?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-repl: don't store repsFrom on DNs other than NC heads
[Samba.git] / source4 / dsdb / samdb / ldb_modules / repl_meta_data.c
blob5fdcf9b1665efe8220501b82f1a864e391408bbd
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /*
25 * Name: ldb
26 *
27 * Component: ldb repl_meta_data module
28 *
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
33 *
34 * Author: Simo Sorce
35 * Author: Stefan Metzmacher
36 */
37
38 #include "includes.h"
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/dom_sid.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/security.h"
52 #include "lib/util/tsort.h"
53
54 struct replmd_private {
55 TALLOC_CTX *la_ctx;
56 struct la_entry *la_list;
57 TALLOC_CTX *bl_ctx;
58 struct la_backlink *la_backlinks;
59 struct nc_entry {
60 struct nc_entry *prev, *next;
61 struct ldb_dn *dn;
62 uint64_t mod_usn;
63 uint64_t mod_usn_urgent;
64 } *ncs;
65 };
66
67 struct la_entry {
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
70 };
71
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
75
76 const struct dsdb_schema *schema;
77
78 /* the controls we pass down */
79 struct ldb_control **controls;
80
81 /* details for the mode where we apply a bunch of inbound replication meessages */
82 bool apply_mode;
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
85
86 struct ldb_message *search_msg;
87
88 uint64_t seq_num;
89 bool is_urgent;
90 };
91
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
96 };
97
98
99 static const struct {
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
109 {NULL, 0}
110 };
111
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
114 "lockoutTime",
115 "pwdLastSet",
116 "userAccountControl",
117 NULL
118 };
119
120
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
123 {
124 unsigned int i, j;
125 for (i=0; urgent_objects[i].update_name; i++) {
126
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
128 continue;
129 }
130
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
134 return true;
135 }
136 }
137 }
138 return false;
139 }
140
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
142 {
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
144 return true;
145 }
146 return false;
147 }
148
149
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
151
152 /*
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
156 */
157 static int replmd_init(struct ldb_module *module)
158 {
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
161
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
164 ldb_oom(ldb);
165 return LDB_ERR_OPERATIONS_ERROR;
166 }
167 ldb_module_set_private(module, replmd_private);
168
169 return ldb_next_init(module);
170 }
171
172 /*
173 cleanup our per-transaction contexts
174 */
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
176 {
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
180
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
184 }
185
186
187 struct la_backlink {
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
191 bool active;
192 };
193
194 /*
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
197 */
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
199 {
200 struct ldb_dn *target_dn, *source_dn;
201 int ret;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
205 char *dn_string;
206
207 /*
208 - find DN of target
209 - find DN of source
210 - construct ldb_message
211 - either an add or a delete
212 */
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
217 return LDB_SUCCESS;
218 }
219
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
225 return ret;
226 }
227
228 msg = ldb_msg_new(tmp_ctx);
229 if (msg == NULL) {
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
233 }
234
235 /* construct a ldb_message for adding/deleting the backlink */
236 msg->dn = target_dn;
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
238 if (!dn_string) {
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
242 }
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
246 return ret;
247 }
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
249
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
256 ldb_errstring(ldb));
257 talloc_free(tmp_ctx);
258 return ret;
259 }
260 talloc_free(tmp_ctx);
261 return ret;
262 }
263
264 /*
265 add a backlink to the list of backlinks to add/delete in the prepare
266 commit
267 */
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
271 {
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
276
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
278 if (!target_attr) {
279 /*
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
284 */
285 return LDB_SUCCESS;
286 }
287
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
294 break;
295 }
296 }
297
298 if (bl) {
299 /* we found an existing one */
300 if (bl->active == active) {
301 return LDB_SUCCESS;
302 }
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
304 talloc_free(bl);
305 return LDB_SUCCESS;
306 }
307
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
313 }
314 }
315
316 /* its a new one */
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
318 if (bl == NULL) {
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
321 }
322
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
325 talloc_free(bl);
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
328 }
329
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
333 bl->active = active;
334
335 /* the caller may ask for this backlink to be processed
336 immediately */
337 if (immediate) {
338 int ret = replmd_process_backlink(module, bl);
339 talloc_free(bl);
340 return ret;
341 }
342
343 DLIST_ADD(replmd_private->la_backlinks, bl);
344
345 return LDB_SUCCESS;
346 }
347
348
349 /*
350 * Callback for most write operations in this module:
351 *
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
355 */
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
357 {
358 int ret;
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
366
367 struct ldb_control **controls;
368
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
370
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
373
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
377 }
378
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
383 }
384
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
389 }
390
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
393
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
398 break;
399 }
400 }
401
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
408 }
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
414 }
415 DLIST_ADD(replmd_private->ncs, modified_partition);
416 }
417
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
420 if (ac->is_urgent) {
421 modified_partition->mod_usn_urgent = ac->seq_num;
422 }
423 }
424 }
425
426 if (ac->apply_mode) {
427 talloc_free(ares);
428 ac->index_current++;
429
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
433 }
434 return ret;
435 } else {
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
443 }
444 }
445
446
447 /*
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
450 */
451 static int replmd_notify_store(struct ldb_module *module)
452 {
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
455
456 while (replmd_private->ncs) {
457 int ret;
458 struct nc_entry *modified_partition = replmd_private->ncs;
459
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
466 return ret;
467 }
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
470 }
471
472 return LDB_SUCCESS;
473 }
474
475
476 /*
477 created a replmd_replicated_request context
478 */
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
481 {
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
484
485 ldb = ldb_module_get_ctx(module);
486
487 ac = talloc_zero(req, struct replmd_replicated_request);
488 if (ac == NULL) {
489 ldb_oom(ldb);
490 return NULL;
491 }
492
493 ac->module = module;
494 ac->req = req;
495
496 ac->schema = dsdb_get_schema(ldb, ac);
497 if (!ac->schema) {
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
501 return NULL;
502 }
503
504 return ac;
505 }
506
507 /*
508 add a time element to a record
509 */
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
511 {
512 struct ldb_message_element *el;
513 char *s;
514
515 if (ldb_msg_find_element(msg, attr) != NULL) {
516 return LDB_SUCCESS;
517 }
518
519 s = ldb_timestring(msg, t);
520 if (s == NULL) {
521 return LDB_ERR_OPERATIONS_ERROR;
522 }
523
524 if (ldb_msg_add_string(msg, attr, s) != LDB_SUCCESS) {
525 return LDB_ERR_OPERATIONS_ERROR;
526 }
527
528 el = ldb_msg_find_element(msg, attr);
529 /* always set as replace. This works because on add ops, the flag
530 is ignored */
531 el->flags = LDB_FLAG_MOD_REPLACE;
532
533 return LDB_SUCCESS;
534 }
535
536 /*
537 add a uint64_t element to a record
538 */
539 static int add_uint64_element(struct ldb_message *msg, const char *attr, uint64_t v)
540 {
541 struct ldb_message_element *el;
542
543 if (ldb_msg_find_element(msg, attr) != NULL) {
544 return LDB_SUCCESS;
545 }
546
547 if (ldb_msg_add_fmt(msg, attr, "%llu", (unsigned long long)v) != LDB_SUCCESS) {
548 return LDB_ERR_OPERATIONS_ERROR;
549 }
550
551 el = ldb_msg_find_element(msg, attr);
552 /* always set as replace. This works because on add ops, the flag
553 is ignored */
554 el->flags = LDB_FLAG_MOD_REPLACE;
555
556 return LDB_SUCCESS;
557 }
558
559 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
560 const struct replPropertyMetaData1 *m2,
561 const uint32_t *rdn_attid)
562 {
563 if (m1->attid == m2->attid) {
564 return 0;
565 }
566
567 /*
568 * the rdn attribute should be at the end!
569 * so we need to return a value greater than zero
570 * which means m1 is greater than m2
571 */
572 if (m1->attid == *rdn_attid) {
573 return 1;
574 }
575
576 /*
577 * the rdn attribute should be at the end!
578 * so we need to return a value less than zero
579 * which means m2 is greater than m1
580 */
581 if (m2->attid == *rdn_attid) {
582 return -1;
583 }
584
585 return m1->attid > m2->attid ? 1 : -1;
586 }
587
588 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
589 const struct dsdb_schema *schema,
590 struct ldb_dn *dn)
591 {
592 const char *rdn_name;
593 const struct dsdb_attribute *rdn_sa;
594
595 rdn_name = ldb_dn_get_rdn_name(dn);
596 if (!rdn_name) {
597 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
598 return LDB_ERR_OPERATIONS_ERROR;
599 }
600
601 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
602 if (rdn_sa == NULL) {
603 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
604 return LDB_ERR_OPERATIONS_ERROR;
605 }
606
607 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
608 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
609
610 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
611
612 return LDB_SUCCESS;
613 }
614
615 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
616 const struct ldb_message_element *e2,
617 const struct dsdb_schema *schema)
618 {
619 const struct dsdb_attribute *a1;
620 const struct dsdb_attribute *a2;
621
622 /*
623 * TODO: make this faster by caching the dsdb_attribute pointer
624 * on the ldb_messag_element
625 */
626
627 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
628 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
629
630 /*
631 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
632 * in the schema
633 */
634 if (!a1 || !a2) {
635 return strcasecmp(e1->name, e2->name);
636 }
637 if (a1->attributeID_id == a2->attributeID_id) {
638 return 0;
639 }
640 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
641 }
642
643 static void replmd_ldb_message_sort(struct ldb_message *msg,
644 const struct dsdb_schema *schema)
645 {
646 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
647 }
648
649 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
650 const struct GUID *invocation_id, uint64_t seq_num,
651 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
652
653
654 /*
655 fix up linked attributes in replmd_add.
