source4/dsdb/kcc/kcc_periodic.c

   1 /*
   2    Unix SMB/CIFS mplementation.
   3    KCC service periodic handling
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    based on repl service code
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 */
  22
  23 #include "includes.h"
  24 #include "lib/events/events.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "auth/auth.h"
  27 #include "smbd/service.h"
  28 #include "lib/messaging/irpc.h"
  29 #include "dsdb/kcc/kcc_connection.h"
  30 #include "dsdb/kcc/kcc_service.h"
  31 #include <ldb_errors.h>
  32 #include "../lib/util/dlinklist.h"
  33 #include "librpc/gen_ndr/ndr_misc.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "librpc/gen_ndr/ndr_drsblobs.h"
  36 #include "librpc/gen_ndr/ndr_irpc_c.h"
  37 #include "param/param.h"
  38 #include "dsdb/common/util.h"
  39
  40 /*
  41  * see if two repsFromToBlob blobs are for the same source DSA
  42  */
  43 static bool kccsrv_same_source_dsa(struct repsFromToBlob *r1, struct repsFromToBlob *r2)
  44 {
  45         return GUID_equal(&r1->ctr.ctr1.source_dsa_obj_guid,
  46                           &r2->ctr.ctr1.source_dsa_obj_guid);
  47 }
  48
  49 /*
  50  * see if a repsFromToBlob is in a list
  51  */
  52 static bool reps_in_list(struct repsFromToBlob *r, struct repsFromToBlob *reps, uint32_t count)
  53 {
  54         uint32_t i;
  55         for (i=0; i<count; i++) {
  56                 if (kccsrv_same_source_dsa(r, &reps[i])) {
  57                         return true;
  58                 }
  59         }
  60         return false;
  61 }
  62
  63 /*
  64   make sure we only add repsFrom entries for DCs who are masters for
  65   the partition
  66  */
  67 static bool check_MasterNC(struct kccsrv_service *service, struct dsdb_ldb_dn_list_node *p, struct repsFromToBlob *r,
  68                            struct ldb_result *res)
  69 {
  70         struct repsFromTo1 *r1 = &r->ctr.ctr1;
  71         struct GUID invocation_id = r1->source_dsa_invocation_id;
  72         unsigned int i, j;
  73         TALLOC_CTX *tmp_ctx;
  74
  75         /* we are expecting only version 1 */
  76         SMB_ASSERT(r->version == 1);
  77
  78         tmp_ctx = talloc_new(p);
  79         if (!tmp_ctx) {
  80                 return false;
  81         }
  82
  83         for (i=0; i<res->count; i++) {
  84                 struct ldb_message *msg = res->msgs[i];
  85                 struct ldb_message_element *el;
  86                 struct ldb_dn *dn;
  87
  88                 struct GUID id2 = samdb_result_guid(msg, "invocationID");
  89                 if (GUID_all_zero(&id2) ||
  90                     !GUID_equal(&invocation_id, &id2)) {
  91                         continue;
  92                 }
  93
  94                 el = ldb_msg_find_element(msg, "msDS-hasMasterNCs");
  95                 if (!el || el->num_values == 0) {
  96                         el = ldb_msg_find_element(msg, "hasMasterNCs");
  97                         if (!el || el->num_values == 0) {
  98                                 continue;
  99                         }
 100                 }
 101                 for (j=0; j<el->num_values; j++) {
 102                         dn = ldb_dn_from_ldb_val(tmp_ctx, service->samdb, &el->values[j]);
 103                         if (!ldb_dn_validate(dn)) {
 104                                 talloc_free(dn);
 105                                 continue;
 106                         }
 107                         if (ldb_dn_compare(dn, p->dn) == 0) {
 108                                 DEBUG(5,("%s %s match on %s in %s\n",
 109                                          r1->other_info->dns_name,
 110                                          el->name,
 111                                          ldb_dn_get_linearized(dn),
 112                                          ldb_dn_get_linearized(msg->dn)));
 113                                 talloc_free(tmp_ctx);
 114                                 return true;
 115                         }
 116                         talloc_free(dn);
 117                 }
 118         }
 119         talloc_free(tmp_ctx);
 120         return false;
 121 }
 122
 123 struct kccsrv_notify_drepl_server_state {
 124         struct dreplsrv_refresh r;
 125 };
 126
 127 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq);
 128
 129 /**
