_DsGetNCChangesRequest10
*req10
,
1767 struct drsuapi_DsGetNCChangesCtr6
*ctr6
,
1768 struct ldb_dn
*search_dn
,
1769 const char *extra_filter
,
1770 struct ldb_result
**search_res
)
1772 /* we have nothing to do in case of ex-op failure */
1773 if (ctr6
->extended_ret
!= DRSUAPI_EXOP_ERR_SUCCESS
) {
1777 switch (req10
->extended_op
) {
1778 case DRSUAPI_EXOP_FSMO_RID_ALLOC
:
1781 struct ldb_dn
*ntds_dn
= NULL
;
1782 struct ldb_dn
*server_dn
= NULL
;
1783 struct ldb_dn
*machine_dn
= NULL
;
1784 struct ldb_dn
*rid_set_dn
= NULL
;
1785 struct ldb_result
*search_res2
= NULL
;
1786 struct ldb_result
*search_res3
= NULL
;
1787 TALLOC_CTX
*frame
= talloc_stackframe();
1788 /* get RID manager, RID set and server DN (in that order) */
1790 /* This first search will get the RID Manager */
1791 ret
= drsuapi_search_with_extended_dn(b_state
->sam_ctx
, frame
,
1793 search_dn
, LDB_SCOPE_BASE
,
1794 collect_objects_attrs
,
1796 if (ret
!= LDB_SUCCESS
) {
1797 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %s",
1798 ldb_dn_get_linearized(search_dn
),
1799 ldb_errstring(b_state
->sam_ctx
)));
1801 return WERR_DS_DRA_INTERNAL_ERROR
;
1804 if ((*search_res
)->count
!= 1) {
1805 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Manager object %s - %u objects returned",
1806 ldb_dn_get_linearized(search_dn
),
1807 (*search_res
)->count
));
1809 return WERR_DS_DRA_INTERNAL_ERROR
;
1812 /* Now extend it to the RID set */
1814 /* Find the computer account DN for the destination
1815 * dsa GUID specified */
1817 ret
= dsdb_find_dn_by_guid(b_state
->sam_ctx
, frame
,
1818 &req10
->destination_dsa_guid
, 0,
1820 if (ret
!= LDB_SUCCESS
) {
1821 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Unable to find NTDS object for guid %s - %s\n",
1823 &req10
->destination_dsa_guid
),
1824 ldb_errstring(b_state
->sam_ctx
)));
1826 return WERR_DS_DRA_INTERNAL_ERROR
;
1829 server_dn
= ldb_dn_get_parent(frame
, ntds_dn
);
1832 return WERR_DS_DRA_INTERNAL_ERROR
;
1835 ret
= samdb_reference_dn(b_state
->sam_ctx
, frame
, server_dn
,
1836 "serverReference", &machine_dn
);
1837 if (ret
!= LDB_SUCCESS
) {
1838 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find serverReference in %s - %s",
1839 ldb_dn_get_linearized(server_dn
),
1840 ldb_errstring(b_state
->sam_ctx
)));
1842 return WERR_DS_DRA_INTERNAL_ERROR
;
1845 ret
= samdb_reference_dn(b_state
->sam_ctx
, frame
, machine_dn
,
1846 "rIDSetReferences", &rid_set_dn
);
1847 if (ret
!= LDB_SUCCESS
) {
1848 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to find rIDSetReferences in %s - %s",
1849 ldb_dn_get_linearized(server_dn
),
1850 ldb_errstring(b_state
->sam_ctx
)));
1852 return WERR_DS_DRA_INTERNAL_ERROR
;
1856 /* This first search will get the RID Manager, now get the RID set */
1857 ret
= drsuapi_search_with_extended_dn(b_state
->sam_ctx
, frame
,
1859 rid_set_dn
, LDB_SCOPE_BASE
,
1860 collect_objects_attrs
,
1862 if (ret
!= LDB_SUCCESS
) {
1863 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %s",
1864 ldb_dn_get_linearized(rid_set_dn
),
1865 ldb_errstring(b_state
->sam_ctx
)));
1867 return WERR_DS_DRA_INTERNAL_ERROR
;
1870 if (search_res2
->count
!= 1) {
1871 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get RID Set object %s - %u objects returned",
1872 ldb_dn_get_linearized(rid_set_dn
),
1873 search_res2
->count
));
1875 return WERR_DS_DRA_INTERNAL_ERROR
;
1878 /* Finally get the server DN */
1879 ret
= drsuapi_search_with_extended_dn(b_state
->sam_ctx
, frame
,
1881 machine_dn
, LDB_SCOPE_BASE
,
1882 collect_objects_attrs
,
1884 if (ret
!= LDB_SUCCESS
) {
1885 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %s",
1886 ldb_dn_get_linearized(server_dn
),
1887 ldb_errstring(b_state
->sam_ctx
)));
1889 return WERR_DS_DRA_INTERNAL_ERROR
;
1892 if (search_res3
->count
!= 1) {
1893 DEBUG(1, ("DRSUAPI_EXOP_FSMO_RID_ALLOC: Failed to get server object %s - %u objects returned",
1894 ldb_dn_get_linearized(server_dn
),
1895 search_res3
->count
));
1897 return WERR_DS_DRA_INTERNAL_ERROR
;
1900 /* Now extend the original search_res with these answers */
1901 (*search_res
)->count
= 3;
1903 (*search_res
)->msgs
= talloc_realloc(frame
, (*search_res
)->msgs
,
1904 struct ldb_message
*,
1905 (*search_res
)->count
);
1906 if ((*search_res
)->msgs
== NULL
) {
1908 return WERR_NOT_ENOUGH_MEMORY
;
1912 talloc_steal(mem_ctx
, *search_res
);
1913 (*search_res
)->msgs
[1] =
1914 talloc_steal((*search_res
)->msgs
, search_res2
->msgs
[0]);
1915 (*search_res
)->msgs
[2] =
1916 talloc_steal((*search_res
)->msgs
, search_res3
->msgs
[0]);
1922 /* TODO: implement extended op specific collection
1923 * of objects. Right now we just normal procedure
1924 * for collecting objects */
1925 return getncchanges_collect_objects(b_state
, mem_ctx
, req10
, search_dn
, extra_filter
, search_res
);
1929 static void dcesrv_drsuapi_update_highwatermark(const struct ldb_message
*msg
,
1931 struct drsuapi_DsReplicaHighWaterMark
*hwm
)
1933 uint64_t uSN
= ldb_msg_find_attr_as_uint64(msg
, "uSNChanged", 0);
1935 if (uSN
> max_usn
) {
1937 * Only report the max_usn we had at the start
1938 * of the replication cycle.
1940 * If this object has changed lately we better
1941 * let the destination dsa refetch the change.
1942 * This is better than the risk of loosing some
1943 * objects or linked attributes.
1948 if (uSN
<= hwm
->tmp_highest_usn
) {
1952 hwm
->tmp_highest_usn
= uSN
;
1953 hwm
->reserved_usn
= 0;
1957 * Adds an object's GUID to the cache of objects already sent.
1958 * This avoids us sending the same object multiple times when
1959 * the GetNCChanges request uses a flag like GET_ANC.
1961 static WERROR
dcesrv_drsuapi_obj_cache_add(struct db_context
*obj_cache
,
1962 const struct GUID
*guid
)
1964 enum ndr_err_code ndr_err
;
1965 uint8_t guid_buf
[DRS_GUID_SIZE
] = { 0, };
1968 .length
= sizeof(guid_buf
),
1980 ndr_err
= ndr_push_struct_into_fixed_blob(&b
, guid
,
1981 (ndr_push_flags_fn_t
)ndr_push_GUID
);
1982 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1983 return WERR_DS_DRA_INTERNAL_ERROR
;
1986 status
= dbwrap_store(obj_cache
, key
, val
, TDB_REPLACE
);
1987 if (!NT_STATUS_IS_OK(status
)) {
1988 return WERR_DS_DRA_INTERNAL_ERROR
;
1995 * Checks if the object with the GUID specified already exists in the
1996 * object cache, i.e. it's already been sent in a GetNCChanges response.
1998 static WERROR
dcesrv_drsuapi_obj_cache_exists(struct db_context
*obj_cache
,
1999 const struct GUID
*guid
)
2001 enum ndr_err_code ndr_err
;
2002 uint8_t guid_buf
[DRS_GUID_SIZE
] = { 0, };
2005 .length
= sizeof(guid_buf
),
2013 ndr_err
= ndr_push_struct_into_fixed_blob(&b
, guid
,
2014 (ndr_push_flags_fn_t
)ndr_push_GUID
);
2015 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
2016 return WERR_DS_DRA_INTERNAL_ERROR
;
2019 exists
= dbwrap_exists(obj_cache
, key
);
2021 return WERR_OBJECT_NOT_FOUND
;
2024 return WERR_OBJECT_NAME_EXISTS
;
2028 * Copies the la_list specified into a sorted array, ready to be sent in a
2029 * GetNCChanges response.