656 This involves setting up the right meta-data in extended DN
657 components, and creating backlinks to the object
658 */
659 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
660 uint64_t seq_num, const struct GUID *invocationId, time_t t,
661 struct GUID *guid, const struct dsdb_attribute *sa)
662 {
663 unsigned int i;
664 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
665 struct ldb_context *ldb = ldb_module_get_ctx(module);
666
667 /* We will take a reference to the schema in replmd_add_backlink */
668 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
669 NTTIME now;
670
671 unix_to_nt_time(&now, t);
672
673 for (i=0; i<el->num_values; i++) {
674 struct ldb_val *v = &el->values[i];
675 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
676 struct GUID target_guid;
677 NTSTATUS status;
678 int ret;
679
680 /* note that the DN already has the extended
681 components from the extended_dn_store module */
682 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
683 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
684 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
685 if (ret != LDB_SUCCESS) {
686 talloc_free(tmp_ctx);
687 return ret;
688 }
689 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
692 return ret;
693 }
694 }
695
696 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
697 seq_num, seq_num, now, 0, false);
698 if (ret != LDB_SUCCESS) {
699 talloc_free(tmp_ctx);
700 return ret;
701 }
702
703 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
704 if (ret != LDB_SUCCESS) {
705 talloc_free(tmp_ctx);
706 return ret;
707 }
708 }
709
710 talloc_free(tmp_ctx);
711 return LDB_SUCCESS;
712 }
713
714
715 /*
716 intercept add requests
717 */
718 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
719 {
720 struct ldb_context *ldb;
721 struct ldb_control *control;
722 struct replmd_replicated_request *ac;
723 enum ndr_err_code ndr_err;
724 struct ldb_request *down_req;
725 struct ldb_message *msg;
726 const DATA_BLOB *guid_blob;
727 struct GUID guid;
728 struct replPropertyMetaDataBlob nmd;
729 struct ldb_val nmd_value;
730 const struct GUID *our_invocation_id;
731 time_t t = time(NULL);
732 NTTIME now;
733 char *time_str;
734 int ret;
735 unsigned int i;
736 unsigned int functional_level;
737 uint32_t ni=0;
738 bool allow_add_guid = false;
739 bool remove_current_guid = false;
740 bool is_urgent = false;
741 struct ldb_message_element *objectclass_el;
742
743 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
744 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
745 if (control) {
746 allow_add_guid = true;
747 }
748
749 /* do not manipulate our control entries */
750 if (ldb_dn_is_special(req->op.add.message->dn)) {
751 return ldb_next_request(module, req);
752 }
753
754 ldb = ldb_module_get_ctx(module);
755
756 functional_level = dsdb_functional_level(ldb);
757
758 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
759
760 ac = replmd_ctx_init(module, req);
761 if (!ac) {
762 return LDB_ERR_OPERATIONS_ERROR;
763 }
764
765 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
766 if ( guid_blob != NULL ) {
767 if( !allow_add_guid ) {
768 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
769 "replmd_add: it's not allowed to add an object with objectGUID\n");
770 talloc_free(ac);
771 return LDB_ERR_UNWILLING_TO_PERFORM;
772 } else {
773 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
774 if ( !NT_STATUS_IS_OK(status)) {
775 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
776 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
777 talloc_free(ac);
778 return LDB_ERR_UNWILLING_TO_PERFORM;
779 }
780 /* we remove this attribute as it can be a string and will not be treated
781 correctly and then we will readd it latter on in the good format*/
782 remove_current_guid = true;
783 }
784 } else {
785 /* a new GUID */
786 guid = GUID_random();
787 }
788
789 /* Get a sequence number from the backend */
790 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
791 if (ret != LDB_SUCCESS) {
792 talloc_free(ac);
793 return ret;
794 }
795
796 /* get our invocationId */
797 our_invocation_id = samdb_ntds_invocation_id(ldb);
798 if (!our_invocation_id) {
799 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
800 "replmd_add: unable to find invocationId\n");
801 talloc_free(ac);
802 return LDB_ERR_OPERATIONS_ERROR;
803 }
804
805 /* we have to copy the message as the caller might have it as a const */
806 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
807 if (msg == NULL) {
808 ldb_oom(ldb);
809 talloc_free(ac);
810 return LDB_ERR_OPERATIONS_ERROR;
811 }
812
813 /* generated times */
814 unix_to_nt_time(&now, t);
815 time_str = ldb_timestring(msg, t);
816 if (!time_str) {
817 ldb_oom(ldb);
818 talloc_free(ac);
819 return LDB_ERR_OPERATIONS_ERROR;
820 }
821 if (remove_current_guid) {
822 ldb_msg_remove_attr(msg,"objectGUID");
823 }
824
825 /*
826 * remove autogenerated attributes
827 */
828 ldb_msg_remove_attr(msg, "whenCreated");
829 ldb_msg_remove_attr(msg, "whenChanged");
830 ldb_msg_remove_attr(msg, "uSNCreated");
831 ldb_msg_remove_attr(msg, "uSNChanged");
832 ldb_msg_remove_attr(msg, "replPropertyMetaData");
833
834 /*
835 * readd replicated attributes
836 */
837 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
838 if (ret != LDB_SUCCESS) {
839 ldb_oom(ldb);
840 talloc_free(ac);
841 return ret;
842 }
843
844 /* build the replication meta_data */
845 ZERO_STRUCT(nmd);
846 nmd.version = 1;
847 nmd.ctr.ctr1.count = msg->num_elements;
848 nmd.ctr.ctr1.array = talloc_array(msg,
849 struct replPropertyMetaData1,
850 nmd.ctr.ctr1.count);
851 if (!nmd.ctr.ctr1.array) {
852 ldb_oom(ldb);
853 talloc_free(ac);
854 return LDB_ERR_OPERATIONS_ERROR;
855 }
856
857 for (i=0; i < msg->num_elements; i++) {
858 struct ldb_message_element *e = &msg->elements[i];
859 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
860 const struct dsdb_attribute *sa;
861
862 if (e->name[0] == '@') continue;
863
864 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
865 if (!sa) {
866 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
867 "replmd_add: attribute '%s' not defined in schema\n",
868 e->name);
869 talloc_free(ac);
870 return LDB_ERR_NO_SUCH_ATTRIBUTE;
871 }
872
873 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
874 /* if the attribute is not replicated (0x00000001)
875 * or constructed (0x00000004) it has no metadata
876 */
877 continue;
878 }
879
880 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
881 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
882 if (ret != LDB_SUCCESS) {
883 talloc_free(ac);
884 return ret;
885 }
886 /* linked attributes are not stored in
887 replPropertyMetaData in FL above w2k */
888 continue;
889 }
890
891 m->attid = sa->attributeID_id;
892 m->version = 1;
893 m->originating_change_time = now;
894 m->originating_invocation_id = *our_invocation_id;
895 m->originating_usn = ac->seq_num;
896 m->local_usn = ac->seq_num;
897 ni++;
898 }
899
900 /* fix meta data count */
901 nmd.ctr.ctr1.count = ni;
902
903 /*
904 * sort meta data array, and move the rdn attribute entry to the end
905 */
906 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
907 if (ret != LDB_SUCCESS) {
908 talloc_free(ac);
909 return ret;
910 }
911
912 /* generated NDR encoded values */
913 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
914 &nmd,
915 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
916 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
917 ldb_oom(ldb);
918 talloc_free(ac);
919 return LDB_ERR_OPERATIONS_ERROR;
920 }
921
922 /*
923 * add the autogenerated values
924 */
925 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
926 if (ret != LDB_SUCCESS) {
927 ldb_oom(ldb);
928 talloc_free(ac);
929 return ret;
930 }
931 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
932 if (ret != LDB_SUCCESS) {
933 ldb_oom(ldb);
934 talloc_free(ac);
935 return ret;
936 }
937 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
938 if (ret != LDB_SUCCESS) {
939 ldb_oom(ldb);
940 talloc_free(ac);
941 return ret;
942 }
943 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
944 if (ret != LDB_SUCCESS) {
945 ldb_oom(ldb);
946 talloc_free(ac);
947 return ret;
948 }
949 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
950 if (ret != LDB_SUCCESS) {
951 ldb_oom(ldb);
952 talloc_free(ac);
953 return ret;
954 }
955
956 /*
957 * sort the attributes by attid before storing the object
958 */
959 replmd_ldb_message_sort(msg, ac->schema);
960
961 objectclass_el = ldb_msg_find_element(msg, "objectClass");
962 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
963 REPL_URGENT_ON_CREATE);
964
965 ac->is_urgent = is_urgent;
966 ret = ldb_build_add_req(&down_req, ldb, ac,
967 msg,
968 req->controls,
969 ac, replmd_op_callback,
970 req);
971
972 if (ret != LDB_SUCCESS) {
973 talloc_free(ac);
974 return ret;
975 }
976
977 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
978 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
979 if (ret != LDB_SUCCESS) {
980 talloc_free(ac);
981 return ret;
982 }
983 }
984
985 /* mark the control done */
986 if (control) {
987 control->critical = 0;
988 }
989
990 /* go on with the call chain */
991 return ldb_next_request(module, down_req);
992 }
993
994
995 /*
996 * update the replPropertyMetaData for one element
997 */
998 static int replmd_update_rpmd_element(struct ldb_context *ldb,
999 struct ldb_message *msg,
1000 struct ldb_message_element *el,
1001 struct ldb_message_element *old_el,
1002 struct replPropertyMetaDataBlob *omd,
1003 const struct dsdb_schema *schema,
1004 uint64_t *seq_num,
1005 const struct GUID *our_invocation_id,
1006 NTTIME now)
1007 {
1008 uint32_t i;
1009 const struct dsdb_attribute *a;
1010 struct replPropertyMetaData1 *md1;
1011
1012 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1013 if (a == NULL) {
1014 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1015 el->name));
1016 return LDB_ERR_OPERATIONS_ERROR;
1017 }
1018
1019 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1020 return LDB_SUCCESS;
1021 }
1022
1023 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1024 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1025 return LDB_SUCCESS;
1026 }
1027
1028 for (i=0; i<omd->ctr.ctr1.count; i++) {
1029 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1030 }
1031
1032 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1033 /* linked attributes are not stored in
1034 replPropertyMetaData in FL above w2k, but we do
1035 raise the seqnum for the object */
1036 if (*seq_num == 0 &&
1037 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1038 return LDB_ERR_OPERATIONS_ERROR;
1039 }
1040 return LDB_SUCCESS;
1041 }
1042
1043 if (i == omd->ctr.ctr1.count) {
1044 /* we need to add a new one */
1045 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1046 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1047 if (omd->ctr.ctr1.array == NULL) {
1048 ldb_oom(ldb);
1049 return LDB_ERR_OPERATIONS_ERROR;
1050 }
1051 omd->ctr.ctr1.count++;
1052 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1053 }
1054
1055 /* Get a new sequence number from the backend. We only do this
1056 * if we have a change that requires a new
1057 * replPropertyMetaData element
1058 */
1059 if (*seq_num == 0) {
1060 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1061 if (ret != LDB_SUCCESS) {
1062 return LDB_ERR_OPERATIONS_ERROR;
1063 }
1064 }
1065
1066 md1 = &omd->ctr.ctr1.array[i];
1067 md1->version++;
1068 md1->attid = a->attributeID_id;
1069 md1->originating_change_time = now;
1070 md1->originating_invocation_id = *our_invocation_id;
1071 md1->originating_usn = *seq_num;
1072 md1->local_usn = *seq_num;
1073
1074 return LDB_SUCCESS;
1075 }
1076
1077 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1078 {
1079 uint32_t count = omd.ctr.ctr1.count;
1080 uint64_t max = 0;
1081 uint32_t i;
1082 for (i=0; i < count; i++) {
1083 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1084 if (max < m.local_usn) {
1085 max = m.local_usn;
1086 }
1087 }
1088 return max;
1089 }
1090
1091 /*
1092 * update the replPropertyMetaData object each time we modify an
1093 * object. This is needed for DRS replication, as the merge on the
1094 * client is based on this object
1095 */
1096 static int replmd_update_rpmd(struct ldb_module *module,
1097 const struct dsdb_schema *schema,
1098 struct ldb_request *req,
1099 struct ldb_message *msg, uint64_t *seq_num,
1100 time_t t,
1101 bool *is_urgent)
1102 {
1103 const struct ldb_val *omd_value;
1104 enum ndr_err_code ndr_err;
1105 struct replPropertyMetaDataBlob omd;
1106 unsigned int i;
1107 NTTIME now;
1108 const struct GUID *our_invocation_id;
1109 int ret;
1110 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1111 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1112 struct ldb_result *res;
1113 struct ldb_context *ldb;
1114 struct ldb_message_element *objectclass_el;
1115 enum urgent_situation situation;
1116 bool rodc, rmd_is_provided;
1117
1118 ldb = ldb_module_get_ctx(module);
1119
1120 our_invocation_id = samdb_ntds_invocation_id(ldb);
1121 if (!our_invocation_id) {
1122 /* this happens during an initial vampire while
1123 updating the schema */
1124 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1125 return LDB_SUCCESS;
1126 }
1127
1128 unix_to_nt_time(&now, t);
1129
1130 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1131 rmd_is_provided = true;
1132 } else {
1133 rmd_is_provided = false;
1134 }
1135
1136 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1137 * otherwise we consider we are updating */
1138 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1139 situation = REPL_URGENT_ON_DELETE;
1140 } else {
1141 situation = REPL_URGENT_ON_UPDATE;
1142 }
1143
1144 if (rmd_is_provided) {
1145 /* In this case the change_replmetadata control was supplied */
1146 /* We check that it's the only attribute that is provided
1147 * (it's a rare case so it's better to keep the code simplier)
1148 * We also check that the highest local_usn is bigger than
1149 * uSNChanged. */
1150 uint64_t db_seq;
1151 if( msg->num_elements != 1 ||
1152 strncmp(msg->elements[0].name,
1153 "replPropertyMetaData", 20) ) {
1154 DEBUG(0,(__location__ ": changereplmetada control called without "\
1155 "a specified replPropertyMetaData attribute or with others\n"));