 130  * Force dreplsrv to update its state as topology is changed
 131  */
 132 static void kccsrv_notify_drepl_server(struct kccsrv_service *s,
 133                                        TALLOC_CTX *mem_ctx)
 134 {
 135         struct kccsrv_notify_drepl_server_state *state;
 136         struct dcerpc_binding_handle *irpc_handle;
 137         struct tevent_req *subreq;
 138
 139         state = talloc_zero(s, struct kccsrv_notify_drepl_server_state);
 140         if (state == NULL) {
 141                 return;
 142         }
 143
 144         irpc_handle = irpc_binding_handle_by_name(state, s->task->msg_ctx,
 145                                                   "dreplsrv", &ndr_table_irpc);
 146         if (irpc_handle == NULL) {
 147                 /* dreplsrv is not running yet */
 148                 TALLOC_FREE(state);
 149                 return;
 150         }
 151
 152         subreq = dcerpc_dreplsrv_refresh_r_send(state, s->task->event_ctx,
 153                                                 irpc_handle, &state->r);
 154         if (subreq == NULL) {
 155                 TALLOC_FREE(state);
 156                 return;
 157         }
 158         tevent_req_set_callback(subreq, kccsrv_notify_drepl_server_done, state);
 159 }
 160
 161 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq)
 162 {
 163         struct kccsrv_notify_drepl_server_state *state =
 164                 tevent_req_callback_data(subreq,
 165                 struct kccsrv_notify_drepl_server_state);
 166
 167         dcerpc_dreplsrv_refresh_r_recv(subreq, state);
 168         TALLOC_FREE(subreq);
 169
 170         /* we don't care about errors */
 171         TALLOC_FREE(state);
 172 }
 173
 174 uint32_t kccsrv_replica_flags(struct kccsrv_service *s)
 175 {
 176         if (s->am_rodc) {
 177                 return DRSUAPI_DRS_INIT_SYNC |
 178                         DRSUAPI_DRS_PER_SYNC |
 179                         DRSUAPI_DRS_ADD_REF |
 180                         DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
 181                         DRSUAPI_DRS_NONGC_RO_REP;
 182         }
 183         return DRSUAPI_DRS_INIT_SYNC |
 184                 DRSUAPI_DRS_PER_SYNC |
 185                 DRSUAPI_DRS_ADD_REF |
 186                 DRSUAPI_DRS_WRIT_REP;
 187 }
 188
 189 /*
 190  * add any missing repsFrom structures to our partitions
 191  */
 192 NTSTATUS kccsrv_add_repsFrom(struct kccsrv_service *s, TALLOC_CTX *mem_ctx,
 193                             struct repsFromToBlob *reps, uint32_t count,
 194                             struct ldb_result *res)
 195 {
 196         struct dsdb_ldb_dn_list_node *p;
 197         bool notify_dreplsrv = false;
 198         uint32_t replica_flags = kccsrv_replica_flags(s);
 199
 200         /* update the repsFrom on all partitions */
 201         for (p=s->partitions; p; p=p->next) {
 202                 struct repsFromToBlob *our_reps;
 203                 uint32_t our_count;
 204                 WERROR werr;
 205                 uint32_t i, j;
 206                 bool modified = false;
 207
 208                 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsFrom", &our_reps, &our_count);
 209                 if (!W_ERROR_IS_OK(werr)) {
 210                         DEBUG(0,(__location__ ": Failed to load repsFrom from %s - %s\n",
 211                                  ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 212                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 213                 }
 214
 215                 /* see if the entry already exists */
 216                 for (i=0; i<count; i++) {
 217                         for (j=0; j<our_count; j++) {
 218                                 if (kccsrv_same_source_dsa(&reps[i], &our_reps[j])) {
 219                                         /* we already have this one -
 220                                            check the replica_flags are right */
 221                                         if (replica_flags != our_reps[j].ctr.ctr1.replica_flags) {
 222                                                 /* we need to update the old one with
 223                                                  * the new flags
 224                                                  */
 225                                                 our_reps[j].ctr.ctr1.replica_flags = replica_flags;