2031 static WERROR
getncchanges_get_sorted_array(const struct drsuapi_DsReplicaLinkedAttribute
*la_list
,
2032 const uint32_t link_count
,
2033 struct ldb_context
*sam_ctx
,
2034 TALLOC_CTX
*mem_ctx
,
2035 const struct dsdb_schema
*schema
,
2036 struct la_for_sorting
**ret_array
)
2039 struct la_for_sorting
*guid_array
;
2040 WERROR werr
= WERR_OK
;
2043 guid_array
= talloc_array(mem_ctx
, struct la_for_sorting
, link_count
);
2044 if (guid_array
== NULL
) {
2045 DEBUG(0, ("Out of memory allocating %u linked attributes for sorting", link_count
));
2046 return WERR_NOT_ENOUGH_MEMORY
;
2049 for (j
= 0; j
< link_count
; j
++) {
2051 /* we need to get the target GUIDs to compare */
2053 const struct drsuapi_DsReplicaLinkedAttribute
*la
= &la_list
[j
];
2054 const struct dsdb_attribute
*schema_attrib
;
2055 const struct ldb_val
*target_guid
;
2056 DATA_BLOB source_guid
;
2057 TALLOC_CTX
*frame
= talloc_stackframe();
2060 schema_attrib
= dsdb_attribute_by_attributeID_id(schema
, la
->attid
);
2062 werr
= dsdb_dn_la_from_blob(sam_ctx
, schema_attrib
, schema
, frame
, la
->value
.blob
, &dn
);
2063 if (!W_ERROR_IS_OK(werr
)) {
2064 DEBUG(0,(__location__
": Bad la blob in sort\n"));
2069 /* Extract the target GUID in NDR form */
2070 target_guid
= ldb_dn_get_extended_component(dn
->dn
, "GUID");
2071 if (target_guid
== NULL
2072 || target_guid
->length
!= sizeof(guid_array
[0].target_guid
)) {
2073 status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2075 /* Repack the source GUID as NDR for sorting */
2076 status
= GUID_to_ndr_blob(&la
->identifier
->guid
,
2081 if (!NT_STATUS_IS_OK(status
)
2082 || source_guid
.length
!= sizeof(guid_array
[0].source_guid
)) {
2083 DEBUG(0,(__location__
": Bad la guid in sort\n"));
2085 return ntstatus_to_werror(status
);
2088 guid_array
[j
].link
= &la_list
[j
];
2089 memcpy(guid_array
[j
].target_guid
, target_guid
->data
,
2090 sizeof(guid_array
[j
].target_guid
));
2091 memcpy(guid_array
[j
].source_guid
, source_guid
.data
,
2092 sizeof(guid_array
[j
].source_guid
));
2096 TYPESAFE_QSORT(guid_array
, link_count
, linked_attribute_compare
);
2098 *ret_array
= guid_array
;
2105 * Adds any ancestor/parent objects of the child_obj specified.
2106 * This is needed when the GET_ANC flag is specified in the request.
2107 * @param new_objs if parents are added, this gets updated to point to a chain
2108 * of parent objects (with the parents first and the child last)
2110 static WERROR
getncchanges_add_ancestors(struct drsuapi_DsReplicaObjectListItemEx
*child_obj
,
2111 struct ldb_dn
*child_dn
,
2112 TALLOC_CTX
*mem_ctx
,
2113 struct ldb_context
*sam_ctx
,
2114 struct drsuapi_getncchanges_state
*getnc_state
,
2115 struct dsdb_schema
*schema
,
2116 DATA_BLOB
*session_key
,
2117 struct drsuapi_DsGetNCChangesRequest10
*req10
,
2118 uint32_t *local_pas
,
2119 struct ldb_dn
*machine_dn
,
2120 struct drsuapi_DsReplicaObjectListItemEx
**new_objs
)
2123 const struct GUID
*next_anc_guid
= NULL
;
2124 WERROR werr
= WERR_OK
;
2125 static const char * const msg_attrs
[] = {
2127 "nTSecurityDescriptor",
2129 "replPropertyMetaData",
2130 DSDB_SECRET_ATTRIBUTES
,
2133 next_anc_guid
= child_obj
->parent_object_guid
;
2135 while (next_anc_guid
!= NULL
) {
2136 struct drsuapi_DsReplicaObjectListItemEx
*anc_obj
= NULL
;
2137 struct ldb_message
*anc_msg
= NULL
;
2138 struct ldb_result
*anc_res
= NULL
;
2139 struct ldb_dn
*anc_dn
= NULL
;
2142 * Don't send an object twice. (If we've sent the object, then
2143 * we've also sent all its parents as well)
2145 werr
= dcesrv_drsuapi_obj_cache_exists(getnc_state
->obj_cache
,
2147 if (W_ERROR_EQUAL(werr
, WERR_OBJECT_NAME_EXISTS
)) {
2150 if (W_ERROR_IS_OK(werr
)) {
2151 return WERR_INTERNAL_ERROR
;
2153 if (!W_ERROR_EQUAL(werr
, WERR_OBJECT_NOT_FOUND
)) {
2157 anc_obj
= talloc_zero(mem_ctx
,
2158 struct drsuapi_DsReplicaObjectListItemEx
);
2159 if (anc_obj
== NULL
) {
2160 return WERR_NOT_ENOUGH_MEMORY
;
2163 anc_dn
= ldb_dn_new_fmt(anc_obj
, sam_ctx
, "<GUID=%s>",
2164 GUID_string(anc_obj
, next_anc_guid
));
2165 if (anc_dn
== NULL
) {
2166 return WERR_NOT_ENOUGH_MEMORY
;
2169 ret
= drsuapi_search_with_extended_dn(sam_ctx
, anc_obj
,
2173 if (ret
!= LDB_SUCCESS
) {
2174 const char *anc_str
= NULL
;
2175 const char *obj_str
= NULL
;
2177 anc_str
= ldb_dn_get_extended_linearized(anc_obj
,
2180 obj_str
= ldb_dn_get_extended_linearized(anc_obj
,
2184 DBG_ERR("getncchanges: failed to fetch ANC "
2185 "DN %s for DN %s - %s\n",
2186 anc_str
, obj_str
, ldb_errstring(sam_ctx
));
2187 return WERR_DS_DRA_INCONSISTENT_DIT
;
2190 anc_msg
= anc_res
->msgs
[0];
2192 werr
= get_nc_changes_build_object(anc_obj
, anc_msg
,
2195 schema
, session_key
,
2197 false, /* force_object_return */
2201 if (!W_ERROR_IS_OK(werr
)) {
2206 * Regardless of whether we actually use it or not,
2207 * we add it to the cache so we don't look at it again
2209 werr
= dcesrv_drsuapi_obj_cache_add(getnc_state
->obj_cache
,
2211 if (!W_ERROR_IS_OK(werr
)) {
2216 * Any ancestors which are below the highwatermark
2217 * or uptodateness_vector shouldn't be added,
2218 * but we still look further up the
2219 * tree for ones which have been changed recently.
2221 if (anc_obj
->meta_data_ctr
!= NULL
) {
2224 * prepend the parent to the list so that the client-side
2225 * adds the parent object before it adds the children
2227 anc_obj
->next_object
= *new_objs
;
2228 *new_objs
= anc_obj
;
2232 TALLOC_FREE(anc_res
);
2233 TALLOC_FREE(anc_dn
);
2236 * We may need to resolve more parents...
2238 next_anc_guid
= anc_obj
->parent_object_guid
;
2244 * Adds a list of new objects into the current chunk of replication data to send
2246 static void getncchanges_chunk_add_objects(struct getncchanges_repl_chunk
*repl_chunk
,
2247 struct drsuapi_DsReplicaObjectListItemEx
*obj_list
)
2249 struct drsuapi_DsReplicaObjectListItemEx
*obj
;
2252 * We track the last object added to the replication chunk, so just add
2253 * the new object-list onto the end
2255 if (repl_chunk
->object_list
== NULL
) {
2256 repl_chunk
->object_list
= obj_list
;
2258 repl_chunk
->last_object
->next_object
= obj_list
;
2261 for (obj
= obj_list
; obj
!= NULL
; obj
= obj
->next_object
) {
2262 repl_chunk
->object_count
+= 1;
2265 * Remember the last object in the response - we'll use this to
2266 * link the next object(s) processed onto the existing list
2268 if (obj
->next_object
== NULL
) {
2269 repl_chunk
->last_object
= obj
;
2275 * Gets the object to send, packed into an RPC struct ready to send. This also
2276 * adds the object to the object cache, and adds any ancestors (if needed).
2277 * @param msg - DB search result for the object to add
2278 * @param guid - GUID of the object to add
2279 * @param ret_obj_list - returns the object ready to be sent (in a list, along
2280 * with any ancestors that might be needed). NULL if nothing to send.