1156 return LDB_ERR_OPERATIONS_ERROR;
1157 }
1158 if (situation == REPL_URGENT_ON_DELETE) {
1159 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1160 return LDB_ERR_OPERATIONS_ERROR;
1161 }
1162 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1163 if (!omd_value) {
1164 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1165 ldb_dn_get_linearized(msg->dn)));
1166 return LDB_ERR_OPERATIONS_ERROR;
1167 }
1168 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1169 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1171 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1172 ldb_dn_get_linearized(msg->dn)));
1173 return LDB_ERR_OPERATIONS_ERROR;
1174 }
1175 *seq_num = find_max_local_usn(omd);
1176
1177 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1178 DSDB_FLAG_NEXT_MODULE |
1179 DSDB_SEARCH_SHOW_DELETED |
1180 DSDB_SEARCH_SHOW_EXTENDED_DN |
1181 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1182 DSDB_SEARCH_REVEAL_INTERNALS);
1183
1184 if (ret != LDB_SUCCESS || res->count != 1) {
1185 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1186 ldb_dn_get_linearized(msg->dn)));
1187 return LDB_ERR_OPERATIONS_ERROR;
1188 }
1189
1190 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1191 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1192 situation)) {
1193 *is_urgent = true;
1194 }
1195
1196 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1197 if (*seq_num <= db_seq) {
1198 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1199 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1200 (long long)*seq_num, (long long)db_seq));
1201 return LDB_ERR_OPERATIONS_ERROR;
1202 }
1203
1204 } else {
1205 /* search for the existing replPropertyMetaDataBlob. We need
1206 * to use REVEAL and ask for DNs in storage format to support
1207 * the check for values being the same in
1208 * replmd_update_rpmd_element()
1209 */
1210 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1211 DSDB_FLAG_NEXT_MODULE |
1212 DSDB_SEARCH_SHOW_DELETED |
1213 DSDB_SEARCH_SHOW_EXTENDED_DN |
1214 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1215 DSDB_SEARCH_REVEAL_INTERNALS);
1216 if (ret != LDB_SUCCESS || res->count != 1) {
1217 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1218 ldb_dn_get_linearized(msg->dn)));
1219 return LDB_ERR_OPERATIONS_ERROR;
1220 }
1221
1222 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1223 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1224 situation)) {
1225 *is_urgent = true;
1226 }
1227
1228 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1229 if (!omd_value) {
1230 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1231 ldb_dn_get_linearized(msg->dn)));
1232 return LDB_ERR_OPERATIONS_ERROR;
1233 }
1234
1235 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1236 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1237 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1238 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1239 ldb_dn_get_linearized(msg->dn)));
1240 return LDB_ERR_OPERATIONS_ERROR;
1241 }
1242
1243 if (omd.version != 1) {
1244 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1245 omd.version, ldb_dn_get_linearized(msg->dn)));
1246 return LDB_ERR_OPERATIONS_ERROR;
1247 }
1248
1249 for (i=0; i<msg->num_elements; i++) {
1250 struct ldb_message_element *old_el;
1251 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1252 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1253 our_invocation_id, now);
1254 if (ret != LDB_SUCCESS) {
1255 return ret;
1256 }
1257
1258 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1259 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1260 }
1261
1262 }
1263 }
1264 /*
1265 * replmd_update_rpmd_element has done an update if the
1266 * seq_num is set
1267 */
1268 if (*seq_num != 0) {
1269 struct ldb_val *md_value;
1270 struct ldb_message_element *el;
1271
1272 /*if we are RODC and this is a DRSR update then its ok*/
1273 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1274 ret = samdb_rodc(ldb, &rodc);
1275 if (ret != LDB_SUCCESS) {
1276 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1277 } else if (rodc) {
1278 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1279 return LDB_ERR_REFERRAL;
1280 }
1281 }
1282
1283 md_value = talloc(msg, struct ldb_val);
1284 if (md_value == NULL) {
1285 ldb_oom(ldb);
1286 return LDB_ERR_OPERATIONS_ERROR;
1287 }
1288
1289 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1290 if (ret != LDB_SUCCESS) {
1291 return ret;
1292 }
1293
1294 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1295 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1296 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1297 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1298 ldb_dn_get_linearized(msg->dn)));
1299 return LDB_ERR_OPERATIONS_ERROR;
1300 }
1301
1302 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1303 if (ret != LDB_SUCCESS) {
1304 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1305 ldb_dn_get_linearized(msg->dn)));
1306 return ret;
1307 }
1308
1309 el->num_values = 1;
1310 el->values = md_value;
1311 }
1312
1313 return LDB_SUCCESS;
1314 }
1315
1316 struct parsed_dn {
1317 struct dsdb_dn *dsdb_dn;
1318 struct GUID *guid;
1319 struct ldb_val *v;
1320 };
1321
1322 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1323 {
1324 return GUID_compare(pdn1->guid, pdn2->guid);
1325 }
1326
1327 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1328 {
1329 struct parsed_dn *ret;
1330 if (dn && GUID_all_zero(guid)) {
1331 /* when updating a link using DRS, we sometimes get a
1332 NULL GUID. We then need to try and match by DN */
1333 int i;
1334 for (i=0; i<count; i++) {
1335 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1336 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1337 return &pdn[i];
1338 }
1339 }
1340 return NULL;
1341 }
1342 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1343 return ret;
1344 }
1345
1346 /*
1347 get a series of message element values as an array of DNs and GUIDs
1348 the result is sorted by GUID
1349 */
1350 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1351 struct ldb_message_element *el, struct parsed_dn **pdn,
1352 const char *ldap_oid)
1353 {
1354 unsigned int i;
1355 struct ldb_context *ldb = ldb_module_get_ctx(module);
1356
1357 if (el == NULL) {
1358 *pdn = NULL;
1359 return LDB_SUCCESS;
1360 }
1361
1362 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1363 if (!*pdn) {
1364 ldb_module_oom(module);
1365 return LDB_ERR_OPERATIONS_ERROR;
1366 }
1367
1368 for (i=0; i<el->num_values; i++) {
1369 struct ldb_val *v = &el->values[i];
1370 NTSTATUS status;
1371 struct ldb_dn *dn;
1372 struct parsed_dn *p;
1373
1374 p = &(*pdn)[i];
1375
1376 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1377 if (p->dsdb_dn == NULL) {
1378 return LDB_ERR_INVALID_DN_SYNTAX;
1379 }
1380
1381 dn = p->dsdb_dn->dn;
1382
1383 p->guid = talloc(*pdn, struct GUID);
1384 if (p->guid == NULL) {
1385 ldb_module_oom(module);
1386 return LDB_ERR_OPERATIONS_ERROR;
1387 }
1388
1389 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1390 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1391 /* we got a DN without a GUID - go find the GUID */
1392 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1393 if (ret != LDB_SUCCESS) {
1394 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1395 ldb_dn_get_linearized(dn));
1396 return ret;
1397 }
1398 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1399 if (ret != LDB_SUCCESS) {
1400 return ret;
1401 }
1402 } else if (!NT_STATUS_IS_OK(status)) {
1403 return LDB_ERR_OPERATIONS_ERROR;
1404 }
1405
1406 /* keep a pointer to the original ldb_val */
1407 p->v = v;
1408 }
1409
1410 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1411
1412 return LDB_SUCCESS;
1413 }
1414
1415 /*
1416 build a new extended DN, including all meta data fields
1417
1418 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1419 RMD_ADDTIME = originating_add_time
1420 RMD_INVOCID = originating_invocation_id
1421 RMD_CHANGETIME = originating_change_time
1422 RMD_ORIGINATING_USN = originating_usn
1423 RMD_LOCAL_USN = local_usn
1424 RMD_VERSION = version
1425 */
1426 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1427 const struct GUID *invocation_id, uint64_t seq_num,
1428 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1429 {
1430 struct ldb_dn *dn = dsdb_dn->dn;
1431 const char *tstring, *usn_string, *flags_string;
1432 struct ldb_val tval;
1433 struct ldb_val iid;
1434 struct ldb_val usnv, local_usnv;
1435 struct ldb_val vers, flagsv;
1436 NTSTATUS status;
1437 int ret;
1438 const char *dnstring;
1439 char *vstring;
1440 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1441
1442 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1443 if (!tstring) {
1444 return LDB_ERR_OPERATIONS_ERROR;
1445 }
1446 tval = data_blob_string_const(tstring);
1447
1448 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1449 if (!usn_string) {
1450 return LDB_ERR_OPERATIONS_ERROR;
1451 }
1452 usnv = data_blob_string_const(usn_string);
1453
1454 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1455 if (!usn_string) {
1456 return LDB_ERR_OPERATIONS_ERROR;
1457 }
1458 local_usnv = data_blob_string_const(usn_string);
1459
1460 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1461 if (!vstring) {
1462 return LDB_ERR_OPERATIONS_ERROR;
1463 }
1464 vers = data_blob_string_const(vstring);
1465
1466 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1467 if (!NT_STATUS_IS_OK(status)) {
1468 return LDB_ERR_OPERATIONS_ERROR;
1469 }
1470
1471 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1472 if (!flags_string) {
1473 return LDB_ERR_OPERATIONS_ERROR;
1474 }
1475 flagsv = data_blob_string_const(flags_string);
1476
1477 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1478 if (ret != LDB_SUCCESS) return ret;
1479 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1480 if (ret != LDB_SUCCESS) return ret;
1481 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1482 if (ret != LDB_SUCCESS) return ret;
1483 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1484 if (ret != LDB_SUCCESS) return ret;
1485 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1486 if (ret != LDB_SUCCESS) return ret;
1487 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1488 if (ret != LDB_SUCCESS) return ret;
1489 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1490 if (ret != LDB_SUCCESS) return ret;
1491
1492 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1493 if (dnstring == NULL) {
1494 return LDB_ERR_OPERATIONS_ERROR;
1495 }
1496 *v = data_blob_string_const(dnstring);
1497
1498 return LDB_SUCCESS;
1499 }
1500
1501 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1502 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1503 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1504 uint32_t version, bool deleted);
1505
1506 /*
1507 check if any links need upgrading from w2k format
1508
1509 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1510 */
1511 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1512 {
1513 uint32_t i;
1514 for (i=0; i<count; i++) {
1515 NTSTATUS status;
1516 uint32_t version;
1517 int ret;
1518
1519 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1520 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1521 continue;
1522 }
1523
1524 /* it's an old one that needs upgrading */
1525 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1526 1, 1, 0, 0, false);
1527 if (ret != LDB_SUCCESS) {
1528 return ret;
1529 }
1530 }
1531 return LDB_SUCCESS;
1532 }
1533
1534 /*
1535 update an extended DN, including all meta data fields
1536
1537 see replmd_build_la_val for value names
1538 */
1539 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1540 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1541 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1542 uint32_t version, bool deleted)
1543 {
1544 struct ldb_dn *dn = dsdb_dn->dn;
1545 const char *tstring, *usn_string, *flags_string;
1546 struct ldb_val tval;
1547 struct ldb_val iid;
1548 struct ldb_val usnv, local_usnv;
1549 struct ldb_val vers, flagsv;
1550 const struct ldb_val *old_addtime;
1551 uint32_t old_version;
1552 NTSTATUS status;
1553 int ret;
1554 const char *dnstring;
1555 char *vstring;
1556 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1557
1558 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1559 if (!tstring) {
1560 return LDB_ERR_OPERATIONS_ERROR;
1561 }
1562 tval = data_blob_string_const(tstring);
1563
1564 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1565 if (!usn_string) {
1566 return LDB_ERR_OPERATIONS_ERROR;
1567 }
1568 usnv = data_blob_string_const(usn_string);
1569
1570 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1571 if (!usn_string) {
1572 return LDB_ERR_OPERATIONS_ERROR;
1573 }
1574 local_usnv = data_blob_string_const(usn_string);
1575
1576 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1577 if (!NT_STATUS_IS_OK(status)) {
1578 return LDB_ERR_OPERATIONS_ERROR;
1579 }
1580
1581 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1582 if (!flags_string) {
1583 return LDB_ERR_OPERATIONS_ERROR;
1584 }
1585 flagsv = data_blob_string_const(flags_string);
1586
1587 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1588 if (ret != LDB_SUCCESS) return ret;
1589
1590 /* get the ADDTIME from the original */
1591 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1592 if (old_addtime == NULL) {
1593 old_addtime = &tval;
1594 }
1595 if (dsdb_dn != old_dsdb_dn) {
1596 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1597 if (ret != LDB_SUCCESS) return ret;
1598 }
1599
1600 /* use our invocation id */
1601 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1602 if (ret != LDB_SUCCESS) return ret;
1603
1604 /* changetime is the current time */
1605 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1606 if (ret != LDB_SUCCESS) return ret;
1607
1608 /* update the USN */
1609 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1610 if (ret != LDB_SUCCESS) return ret;
1611
1612 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1613 if (ret != LDB_SUCCESS) return ret;
1614
1615 /* increase the version by 1 */
1616 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1617 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1618 version = old_version+1;