 226                                                 modified = true;
 227                                         }
 228                                         break;
 229                                 }
 230                         }
 231                         if (j == our_count) {
 232                                 /* we don't have the new one - add it
 233                                  * if it is a master
 234                                  */
 235                                 if (res && !check_MasterNC(s, p, &reps[i], res)) {
 236                                         /* its not a master, we don't
 237                                            want to pull from it */
 238                                         continue;
 239                                 }
 240                                 /* we need to add it to our repsFrom */
 241                                 our_reps = talloc_realloc(mem_ctx, our_reps, struct repsFromToBlob, our_count+1);
 242                                 NT_STATUS_HAVE_NO_MEMORY(our_reps);
 243                                 our_reps[our_count] = reps[i];
 244                                 our_reps[our_count].ctr.ctr1.replica_flags = replica_flags;
 245                                 our_count++;
 246                                 modified = true;
 247                                 DEBUG(4,(__location__ ": Added repsFrom for %s\n",
 248                                          reps[i].ctr.ctr1.other_info->dns_name));
 249                         }
 250                 }
 251
 252                 /* remove any stale ones */
 253                 for (i=0; i<our_count; i++) {
 254                         if (!reps_in_list(&our_reps[i], reps, count) ||
 255                             (res && !check_MasterNC(s, p, &our_reps[i], res))) {
 256                                 DEBUG(4,(__location__ ": Removed repsFrom for %s\n",
 257                                          our_reps[i].ctr.ctr1.other_info->dns_name));
 258                                 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
 259                                 our_count--;
 260                                 i--;
 261                                 modified = true;
 262                         }
 263                 }
 264
 265                 if (modified) {
 266                         werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsFrom", our_reps, our_count);
 267                         if (!W_ERROR_IS_OK(werr)) {
 268                                 DEBUG(0,(__location__ ": Failed to save repsFrom to %s - %s\n",
 269                                          ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 270                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 271                         }
 272                         /* dreplsrv should refresh its state */
 273                         notify_dreplsrv = true;
 274                 }
 275
 276                 /* remove stale repsTo entries */
 277                 modified = false;
 278                 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsTo", &our_reps, &our_count);
 279                 if (!W_ERROR_IS_OK(werr)) {
 280                         DEBUG(0,(__location__ ": Failed to load repsTo from %s - %s\n",
 281                                  ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 282                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 283                 }
 284
 285                 /* remove any stale ones */
 286                 for (i=0; i<our_count; i++) {
 287                         if (!reps_in_list(&our_reps[i], reps, count)) {
 288                                 DEBUG(4,(__location__ ": Removed repsTo for %s\n",
 289                                          our_reps[i].ctr.ctr1.other_info->dns_name));
 290                                 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
 291                                 our_count--;
 292                                 i--;
 293                                 modified = true;
 294                         }
 295                 }
 296
 297                 if (modified) {
 298                         werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsTo", our_reps, our_count);
 299                         if (!W_ERROR_IS_OK(werr)) {