2282 static WERROR
getncchanges_get_obj_to_send(const struct ldb_message
*msg
,
2283 TALLOC_CTX
*mem_ctx
,
2284 struct ldb_context
*sam_ctx
,
2285 struct drsuapi_getncchanges_state
*getnc_state
,
2286 struct dsdb_schema
*schema
,
2287 DATA_BLOB
*session_key
,
2288 struct drsuapi_DsGetNCChangesRequest10
*req10
,
2289 bool force_object_return
,
2290 uint32_t *local_pas
,
2291 struct ldb_dn
*machine_dn
,
2292 const struct GUID
*guid
,
2293 struct drsuapi_DsReplicaObjectListItemEx
**ret_obj_list
)
2295 struct drsuapi_DsReplicaObjectListItemEx
*obj
;
2298 *ret_obj_list
= NULL
;
2300 obj
= talloc_zero(mem_ctx
, struct drsuapi_DsReplicaObjectListItemEx
);
2301 W_ERROR_HAVE_NO_MEMORY(obj
);
2303 werr
= get_nc_changes_build_object(obj
, msg
, sam_ctx
, getnc_state
,
2304 schema
, session_key
, req10
,
2305 force_object_return
,
2306 local_pas
, machine_dn
, guid
);
2307 if (!W_ERROR_IS_OK(werr
)) {
2312 * The object may get filtered out by the UTDV's USN and not actually
2313 * sent, in which case there's nothing more to do here
2315 if (obj
->meta_data_ctr
== NULL
) {
2320 if (getnc_state
->obj_cache
!= NULL
) {
2321 werr
= dcesrv_drsuapi_obj_cache_add(getnc_state
->obj_cache
,
2323 if (!W_ERROR_IS_OK(werr
)) {
2328 *ret_obj_list
= obj
;
2331 * If required, also add any ancestors that the client may need to know
2332 * about before it can resolve this object. These get prepended to the
2333 * ret_obj_list so the client adds them first.
2335 * We allow this to be disabled to permit testing of a
2336 * client-side fallback for the broken behaviour in Samba 4.5
2339 if (getnc_state
->is_get_anc
2340 && !getnc_state
->broken_samba_4_5_get_anc_emulation
) {
2341 werr
= getncchanges_add_ancestors(obj
, msg
->dn
, mem_ctx
,
2342 sam_ctx
, getnc_state
,
2343 schema
, session_key
,
2345 machine_dn
, ret_obj_list
);
2352 * Returns the number of links that are waiting to be sent
2354 static uint32_t getncchanges_chunk_links_pending(struct getncchanges_repl_chunk
*repl_chunk
,
2355 struct drsuapi_getncchanges_state
*getnc_state
)
2357 uint32_t links_to_send
= 0;
2359 if (getnc_state
->is_get_tgt
) {
2362 * when the GET_TGT flag is set, only include the linked
2363 * attributes whose target object has already been checked
2364 * (i.e. they're ready to send).
2366 if (repl_chunk
->tgt_la_count
> getnc_state
->la_idx
) {
2367 links_to_send
= (repl_chunk
->tgt_la_count
-
2368 getnc_state
->la_idx
);
2371 links_to_send
= getnc_state
->la_count
- getnc_state
->la_idx
;
2374 return links_to_send
;
2378 * Returns the max number of links that will fit in the current replication chunk
2380 static uint32_t getncchanges_chunk_max_links(struct getncchanges_repl_chunk
*repl_chunk
)
2382 uint32_t max_links
= 0;
2384 if (repl_chunk
->max_links
!= DEFAULT_MAX_LINKS
||
2385 repl_chunk
->max_objects
!= DEFAULT_MAX_OBJECTS
) {
2388 * We're using non-default settings, so don't try to adjust
2389 * them, just trust the user has configured decent values
2391 max_links
= repl_chunk
->max_links
;
2393 } else if (repl_chunk
->max_links
> repl_chunk
->object_count
) {
2396 * This is just an approximate guess to avoid overfilling the
2397 * replication chunk. It's the logic we've used historically.
2398 * E.g. if we've already sent 1000 objects, then send 1000 fewer
2399 * links. For comparison, the max that Windows seems to send is
2400 * ~2700 links and ~250 objects (although this may vary based
2403 max_links
= repl_chunk
->max_links
- repl_chunk
->object_count
;
2410 * Returns true if the current GetNCChanges() call has taken longer than its
2411 * allotted time. This prevents the client from timing out.
2413 static bool getncchanges_chunk_timed_out(struct getncchanges_repl_chunk
*repl_chunk
)
2415 return (time(NULL
) - repl_chunk
->start
> repl_chunk
->max_wait
);
2419 * Returns true if the current chunk of replication data has reached the
2420 * max_objects and/or max_links thresholds.
2422 static bool getncchanges_chunk_is_full(struct getncchanges_repl_chunk
*repl_chunk
,
2423 struct drsuapi_getncchanges_state
*getnc_state
)
2425 bool chunk_full
= false;
2426 uint32_t links_to_send
;
2427 uint32_t chunk_limit
;
2429 /* check if the current chunk is already full with objects */
2430 if (repl_chunk
->object_count
>= repl_chunk
->max_objects
) {
2433 } else if (repl_chunk
->object_count
> 0 &&
2434 getncchanges_chunk_timed_out(repl_chunk
)) {
2437 * We've exceeded our allotted time building this chunk,
2438 * and we have at least one object to send back to the client
2442 } else if (repl_chunk
->immediate_link_sync
) {
2444 /* check if the chunk is already full with links */
2445 links_to_send
= getncchanges_chunk_links_pending(repl_chunk
,
2448 chunk_limit
= getncchanges_chunk_max_links(repl_chunk
);
2451 * The chunk is full if we've got more links to send than will
2454 if (links_to_send
> 0 && chunk_limit
<= links_to_send
) {
2463 * Goes through any new linked attributes and checks that the target object
2464 * will be known to the client, i.e. we've already sent it in an replication
2465 * chunk. If not, then it adds the target object to the current replication
2466 * chunk. This is only done when the client specifies DRS_GET_TGT.
2468 static WERROR
getncchanges_chunk_add_la_targets(struct getncchanges_repl_chunk
*repl_chunk
,
2469 struct drsuapi_getncchanges_state
*getnc_state
,
2470 uint32_t start_la_index
,
2471 TALLOC_CTX
*mem_ctx
,
2472 struct ldb_context
*sam_ctx
,
2473 struct dsdb_schema
*schema
,
2474 DATA_BLOB
*session_key
,
2475 struct drsuapi_DsGetNCChangesRequest10
*req10
,
2476 uint32_t *local_pas
,
2477 struct ldb_dn
*machine_dn
)
2481 uint32_t max_la_index
;
2483 uint32_t target_count
= 0;
2484 WERROR werr
= WERR_OK
;
2485 static const char * const msg_attrs
[] = {
2487 "nTSecurityDescriptor",
2489 "replPropertyMetaData",
2490 DSDB_SECRET_ATTRIBUTES
,
2494 * A object can potentially link to thousands of targets. Only bother
2495 * checking as many targets as will fit into the current response
2497 max_links
= getncchanges_chunk_max_links(repl_chunk
);
2498 max_la_index
= MIN(getnc_state
->la_count
,
2499 start_la_index
+ max_links
);
2501 /* loop through any linked attributes to check */
2502 for (i
= start_la_index
;
2503 (i
< max_la_index
&&
2504 !getncchanges_chunk_is_full(repl_chunk
, getnc_state
));
2507 struct GUID target_guid
;
2508 struct drsuapi_DsReplicaObjectListItemEx
*new_objs
= NULL
;
2509 const struct drsuapi_DsReplicaLinkedAttribute
*la
;
2510 struct ldb_result
*msg_res
;
2511 struct ldb_dn
*search_dn
;
2512 TALLOC_CTX
*tmp_ctx
;
2514 const struct dsdb_attribute
*schema_attrib
;
2518 la
= &getnc_state
->la_list
[i
];
2519 tmp_ctx
= talloc_new(mem_ctx
);
2522 * Track what linked attribute targets we've checked. We might
2523 * not have time to check them all, so we should only send back
2524 * the ones we've actually checked.
2526 repl_chunk
->tgt_la_count
= i
+ 1;
2528 /* get the GUID of the linked attribute's target object */
2529 schema_attrib
= dsdb_attribute_by_attributeID_id(schema
,
2532 werr
= dsdb_dn_la_from_blob(sam_ctx
, schema_attrib
, schema
,
2533 tmp_ctx
, la
->value
.blob
, &dn
);
2535 if (!W_ERROR_IS_OK(werr
)) {
2536 DEBUG(0,(__location__
": Bad la blob\n"));
2540 status
= dsdb_get_extended_dn_guid(dn
->dn
, &target_guid
, "GUID");
2542 if (!NT_STATUS_IS_OK(status
)) {
2543 return ntstatus_to_werror(status
);
2547 * if the target isn't in the cache, then the client
2548 * might not know about it, so send the target now
2550 werr
= dcesrv_drsuapi_obj_cache_exists(getnc_state
->obj_cache
,
2553 if (W_ERROR_EQUAL(werr
, WERR_OBJECT_NAME_EXISTS
)) {
2555 /* target already sent, nothing to do */
2556 TALLOC_FREE(tmp_ctx
);
2560 same_nc
= dsdb_objects_have_same_nc(sam_ctx
, tmp_ctx
, dn
->dn
,
2561 getnc_state
->ncRoot_dn
);
2563 /* don't try to fetch target objects from another partition */
2565 TALLOC_FREE(tmp_ctx
);
2569 search_dn
= ldb_dn_new_fmt(tmp_ctx
, sam_ctx
, "<GUID=%s>",
2570 GUID_string(tmp_ctx
, &target_guid
));
2571 W_ERROR_HAVE_NO_MEMORY(search_dn
);
2573 ret
= drsuapi_search_with_extended_dn(sam_ctx
, tmp_ctx
,
2574 &msg_res
, search_dn
,
2579 * Don't fail the replication if we can't find the target.