1619 }
1620 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1621 vers = data_blob_string_const(vstring);
1622 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1623 if (ret != LDB_SUCCESS) return ret;
1624
1625 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1626 if (dnstring == NULL) {
1627 return LDB_ERR_OPERATIONS_ERROR;
1628 }
1629 *v = data_blob_string_const(dnstring);
1630
1631 return LDB_SUCCESS;
1632 }
1633
1634 /*
1635 handle adding a linked attribute
1636 */
1637 static int replmd_modify_la_add(struct ldb_module *module,
1638 const struct dsdb_schema *schema,
1639 struct ldb_message *msg,
1640 struct ldb_message_element *el,
1641 struct ldb_message_element *old_el,
1642 const struct dsdb_attribute *schema_attr,
1643 uint64_t seq_num,
1644 time_t t,
1645 struct GUID *msg_guid)
1646 {
1647 unsigned int i;
1648 struct parsed_dn *dns, *old_dns;
1649 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1650 int ret;
1651 struct ldb_val *new_values = NULL;
1652 unsigned int num_new_values = 0;
1653 unsigned old_num_values = old_el?old_el->num_values:0;
1654 const struct GUID *invocation_id;
1655 struct ldb_context *ldb = ldb_module_get_ctx(module);
1656 NTTIME now;
1657
1658 unix_to_nt_time(&now, t);
1659
1660 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1661 if (ret != LDB_SUCCESS) {
1662 talloc_free(tmp_ctx);
1663 return ret;
1664 }
1665
1666 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1667 if (ret != LDB_SUCCESS) {
1668 talloc_free(tmp_ctx);
1669 return ret;
1670 }
1671
1672 invocation_id = samdb_ntds_invocation_id(ldb);
1673 if (!invocation_id) {
1674 talloc_free(tmp_ctx);
1675 return LDB_ERR_OPERATIONS_ERROR;
1676 }
1677
1678 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1679 if (ret != LDB_SUCCESS) {
1680 talloc_free(tmp_ctx);
1681 return ret;
1682 }
1683
1684 /* for each new value, see if it exists already with the same GUID */
1685 for (i=0; i<el->num_values; i++) {
1686 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1687 if (p == NULL) {
1688 /* this is a new linked attribute value */
1689 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1690 if (new_values == NULL) {
1691 ldb_module_oom(module);
1692 talloc_free(tmp_ctx);
1693 return LDB_ERR_OPERATIONS_ERROR;
1694 }
1695 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1696 invocation_id, seq_num, seq_num, now, 0, false);
1697 if (ret != LDB_SUCCESS) {
1698 talloc_free(tmp_ctx);
1699 return ret;
1700 }
1701 num_new_values++;
1702 } else {
1703 /* this is only allowed if the GUID was
1704 previously deleted. */
1705 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1706
1707 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1708 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1709 el->name, GUID_string(tmp_ctx, p->guid));
1710 talloc_free(tmp_ctx);
1711 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1712 }
1713 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1714 invocation_id, seq_num, seq_num, now, 0, false);
1715 if (ret != LDB_SUCCESS) {
1716 talloc_free(tmp_ctx);
1717 return ret;
1718 }
1719 }
1720
1721 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1722 if (ret != LDB_SUCCESS) {
1723 talloc_free(tmp_ctx);
1724 return ret;
1725 }
1726 }
1727
1728 /* add the new ones on to the end of the old values, constructing a new el->values */
1729 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1730 struct ldb_val,
1731 old_num_values+num_new_values);
1732 if (el->values == NULL) {
1733 ldb_module_oom(module);
1734 return LDB_ERR_OPERATIONS_ERROR;
1735 }
1736
1737 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1738 el->num_values = old_num_values + num_new_values;
1739
1740 talloc_steal(msg->elements, el->values);
1741 talloc_steal(el->values, new_values);
1742
1743 talloc_free(tmp_ctx);
1744
1745 /* we now tell the backend to replace all existing values
1746 with the one we have constructed */
1747 el->flags = LDB_FLAG_MOD_REPLACE;
1748
1749 return LDB_SUCCESS;
1750 }
1751
1752
1753 /*
1754 handle deleting all active linked attributes
1755 */
1756 static int replmd_modify_la_delete(struct ldb_module *module,
1757 const struct dsdb_schema *schema,
1758 struct ldb_message *msg,
1759 struct ldb_message_element *el,
1760 struct ldb_message_element *old_el,
1761 const struct dsdb_attribute *schema_attr,
1762 uint64_t seq_num,
1763 time_t t,
1764 struct GUID *msg_guid)
1765 {
1766 unsigned int i;
1767 struct parsed_dn *dns, *old_dns;
1768 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1769 int ret;
1770 const struct GUID *invocation_id;
1771 struct ldb_context *ldb = ldb_module_get_ctx(module);
1772 NTTIME now;
1773
1774 unix_to_nt_time(&now, t);
1775
1776 /* check if there is nothing to delete */
1777 if ((!old_el || old_el->num_values == 0) &&
1778 el->num_values == 0) {
1779 return LDB_SUCCESS;
1780 }
1781
1782 if (!old_el || old_el->num_values == 0) {
1783 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1784 }
1785
1786 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1787 if (ret != LDB_SUCCESS) {
1788 talloc_free(tmp_ctx);
1789 return ret;
1790 }
1791
1792 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1793 if (ret != LDB_SUCCESS) {
1794 talloc_free(tmp_ctx);
1795 return ret;
1796 }
1797
1798 invocation_id = samdb_ntds_invocation_id(ldb);
1799 if (!invocation_id) {
1800 return LDB_ERR_OPERATIONS_ERROR;
1801 }
1802
1803 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1804 if (ret != LDB_SUCCESS) {
1805 talloc_free(tmp_ctx);
1806 return ret;
1807 }
1808
1809 el->values = NULL;
1810
1811 /* see if we are being asked to delete any links that
1812 don't exist or are already deleted */
1813 for (i=0; i<el->num_values; i++) {
1814 struct parsed_dn *p = &dns[i];
1815 struct parsed_dn *p2;
1816 uint32_t rmd_flags;
1817
1818 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1819 if (!p2) {
1820 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1821 el->name, GUID_string(tmp_ctx, p->guid));
1822 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1823 }
1824 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1825 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1826 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1827 el->name, GUID_string(tmp_ctx, p->guid));
1828 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1829 }
1830 }
1831
1832 /* for each new value, see if it exists already with the same GUID
1833 if it is not already deleted and matches the delete list then delete it
1834 */
1835 for (i=0; i<old_el->num_values; i++) {
1836 struct parsed_dn *p = &old_dns[i];
1837 uint32_t rmd_flags;
1838
1839 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1840 continue;
1841 }
1842
1843 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1844 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1845
1846 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1847 invocation_id, seq_num, seq_num, now, 0, true);
1848 if (ret != LDB_SUCCESS) {
1849 talloc_free(tmp_ctx);
1850 return ret;
1851 }
1852
1853 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1854 if (ret != LDB_SUCCESS) {
1855 talloc_free(tmp_ctx);
1856 return ret;
1857 }
1858 }
1859
1860 el->values = talloc_steal(msg->elements, old_el->values);
1861 el->num_values = old_el->num_values;
1862
1863 talloc_free(tmp_ctx);
1864
1865 /* we now tell the backend to replace all existing values
1866 with the one we have constructed */
1867 el->flags = LDB_FLAG_MOD_REPLACE;
1868
1869 return LDB_SUCCESS;
1870 }
1871
1872 /*
1873 handle replacing a linked attribute
1874 */
1875 static int replmd_modify_la_replace(struct ldb_module *module,
1876 const struct dsdb_schema *schema,
1877 struct ldb_message *msg,
1878 struct ldb_message_element *el,
1879 struct ldb_message_element *old_el,
1880 const struct dsdb_attribute *schema_attr,
1881 uint64_t seq_num,
1882 time_t t,
1883 struct GUID *msg_guid)
1884 {
1885 unsigned int i;
1886 struct parsed_dn *dns, *old_dns;
1887 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1888 int ret;
1889 const struct GUID *invocation_id;
1890 struct ldb_context *ldb = ldb_module_get_ctx(module);
1891 struct ldb_val *new_values = NULL;
1892 unsigned int num_new_values = 0;
1893 unsigned int old_num_values = old_el?old_el->num_values:0;
1894 NTTIME now;
1895
1896 unix_to_nt_time(&now, t);
1897
1898 /* check if there is nothing to replace */
1899 if ((!old_el || old_el->num_values == 0) &&
1900 el->num_values == 0) {
1901 return LDB_SUCCESS;
1902 }
1903
1904 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1905 if (ret != LDB_SUCCESS) {
1906 talloc_free(tmp_ctx);
1907 return ret;
1908 }
1909
1910 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1911 if (ret != LDB_SUCCESS) {
1912 talloc_free(tmp_ctx);
1913 return ret;
1914 }
1915
1916 invocation_id = samdb_ntds_invocation_id(ldb);
1917 if (!invocation_id) {
1918 return LDB_ERR_OPERATIONS_ERROR;
1919 }
1920
1921 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1922 if (ret != LDB_SUCCESS) {
1923 talloc_free(tmp_ctx);
1924 return ret;
1925 }
1926
1927 /* mark all the old ones as deleted */
1928 for (i=0; i<old_num_values; i++) {
1929 struct parsed_dn *old_p = &old_dns[i];
1930 struct parsed_dn *p;
1931 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1932
1933 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1934
1935 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1936 if (ret != LDB_SUCCESS) {
1937 talloc_free(tmp_ctx);
1938 return ret;
1939 }
1940
1941 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1942 if (p) {
1943 /* we don't delete it if we are re-adding it */
1944 continue;
1945 }
1946
1947 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1948 invocation_id, seq_num, seq_num, now, 0, true);
1949 if (ret != LDB_SUCCESS) {
1950 talloc_free(tmp_ctx);
1951 return ret;
1952 }
1953 }
1954
1955 /* for each new value, either update its meta-data, or add it
1956 * to old_el
1957 */
1958 for (i=0; i<el->num_values; i++) {
1959 struct parsed_dn *p = &dns[i], *old_p;
1960
1961 if (old_dns &&
1962 (old_p = parsed_dn_find(old_dns,
1963 old_num_values, p->guid, NULL)) != NULL) {
1964 /* update in place */
1965 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1966 old_p->dsdb_dn, invocation_id,
1967 seq_num, seq_num, now, 0, false);
1968 if (ret != LDB_SUCCESS) {
1969 talloc_free(tmp_ctx);
1970 return ret;
1971 }
1972 } else {
1973 /* add a new one */
1974 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1975 num_new_values+1);
1976 if (new_values == NULL) {
1977 ldb_module_oom(module);
1978 talloc_free(tmp_ctx);
1979 return LDB_ERR_OPERATIONS_ERROR;
1980 }
1981 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1982 invocation_id, seq_num, seq_num, now, 0, false);
1983 if (ret != LDB_SUCCESS) {
1984 talloc_free(tmp_ctx);
1985 return ret;
1986 }
1987 num_new_values++;
1988 }
1989
1990 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1991 if (ret != LDB_SUCCESS) {
1992 talloc_free(tmp_ctx);
1993 return ret;
1994 }
1995 }
1996
1997 /* add the new values to the end of old_el */
1998 if (num_new_values != 0) {
1999 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2000 struct ldb_val, old_num_values+num_new_values);
2001 if (el->values == NULL) {
2002 ldb_module_oom(module);
2003 return LDB_ERR_OPERATIONS_ERROR;
2004 }
2005 memcpy(&el->values[old_num_values], &new_values[0],
2006 sizeof(struct ldb_val)*num_new_values);
2007 el->num_values = old_num_values + num_new_values;
2008 talloc_steal(msg->elements, new_values);
2009 } else {
2010 el->values = old_el->values;
2011 el->num_values = old_el->num_values;
2012 talloc_steal(msg->elements, el->values);
2013 }
2014
2015 talloc_free(tmp_ctx);
2016
2017 /* we now tell the backend to replace all existing values
2018 with the one we have constructed */
2019 el->flags = LDB_FLAG_MOD_REPLACE;
2020
2021 return LDB_SUCCESS;
2022 }
2023
2024
2025 /*
2026 handle linked attributes in modify requests
2027 */
2028 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2029 struct ldb_message *msg,
2030 uint64_t seq_num, time_t t)
2031 {
2032 struct ldb_result *res;
2033 unsigned int i;
2034 int ret;
2035 struct ldb_context *ldb = ldb_module_get_ctx(module);
2036 struct ldb_message *old_msg;
2037
2038 const struct dsdb_schema *schema;
2039 struct GUID old_guid;
2040
2041 if (seq_num == 0) {
2042 /* there the replmd_update_rpmd code has already
2043 * checked and saw that there are no linked
2044 * attributes */
2045 return LDB_SUCCESS;
2046 }
2047
2048 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2049 /* don't do anything special for linked attributes */
2050 return LDB_SUCCESS;
2051 }
2052
2053 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2054 DSDB_FLAG_NEXT_MODULE |
2055 DSDB_SEARCH_SHOW_DELETED |
2056 DSDB_SEARCH_REVEAL_INTERNALS |
2057 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2058 if (ret != LDB_SUCCESS) {
2059 return ret;
2060 }
2061 schema = dsdb_get_schema(ldb, res);
2062 if (!schema) {
2063 return LDB_ERR_OPERATIONS_ERROR;
2064 }
2065
2066 old_msg = res->msgs[0];
2067
2068 old_guid = samdb_result_guid(old_msg, "objectGUID");
2069
2070 for (i=0; i<msg->num_elements; i++) {
2071 struct ldb_message_element *el = &msg->elements[i];
2072 struct ldb_message_element *old_el, *new_el;
2073 const struct dsdb_attribute *schema_attr
2074 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2075 if (!schema_attr) {
2076 ldb_asprintf_errstring(ldb,
2077 "attribute %s is not a valid attribute in schema", el->name);
2078 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2079 }
2080 if (schema_attr->linkID == 0) {
2081 continue;
2082 }
2083 if ((schema_attr->linkID & 1) == 1) {
2084 /* Odd is for the target. Illegal to modify */
2085 ldb_asprintf_errstring(ldb,
2086 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2087 return LDB_ERR_UNWILLING_TO_PERFORM;
2088 }
2089 old_el = ldb_msg_find_element(old_msg, el->name);
2090 switch (el->flags & LDB_FLAG_MOD_MASK) {
2091 case LDB_FLAG_MOD_REPLACE:
2092 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2093 break;
2094 case LDB_FLAG_MOD_DELETE:
2095 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2096 break;
2097 case LDB_FLAG_MOD_ADD:
2098 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2099 break;
2100 default:
2101 ldb_asprintf_errstring(ldb,
2102 "invalid flags 0x%x for %s linked attribute",