 300                                 DEBUG(0,(__location__ ": Failed to save repsTo to %s - %s\n",
 301                                          ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 302                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 303                         }
 304                         /* dreplsrv should refresh its state */
 305                         notify_dreplsrv = true;
 306                 }
 307         }
 308
 309         /* notify dreplsrv toplogy has changed */
 310         if (notify_dreplsrv) {
 311                 kccsrv_notify_drepl_server(s, mem_ctx);
 312         }
 313
 314         return NT_STATUS_OK;
 315
 316 }
 317
 318
 319 /*
 320   form a unique list of DNs from a search result and a given set of attributes
 321  */
 322 static int kccsrv_dn_list(struct ldb_context *ldb, struct ldb_result *res,
 323                           TALLOC_CTX *mem_ctx,
 324                           const char **attrs,
 325                           struct ldb_dn ***dn_list, int *dn_count)
 326 {
 327         int i;
 328         struct ldb_dn **nc_list = NULL;
 329         int nc_count = 0;
 330
 331         nc_list = talloc_array(mem_ctx, struct ldb_dn *, 0);
 332         if (nc_list == NULL) {
 333                 return LDB_ERR_OPERATIONS_ERROR;
 334         }
 335
 336         /* gather up a list of all NCs in this forest */
 337         for (i=0; i<res->count; i++) {
 338                 struct ldb_message *msg = res->msgs[i];
 339                 int j;
 340                 for (j=0; attrs[j]; j++) {
 341                         struct ldb_message_element *el;
 342                         int k;
 343
 344                         el = ldb_msg_find_element(msg, attrs[j]);
 345                         if (el == NULL) continue;
 346                         for (k=0; k<el->num_values; k++) {
 347                                 struct ldb_dn *dn;
 348                                 dn = ldb_dn_from_ldb_val(nc_list, ldb, &el->values[k]);
 349                                 if (dn != NULL) {
 350                                         int l;
 351                                         for (l=0; l<nc_count; l++) {
 352                                                 if (ldb_dn_compare(nc_list[l], dn) == 0) break;
 353                                         }
 354                                         if (l < nc_count) continue;
 355                                         nc_list = talloc_realloc(mem_ctx, nc_list, struct ldb_dn *, nc_count+1);
 356                                         if (nc_list == NULL) {
 357                                                 return LDB_ERR_OPERATIONS_ERROR;
 358                                         }
 359                                         nc_list[nc_count] = dn;
 360                                         nc_count++;
 361                                 }
 362                         }
 363                 }
 364         }
 365
 366         (*dn_list) = nc_list;
 367         (*dn_count) = nc_count;
 368         return LDB_SUCCESS;
 369 }
 370
 371
 372 /*
 373   look for any additional global catalog partitions that we should be
 374   replicating (by looking for msDS-HasDomainNCs), and add them to our
 375   hasPartialReplicaNCs NTDS attribute
 376  */
 377 static int kccsrv_gc_update(struct kccsrv_service *s, struct ldb_result *res)
 378 {
 379         int i;
 380         struct ldb_dn **nc_list = NULL;
 381         int nc_count = 0;
 382         struct ldb_dn **our_nc_list = NULL;
 383         int our_nc_count = 0;
 384         const char *attrs1[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
 385         const char *attrs2[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", "hasPartialReplicaNCs", NULL };
 386         int ret;
 387         TALLOC_CTX *tmp_ctx = talloc_new(res);
 388         struct ldb_result *res2;
 389         struct ldb_message *msg;
 390
 391         /* get a complete list of NCs for the forest */
 392         ret = kccsrv_dn_list(s->samdb, res, tmp_ctx, attrs1, &nc_list, &nc_count);
 393         if (ret != LDB_SUCCESS) {
 394                 DEBUG(1,("Failed to get NC list for GC update - %s\n", ldb_errstring(s->samdb)));
 395                 talloc_free(tmp_ctx);
 396                 return ret;
 397         }
 398
 399         /* get a list of what NCs we are already replicating */