2580 * This could happen for a one-way linked attribute, if the
2581 * target is deleted and then later expunged (thus, the source
2582 * object can be left with a hanging link). Continue to send
2583 * the the link (the client-side has already tried once with
2584 * GET_TGT, so it should just end up ignoring it).
2586 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
2587 DBG_WARNING("Encountered unknown link target DN %s\n",
2588 ldb_dn_get_extended_linearized(tmp_ctx
, dn
->dn
, 1));
2589 TALLOC_FREE(tmp_ctx
);
2592 } else if (ret
!= LDB_SUCCESS
) {
2593 DBG_ERR("Failed to fetch link target DN %s - %s\n",
2594 ldb_dn_get_extended_linearized(tmp_ctx
, dn
->dn
, 1),
2595 ldb_errstring(sam_ctx
));
2596 return WERR_DS_DRA_INCONSISTENT_DIT
;
2600 * Construct an object, ready to send (this will include
2601 * the object's ancestors as well, if GET_ANC is set)
2603 werr
= getncchanges_get_obj_to_send(msg_res
->msgs
[0], mem_ctx
,
2604 sam_ctx
, getnc_state
,
2605 schema
, session_key
, req10
,
2607 machine_dn
, &target_guid
,
2609 if (!W_ERROR_IS_OK(werr
)) {
2613 if (new_objs
!= NULL
) {
2615 getncchanges_chunk_add_objects(repl_chunk
, new_objs
);
2617 TALLOC_FREE(tmp_ctx
);
2620 if (target_count
> 0) {
2621 DEBUG(3, ("GET_TGT: checked %u link-attrs, added %u target objs\n",
2622 i
- start_la_index
, target_count
));
2629 * Creates a helper struct used for building a chunk of replication data,
2630 * i.e. used over a single call to dcesrv_drsuapi_DsGetNCChanges().
2632 static struct getncchanges_repl_chunk
* getncchanges_chunk_new(TALLOC_CTX
*mem_ctx
,
2633 struct dcesrv_call_state
*dce_call
,
2634 struct drsuapi_DsGetNCChangesRequest10
*req10
)
2636 struct getncchanges_repl_chunk
*repl_chunk
;
2638 repl_chunk
= talloc_zero(mem_ctx
, struct getncchanges_repl_chunk
);
2640 repl_chunk
->start
= time(NULL
);
2642 repl_chunk
->max_objects
= lpcfg_parm_int(dce_call
->conn
->dce_ctx
->lp_ctx
, NULL
,
2643 "drs", "max object sync",
2644 DEFAULT_MAX_OBJECTS
);
2647 * The client control here only applies in normal replication, not extended
2648 * operations, which return a fixed set, even if the caller
2649 * sets max_object_count == 0
2651 if (req10
->extended_op
== DRSUAPI_EXOP_NONE
) {
2654 * use this to force single objects at a time, which is useful
2655 * for working out what object is giving problems
2657 if (req10
->max_object_count
< repl_chunk
->max_objects
) {
2658 repl_chunk
->max_objects
= req10
->max_object_count
;
2662 repl_chunk
->max_links
=
2663 lpcfg_parm_int(dce_call
->conn
->dce_ctx
->lp_ctx
, NULL
,
2664 "drs", "max link sync",
2667 repl_chunk
->immediate_link_sync
=
2668 lpcfg_parm_bool(dce_call
->conn
->dce_ctx
->lp_ctx
, NULL
,
2669 "drs", "immediate link sync", false);
2672 * Maximum time that we can spend in a getncchanges
2673 * in order to avoid timeout of the other part.
2674 * 10 seconds by default.
2676 repl_chunk
->max_wait
= lpcfg_parm_int(dce_call
->conn
->dce_ctx
->lp_ctx
,
2677 NULL
, "drs", "max work time", 10);
2683 drsuapi_DsGetNCChanges
2685 see MS-DRSR 4.1.10.5.2 for basic logic of this function
2687 WERROR
dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
2688 struct drsuapi_DsGetNCChanges
*r
)
2690 struct auth_session_info
*session_info
=
2691 dcesrv_call_session_info(dce_call
);
2692 struct imessaging_context
*imsg_ctx
=
2693 dcesrv_imessaging_context(dce_call
->conn
);
2694 struct drsuapi_DsReplicaObjectIdentifier
*ncRoot
;
2697 struct dsdb_schema
*schema
;
2698 struct drsuapi_DsReplicaOIDMapping_Ctr
*ctr
;
2699 struct getncchanges_repl_chunk
*repl_chunk
;
2701 DATA_BLOB session_key
;
2703 struct dcesrv_handle
*h
;
2704 struct drsuapi_bind_state
*b_state
;
2705 struct drsuapi_getncchanges_state
*getnc_state
;
2706 struct drsuapi_DsGetNCChangesRequest10
*req10
;
2708 uint32_t link_count
= 0;
2709 struct ldb_dn
*search_dn
= NULL
;
2711 enum security_user_level security_level
;
2712 struct ldb_context
*sam_ctx
;
2713 struct dom_sid
*user_sid
;
2714 bool is_secret_request
;
2715 bool is_gc_pas_request
;
2716 struct drsuapi_changed_objects
*changes
;
2717 bool has_get_all_changes
= false;
2718 struct GUID invocation_id
;
2719 static const struct drsuapi_DsReplicaLinkedAttribute no_linked_attr
;
2720 struct dsdb_schema_prefixmap
*pfm_remote
= NULL
;
2722 uint32_t *local_pas
= NULL
;
2723 struct ldb_dn
*machine_dn
= NULL
; /* Only used for REPL SECRET EXOP */
2725 DCESRV_PULL_HANDLE_WERR(h
, r
->in
.bind_handle
, DRSUAPI_BIND_HANDLE
);
2728 /* sam_ctx_system is not present for non-administrator users */
2729 sam_ctx
= b_state
->sam_ctx_system
?b_state
->sam_ctx_system
:b_state
->sam_ctx
;
2731 invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
2733 *r
->out
.level_out
= 6;
2735 r
->out
.ctr
->ctr6
.linked_attributes_count
= 0;
2736 r
->out
.ctr
->ctr6
.linked_attributes
= discard_const_p(struct drsuapi_DsReplicaLinkedAttribute
, &no_linked_attr
);
2738 r
->out
.ctr
->ctr6
.object_count
= 0;
2739 r
->out
.ctr
->ctr6
.nc_object_count
= 0;
2740 r
->out
.ctr
->ctr6
.more_data
= false;
2741 r
->out
.ctr
->ctr6
.uptodateness_vector
= NULL
;
2742 r
->out
.ctr
->ctr6
.source_dsa_guid
= *(samdb_ntds_objectGUID(sam_ctx
));
2743 r
->out
.ctr
->ctr6
.source_dsa_invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
2744 r
->out
.ctr
->ctr6
.first_object
= NULL
;
2746 /* Check request revision.