2103 el->flags, el->name);
2104 return LDB_ERR_UNWILLING_TO_PERFORM;
2105 }
2106 if (ret != LDB_SUCCESS) {
2107 return ret;
2108 }
2109 if (old_el) {
2110 ldb_msg_remove_attr(old_msg, el->name);
2111 }
2112 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2113 new_el->num_values = el->num_values;
2114 new_el->values = talloc_steal(msg->elements, el->values);
2115
2116 /* TODO: this relises a bit too heavily on the exact
2117 behaviour of ldb_msg_find_element and
2118 ldb_msg_remove_element */
2119 old_el = ldb_msg_find_element(msg, el->name);
2120 if (old_el != el) {
2121 ldb_msg_remove_element(msg, old_el);
2122 i--;
2123 }
2124 }
2125
2126 talloc_free(res);
2127 return ret;
2128 }
2129
2130
2131
2132 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2133 {
2134 struct ldb_context *ldb;
2135 struct replmd_replicated_request *ac;
2136 struct ldb_request *down_req;
2137 struct ldb_message *msg;
2138 time_t t = time(NULL);
2139 int ret;
2140 bool is_urgent = false;
2141 struct loadparm_context *lp_ctx;
2142 char *referral;
2143 unsigned int functional_level;
2144
2145 /* do not manipulate our control entries */
2146 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2147 return ldb_next_request(module, req);
2148 }
2149
2150 ldb = ldb_module_get_ctx(module);
2151 functional_level = dsdb_functional_level(ldb);
2152
2153 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2154 struct loadparm_context);
2155
2156 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2157
2158 ac = replmd_ctx_init(module, req);
2159 if (!ac) {
2160 return LDB_ERR_OPERATIONS_ERROR;
2161 }
2162
2163 /* we have to copy the message as the caller might have it as a const */
2164 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2165 if (msg == NULL) {
2166 ldb_oom(ldb);
2167 talloc_free(ac);
2168 return LDB_ERR_OPERATIONS_ERROR;
2169 }
2170
2171 ldb_msg_remove_attr(msg, "whenChanged");
2172 ldb_msg_remove_attr(msg, "uSNChanged");
2173
2174 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2175 if (ret == LDB_ERR_REFERRAL) {
2176 referral = talloc_asprintf(req,
2177 "ldap://%s/%s",
2178 lpcfg_dnsdomain(lp_ctx),
2179 ldb_dn_get_linearized(msg->dn));
2180 ret = ldb_module_send_referral(req, referral);
2181 talloc_free(ac);
2182 return ldb_module_done(req, NULL, NULL, ret);
2183 }
2184
2185 if (ret != LDB_SUCCESS) {
2186 talloc_free(ac);
2187 return ret;
2188 }
2189
2190 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2191 if (ret != LDB_SUCCESS) {
2192 talloc_free(ac);
2193 return ret;
2194 }
2195
2196 /* TODO:
2197 * - replace the old object with the newly constructed one
2198 */
2199
2200 ac->is_urgent = is_urgent;
2201
2202 ret = ldb_build_mod_req(&down_req, ldb, ac,
2203 msg,
2204 req->controls,
2205 ac, replmd_op_callback,
2206 req);
2207 if (ret != LDB_SUCCESS) {
2208 talloc_free(ac);
2209 return ret;
2210 }
2211
2212 /* If we are in functional level 2000, then
2213 * replmd_modify_handle_linked_attribs will have done
2214 * nothing */
2215 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2216 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2217 if (ret != LDB_SUCCESS) {
2218 talloc_free(ac);
2219 return ret;
2220 }
2221 }
2222
2223 talloc_steal(down_req, msg);
2224
2225 /* we only change whenChanged and uSNChanged if the seq_num
2226 has changed */
2227 if (ac->seq_num != 0) {
2228 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2229 talloc_free(ac);
2230 return ret;
2231 }
2232
2233 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2234 talloc_free(ac);
2235 return ret;
2236 }
2237 }
2238
2239 /* go on with the call chain */
2240 return ldb_next_request(module, down_req);
2241 }
2242
2243 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2244
2245 /*
2246 handle a rename request
2247
2248 On a rename we need to do an extra ldb_modify which sets the
2249 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2250 */
2251 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2252 {
2253 struct ldb_context *ldb;
2254 struct replmd_replicated_request *ac;
2255 int ret;
2256 struct ldb_request *down_req;
2257
2258 /* do not manipulate our control entries */
2259 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2260 return ldb_next_request(module, req);
2261 }
2262
2263 ldb = ldb_module_get_ctx(module);
2264
2265 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2266
2267 ac = replmd_ctx_init(module, req);
2268 if (!ac) {
2269 return LDB_ERR_OPERATIONS_ERROR;
2270 }
2271 ret = ldb_build_rename_req(&down_req, ldb, ac,
2272 ac->req->op.rename.olddn,
2273 ac->req->op.rename.newdn,
2274 ac->req->controls,
2275 ac, replmd_rename_callback,
2276 ac->req);
2277
2278 if (ret != LDB_SUCCESS) {
2279 talloc_free(ac);
2280 return ret;
2281 }
2282
2283 /* go on with the call chain */
2284 return ldb_next_request(module, down_req);
2285 }
2286
2287 /* After the rename is compleated, update the whenchanged etc */
2288 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2289 {
2290 struct ldb_context *ldb;
2291 struct replmd_replicated_request *ac;
2292 struct ldb_request *down_req;
2293 struct ldb_message *msg;
2294 time_t t = time(NULL);
2295 int ret;
2296
2297 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2298 ldb = ldb_module_get_ctx(ac->module);
2299
2300 if (ares->error != LDB_SUCCESS) {
2301 return ldb_module_done(ac->req, ares->controls,
2302 ares->response, ares->error);
2303 }
2304
2305 if (ares->type != LDB_REPLY_DONE) {
2306 ldb_set_errstring(ldb,
2307 "invalid ldb_reply_type in callback");
2308 talloc_free(ares);
2309 return ldb_module_done(ac->req, NULL, NULL,
2310 LDB_ERR_OPERATIONS_ERROR);
2311 }
2312
2313 /* Get a sequence number from the backend */
2314 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2315 if (ret != LDB_SUCCESS) {
2316 return ret;
2317 }
2318
2319 /* TODO:
2320 * - replace the old object with the newly constructed one
2321 */
2322
2323 msg = ldb_msg_new(ac);
2324 if (msg == NULL) {
2325 ldb_oom(ldb);
2326 return LDB_ERR_OPERATIONS_ERROR;
2327 }
2328
2329 msg->dn = ac->req->op.rename.newdn;
2330
2331 ret = ldb_build_mod_req(&down_req, ldb, ac,
2332 msg,
2333 req->controls,
2334 ac, replmd_op_callback,
2335 req);
2336
2337 if (ret != LDB_SUCCESS) {
2338 talloc_free(ac);
2339 return ret;
2340 }
2341 talloc_steal(down_req, msg);
2342
2343 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2344 talloc_free(ac);
2345 return ret;
2346 }
2347
2348 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2349 talloc_free(ac);
2350 return ret;
2351 }
2352
2353 /* go on with the call chain - do the modify after the rename */
2354 return ldb_next_request(ac->module, down_req);
2355 }
2356
2357 /*
2358 remove links from objects that point at this object when an object
2359 is deleted
2360 */
2361 static int replmd_delete_remove_link(struct ldb_module *module,
2362 const struct dsdb_schema *schema,
2363 struct ldb_dn *dn,
2364 struct ldb_message_element *el,
2365 const struct dsdb_attribute *sa)
2366 {
2367 unsigned int i;
2368 TALLOC_CTX *tmp_ctx = talloc_new(module);
2369 struct ldb_context *ldb = ldb_module_get_ctx(module);
2370
2371 for (i=0; i<el->num_values; i++) {
2372 struct dsdb_dn *dsdb_dn;
2373 NTSTATUS status;
2374 int ret;
2375 struct GUID guid2;
2376 struct ldb_message *msg;
2377 const struct dsdb_attribute *target_attr;
2378 struct ldb_message_element *el2;
2379 struct ldb_val dn_val;
2380
2381 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2382 continue;
2383 }
2384
2385 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2386 if (!dsdb_dn) {
2387 talloc_free(tmp_ctx);
2388 return LDB_ERR_OPERATIONS_ERROR;
2389 }
2390
2391 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2392 if (!NT_STATUS_IS_OK(status)) {
2393 talloc_free(tmp_ctx);
2394 return LDB_ERR_OPERATIONS_ERROR;
2395 }
2396
2397 /* remove the link */
2398 msg = ldb_msg_new(tmp_ctx);
2399 if (!msg) {
2400 ldb_module_oom(module);
2401 talloc_free(tmp_ctx);
2402 return LDB_ERR_OPERATIONS_ERROR;
2403 }
2404
2405
2406 msg->dn = dsdb_dn->dn;
2407
2408 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2409 if (target_attr == NULL) {
2410 continue;
2411 }
2412
2413 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2414 if (ret != LDB_SUCCESS) {
2415 ldb_module_oom(module);
2416 talloc_free(tmp_ctx);
2417 return LDB_ERR_OPERATIONS_ERROR;
2418 }
2419 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2420 el2->values = &dn_val;
2421 el2->num_values = 1;
2422
2423 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2424 if (ret != LDB_SUCCESS) {
2425 talloc_free(tmp_ctx);
2426 return ret;
2427 }
2428 }
2429 talloc_free(tmp_ctx);
2430 return LDB_SUCCESS;
2431 }
2432
2433
2434 /*
2435 handle update of replication meta data for deletion of objects
2436
2437 This also handles the mapping of delete to a rename operation
2438 to allow deletes to be replicated.
2439 */
2440 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2441 {
2442 int ret = LDB_ERR_OTHER;
2443 bool retb;
2444 struct ldb_dn *old_dn, *new_dn;
2445 const char *rdn_name;
2446 const struct ldb_val *rdn_value, *new_rdn_value;
2447 struct GUID guid;
2448 struct ldb_context *ldb = ldb_module_get_ctx(module);
2449 const struct dsdb_schema *schema;
2450 struct ldb_message *msg, *old_msg;
2451 struct ldb_message_element *el;
2452 TALLOC_CTX *tmp_ctx;
2453 struct ldb_result *res, *parent_res;
2454 const char *preserved_attrs[] = {
2455 /* yes, this really is a hard coded list. See MS-ADTS
2456 section 3.1.1.5.5.1.1 */
2457 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2458 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2459 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2460 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2461 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2462 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2463 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2464 "whenChanged", NULL};
2465 unsigned int i, el_count = 0;
2466 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2467 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2468 enum deletion_state deletion_state, next_deletion_state;
2469 bool enabled;
2470
2471 if (ldb_dn_is_special(req->op.del.dn)) {
2472 return ldb_next_request(module, req);
2473 }
2474
2475 tmp_ctx = talloc_new(ldb);
2476 if (!tmp_ctx) {
2477 ldb_oom(ldb);
2478 return LDB_ERR_OPERATIONS_ERROR;
2479 }
2480
2481 schema = dsdb_get_schema(ldb, tmp_ctx);
2482 if (!schema) {
2483 return LDB_ERR_OPERATIONS_ERROR;
2484 }
2485
2486 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2487
2488 /* we need the complete msg off disk, so we can work out which
2489 attributes need to be removed */
2490 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2491 DSDB_FLAG_NEXT_MODULE |
2492 DSDB_SEARCH_SHOW_DELETED |
2493 DSDB_SEARCH_REVEAL_INTERNALS |
2494 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2495 if (ret != LDB_SUCCESS) {
2496 talloc_free(tmp_ctx);
2497 return ret;
2498 }
2499 old_msg = res->msgs[0];
2500
2501
2502 ret = dsdb_recyclebin_enabled(module, &enabled);
2503 if (ret != LDB_SUCCESS) {
2504 talloc_free(tmp_ctx);
2505 return ret;
2506 }
2507
2508 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2509 if (!enabled) {
2510 deletion_state = OBJECT_TOMBSTONE;
2511 next_deletion_state = OBJECT_REMOVED;
2512 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2513 deletion_state = OBJECT_RECYCLED;
2514 next_deletion_state = OBJECT_REMOVED;
2515 } else {
2516 deletion_state = OBJECT_DELETED;
2517 next_deletion_state = OBJECT_RECYCLED;
2518 }
2519 } else {
2520 deletion_state = OBJECT_NOT_DELETED;
2521 if (enabled) {
2522 next_deletion_state = OBJECT_DELETED;
2523 } else {
2524 next_deletion_state = OBJECT_TOMBSTONE;
2525 }
2526 }
2527
2528 if (next_deletion_state == OBJECT_REMOVED) {
2529 struct auth_session_info *session_info =
2530 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2531 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2532 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2533 ldb_dn_get_linearized(old_msg->dn));
2534 return LDB_ERR_UNWILLING_TO_PERFORM;
2535 }
2536
2537 /* it is already deleted - really remove it this time */
2538 talloc_free(tmp_ctx);
2539 return ldb_next_request(module, req);
2540 }
2541
2542 rdn_name = ldb_dn_get_rdn_name(old_dn);
2543 rdn_value = ldb_dn_get_rdn_val(old_dn);
2544
2545 msg = ldb_msg_new(tmp_ctx);
2546 if (msg == NULL) {
2547 ldb_module_oom(module);
2548 talloc_free(tmp_ctx);
2549 return LDB_ERR_OPERATIONS_ERROR;
2550 }
2551
2552 msg->dn = old_dn;
2553
2554 if (deletion_state == OBJECT_NOT_DELETED){
2555 /* work out where we will be renaming this object to */
2556 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn, &new_dn);
2557 if (ret != LDB_SUCCESS) {
2558 /* this is probably an attempted delete on a partition
2559 * that doesn't allow delete operations, such as the
2560 * schema partition */
2561 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2562 ldb_dn_get_linearized(old_dn));
2563 talloc_free(tmp_ctx);
2564 return LDB_ERR_UNWILLING_TO_PERFORM;
2565 }
2566
2567 /* get the objects GUID from the search we just did */
2568 guid = samdb_result_guid(old_msg, "objectGUID");
2569
2570 /* Add a formatted child */
2571 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2572 rdn_name,
2573 rdn_value->data,
2574 GUID_string(tmp_ctx, &guid));
2575 if (!retb) {
2576 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2577 ldb_dn_get_linearized(new_dn)));
2578 talloc_free(tmp_ctx);
2579 return LDB_ERR_OPERATIONS_ERROR;
2580 }
2581
2582 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2583 if (ret != LDB_SUCCESS) {
2584 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2585 ldb_module_oom(module);
2586 talloc_free(tmp_ctx);
2587 return ret;
2588 }
2589 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2590 }
2591
2592 /*
2593 now we need to modify the object in the following ways:
2594
2595 - add isDeleted=TRUE
2596 - update rDN and name, with new rDN
2597 - remove linked attributes
2598 - remove objectCategory and sAMAccountType
2599 - remove attribs not on the preserved list
2600 - preserved if in above list, or is rDN
2601 - remove all linked attribs from this object
2602 - remove all links from other objects to this object
2603 - add lastKnownParent
2604 - update replPropertyMetaData?