 400         ret = dsdb_search_dn(s->samdb, tmp_ctx, &res2, samdb_ntds_settings_dn(s->samdb, tmp_ctx), attrs2, 0);
 401         if (ret != LDB_SUCCESS) {
 402                 DEBUG(1,("Failed to get our NC list attributes for GC update - %s\n", ldb_errstring(s->samdb)));
 403                 talloc_free(tmp_ctx);
 404                 return ret;
 405         }
 406
 407         ret = kccsrv_dn_list(s->samdb, res2, tmp_ctx, attrs2, &our_nc_list, &our_nc_count);
 408         if (ret != LDB_SUCCESS) {
 409                 DEBUG(1,("Failed to get our NC list for GC update - %s\n", ldb_errstring(s->samdb)));
 410                 talloc_free(tmp_ctx);
 411                 return ret;
 412         }
 413
 414         msg = ldb_msg_new(tmp_ctx);
 415         if (msg == NULL) {
 416                 talloc_free(tmp_ctx);
 417                 return LDB_ERR_OPERATIONS_ERROR;
 418         }
 419         msg->dn = res2->msgs[0]->dn;
 420
 421         /* see if we are missing any */
 422         for (i=0; i<nc_count; i++) {
 423                 int j;
 424                 for (j=0; j<our_nc_count; j++) {
 425                         if (ldb_dn_compare(nc_list[i], our_nc_list[j]) == 0) break;
 426                 }
 427                 if (j == our_nc_count) {
 428                         /* its a new one */
 429                         ret = ldb_msg_add_string(msg, "hasPartialReplicaNCs",
 430                                                  ldb_dn_get_extended_linearized(msg, nc_list[i], 1));
 431                         if (ret != LDB_SUCCESS) {
 432                                 talloc_free(tmp_ctx);
 433                                 return ret;
 434                         }
 435
 436                 }
 437         }
 438
 439         if (msg->num_elements == 0) {
 440                 /* none to add */
 441                 talloc_free(tmp_ctx);
 442                 return LDB_SUCCESS;
 443         }
 444
 445         if (s->am_rodc) {
 446                 DEBUG(5, ("%d partial replica should be added but we are RODC so we skip\n", msg->num_elements));
 447                 talloc_free(tmp_ctx);
 448                 return LDB_SUCCESS;
 449         }
 450
 451         msg->elements[0].flags = LDB_FLAG_MOD_ADD;
 452
 453         ret = dsdb_modify(s->samdb, msg, 0);
 454         if (ret != LDB_SUCCESS) {
 455                 DEBUG(0,("Failed to add hasPartialReplicaNCs - %s\n",
 456                          ldb_errstring(s->samdb)));
 457         }
 458
 459         talloc_free(tmp_ctx);
 460         return ret;
 461 }
 462
 463
 464 /*
 465   this is the core of our initial simple KCC
 466   We just add a repsFrom entry for all DCs we find that have nTDSDSA
 467   objects, except for ourselves
 468  */
 469 NTSTATUS kccsrv_simple_update(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
 470 {
 471         struct ldb_result *res;
 472         unsigned int i;
 473         int ret;
 474         const char *attrs[] = { "objectGUID", "invocationID", "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
 475         struct repsFromToBlob *reps = NULL;
 476         uint32_t count = 0;
 477         struct kcc_connection_list *ntds_conn, *dsa_conn;
 478
 479         ret = dsdb_search(s->samdb, mem_ctx, &res, s->config_dn, LDB_SCOPE_SUBTREE,
 480                           attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "objectClass=nTDSDSA");
 481         if (ret != LDB_SUCCESS) {
 482                 DEBUG(0,(__location__ ": Failed nTDSDSA search - %s\n", ldb_errstring(s->samdb)));
 483                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 484         }
 485
 486         if (samdb_is_gc(s->samdb)) {
 487                 kccsrv_gc_update(s, res);
 488         }
 489
 490         /* get the current list of connections */
 491         ntds_conn = kccsrv_find_connections(s, mem_ctx);
 492
 493         dsa_conn = talloc_zero(mem_ctx, struct kcc_connection_list);
 494
 495         for (i=0; i<res->count; i++) {
 496                 struct repsFromTo1 *r1;
 497                 struct GUID ntds_guid, invocation_id;
 498
 499                 ntds_guid = samdb_result_guid(res->msgs[i], "objectGUID");
 500                 if (GUID_equal(&ntds_guid, &s->ntds_guid)) {
 501                         /* don't replicate with ourselves */
 502                         continue;
 503                 }
 504