2748 switch (r
->in
.level
) {
2750 req10
= getncchanges_map_req8(mem_ctx
, &r
->in
.req
->req8
);
2751 if (req10
== NULL
) {
2752 return WERR_NOT_ENOUGH_MEMORY
;
2756 req10
= &r
->in
.req
->req10
;
2759 DEBUG(0,(__location__
": Request for DsGetNCChanges with unsupported level %u\n",
2761 return WERR_REVISION_MISMATCH
;
2764 repl_chunk
= getncchanges_chunk_new(mem_ctx
, dce_call
, req10
);
2766 if (repl_chunk
== NULL
) {
2767 return WERR_NOT_ENOUGH_MEMORY
;
2770 /* a RODC doesn't allow for any replication */
2771 ret
= samdb_rodc(sam_ctx
, &am_rodc
);
2772 if (ret
== LDB_SUCCESS
&& am_rodc
) {
2773 DEBUG(0,(__location__
": DsGetNCChanges attempt on RODC\n"));
2774 return WERR_DS_DRA_SOURCE_DISABLED
;
2778 * Help our tests pass by pre-checking the
2779 * destination_dsa_guid before the NC permissions. Info on
2780 * valid DSA GUIDs is not sensitive so this isn't a leak
2782 switch (req10
->extended_op
) {
2783 case DRSUAPI_EXOP_FSMO_REQ_ROLE
:
2784 case DRSUAPI_EXOP_FSMO_RID_ALLOC
:
2785 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE
:
2786 case DRSUAPI_EXOP_FSMO_REQ_PDC
:
2787 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE
:
2789 const char *attrs
[] = { NULL
};
2791 ret
= samdb_get_ntds_obj_by_guid(mem_ctx
,
2793 &req10
->destination_dsa_guid
,
2796 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
2798 * Error out with an EXOP error but success at
2799 * the top level return value
2801 r
->out
.ctr
->ctr6
.extended_ret
= DRSUAPI_EXOP_ERR_UNKNOWN_CALLER
;
2803 } else if (ret
!= LDB_SUCCESS
) {
2804 return WERR_DS_DRA_INTERNAL_ERROR
;
2809 case DRSUAPI_EXOP_REPL_SECRET
:
2810 case DRSUAPI_EXOP_REPL_OBJ
:
2811 case DRSUAPI_EXOP_NONE
:
2815 /* Perform access checks. */
2816 ncRoot
= req10
->naming_context
;
2817 if (ncRoot
== NULL
) {
2818 DEBUG(0,(__location__
": Request for DsGetNCChanges with no NC\n"));
2819 return WERR_DS_DRA_INVALID_PARAMETER
;
2822 if (samdb_ntds_options(sam_ctx
, &options
) != LDB_SUCCESS
) {
2823 return WERR_DS_DRA_INTERNAL_ERROR
;
2826 if ((options
& DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL
) &&
2827 !(req10
->replica_flags
& DRSUAPI_DRS_SYNC_FORCED
)) {
2828 return WERR_DS_DRA_SOURCE_DISABLED
;
2831 user_sid
= &session_info
->security_token
->sids
[PRIMARY_USER_SID_INDEX
];
2834 * all clients must have GUID_DRS_GET_CHANGES. This finds the
2835 * actual NC root of the given value and checks that, allowing
2836 * REPL_OBJ to work safely
2838 werr
= drs_security_access_check_nc_root(sam_ctx
,
2840 session_info
->security_token
,
2841 req10
->naming_context
,
2842 GUID_DRS_GET_CHANGES
);
2844 if (W_ERROR_EQUAL(werr
, WERR_DS_DRA_BAD_NC
)) {
2846 * These extended operations need a different error if
2847 * the supplied DN can't be found
2849 switch (req10
->extended_op
) {
2850 case DRSUAPI_EXOP_REPL_OBJ
:
2851 case DRSUAPI_EXOP_REPL_SECRET
:
2852 return WERR_DS_DRA_BAD_DN
;
2857 if (!W_ERROR_IS_OK(werr
)) {
2861 if (dsdb_functional_level(sam_ctx
) >= DS_DOMAIN_FUNCTION_2008
) {
2862 full
= req10
->partial_attribute_set
== NULL
&&
2863 req10
->partial_attribute_set_ex
== NULL
;
2865 full
= (options
& DRSUAPI_DRS_WRIT_REP
) != 0;
2868 werr
= dsdb_schema_pfm_from_drsuapi_pfm(&req10
->mapping_ctr
, true,
2869 mem_ctx
, &pfm_remote
, NULL
);
2871 /* We were supplied a partial attribute set, without the prefix map! */
2872 if (!full
&& !W_ERROR_IS_OK(werr
)) {
2873 if (req10
->mapping_ctr
.num_mappings
== 0) {
2875 * Despite the fact MS-DRSR specifies that this shouldn't
2876 * happen, Windows RODCs will in fact not provide a prefixMap.
2878 DEBUG(5,(__location__
": Failed to provide a remote prefixMap,"
2879 " falling back to local prefixMap\n"));
2881 DEBUG(0,(__location__
": Failed to decode remote prefixMap: %s\n",
2887 /* allowed if the GC PAS and client has
2888 GUID_DRS_GET_FILTERED_ATTRIBUTES */
2889 werr
= dcesrv_drsuapi_is_gc_pas_request(b_state
, req10
, pfm_remote
, &is_gc_pas_request
);
2890 if (!W_ERROR_IS_OK(werr
)) {
2893 if (is_gc_pas_request
) {
2894 werr
= drs_security_access_check_nc_root(sam_ctx
,
2896 session_info
->security_token
,
2897 req10
->naming_context
,
2898 GUID_DRS_GET_FILTERED_ATTRIBUTES
);
2899 if (W_ERROR_IS_OK(werr
)) {
2904 werr
= dcesrv_drsuapi_is_reveal_secrets_request(b_state
, req10
,
2906 &is_secret_request
);
2907 if (!W_ERROR_IS_OK(werr
)) {
2910 if (is_secret_request
) {
2911 werr
= drs_security_access_check_nc_root(sam_ctx
,
2913 session_info
->security_token
,
2914 req10
->naming_context
,
2915 GUID_DRS_GET_ALL_CHANGES
);
2916 if (!W_ERROR_IS_OK(werr
)) {
2917 /* Only bail if this is not a EXOP_REPL_SECRET */
2918 if (req10
->extended_op
!= DRSUAPI_EXOP_REPL_SECRET
) {
2922 has_get_all_changes
= true;
2927 /* for non-administrator replications, check that they have
2928 given the correct source_dsa_invocation_id */
2929 security_level
= security_session_user_level(session_info
,
2930 samdb_domain_sid(sam_ctx
));
2931 if (security_level
== SECURITY_RO_DOMAIN_CONTROLLER
) {
2932 if (req10
->replica_flags
& DRSUAPI_DRS_WRIT_REP
) {
2933 /* we rely on this flag being unset for RODC requests */
2934 req10
->replica_flags
&= ~DRSUAPI_DRS_WRIT_REP
;
2938 if (req10
->replica_flags
& DRSUAPI_DRS_FULL_SYNC_PACKET
) {
2939 /* Ignore the _in_ uptpdateness vector*/
2940 req10
->uptodateness_vector
= NULL
;
2943 if (GUID_all_zero(&req10
->source_dsa_invocation_id
)) {
2944 req10
->source_dsa_invocation_id
= invocation_id
;
2947 if (!GUID_equal(&req10
->source_dsa_invocation_id
, &invocation_id
)) {
2949 * The given highwatermark is only valid relative to the
2950 * specified source_dsa_invocation_id.
2952 ZERO_STRUCT(req10
->highwatermark
);
2955 getnc_state
= b_state
->getncchanges_state
;
2957 /* see if a previous replication has been abandoned */
2959 struct ldb_dn
*new_dn
;
2960 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(getnc_state
,
2965 if (ret
!= LDB_SUCCESS
) {
2967 * This can't fail as we have done this above
2968 * implicitly but not got the DN out
2970 DBG_ERR("Bad DN '%s'\n",
2971 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
));
2972 return WERR_DS_DRA_INVALID_PARAMETER
;
2974 if (ldb_dn_compare(new_dn
, getnc_state
->ncRoot_dn
) != 0) {
2975 DEBUG(0,(__location__
": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
2976 ldb_dn_get_linearized(new_dn
),
2977 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
),
2978 ldb_dn_get_linearized(getnc_state
->last_dn
)));
2979 TALLOC_FREE(getnc_state
);
2980 b_state
->getncchanges_state
= NULL
;
2985 ret
= drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state
->last_hwm
,
2986 &req10
->highwatermark
);
2988 DEBUG(0,(__location__
": DsGetNCChanges 2nd replication "
2989 "on DN %s %s highwatermark (last_dn %s)\n",
2990 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
),