2605
2606 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2607 */
2608
2609 /* we need the storage form of the parent GUID */
2610 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2611 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2612 DSDB_FLAG_NEXT_MODULE |
2613 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2614 DSDB_SEARCH_REVEAL_INTERNALS|
2615 DSDB_SEARCH_SHOW_DELETED);
2616 if (ret != LDB_SUCCESS) {
2617 talloc_free(tmp_ctx);
2618 return ret;
2619 }
2620
2621 if (deletion_state == OBJECT_NOT_DELETED){
2622 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2623 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2624 if (ret != LDB_SUCCESS) {
2625 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2626 ldb_module_oom(module);
2627 talloc_free(tmp_ctx);
2628 return ret;
2629 }
2630 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2631 }
2632
2633 switch (next_deletion_state){
2634
2635 case OBJECT_DELETED:
2636
2637 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2638 if (ret != LDB_SUCCESS) {
2639 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2640 ldb_module_oom(module);
2641 talloc_free(tmp_ctx);
2642 return ret;
2643 }
2644 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2645
2646 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2647 if (ret != LDB_SUCCESS) {
2648 talloc_free(tmp_ctx);
2649 ldb_module_oom(module);
2650 return ret;
2651 }
2652
2653 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2654 if (ret != LDB_SUCCESS) {
2655 talloc_free(tmp_ctx);
2656 ldb_module_oom(module);
2657 return ret;
2658 }
2659
2660 break;
2661
2662 case OBJECT_RECYCLED:
2663 case OBJECT_TOMBSTONE:
2664
2665 /* we also mark it as recycled, meaning this object can't be
2666 recovered (we are stripping its attributes) */
2667 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2668 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2669 if (ret != LDB_SUCCESS) {
2670 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2671 ldb_module_oom(module);
2672 talloc_free(tmp_ctx);
2673 return ret;
2674 }
2675 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2676 }
2677
2678 /* work out which of the old attributes we will be removing */
2679 for (i=0; i<old_msg->num_elements; i++) {
2680 const struct dsdb_attribute *sa;
2681 el = &old_msg->elements[i];
2682 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2683 if (!sa) {
2684 talloc_free(tmp_ctx);
2685 return LDB_ERR_OPERATIONS_ERROR;
2686 }
2687 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2688 /* don't remove the rDN */
2689 continue;
2690 }
2691 if (sa->linkID && sa->linkID & 1) {
2692 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2693 if (ret != LDB_SUCCESS) {
2694 talloc_free(tmp_ctx);
2695 return LDB_ERR_OPERATIONS_ERROR;
2696 }
2697 continue;
2698 }
2699 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2700 continue;
2701 }
2702 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2703 if (ret != LDB_SUCCESS) {
2704 talloc_free(tmp_ctx);
2705 ldb_module_oom(module);
2706 return ret;
2707 }
2708 }
2709 break;
2710
2711 default:
2712 break;
2713 }
2714
2715 if (deletion_state == OBJECT_NOT_DELETED) {
2716 const struct dsdb_attribute *sa;
2717
2718 /* work out what the new rdn value is, for updating the
2719 rDN and name fields */
2720 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2721
2722 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2723 if (!sa) {
2724 talloc_free(tmp_ctx);
2725 return LDB_ERR_OPERATIONS_ERROR;
2726 }
2727
2728 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2729 &el);
2730 if (ret != LDB_SUCCESS) {
2731 talloc_free(tmp_ctx);
2732 return ret;
2733 }
2734 el->flags = LDB_FLAG_MOD_REPLACE;
2735
2736 el = ldb_msg_find_element(old_msg, "name");
2737 if (el) {
2738 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2739 if (ret != LDB_SUCCESS) {
2740 talloc_free(tmp_ctx);
2741 return ret;
2742 }
2743 el->flags = LDB_FLAG_MOD_REPLACE;
2744 }
2745 }
2746
2747 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2748 if (ret != LDB_SUCCESS) {
2749 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2750 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2751 talloc_free(tmp_ctx);
2752 return ret;
2753 }
2754
2755 if (deletion_state == OBJECT_NOT_DELETED) {
2756 /* now rename onto the new DN */
2757 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2758 if (ret != LDB_SUCCESS){
2759 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2760 ldb_dn_get_linearized(old_dn),
2761 ldb_dn_get_linearized(new_dn),
2762 ldb_errstring(ldb)));
2763 talloc_free(tmp_ctx);
2764 return ret;
2765 }
2766 }
2767
2768 talloc_free(tmp_ctx);
2769
2770 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2771 }
2772
2773
2774
2775 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2776 {
2777 return ret;
2778 }
2779
2780 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2781 {
2782 int ret = LDB_ERR_OTHER;
2783 /* TODO: do some error mapping */
2784 return ret;
2785 }
2786
2787 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2788 {
2789 struct ldb_context *ldb;
2790 struct ldb_request *change_req;
2791 enum ndr_err_code ndr_err;
2792 struct ldb_message *msg;
2793 struct replPropertyMetaDataBlob *md;
2794 struct ldb_val md_value;
2795 unsigned int i;
2796 int ret;
2797
2798 /*
2799 * TODO: check if the parent object exist
2800 */
2801
2802 /*
2803 * TODO: handle the conflict case where an object with the
2804 * same name exist
2805 */
2806
2807 ldb = ldb_module_get_ctx(ar->module);
2808 msg = ar->objs->objects[ar->index_current].msg;
2809 md = ar->objs->objects[ar->index_current].meta_data;
2810
2811 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2812 if (ret != LDB_SUCCESS) {
2813 return replmd_replicated_request_error(ar, ret);
2814 }
2815
2816 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2817 if (ret != LDB_SUCCESS) {
2818 return replmd_replicated_request_error(ar, ret);
2819 }
2820
2821 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2822 if (ret != LDB_SUCCESS) {
2823 return replmd_replicated_request_error(ar, ret);
2824 }
2825
2826 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2827 if (ret != LDB_SUCCESS) {
2828 return replmd_replicated_request_error(ar, ret);
2829 }
2830
2831 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2832 if (ret != LDB_SUCCESS) {
2833 return replmd_replicated_request_error(ar, ret);
2834 }
2835
2836 /* remove any message elements that have zero values */
2837 for (i=0; i<msg->num_elements; i++) {
2838 struct ldb_message_element *el = &msg->elements[i];
2839
2840 if (el->num_values == 0) {
2841 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2842 el->name));
2843 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2844 msg->num_elements--;
2845 i--;
2846 continue;
2847 }
2848 }
2849
2850 /*
2851 * the meta data array is already sorted by the caller
2852 */
2853 for (i=0; i < md->ctr.ctr1.count; i++) {
2854 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2855 }
2856 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2857 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2858 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2859 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2860 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2861 }
2862 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2863 if (ret != LDB_SUCCESS) {
2864 return replmd_replicated_request_error(ar, ret);
2865 }
2866
2867 replmd_ldb_message_sort(msg, ar->schema);
2868
2869 if (DEBUGLVL(4)) {
2870 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2871 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2872 talloc_free(s);
2873 }
2874
2875 ret = ldb_build_add_req(&change_req,
2876 ldb,
2877 ar,
2878 msg,
2879 ar->controls,
2880 ar,
2881 replmd_op_callback,
2882 ar->req);
2883 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2884
2885 return ldb_next_request(ar->module, change_req);
2886 }
2887
2888 /*
2889 return true if an update is newer than an existing entry
2890 see section 5.11 of MS-ADTS
2891 */
2892 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2893 const struct GUID *update_invocation_id,
2894 uint32_t current_version,
2895 uint32_t update_version,
2896 NTTIME current_change_time,
2897 NTTIME update_change_time)
2898 {
2899 if (update_version != current_version) {
2900 return update_version > current_version;
2901 }
2902 if (update_change_time > current_change_time) {
2903 return true;
2904 }
2905 if (update_change_time == current_change_time) {
2906 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
2907 }
2908 return false;
2909 }
2910
2911 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2912 struct replPropertyMetaData1 *new_m)
2913 {
2914 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2915 &new_m->originating_invocation_id,
2916 cur_m->version,
2917 new_m->version,
2918 cur_m->originating_change_time,
2919 new_m->originating_change_time);
2920 }
2921
2922 static struct replPropertyMetaData1 *
2923 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2924 enum drsuapi_DsAttributeId attid)
2925 {
2926 uint32_t i;
2927 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2928
2929 for (i = 0; i < rpmd_ctr->count; i++) {
2930 if (rpmd_ctr->array[i].attid == attid) {
2931 return &rpmd_ctr->array[i];
2932 }
2933 }
2934 return NULL;
2935 }
2936
2937 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
2938 {
2939 struct ldb_context *ldb;
2940 struct ldb_request *change_req;
2941 enum ndr_err_code ndr_err;
2942 struct ldb_message *msg;
2943 struct replPropertyMetaDataBlob *rmd;
2944 struct replPropertyMetaDataBlob omd;
2945 const struct ldb_val *omd_value;
2946 struct replPropertyMetaDataBlob nmd;
2947 struct ldb_val nmd_value;
2948 struct replPropertyMetaData1 *md_remote;
2949 struct replPropertyMetaData1 *md_local;
2950 unsigned int i;
2951 uint32_t j,ni=0;
2952 unsigned int removed_attrs = 0;
2953 int ret;
2954
2955 ldb = ldb_module_get_ctx(ar->module);
2956 msg = ar->objs->objects[ar->index_current].msg;
2957 rmd = ar->objs->objects[ar->index_current].meta_data;
2958 ZERO_STRUCT(omd);
2959 omd.version = 1;
2960
2961 /* find existing meta data */
2962 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
2963 if (omd_value) {
2964 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
2965 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
2966 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2967 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2968 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2969 }
2970
2971 if (omd.version != 1) {
2972 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
2973 }
2974 }
2975
2976 /* check if remote 'name' has change,
2977 * which indicates a rename operation */
2978 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTRIBUTE_name);
2979 if (md_remote) {
2980 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTRIBUTE_name);
2981 SMB_ASSERT(md_local);
2982 if (replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
2983 SMB_ASSERT(ldb_dn_compare(msg->dn, ar->search_msg->dn) != 0);
2984 /* TODO: Find appropriate local name (dn) for the object
2985 * and modify msg->dn appropriately */
2986
2987 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
2988 ldb_dn_get_linearized(ar->search_msg->dn),
2989 ldb_dn_get_linearized(msg->dn)));
2990 /* pass rename to the next module
2991 * so it doesn't appear as an originating update */
2992 ret = dsdb_module_rename(ar->module,
2993 ar->search_msg->dn, msg->dn,
2994 DSDB_FLAG_NEXT_MODULE);
2995 if (ret != LDB_SUCCESS) {
2996 ldb_debug(ldb, LDB_DEBUG_FATAL,
2997 "replmd_replicated_request rename %s => %s failed - %s\n",
2998 ldb_dn_get_linearized(ar->search_msg->dn),
2999 ldb_dn_get_linearized(msg->dn),
3000 ldb_errstring(ldb));
3001 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3002 }
3003 }
3004 }
3005
3006 ZERO_STRUCT(nmd);
3007 nmd.version = 1;
3008 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3009 nmd.ctr.ctr1.array = talloc_array(ar,
3010 struct replPropertyMetaData1,
3011 nmd.ctr.ctr1.count);
3012 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3013
3014 /* first copy the old meta data */
3015 for (i=0; i < omd.ctr.ctr1.count; i++) {
3016 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3017 ni++;
3018 }
3019
3020 /* now merge in the new meta data */
3021 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3022 bool found = false;
3023
3024 for (j=0; j < ni; j++) {
3025 bool cmp;
3026
3027 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3028 continue;
3029 }
3030
3031 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3032 &rmd->ctr.ctr1.array[i]);
3033 if (cmp) {
3034 /* replace the entry */
3035 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3036 found = true;
3037 break;
3038 }
3039
3040 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) {
3041 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3042 msg->elements[i-removed_attrs].name,
3043 ldb_dn_get_linearized(msg->dn),
3044 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3045 }
3046
3047 /* we don't want to apply this change so remove the attribute */
3048 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3049 removed_attrs++;
3050
3051 found = true;
3052 break;
3053 }
3054
3055 if (found) continue;
3056
3057 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3058 ni++;
3059 }
3060
3061 /*
3062 * finally correct the size of the meta_data array
3063 */
3064 nmd.ctr.ctr1.count = ni;
3065
3066 /*
3067 * the rdn attribute (the alias for the name attribute),
3068 * 'cn' for most objects is the last entry in the meta data array
3069 * we have stored
3070 *
3071 * sort the new meta data array
3072 */
3073 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3074 if (ret != LDB_SUCCESS) {
3075 return ret;
3076 }
3077
3078 /*
3079 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3080 */
3081 if (msg->num_elements == 0) {
3082 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3083 ar->index_current);
3084
3085 ar->index_current++;
3086 return replmd_replicated_apply_next(ar);
3087 }
3088
3089 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3090 ar->index_current, msg->num_elements);
3091
3092 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3093 if (ret != LDB_SUCCESS) {
3094 return replmd_replicated_request_error(ar, ret);
3095 }
3096
3097 for (i=0; i<ni; i++) {
3098 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3099 }
3100
3101 /* create the meta data value */
3102 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3103 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3104 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3105 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3106 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3107 }
3108
3109 /*
3110 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3111 * and replPopertyMetaData attributes
3112 */
3113 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3114 if (ret != LDB_SUCCESS) {
3115 return replmd_replicated_request_error(ar, ret);
3116 }
3117 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3118 if (ret != LDB_SUCCESS) {
3119 return replmd_replicated_request_error(ar, ret);
3120 }
3121 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3122 if (ret != LDB_SUCCESS) {
3123 return replmd_replicated_request_error(ar, ret);
3124 }
3125