 505                 invocation_id = samdb_result_guid(res->msgs[i], "invocationID");
 506
 507                 reps = talloc_realloc(mem_ctx, reps, struct repsFromToBlob, count+1);
 508                 NT_STATUS_HAVE_NO_MEMORY(reps);
 509
 510                 ZERO_STRUCT(reps[count]);
 511                 reps[count].version = 1;
 512                 r1 = &reps[count].ctr.ctr1;
 513
 514                 r1->other_info               = talloc_zero(reps, struct repsFromTo1OtherInfo);
 515                 r1->other_info->dns_name     = samdb_ntds_msdcs_dns_name(s->samdb, reps, &ntds_guid);
 516                 r1->source_dsa_obj_guid      = ntds_guid;
 517                 r1->source_dsa_invocation_id = invocation_id;
 518                 r1->replica_flags = kccsrv_replica_flags(s);
 519                 memset(r1->schedule, 0x11, sizeof(r1->schedule));
 520
 521                 dsa_conn->servers = talloc_realloc(dsa_conn, dsa_conn->servers,
 522                                                   struct kcc_connection,
 523                                                   dsa_conn->count + 1);
 524                 NT_STATUS_HAVE_NO_MEMORY(dsa_conn->servers);
 525                 dsa_conn->servers[dsa_conn->count].dsa_guid = r1->source_dsa_obj_guid;
 526                 dsa_conn->count++;
 527
 528                 count++;
 529         }
 530
 531         kccsrv_apply_connections(s, ntds_conn, dsa_conn);
 532
 533         return kccsrv_add_repsFrom(s, mem_ctx, reps, count, res);
 534 }
 535
 536
 537 static void kccsrv_periodic_run(struct kccsrv_service *service);
 538
 539 static void kccsrv_periodic_handler_te(struct tevent_context *ev, struct tevent_timer *te,
 540                                          struct timeval t, void *ptr)
 541 {
 542         struct kccsrv_service *service = talloc_get_type(ptr, struct kccsrv_service);
 543         WERROR status;
 544
 545         service->periodic.te = NULL;
 546
 547         kccsrv_periodic_run(service);
 548
 549         status = kccsrv_periodic_schedule(service, service->periodic.interval);
 550         if (!W_ERROR_IS_OK(status)) {
 551                 task_server_terminate(service->task, win_errstr(status), true);
 552                 return;
 553         }
 554 }
 555
 556 WERROR kccsrv_periodic_schedule(struct kccsrv_service *service, uint32_t next_interval)
 557 {
 558         TALLOC_CTX *tmp_mem;
 559         struct tevent_timer *new_te;
 560         struct timeval next_time;
 561
 562         /* prevent looping */
 563         if (next_interval == 0) next_interval = 1;
 564
 565         next_time = timeval_current_ofs(next_interval, 50);
 566
 567         if (service->periodic.te) {
 568                 /*
 569                  * if the timestamp of the new event is higher,
 570                  * as current next we don't need to reschedule
 571                  */
 572                 if (timeval_compare(&next_time, &service->periodic.next_event) > 0) {
 573                         return WERR_OK;
 574                 }
 575         }
 576
 577         /* reset the next scheduled timestamp */
 578         service->periodic.next_event = next_time;
 579
 580         new_te = tevent_add_timer(service->task->event_ctx, service,
 581                                  service->periodic.next_event,
 582                                  kccsrv_periodic_handler_te, service);
 583         W_ERROR_HAVE_NO_MEMORY(new_te);
 584
 585         tmp_mem = talloc_new(service);
 586         DEBUG(4,("kccsrv_periodic_schedule(%u) %sscheduled for: %s\n",
 587                 next_interval,
 588                 (service->periodic.te?"re":""),
 589                 nt_time_string(tmp_mem, timeval_to_nttime(&next_time))));
 590         talloc_free(tmp_mem);
 591
 592         talloc_free(service->periodic.te);
 593         service->periodic.te = new_te;
 594
 595         return WERR_OK;
 596 }
 597
 598 /*
 599  * check to see if any dns entries need scavenging
 600  */
 601 static NTSTATUS kccsrv_dns_zone_scavenging(
 602         struct kccsrv_service *s,
 603         TALLOC_CTX *mem_ctx)
 604 {
 605
 606         time_t current_time = time(NULL);
 607         time_t dns_scavenge_interval;
 608         time_t dns_collection_interval;
 609
 610         NTSTATUS status;
 611         char *error_string = NULL;
 612
 613         /*
 614          * Only perform zone scavenging if it's been enabled.