2991 (ret
> 0) ? "older" : "newer",
2992 ldb_dn_get_linearized(getnc_state
->last_dn
)));
2993 TALLOC_FREE(getnc_state
);
2994 b_state
->getncchanges_state
= NULL
;
2998 if (getnc_state
== NULL
) {
2999 struct ldb_result
*res
= NULL
;
3000 const char *attrs
[] = {
3005 uint32_t nc_instanceType
;
3006 struct ldb_dn
*ncRoot_dn
;
3008 ret
= drs_ObjectIdentifier_to_dn_and_nc_root(mem_ctx
,
3013 if (ret
!= LDB_SUCCESS
) {
3014 return WERR_DS_DRA_BAD_DN
;
3017 ret
= dsdb_search_dn(sam_ctx
, mem_ctx
, &res
,
3019 DSDB_SEARCH_SHOW_DELETED
|
3020 DSDB_SEARCH_SHOW_RECYCLED
);
3021 if (ret
!= LDB_SUCCESS
) {
3022 DBG_WARNING("Failed to find ncRoot_dn %s\n",
3023 ldb_dn_get_linearized(ncRoot_dn
));
3024 return WERR_DS_DRA_BAD_DN
;
3026 nc_instanceType
= ldb_msg_find_attr_as_int(res
->msgs
[0],
3030 if (req10
->extended_op
!= DRSUAPI_EXOP_NONE
) {
3031 r
->out
.ctr
->ctr6
.extended_ret
= DRSUAPI_EXOP_ERR_SUCCESS
;
3035 * This is the first replication cycle and it is
3036 * a good place to handle extended operations
3038 * FIXME: we don't fully support extended operations yet
3040 switch (req10
->extended_op
) {
3041 case DRSUAPI_EXOP_NONE
:
3042 if ((nc_instanceType
& INSTANCE_TYPE_IS_NC_HEAD
) == 0) {
3044 = ldb_dn_get_linearized(ncRoot_dn
);
3046 DBG_NOTICE("Rejecting full replication on "
3047 "not NC %s", dn_str
);
3049 return WERR_DS_CANT_FIND_EXPECTED_NC
;
3053 case DRSUAPI_EXOP_FSMO_RID_ALLOC
:
3054 werr
= getncchanges_rid_alloc(b_state
, mem_ctx
, req10
, &r
->out
.ctr
->ctr6
, &search_dn
);
3055 W_ERROR_NOT_OK_RETURN(werr
);
3056 if (r
->out
.ctr
->ctr6
.extended_ret
!= DRSUAPI_EXOP_ERR_SUCCESS
) {
3060 case DRSUAPI_EXOP_REPL_SECRET
:
3061 werr
= getncchanges_repl_secret(b_state
, mem_ctx
, req10
,
3064 has_get_all_changes
,
3066 r
->out
.result
= werr
;
3067 W_ERROR_NOT_OK_RETURN(werr
);
3069 case DRSUAPI_EXOP_FSMO_REQ_ROLE
:
3070 werr
= getncchanges_change_master(b_state
, mem_ctx
, req10
, &r
->out
.ctr
->ctr6
);
3071 W_ERROR_NOT_OK_RETURN(werr
);
3072 if (r
->out
.ctr
->ctr6
.extended_ret
!= DRSUAPI_EXOP_ERR_SUCCESS
) {
3076 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE
:
3077 werr
= getncchanges_change_master(b_state
, mem_ctx
, req10
, &r
->out
.ctr
->ctr6
);
3078 W_ERROR_NOT_OK_RETURN(werr
);
3079 if (r
->out
.ctr
->ctr6
.extended_ret
!= DRSUAPI_EXOP_ERR_SUCCESS
) {
3083 case DRSUAPI_EXOP_FSMO_REQ_PDC
:
3084 werr
= getncchanges_change_master(b_state
, mem_ctx
, req10
, &r
->out
.ctr
->ctr6
);
3085 W_ERROR_NOT_OK_RETURN(werr
);
3086 if (r
->out
.ctr
->ctr6
.extended_ret
!= DRSUAPI_EXOP_ERR_SUCCESS
) {
3090 case DRSUAPI_EXOP_REPL_OBJ
:
3091 werr
= getncchanges_repl_obj(b_state
, mem_ctx
, req10
, user_sid
, &r
->out
.ctr
->ctr6
);
3092 r
->out
.result
= werr
;
3093 W_ERROR_NOT_OK_RETURN(werr
);
3096 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE
:
3098 DEBUG(0,(__location__
": Request for DsGetNCChanges unsupported extended op 0x%x\n",
3099 (unsigned)req10
->extended_op
));
3100 return WERR_DS_DRA_NOT_SUPPORTED
;
3103 /* Initialize the state we'll store over the replication cycle */
3104 getnc_state
= talloc_zero(b_state
, struct drsuapi_getncchanges_state
);
3105 if (getnc_state
== NULL
) {
3106 return WERR_NOT_ENOUGH_MEMORY
;
3108 b_state
->getncchanges_state
= getnc_state
;
3110 getnc_state
->ncRoot_dn
= ncRoot_dn
;
3111 talloc_steal(getnc_state
, ncRoot_dn
);
3113 getnc_state
->ncRoot_guid
= samdb_result_guid(res
->msgs
[0],
3115 ncRoot
->guid
= getnc_state
->ncRoot_guid
;
3117 /* find out if we are to replicate Schema NC */
3118 ret
= ldb_dn_compare_base(ldb_get_schema_basedn(sam_ctx
),
3120 getnc_state
->is_schema_nc
= (0 == ret
);
3125 if (!ldb_dn_validate(getnc_state
->ncRoot_dn
) ||
3126 ldb_dn_is_null(getnc_state
->ncRoot_dn
)) {
3127 DEBUG(0,(__location__
": Bad DN '%s'\n",
3128 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
)));
3129 return WERR_DS_DRA_INVALID_PARAMETER
;
3132 ncRoot
->guid
= getnc_state
->ncRoot_guid
;
3134 /* we need the session key for encrypting password attributes */
3135 status
= dcesrv_auth_session_key(dce_call
, &session_key
);
3136 if (!NT_STATUS_IS_OK(status
)) {
3137 DEBUG(0,(__location__
": Failed to get session key\n"));
3138 return WERR_DS_DRA_INTERNAL_ERROR
;
3142 TODO: MS-DRSR section 4.1.10.1.1
3143 Work out if this is the start of a new cycle */
3145 if (getnc_state
->guids
== NULL
) {
3146 const char *extra_filter
;
3147 struct ldb_result
*search_res
= NULL
;
3148 static const struct drsuapi_DsReplicaCursorCtrEx empty_udv
;
3149 const struct drsuapi_DsReplicaCursorCtrEx
*udv
= NULL
;
3151 extra_filter
= lpcfg_parm_string(dce_call
->conn
->dce_ctx
->lp_ctx
, NULL
, "drs", "object filter");
3153 if (req10
->extended_op
== DRSUAPI_EXOP_NONE
) {
3154 if (req10
->uptodateness_vector
!= NULL
) {
3155 udv
= req10
->uptodateness_vector
;
3160 getnc_state
->min_usn
= req10
->highwatermark
.highest_usn
;
3161 for (i
= 0; i
< udv
->count
; i
++) {
3163 const struct drsuapi_DsReplicaCursor
*cur
=
3166 match
= GUID_equal(&invocation_id
,
3167 &cur
->source_dsa_invocation_id
);
3171 if (cur
->highest_usn
> getnc_state
->min_usn
) {
3172 getnc_state
->min_usn
= cur
->highest_usn
;
3177 /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
3179 getnc_state
->min_usn
= 0;
3182 getnc_state
->max_usn
= getnc_state
->min_usn
;
3184 getnc_state
->final_udv
= talloc_zero(getnc_state
,
3185 struct drsuapi_DsReplicaCursor2CtrEx
);
3186 if (getnc_state
->final_udv
== NULL
) {
3187 return WERR_NOT_ENOUGH_MEMORY
;
3189 werr
= get_nc_changes_udv(sam_ctx
, getnc_state
->ncRoot_dn
,
3190 getnc_state
->final_udv
);
3191 if (!W_ERROR_IS_OK(werr
)) {
3195 if (req10
->extended_op
== DRSUAPI_EXOP_NONE
) {
3196 werr
= getncchanges_collect_objects(b_state
, mem_ctx
, req10
,
3197 search_dn
, extra_filter
,
3200 werr
= getncchanges_collect_objects_exop(b_state
, mem_ctx
, req10
,
3202 search_dn
, extra_filter
,
3205 W_ERROR_NOT_OK_RETURN(werr
);
3207 /* extract out the GUIDs list */
3208 getnc_state
->num_records
= search_res
? search_res
->count
: 0;
3209 getnc_state
->guids
= talloc_array(getnc_state
, struct GUID
, getnc_state
->num_records
);
3210 W_ERROR_HAVE_NO_MEMORY(getnc_state
->guids
);
3212 changes
= talloc_array(getnc_state
,
3213 struct drsuapi_changed_objects
,
3214 getnc_state
->num_records
);
3215 W_ERROR_HAVE_NO_MEMORY(changes
);
3217 for (i
=0; i
<getnc_state
->num_records
; i
++) {
3218 changes
[i
].dn
= search_res
->msgs
[i
]->dn
;
3219 changes
[i
].guid
= samdb_result_guid(search_res
->msgs
[i
], "objectGUID");
3220 changes
[i
].usn
= ldb_msg_find_attr_as_uint64(search_res
->msgs
[i
], "uSNChanged", 0);
3222 if (changes
[i
].usn
> getnc_state
->max_usn
) {
3223 getnc_state
->max_usn
= changes
[i
].usn
;
3227 if (req10
->extended_op
== DRSUAPI_EXOP_NONE
) {
3228 getnc_state
->is_get_anc
=
3229 ((req10