3126 replmd_ldb_message_sort(msg, ar->schema);
3127
3128 /* we want to replace the old values */
3129 for (i=0; i < msg->num_elements; i++) {
3130 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3131 }
3132
3133 if (DEBUGLVL(4)) {
3134 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3135 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3136 talloc_free(s);
3137 }
3138
3139 ret = ldb_build_mod_req(&change_req,
3140 ldb,
3141 ar,
3142 msg,
3143 ar->controls,
3144 ar,
3145 replmd_op_callback,
3146 ar->req);
3147 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3148
3149 return ldb_next_request(ar->module, change_req);
3150 }
3151
3152 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3153 struct ldb_reply *ares)
3154 {
3155 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3156 struct replmd_replicated_request);
3157 int ret;
3158
3159 if (!ares) {
3160 return ldb_module_done(ar->req, NULL, NULL,
3161 LDB_ERR_OPERATIONS_ERROR);
3162 }
3163 if (ares->error != LDB_SUCCESS &&
3164 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3165 return ldb_module_done(ar->req, ares->controls,
3166 ares->response, ares->error);
3167 }
3168
3169 switch (ares->type) {
3170 case LDB_REPLY_ENTRY:
3171 ar->search_msg = talloc_steal(ar, ares->message);
3172 break;
3173
3174 case LDB_REPLY_REFERRAL:
3175 /* we ignore referrals */
3176 break;
3177
3178 case LDB_REPLY_DONE:
3179 if (ar->search_msg != NULL) {
3180 ret = replmd_replicated_apply_merge(ar);
3181 } else {
3182 ret = replmd_replicated_apply_add(ar);
3183 }
3184 if (ret != LDB_SUCCESS) {
3185 return ldb_module_done(ar->req, NULL, NULL, ret);
3186 }
3187 }
3188
3189 talloc_free(ares);
3190 return LDB_SUCCESS;
3191 }
3192
3193 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3194
3195 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3196 {
3197 struct ldb_context *ldb;
3198 int ret;
3199 char *tmp_str;
3200 char *filter;
3201 struct ldb_request *search_req;
3202 struct ldb_search_options_control *options;
3203
3204 if (ar->index_current >= ar->objs->num_objects) {
3205 /* done with it, go to next stage */
3206 return replmd_replicated_uptodate_vector(ar);
3207 }
3208
3209 ldb = ldb_module_get_ctx(ar->module);
3210 ar->search_msg = NULL;
3211
3212 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3213 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3214
3215 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3216 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3217 talloc_free(tmp_str);
3218
3219 ret = ldb_build_search_req(&search_req,
3220 ldb,
3221 ar,
3222 NULL,
3223 LDB_SCOPE_SUBTREE,
3224 filter,
3225 NULL,
3226 NULL,
3227 ar,
3228 replmd_replicated_apply_search_callback,
3229 ar->req);
3230
3231 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
3232 if (ret != LDB_SUCCESS) {
3233 return ret;
3234 }
3235
3236 /* we need to cope with cross-partition links, so search for
3237 the GUID over all partitions */
3238 options = talloc(search_req, struct ldb_search_options_control);
3239 if (options == NULL) {
3240 DEBUG(0, (__location__ ": out of memory\n"));
3241 return LDB_ERR_OPERATIONS_ERROR;
3242 }
3243 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3244
3245 ret = ldb_request_add_control(search_req,
3246 LDB_CONTROL_SEARCH_OPTIONS_OID,
3247 true, options);
3248 if (ret != LDB_SUCCESS) {
3249 return ret;
3250 }
3251
3252 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3253
3254 return ldb_next_request(ar->module, search_req);
3255 }
3256
3257 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3258 struct ldb_reply *ares)
3259 {
3260 struct ldb_context *ldb;
3261 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3262 struct replmd_replicated_request);
3263 ldb = ldb_module_get_ctx(ar->module);
3264
3265 if (!ares) {
3266 return ldb_module_done(ar->req, NULL, NULL,
3267 LDB_ERR_OPERATIONS_ERROR);
3268 }
3269 if (ares->error != LDB_SUCCESS) {
3270 return ldb_module_done(ar->req, ares->controls,
3271 ares->response, ares->error);
3272 }
3273
3274 if (ares->type != LDB_REPLY_DONE) {
3275 ldb_set_errstring(ldb, "Invalid reply type\n!");
3276 return ldb_module_done(ar->req, NULL, NULL,
3277 LDB_ERR_OPERATIONS_ERROR);
3278 }
3279
3280 talloc_free(ares);
3281
3282 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3283 }
3284
3285 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3286 {
3287 struct ldb_context *ldb;
3288 struct ldb_request *change_req;
3289 enum ndr_err_code ndr_err;
3290 struct ldb_message *msg;
3291 struct replUpToDateVectorBlob ouv;
3292 const struct ldb_val *ouv_value;
3293 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3294 struct replUpToDateVectorBlob nuv;
3295 struct ldb_val nuv_value;
3296 struct ldb_message_element *nuv_el = NULL;
3297 const struct GUID *our_invocation_id;
3298 struct ldb_message_element *orf_el = NULL;
3299 struct repsFromToBlob nrf;
3300 struct ldb_val *nrf_value = NULL;
3301 struct ldb_message_element *nrf_el = NULL;
3302 unsigned int i;
3303 uint32_t j,ni=0;
3304 bool found = false;
3305 time_t t = time(NULL);
3306 NTTIME now;
3307 int ret;
3308 uint32_t instanceType;
3309
3310 ldb = ldb_module_get_ctx(ar->module);
3311 ruv = ar->objs->uptodateness_vector;
3312 ZERO_STRUCT(ouv);
3313 ouv.version = 2;
3314 ZERO_STRUCT(nuv);
3315 nuv.version = 2;
3316
3317 unix_to_nt_time(&now, t);
3318
3319 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3320 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3321 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3322 ldb_dn_get_linearized(ar->search_msg->dn)));
3323 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3324 }
3325
3326 /*
3327 * first create the new replUpToDateVector
3328 */
3329 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3330 if (ouv_value) {
3331 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3332 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3333 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3334 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3335 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3336 }
3337
3338 if (ouv.version != 2) {
3339 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3340 }
3341 }
3342
3343 /*
3344 * the new uptodateness vector will at least
3345 * contain 1 entry, one for the source_dsa
3346 *
3347 * plus optional values from our old vector and the one from the source_dsa
3348 */
3349 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3350 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3351 nuv.ctr.ctr2.cursors = talloc_array(ar,
3352 struct drsuapi_DsReplicaCursor2,
3353 nuv.ctr.ctr2.count);
3354 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3355
3356 /* first copy the old vector */
3357 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3358 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3359 ni++;
3360 }
3361
3362 /* get our invocation_id if we have one already attached to the ldb */
3363 our_invocation_id = samdb_ntds_invocation_id(ldb);
3364
3365 /* merge in the source_dsa vector is available */
3366 for (i=0; (ruv && i < ruv->count); i++) {
3367 found = false;
3368
3369 if (our_invocation_id &&
3370 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3371 our_invocation_id)) {
3372 continue;
3373 }
3374
3375 for (j=0; j < ni; j++) {
3376 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3377 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3378 continue;
3379 }
3380
3381 found = true;
3382
3383 /*
3384 * we update only the highest_usn and not the latest_sync_success time,
3385 * because the last success stands for direct replication
3386 */
3387 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3388 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3389 }
3390 break;
3391 }
3392
3393 if (found) continue;
3394
3395 /* if it's not there yet, add it */
3396 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3397 ni++;
3398 }
3399
3400 /*
3401 * merge in the current highwatermark for the source_dsa
3402 */
3403 found = false;
3404 for (j=0; j < ni; j++) {
3405 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3406 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3407 continue;
3408 }
3409
3410 found = true;
3411
3412 /*
3413 * here we update the highest_usn and last_sync_success time
3414 * because we're directly replicating from the source_dsa
3415 *
3416 * and use the tmp_highest_usn because this is what we have just applied
3417 * to our ldb
3418 */
3419 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3420 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3421 break;
3422 }
3423 if (!found) {
3424 /*
3425 * here we update the highest_usn and last_sync_success time
3426 * because we're directly replicating from the source_dsa
3427 *
3428 * and use the tmp_highest_usn because this is what we have just applied
3429 * to our ldb
3430 */
3431 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3432 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3433 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3434 ni++;
3435 }
3436
3437 /*
3438 * finally correct the size of the cursors array
3439 */
3440 nuv.ctr.ctr2.count = ni;
3441
3442 /*
3443 * sort the cursors
3444 */
3445 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3446
3447 /*
3448 * create the change ldb_message
3449 */
3450 msg = ldb_msg_new(ar);
3451 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3452 msg->dn = ar->search_msg->dn;
3453
3454 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3455 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3456 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3457 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3458 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3459 }
3460 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3461 if (ret != LDB_SUCCESS) {
3462 return replmd_replicated_request_error(ar, ret);
3463 }
3464 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3465
3466 /*
3467 * now create the new repsFrom value from the given repsFromTo1 structure
3468 */
3469 ZERO_STRUCT(nrf);
3470 nrf.version = 1;
3471 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3472 /* and fix some values... */
3473 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3474 nrf.ctr.ctr1.last_success = now;
3475 nrf.ctr.ctr1.last_attempt = now;
3476 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3477 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3478
3479 /*
3480 * first see if we already have a repsFrom value for the current source dsa
3481 * if so we'll later replace this value
3482 */
3483 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3484 if (orf_el) {
3485 for (i=0; i < orf_el->num_values; i++) {
3486 struct repsFromToBlob *trf;
3487
3488 trf = talloc(ar, struct repsFromToBlob);
3489 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3490
3491 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3492 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3493 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3494 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3495 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3496 }
3497
3498 if (trf->version != 1) {
3499 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3500 }
3501
3502 /*
3503 * we compare the source dsa objectGUID not the invocation_id
3504 * because we want only one repsFrom value per source dsa
3505 * and when the invocation_id of the source dsa has changed we don't need
3506 * the old repsFrom with the old invocation_id
3507 */
3508 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3509 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3510 talloc_free(trf);
3511 continue;
3512 }
3513
3514 talloc_free(trf);
3515 nrf_value = &orf_el->values[i];
3516 break;
3517 }
3518
3519 /*
3520 * copy over all old values to the new ldb_message
3521 */
3522 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3523 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3524 *nrf_el = *orf_el;
3525 }
3526
3527 /*
3528 * if we haven't found an old repsFrom value for the current source dsa
3529 * we'll add a new value
3530 */
3531 if (!nrf_value) {
3532 struct ldb_val zero_value;
3533 ZERO_STRUCT(zero_value);
3534 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3535 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3536
3537 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3538 }
3539
3540 /* we now fill the value which is already attached to ldb_message */
3541 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3542 &nrf,
3543 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3544 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3545 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3546 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3547 }
3548
3549 /*
3550 * the ldb_message_element for the attribute, has all the old values and the new one
3551 * so we'll replace the whole attribute with all values
3552 */
3553 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3554
3555 if (DEBUGLVL(4)) {
3556 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3557 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3558 talloc_free(s);
3559 }
3560
3561 /* prepare the ldb_modify() request */
3562 ret = ldb_build_mod_req(&change_req,
3563 ldb,
3564 ar,
3565 msg,
3566 ar->controls,
3567 ar,
3568 replmd_replicated_uptodate_modify_callback,
3569 ar->req);
3570 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3571
3572 return ldb_next_request(ar->module, change_req);
3573 }
3574
3575 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3576 struct ldb_reply *ares)
3577 {
3578 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3579 struct replmd_replicated_request);
3580 int ret;
3581
3582 if (!ares) {
3583 return ldb_module_done(ar->req, NULL, NULL,
3584 LDB_ERR_OPERATIONS_ERROR);
3585 }
3586 if (ares->error != LDB_SUCCESS &&
3587 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3588 return ldb_module_done(ar->req, ares->controls,
3589 ares->response, ares->error);
3590 }
3591
3592 switch (ares->type) {
3593 case LDB_REPLY_ENTRY:
3594 ar->search_msg = talloc_steal(ar, ares->message);
3595 break;
3596
3597 case LDB_REPLY_REFERRAL:
3598 /* we ignore referrals */
3599 break;
3600
3601 case LDB_REPLY_DONE:
3602 if (ar->search_msg == NULL) {
3603 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3604 } else {
3605 ret = replmd_replicated_uptodate_modify(ar);
3606 }
3607 if (ret != LDB_SUCCESS) {
3608 return ldb_module_done(ar->req, NULL, NULL, ret);
3609 }
3610 }
3611
3612 talloc_free(ares);
3613 return LDB_SUCCESS;
3614 }
3615
3616
3617 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3618 {
3619 struct ldb_context *ldb;
3620 int ret;
3621 static const char *attrs[] = {
3622 "replUpToDateVector",
3623 "repsFrom",
3624 "instanceType",
3625 NULL
3626 };
3627 struct ldb_request *search_req;
3628
3629 ldb = ldb_module_get_ctx(ar->module);
3630 ar->search_msg = NULL;
3631
3632 ret = ldb_build_search_req(&search_req,
3633 ldb,
3634 ar,
3635 ar->objs->partition_dn,
3636 LDB_SCOPE_BASE,
3637 "(objectClass=*)",
3638 attrs,
3639 NULL,
3640 ar,
3641 replmd_replicated_uptodate_search_callback,
3642 ar->req);
3643 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3644
3645 return ldb_next_request(ar->module, search_req);
3646 }
3647
3648
3649
3650 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3651 {