 615          */
 616         if (!lpcfg_dns_zone_scavenging(s->task->lp_ctx)) {
 617                 return NT_STATUS_OK;
 618         }
 619
 620         dns_scavenge_interval = lpcfg_parm_int(s->task->lp_ctx,
 621                                                NULL,
 622                                                "dnsserver",
 623                                                "scavenging_interval",
 624                                                2 * 60 * 60);
 625         dns_collection_interval =
 626             lpcfg_parm_int(s->task->lp_ctx,
 627                            NULL,
 628                            "dnsserver",
 629                            "tombstone_collection_interval",
 630                            24 * 60 * 60);
 631         if ((current_time - s->last_dns_scavenge) > dns_scavenge_interval) {
 632                 s->last_dns_scavenge = current_time;
 633                 status = dns_tombstone_records(mem_ctx, s->samdb,
 634                                                &error_string);
 635                 if (!NT_STATUS_IS_OK(status)) {
 636                         const char *err = NULL;
 637                         if (error_string != NULL) {
 638                                 err = error_string;
 639                         } else {
 640                                 err = nt_errstr(status);
 641                         }
 642                         DBG_ERR("DNS record scavenging process failed: %s",
 643                                 err);
 644                         return status;
 645                 }
 646         }
 647
 648         if ((current_time - s->last_dns_tombstone_collection) >
 649             dns_collection_interval) {
 650                 s->last_dns_tombstone_collection = current_time;
 651                 status = dns_delete_tombstones(mem_ctx, s->samdb,
 652                                                &error_string);
 653                 if (!NT_STATUS_IS_OK(status)) {
 654                         const char *err = NULL;
 655                         if (error_string != NULL) {
 656                                 err = error_string;
 657                         } else {
 658                                 err = nt_errstr(status);
 659                         }
 660                         DBG_ERR("DNS tombstone deletion failed: %s", err);
 661                         return status;
 662                 }
 663         }
 664
 665         return NT_STATUS_OK;
 666 }
 667
 668 /*
 669   check to see if any deleted objects need scavenging
 670  */
 671 static NTSTATUS kccsrv_check_deleted(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
 672 {
 673         time_t current_time = time(NULL);
 674         time_t interval = lpcfg_parm_int(
 675             s->task->lp_ctx, NULL, "kccsrv", "check_deleted_interval", 86400);
 676         uint32_t tombstoneLifetime;
 677         int ret;
 678         unsigned int num_objects_removed = 0;
 679         unsigned int num_links_removed = 0;
 680         NTSTATUS status;
 681         char *error_string = NULL;
 682
 683         if (current_time - s->last_deleted_check < interval) {
 684                 return NT_STATUS_OK;
 685         }
 686
 687         ret = dsdb_tombstone_lifetime(s->samdb, &tombstoneLifetime);
 688         if (ret != LDB_SUCCESS) {
 689                 DEBUG(1,(__location__ ": Failed to get tombstone lifetime\n"));
 690                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 691         }
 692
 693         s->last_deleted_check = current_time;
 694
 695         status = dsdb_garbage_collect_tombstones(mem_ctx, s->samdb,
 696                                                  s->partitions,
 697                                                  current_time, tombstoneLifetime,
 698                                                  &num_objects_removed,
 699                                                  &num_links_removed,
 700                                                  &error_string);
 701
 702         if (NT_STATUS_IS_OK(status)) {