->replica_flags
& DRSUAPI_DRS_GET_ANC
) != 0);
3230 if (getnc_state
->is_get_anc
3231 && lpcfg_parm_bool(dce_call
->conn
->dce_ctx
->lp_ctx
,
3234 "broken_samba_4.5_get_anc_emulation",
3236 getnc_state
->broken_samba_4_5_get_anc_emulation
= true;
3238 if (lpcfg_parm_bool(dce_call
->conn
->dce_ctx
->lp_ctx
,
3243 getnc_state
->is_get_tgt
=
3244 ((req10
->more_flags
& DRSUAPI_DRS_GET_TGT
) != 0);
3248 /* RID_ALLOC returns 3 objects in a fixed order */
3249 if (req10
->extended_op
== DRSUAPI_EXOP_FSMO_RID_ALLOC
) {
3251 } else if (getnc_state
->broken_samba_4_5_get_anc_emulation
) {
3252 LDB_TYPESAFE_QSORT(changes
,
3253 getnc_state
->num_records
,
3255 site_res_cmp_anc_order
);
3257 LDB_TYPESAFE_QSORT(changes
,
3258 getnc_state
->num_records
,
3260 site_res_cmp_usn_order
);
3263 for (i
=0; i
< getnc_state
->num_records
; i
++) {
3264 getnc_state
->guids
[i
] = changes
[i
].guid
;
3265 if (GUID_all_zero(&getnc_state
->guids
[i
])) {
3266 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
3267 ldb_dn_get_linearized(search_res
->msgs
[i
]->dn
)));
3268 return WERR_DS_DRA_INTERNAL_ERROR
;
3272 getnc_state
->final_hwm
.tmp_highest_usn
= getnc_state
->max_usn
;
3273 getnc_state
->final_hwm
.reserved_usn
= 0;
3274 getnc_state
->final_hwm
.highest_usn
= getnc_state
->max_usn
;
3276 talloc_free(search_res
);
3277 talloc_free(changes
);
3280 * when using GET_ANC or GET_TGT, cache the objects that have
3281 * been already sent, to avoid sending them multiple times
3283 if (getnc_state
->is_get_anc
|| getnc_state
->is_get_tgt
) {
3284 DEBUG(3,("Using object cache, GET_ANC %u, GET_TGT %u\n",
3285 getnc_state
->is_get_anc
,
3286 getnc_state
->is_get_tgt
));
3288 getnc_state
->obj_cache
= db_open_rbt(getnc_state
);
3289 if (getnc_state
->obj_cache
== NULL
) {
3290 return WERR_NOT_ENOUGH_MEMORY
;
3295 if (req10
->uptodateness_vector
) {
3296 /* make sure its sorted */
3297 TYPESAFE_QSORT(req10
->uptodateness_vector
->cursors
,
3298 req10
->uptodateness_vector
->count
,
3299 drsuapi_DsReplicaCursor_compare
);
3302 /* Prefix mapping */
3303 schema
= dsdb_get_schema(sam_ctx
, mem_ctx
);
3305 DEBUG(0,("No schema in sam_ctx\n"));
3306 return WERR_DS_DRA_INTERNAL_ERROR
;
3309 r
->out
.ctr
->ctr6
.naming_context
= talloc(mem_ctx
, struct drsuapi_DsReplicaObjectIdentifier
);
3310 if (r
->out
.ctr
->ctr6
.naming_context
== NULL
) {
3311 return WERR_NOT_ENOUGH_MEMORY
;
3313 *r
->out
.ctr
->ctr6
.naming_context
= *ncRoot
;
3315 /* find the SID if there is one */
3316 dsdb_find_sid_by_dn(sam_ctx
, getnc_state
->ncRoot_dn
, &r
->out
.ctr
->ctr6
.naming_context
->sid
);
3318 dsdb_get_oid_mappings_drsuapi(schema
, true, mem_ctx
, &ctr
);
3319 r
->out
.ctr
->ctr6
.mapping_ctr
= *ctr
;
3321 r
->out
.ctr
->ctr6
.source_dsa_guid
= *(samdb_ntds_objectGUID(sam_ctx
));
3322 r
->out
.ctr
->ctr6
.source_dsa_invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
3324 r
->out
.ctr
->ctr6
.old_highwatermark
= req10
->highwatermark
;
3325 r
->out
.ctr
->ctr6
.new_highwatermark
= req10
->highwatermark
;
3328 * If the client has already set GET_TGT then we know they can handle
3329 * receiving the linked attributes interleaved with the source objects
3331 if (getnc_state
->is_get_tgt
) {
3332 repl_chunk
->immediate_link_sync
= true;
3335 if (req10
->partial_attribute_set
!= NULL
) {
3336 struct dsdb_syntax_ctx syntax_ctx
;
3339 dsdb_syntax_ctx_init(&syntax_ctx
, sam_ctx
, schema
);
3340 syntax_ctx
.pfm_remote
= pfm_remote
;
3342 local_pas
= talloc_array(b_state
, uint32_t, req10
->partial_attribute_set
->num_attids
);
3344 for (j
= 0; j
< req10
->partial_attribute_set
->num_attids
; j
++) {
3345 getncchanges_attid_remote_to_local(schema
,
3347 req10
->partial_attribute_set
->attids
[j
],
3348 (enum drsuapi_DsAttributeId
*)&local_pas
[j
],
3352 TYPESAFE_QSORT(local_pas
,
3353 req10
->partial_attribute_set
->num_attids
,
3358 * Check in case we're still processing the links from an object in the
3359 * previous chunk. We want to send the links (and any targets needed)
3360 * before moving on to the next object.
3362 if (getnc_state
->is_get_tgt
) {
3363 werr
= getncchanges_chunk_add_la_targets(repl_chunk
,
3365 getnc_state
->la_idx
,
3367 schema
, &session_key
,
3371 if (!W_ERROR_IS_OK(werr
)) {
3376 for (i
=getnc_state
->num_processed
;
3377 i
<getnc_state
->num_records
&&
3378 !getncchanges_chunk_is_full(repl_chunk
, getnc_state
);
3380 struct drsuapi_DsReplicaObjectListItemEx
*new_objs
= NULL
;
3381 struct ldb_message
*msg
;
3382 static const char * const msg_attrs
[] = {
3384 "nTSecurityDescriptor",
3386 "replPropertyMetaData",
3387 DSDB_SECRET_ATTRIBUTES
,
3389 struct ldb_result
*msg_res
;
3390 struct ldb_dn
*msg_dn
;
3391 bool obj_already_sent
= false;
3392 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
3393 uint32_t old_la_index
;
3395 msg_dn
= ldb_dn_new_fmt(tmp_ctx
, sam_ctx
, "<GUID=%s>",
3396 GUID_string(tmp_ctx
, &getnc_state
->guids
[i
]));
3397 W_ERROR_HAVE_NO_MEMORY(msg_dn
);
3400 * by re-searching here we avoid having a lot of full
3401 * records in memory between calls to getncchanges.
3403 * We expect that we may get some objects that vanish
3404 * (tombstone expunge) between the first and second
3407 ret
= drsuapi_search_with_extended_dn(sam_ctx
, tmp_ctx
, &msg_res
,
3409 LDB_SCOPE_BASE
, msg_attrs
, NULL
);
3410 if (ret
!= LDB_SUCCESS
) {
3411 if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
3412 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
3413 ldb_dn_get_extended_linearized(tmp_ctx
, msg_dn
, 1),
3414 ldb_errstring(sam_ctx
)));
3416 TALLOC_FREE(tmp_ctx
);
3420 if (msg_res
->count
== 0) {
3421 DEBUG(1,("getncchanges: got LDB_SUCCESS but failed"
3422 "to get any results in fetch of DN "
3423 "%s (race with tombstone expunge?)\n",
3424 ldb_dn_get_extended_linearized(tmp_ctx
,
3426 TALLOC_FREE(tmp_ctx
);
3430 msg
= msg_res
->msgs
[0];
3433 * Check if we've already sent the object as an ancestor of
3434 * another object. If so, we don't need to send it again
3436 if (getnc_state
->obj_cache
!= NULL
) {
3437 werr
= dcesrv_drsuapi_obj_cache_exists(getnc_state
->obj_cache
,
3438 &getnc_state
->guids
[i
]);
3439 if (W_ERROR_EQUAL(werr
, WERR_OBJECT_NAME_EXISTS
)) {
3440 obj_already_sent
= true;
3444 if (!obj_already_sent
) {
3445 bool max_wait_reached
;
3447 max_wait_reached
= getncchanges_chunk_timed_out(repl_chunk
);
3450 * Construct an object, ready to send (this will include
3451 * the object's ancestors as well, if needed)
3453 werr
= getncchanges_get_obj_to_send(msg
, mem_ctx
, sam_ctx
,
3454 getnc_state
, schema
,
3455 &session_key
, req10
,
3457 local_pas
, machine_dn
,
3458 &getnc_state
->guids
[i
],
3460 if (!W_ERROR_IS_OK(werr
)) {
3465 old_la_index
= getnc_state
->la_count
;
3468 * We've reached the USN where this object naturally occurs.