3652 struct ldb_context *ldb;
3653 struct dsdb_extended_replicated_objects *objs;
3654 struct replmd_replicated_request *ar;
3655 struct ldb_control **ctrls;
3656 int ret;
3657 uint32_t i;
3658 struct replmd_private *replmd_private =
3659 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3660
3661 ldb = ldb_module_get_ctx(module);
3662
3663 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3664
3665 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3666 if (!objs) {
3667 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3668 return LDB_ERR_PROTOCOL_ERROR;
3669 }
3670
3671 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3672 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3673 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3674 return LDB_ERR_PROTOCOL_ERROR;
3675 }
3676
3677 ar = replmd_ctx_init(module, req);
3678 if (!ar)
3679 return LDB_ERR_OPERATIONS_ERROR;
3680
3681 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3682 ar->apply_mode = true;
3683 ar->objs = objs;
3684 ar->schema = dsdb_get_schema(ldb, ar);
3685 if (!ar->schema) {
3686 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3687 talloc_free(ar);
3688 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3689 return LDB_ERR_CONSTRAINT_VIOLATION;
3690 }
3691
3692 ctrls = req->controls;
3693
3694 if (req->controls) {
3695 req->controls = talloc_memdup(ar, req->controls,
3696 talloc_get_size(req->controls));
3697 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3698 }
3699
3700 /* This allows layers further down to know if a change came in over replication */
3701 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3702 if (ret != LDB_SUCCESS) {
3703 return ret;
3704 }
3705
3706 /* If this change contained linked attributes in the body
3707 * (rather than in the links section) we need to update
3708 * backlinks in linked_attributes */
3709 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3710 if (ret != LDB_SUCCESS) {
3711 return ret;
3712 }
3713
3714 ar->controls = req->controls;
3715 req->controls = ctrls;
3716
3717 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3718
3719 /* save away the linked attributes for the end of the
3720 transaction */
3721 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3722 struct la_entry *la_entry;
3723
3724 if (replmd_private->la_ctx == NULL) {
3725 replmd_private->la_ctx = talloc_new(replmd_private);
3726 }
3727 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3728 if (la_entry == NULL) {
3729 ldb_oom(ldb);
3730 return LDB_ERR_OPERATIONS_ERROR;
3731 }
3732 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3733 if (la_entry->la == NULL) {
3734 talloc_free(la_entry);
3735 ldb_oom(ldb);
3736 return LDB_ERR_OPERATIONS_ERROR;
3737 }
3738 *la_entry->la = ar->objs->linked_attributes[i];
3739
3740 /* we need to steal the non-scalars so they stay
3741 around until the end of the transaction */
3742 talloc_steal(la_entry->la, la_entry->la->identifier);
3743 talloc_steal(la_entry->la, la_entry->la->value.blob);
3744
3745 DLIST_ADD(replmd_private->la_list, la_entry);
3746 }
3747
3748 return replmd_replicated_apply_next(ar);
3749 }
3750
3751 /*
3752 process one linked attribute structure
3753 */
3754 static int replmd_process_linked_attribute(struct ldb_module *module,
3755 struct la_entry *la_entry)
3756 {
3757 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3758 struct ldb_context *ldb = ldb_module_get_ctx(module);
3759 struct ldb_message *msg;
3760 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3761 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3762 int ret;
3763 const struct dsdb_attribute *attr;
3764 struct dsdb_dn *dsdb_dn;
3765 uint64_t seq_num = 0;
3766 struct ldb_message_element *old_el;
3767 WERROR status;
3768 time_t t = time(NULL);
3769 struct ldb_result *res;
3770 const char *attrs[2];
3771 struct parsed_dn *pdn_list, *pdn;
3772 struct GUID guid = GUID_zero();
3773 NTSTATUS ntstatus;
3774 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3775 const struct GUID *our_invocation_id;
3776
3777 /*
3778 linked_attributes[0]:
3779 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3780 identifier : *
3781 identifier: struct drsuapi_DsReplicaObjectIdentifier
3782 __ndr_size : 0x0000003a (58)
3783 __ndr_size_sid : 0x00000000 (0)
3784 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3785 sid : S-0-0
3786 __ndr_size_dn : 0x00000000 (0)
3787 dn : ''
3788 attid : DRSUAPI_ATTRIBUTE_member (0x1F)
3789 value: struct drsuapi_DsAttributeValue
3790 __ndr_size : 0x0000007e (126)
3791 blob : *
3792 blob : DATA_BLOB length=126
3793 flags : 0x00000001 (1)
3794 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3795 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3796 meta_data: struct drsuapi_DsReplicaMetaData
3797 version : 0x00000015 (21)
3798 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3799 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3800 originating_usn : 0x000000000001e19c (123292)
3801
3802 (for cases where the link is to a normal DN)
3803 &target: struct drsuapi_DsReplicaObjectIdentifier3
3804 __ndr_size : 0x0000007e (126)
3805 __ndr_size_sid : 0x0000001c (28)
3806 guid : 7639e594-db75-4086-b0d4-67890ae46031
3807 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3808 __ndr_size_dn : 0x00000022 (34)
3809 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3810 */
3811
3812 /* find the attribute being modified */
3813 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3814 if (attr == NULL) {
3815 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3816 talloc_free(tmp_ctx);
3817 return LDB_ERR_OPERATIONS_ERROR;
3818 }
3819
3820 attrs[0] = attr->lDAPDisplayName;
3821 attrs[1] = NULL;
3822
3823 /* get the existing message from the db for the object with
3824 this GUID, returning attribute being modified. We will then
3825 use this msg as the basis for a modify call */
3826 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3827 DSDB_FLAG_NEXT_MODULE |
3828 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3829 DSDB_SEARCH_SHOW_DELETED |
3830 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3831 DSDB_SEARCH_REVEAL_INTERNALS,
3832 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3833 if (ret != LDB_SUCCESS) {
3834 talloc_free(tmp_ctx);
3835 return ret;
3836 }
3837 if (res->count != 1) {
3838 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3839 GUID_string(tmp_ctx, &la->identifier->guid));
3840 talloc_free(tmp_ctx);
3841 return LDB_ERR_NO_SUCH_OBJECT;
3842 }
3843 msg = res->msgs[0];
3844
3845 if (msg->num_elements == 0) {
3846 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3847 if (ret != LDB_SUCCESS) {
3848 ldb_module_oom(module);
3849 talloc_free(tmp_ctx);
3850 return LDB_ERR_OPERATIONS_ERROR;
3851 }
3852 } else {
3853 old_el = &msg->elements[0];
3854 old_el->flags = LDB_FLAG_MOD_REPLACE;
3855 }
3856
3857 /* parse the existing links */
3858 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3859 if (ret != LDB_SUCCESS) {
3860 talloc_free(tmp_ctx);
3861 return ret;
3862 }
3863
3864 /* get our invocationId */
3865 our_invocation_id = samdb_ntds_invocation_id(ldb);
3866 if (!our_invocation_id) {
3867 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3868 talloc_free(tmp_ctx);
3869 return LDB_ERR_OPERATIONS_ERROR;
3870 }
3871
3872 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3873 if (ret != LDB_SUCCESS) {
3874 talloc_free(tmp_ctx);
3875 return ret;
3876 }
3877
3878 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3879 if (!W_ERROR_IS_OK(status)) {
3880 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3881 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3882 return LDB_ERR_OPERATIONS_ERROR;
3883 }
3884
3885 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3886 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3887 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3888 old_el->name,
3889 ldb_dn_get_linearized(dsdb_dn->dn),
3890 ldb_dn_get_linearized(msg->dn));
3891 return LDB_ERR_OPERATIONS_ERROR;
3892 }
3893
3894 /* re-resolve the DN by GUID, as the DRS server may give us an
3895 old DN value */
3896 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3897 if (ret != LDB_SUCCESS) {
3898 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3899 GUID_string(tmp_ctx, &guid),
3900 ldb_dn_get_linearized(dsdb_dn->dn)));
3901 }
3902
3903 /* see if this link already exists */
3904 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3905 if (pdn != NULL) {
3906 /* see if this update is newer than what we have already */
3907 struct GUID invocation_id = GUID_zero();
3908 uint32_t version = 0;
3909 NTTIME change_time = 0;
3910 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3911
3912 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3913 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3914 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3915
3916 if (!replmd_update_is_newer(&invocation_id,
3917 &la->meta_data.originating_invocation_id,
3918 version,
3919 la->meta_data.version,
3920 change_time,
3921 la->meta_data.originating_change_time)) {
3922 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3923 old_el->name, ldb_dn_get_linearized(msg->dn),
3924 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
3925 talloc_free(tmp_ctx);
3926 return LDB_SUCCESS;
3927 }
3928
3929 /* get a seq_num for this change */
3930 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3931 if (ret != LDB_SUCCESS) {
3932 talloc_free(tmp_ctx);
3933 return ret;
3934 }
3935
3936 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
3937 /* remove the existing backlink */
3938 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
3939 if (ret != LDB_SUCCESS) {
3940 talloc_free(tmp_ctx);
3941 return ret;
3942 }
3943 }
3944
3945 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
3946 &la->meta_data.originating_invocation_id,
3947 la->meta_data.originating_usn, seq_num,
3948 la->meta_data.originating_change_time,
3949 la->meta_data.version,
3950 !active);
3951 if (ret != LDB_SUCCESS) {
3952 talloc_free(tmp_ctx);
3953 return ret;
3954 }
3955
3956 if (active) {
3957 /* add the new backlink */
3958 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
3959 if (ret != LDB_SUCCESS) {
3960 talloc_free(tmp_ctx);
3961 return ret;
3962 }
3963 }
3964 } else {
3965 /* get a seq_num for this change */
3966 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3967 if (ret != LDB_SUCCESS) {
3968 talloc_free(tmp_ctx);
3969 return ret;
3970 }
3971
3972 old_el->values = talloc_realloc(msg->elements, old_el->values,
3973 struct ldb_val, old_el->num_values+1);
3974 if (!old_el->values) {
3975 ldb_module_oom(module);
3976 return LDB_ERR_OPERATIONS_ERROR;
3977 }
3978 old_el->num_values++;
3979
3980 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
3981 &la->meta_data.originating_invocation_id,
3982 la->meta_data.originating_usn, seq_num,
3983 la->meta_data.originating_change_time,
3984 la->meta_data.version,
3985 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
3986 if (ret != LDB_SUCCESS) {
3987 talloc_free(tmp_ctx);
3988 return ret;
3989 }
3990
3991 if (active) {
3992 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
3993 true, attr, false);
3994 if (ret != LDB_SUCCESS) {
3995 talloc_free(tmp_ctx);
3996 return ret;
3997 }
3998 }
3999 }
4000
4001 /* we only change whenChanged and uSNChanged if the seq_num
4002 has changed */
4003 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4004 talloc_free(tmp_ctx);
4005 return LDB_ERR_OPERATIONS_ERROR;
4006 }
4007
4008 if (add_uint64_element(msg, "uSNChanged", seq_num) != LDB_SUCCESS) {
4009 talloc_free(tmp_ctx);
4010 return LDB_ERR_OPERATIONS_ERROR;
4011 }
4012
4013 ret = dsdb_check_single_valued_link(attr, old_el);
4014 if (ret != LDB_SUCCESS) {
4015 talloc_free(tmp_ctx);
4016 return ret;
4017 }
4018
4019 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
4020 if (ret != LDB_SUCCESS) {
4021 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4022 ldb_errstring(ldb),
4023 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4024 talloc_free(tmp_ctx);
4025 return ret;
4026 }
4027
4028 talloc_free(tmp_ctx);
4029
4030 return ret;
4031 }
4032
4033 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4034 {
4035 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4036 return replmd_extended_replicated_objects(module, req);
4037 }
4038
4039 return ldb_next_request(module, req);
4040 }
4041
4042
4043 /*
4044 we hook into the transaction operations to allow us to
4045 perform the linked attribute updates at the end of the whole
4046 transaction. This allows a forward linked attribute to be created
4047 before the object is created. During a vampire, w2k8 sends us linked
4048 attributes before the objects they are part of.
4049 */
4050 static int replmd_start_transaction(struct ldb_module *module)
4051 {
4052 /* create our private structure for this transaction */
4053 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4054 struct replmd_private);
4055 replmd_txn_cleanup(replmd_private);
4056
4057 /* free any leftover mod_usn records from cancelled
4058 transactions */
4059 while (replmd_private->ncs) {
4060 struct nc_entry *e = replmd_private->ncs;
4061 DLIST_REMOVE(replmd_private->ncs, e);
4062 talloc_free(e);
4063 }
4064
4065 return ldb_next_start_trans(module);
4066 }
4067
4068 /*
4069 on prepare commit we loop over our queued la_context structures and
4070 apply each of them
4071 */
4072 static int replmd_prepare_commit(struct ldb_module *module)
4073 {
4074 struct replmd_private *replmd_private =
4075 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4076 struct la_entry *la, *prev;
4077 struct la_backlink *bl;
4078 int ret;
4079
4080 /* walk the list backwards, to do the first entry first, as we
4081 * added the entries with DLIST_ADD() which puts them at the
4082 * start of the list */
4083 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4084 prev = DLIST_PREV(la);
4085 DLIST_REMOVE(replmd_private->la_list, la);
4086 ret = replmd_process_linked_attribute(module, la);
4087 if (ret != LDB_SUCCESS) {
4088 replmd_txn_cleanup(replmd_private);
4089 return ret;
4090 }
4091 }
4092
4093 /* process our backlink list, creating and deleting backlinks
4094 as necessary */
4095 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4096 ret = replmd_process_backlink(module, bl);
4097 if (ret != LDB_SUCCESS) {
4098 replmd_txn_cleanup(replmd_private);
4099 return ret;
4100 }
4101 }
4102
4103 replmd_txn_cleanup(replmd_private);
4104
4105 /* possibly change @REPLCHANGED */
4106 ret = replmd_notify_store(module);
4107 if (ret != LDB_SUCCESS) {
4108 return ret;
4109 }
4110
4111 return ldb_next_prepare_commit(module);
4112 }
4113
4114 static int replmd_del_transaction(struct ldb_module *module)
4115 {
4116 struct replmd_private *replmd_private =
4117 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4118 replmd_txn_cleanup(replmd_private);
4119
4120 return ldb_next_del_trans(module);
4121 }
4122
4123
4124 _PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4125 .name = "repl_meta_data",
4126 .init_context = replmd_init,
4127 .add = replmd_add,
4128 .modify = replmd_modify,
4129 .rename = replmd_rename,
4130 .del = replmd_delete,
4131 .extended = replmd_extended,
4132 .start_transaction = replmd_start_transaction,
4133 .prepare_commit = replmd_prepare_commit,
4134 .del_transaction = replmd_del_transaction,
4135 };
Samba GIT mirror