 703                 DEBUG(5, ("garbage_collect_tombstones: Removed %u tombstone objects "
 704                           "and %u tombstone links successfully\n",
 705                           num_objects_removed, num_links_removed));
 706         } else {
 707                 DEBUG(2, ("garbage_collect_tombstones: Failure removing tombstone "
 708                           "objects and links after removing %u tombstone objects "
 709                           "and %u tombstone links successfully: %s\n",
 710                           num_objects_removed, num_links_removed,
 711                           error_string ? error_string : nt_errstr(status)));
 712         }
 713         return status;
 714 }
 715
 716 static void kccsrv_periodic_run(struct kccsrv_service *service)
 717 {
 718         TALLOC_CTX *mem_ctx;
 719         NTSTATUS status;
 720
 721         DEBUG(4,("kccsrv_periodic_run(): update\n"));
 722
 723         mem_ctx = talloc_new(service);
 724
 725         if (service->samba_kcc_code)
 726                 status = kccsrv_samba_kcc(service);
 727         else {
 728                 status = kccsrv_simple_update(service, mem_ctx);
 729                 if (!NT_STATUS_IS_OK(status))
 730                         DEBUG(0,("kccsrv_simple_update failed - %s\n",
 731                                 nt_errstr(status)));
 732         }
 733
 734         status = kccsrv_check_deleted(service, mem_ctx);
 735         if (!NT_STATUS_IS_OK(status)) {
 736                 DEBUG(0,("kccsrv_check_deleted failed - %s\n", nt_errstr(status)));
 737         }
 738         status = kccsrv_dns_zone_scavenging(service, mem_ctx);
 739         if (!NT_STATUS_IS_OK(status)) {
 740                 DBG_ERR("kccsrv_dns_zone_scavenging failed - %s\n",
 741                         nt_errstr(status));
 742         }
 743         talloc_free(mem_ctx);
 744 }
 745
 746 /* Called when samba_kcc script has finished
 747  */
 748 static void samba_kcc_done(struct tevent_req *subreq)
 749 {
 750         struct kccsrv_service *service =
 751                 tevent_req_callback_data(subreq, struct kccsrv_service);
 752         int rc;
 753         int sys_errno;
 754
 755         service->periodic.subreq = NULL;
 756
 757         rc = samba_runcmd_recv(subreq, &sys_errno);
 758         TALLOC_FREE(subreq);
 759
 760         if (rc != 0)
 761                 service->periodic.status =
 762                         map_nt_error_from_unix_common(sys_errno);
 763         else
 764                 service->periodic.status = NT_STATUS_OK;
 765
 766         if (!NT_STATUS_IS_OK(service->periodic.status))
 767                 DEBUG(0,(__location__ ": Failed samba_kcc - %s\n",
 768                         nt_errstr(service->periodic.status)));
 769         else
 770                 DEBUG(3,("Completed samba_kcc OK\n"));
 771 }
 772
 773 /* Invocation of the samba_kcc python script for replication
 774  * topology generation.
 775  */
 776 NTSTATUS kccsrv_samba_kcc(struct kccsrv_service *service)
 777 {
 778         NTSTATUS status = NT_STATUS_OK;
 779         const char * const *samba_kcc_command =
 780                 lpcfg_samba_kcc_command(service->task->lp_ctx);
 781
 782         /* kill any existing child */
 783         TALLOC_FREE(service->periodic.subreq);
 784
 785         DEBUG(2, ("Calling samba_kcc script\n"));
 786         service->periodic.subreq = samba_runcmd_send(service,
 787                                         service->task->event_ctx,
 788                                         timeval_current_ofs(40, 0),
 789                                         2, 0, samba_kcc_command, NULL);
 790
 791         if (service->periodic.subreq == NULL) {
 792                 status = NT_STATUS_NO_MEMORY;
 793                 goto xerror;
 794         }
 795         tevent_req_set_callback(service->periodic.subreq,
 796                                 samba_kcc_done, service);
 797
 798 xerror:
 799         if (!NT_STATUS_IS_OK(status))
 800                 DEBUG(0,(__location__ ": failed - %s\n", nt_errstr(status)));
 801         return status;
 802 }