3469 * Regardless of whether we've already sent the object (as an
3470 * ancestor), we add its links and update the HWM at this point
3472 werr
= get_nc_changes_add_links(sam_ctx
, getnc_state
,
3473 getnc_state
->is_schema_nc
,
3474 schema
, getnc_state
->min_usn
,
3475 req10
->replica_flags
,
3477 &getnc_state
->la_list
,
3478 &getnc_state
->la_count
,
3479 req10
->uptodateness_vector
);
3480 if (!W_ERROR_IS_OK(werr
)) {
3484 dcesrv_drsuapi_update_highwatermark(msg
,
3485 getnc_state
->max_usn
,
3486 &r
->out
.ctr
->ctr6
.new_highwatermark
);
3488 if (new_objs
!= NULL
) {
3491 * Add the object (and, if GET_ANC, any parents it may
3492 * have) into the current chunk of replication data
3494 getncchanges_chunk_add_objects(repl_chunk
, new_objs
);
3496 talloc_free(getnc_state
->last_dn
);
3497 getnc_state
->last_dn
= talloc_move(getnc_state
, &msg
->dn
);
3500 DEBUG(8,(__location__
": %s object %s\n",
3501 new_objs
? "replicating" : "skipping send of",
3502 ldb_dn_get_linearized(msg
->dn
)));
3504 getnc_state
->total_links
+= (getnc_state
->la_count
- old_la_index
);
3507 * If the GET_TGT flag was set, check any new links added to
3508 * make sure the client knows about the link target object
3510 if (getnc_state
->is_get_tgt
) {
3511 werr
= getncchanges_chunk_add_la_targets(repl_chunk
,
3515 schema
, &session_key
,
3519 if (!W_ERROR_IS_OK(werr
)) {
3524 TALLOC_FREE(tmp_ctx
);
3527 /* copy the constructed object list into the response message */
3528 r
->out
.ctr
->ctr6
.object_count
= repl_chunk
->object_count
;
3529 r
->out
.ctr
->ctr6
.first_object
= repl_chunk
->object_list
;
3531 getnc_state
->num_processed
= i
;
3533 if (i
< getnc_state
->num_records
) {
3534 r
->out
.ctr
->ctr6
.more_data
= true;
3537 /* the client can us to call UpdateRefs on its behalf to
3538 re-establish monitoring of the NC */
3539 if ((req10
->replica_flags
& (DRSUAPI_DRS_ADD_REF
| DRSUAPI_DRS_REF_GCSPN
)) &&
3540 !GUID_all_zero(&req10
->destination_dsa_guid
)) {
3541 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq
;
3542 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
3543 GUID_string(mem_ctx
, &req10
->destination_dsa_guid
)));
3544 ureq
.naming_context
= ncRoot
;
3545 ureq
.dest_dsa_dns_name
= samdb_ntds_msdcs_dns_name(sam_ctx
, mem_ctx
,
3546 &req10
->destination_dsa_guid
);
3547 if (!ureq
.dest_dsa_dns_name
) {
3548 return WERR_NOT_ENOUGH_MEMORY
;
3550 ureq
.dest_dsa_guid
= req10
->destination_dsa_guid
;
3551 ureq
.options
= DRSUAPI_DRS_ADD_REF
|
3552 DRSUAPI_DRS_ASYNC_OP
|
3553 DRSUAPI_DRS_GETCHG_CHECK
;
3555 /* we also need to pass through the
3556 DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
3557 to send notifies using the GC SPN */
3558 ureq
.options
|= (req10
->replica_flags
& DRSUAPI_DRS_REF_GCSPN
);
3560 werr
= drsuapi_UpdateRefs(imsg_ctx
,
3561 dce_call
->event_ctx
,
3565 if (!W_ERROR_IS_OK(werr
)) {
3566 DEBUG(0,(__location__
": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
3567 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
),
3568 ureq
.dest_dsa_dns_name
,
3574 * Work out how many links we can send in this chunk. The default is to
3575 * send all the links last, but there is a config option to send them
3576 * immediately, in the same chunk as their source object
3578 if (!r
->out
.ctr
->ctr6
.more_data
|| repl_chunk
->immediate_link_sync
) {
3579 link_count
= getncchanges_chunk_links_pending(repl_chunk
,
3581 link_count
= MIN(link_count
,
3582 getncchanges_chunk_max_links(repl_chunk
));
3585 /* If we've got linked attributes to send, add them now */
3586 if (link_count
> 0) {
3587 struct la_for_sorting
*la_sorted
;
3590 * Grab a chunk of linked attributes off the list and put them
3591 * in sorted array, ready to send
3593 werr
= getncchanges_get_sorted_array(&getnc_state
->la_list
[getnc_state
->la_idx
],
3595 sam_ctx
, getnc_state
,
3598 if (!W_ERROR_IS_OK(werr
)) {
3602 r
->out
.ctr
->ctr6
.linked_attributes_count
= link_count
;
3603 r
->out
.ctr
->ctr6
.linked_attributes
= talloc_array(r
->out
.ctr
, struct drsuapi_DsReplicaLinkedAttribute
, link_count
);
3604 if (r
->out
.ctr
->ctr6
.linked_attributes
== NULL
) {
3605 DEBUG(0, ("Out of memory allocating %u linked attributes for output", link_count
));
3606 return WERR_NOT_ENOUGH_MEMORY
;
3609 for (k
= 0; k
< link_count
; k
++) {
3610 r
->out
.ctr
->ctr6
.linked_attributes
[k
] = *la_sorted
[k
].link
;
3613 getnc_state
->la_idx
+= link_count
;
3614 getnc_state
->links_given
+= link_count
;
3616 if (getnc_state
->la_idx
< getnc_state
->la_count
) {
3617 r
->out
.ctr
->ctr6
.more_data
= true;
3621 * We've now sent all the links seen so far, so we can
3622 * reset la_list back to an empty list again. Note that
3623 * the steal means the linked attribute memory gets
3624 * freed after this RPC message is sent on the wire.
3626 talloc_steal(mem_ctx
, getnc_state
->la_list
);
3627 getnc_state
->la_list
= NULL
;
3628 getnc_state
->la_idx
= 0;
3629 getnc_state
->la_count
= 0;
3632 TALLOC_FREE(la_sorted
);
3635 if (req10
->replica_flags
& DRSUAPI_DRS_GET_NC_SIZE
) {
3637 * TODO: This implementation is wrong
3638 * we should find out the total number of
3639 * objects and links in the whole naming context
3640 * at the start of the cycle and return these
3641 * values in each message.
3643 * For now we keep our current strategy and return
3644 * the number of objects for this cycle and the number
3645 * of links we found so far during the cycle.
3647 r
->out
.ctr
->ctr6
.nc_object_count
= getnc_state
->num_records
;
3648 r
->out
.ctr
->ctr6
.nc_linked_attributes_count
= getnc_state
->total_links
;
3651 if (!r
->out
.ctr
->ctr6
.more_data
) {
3653 /* this is the last response in the replication cycle */
3654 r
->out
.ctr
->ctr6
.new_highwatermark
= getnc_state
->final_hwm
;
3655 r
->out
.ctr
->ctr6
.uptodateness_vector
= talloc_move(mem_ctx
,
3656 &getnc_state
->final_udv
);
3659 * Free the state info stored for the replication cycle. Note
3660 * that the RPC message we're sending contains links stored in
3661 * getnc_state. mem_ctx is local to this RPC call, so the memory
3662 * will get freed after the RPC message is sent on the wire.
3664 talloc_steal(mem_ctx
, getnc_state
);
3665 b_state
->getncchanges_state
= NULL
;
3667 ret
= drsuapi_DsReplicaHighWaterMark_cmp(&r
->out
.ctr
->ctr6
.old_highwatermark
,
3668 &r
->out
.ctr
->ctr6
.new_highwatermark
);
3671 * We need to make sure that we never return the
3672 * same highwatermark within the same replication
3673 * cycle more than once. Otherwise we cannot detect
3674 * when the client uses an unexptected highwatermark.
3676 * This is a HACK which is needed because our
3677 * object ordering is wrong and set tmp_highest_usn
3678 * to a value that is higher than what we already
3679 * sent to the client (destination dsa).
3681 r
->out
.ctr
->ctr6
.new_highwatermark
.reserved_usn
+= 1;
3684 getnc_state
->last_hwm
= r
->out
.ctr
->ctr6
.new_highwatermark
;
3687 if (req10
->extended_op
!= DRSUAPI_EXOP_NONE
) {
3688 r
->out
.ctr
->ctr6
.uptodateness_vector
= NULL
;
3689 r
->out
.ctr
->ctr6
.nc_object_count
= 0;
3690 ZERO_STRUCT(r
->out
.ctr
->ctr6
.new_highwatermark
);
3693 TALLOC_FREE(repl_chunk
);
3695 DEBUG(r
->out
.ctr
->ctr6
.more_data
?4:2,
3696 ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
3697 (unsigned long long)(req10
->highwatermark
.highest_usn
+1),
3698 req10
->replica_flags
,
3699 drs_ObjectIdentifier_to_debug_string(mem_ctx
, ncRoot
),
3700 r
->out
.ctr
->ctr6
.object_count
,
3701 i
, r
->out
.ctr
->ctr6
.more_data
?getnc_state
->num_records
:i
,
3702 r
->out
.ctr
->ctr6
.linked_attributes_count
,
3703 getnc_state
->links_given
, getnc_state
->total_links
,
3704 dom_sid_string(mem_ctx
, user_sid
)));
3707 if (!r
->out
.ctr
->ctr6
.more_data
&& req10
->extended_op
!= DRSUAPI_EXOP_NONE
) {
3708 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges
, NDR_BOTH
, r
);