lib/util: Build iov_buf library only when building samba
[Samba.git] / source4 / dsdb / kcc / kcc_periodic.c
blob0e84e422d5fe4b6ec3782002898e963cfa264e4f
1 /*
2 Unix SMB/CIFS mplementation.
3 KCC service periodic handling
5 Copyright (C) Andrew Tridgell 2009
6 based on repl service code
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "includes.h"
24 #include "lib/events/events.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "auth/auth.h"
27 #include "smbd/service.h"
28 #include "lib/messaging/irpc.h"
29 #include "dsdb/kcc/kcc_connection.h"
30 #include "dsdb/kcc/kcc_service.h"
31 #include <ldb_errors.h>
32 #include "../lib/util/dlinklist.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "librpc/gen_ndr/ndr_drsblobs.h"
36 #include "librpc/gen_ndr/ndr_irpc_c.h"
37 #include "param/param.h"
38 #include "dsdb/common/util.h"
41 * see if two repsFromToBlob blobs are for the same source DSA
43 static bool kccsrv_same_source_dsa(struct repsFromToBlob *r1, struct repsFromToBlob *r2)
45 return GUID_equal(&r1->ctr.ctr1.source_dsa_obj_guid,
46 &r2->ctr.ctr1.source_dsa_obj_guid);
50 * see if a repsFromToBlob is in a list
52 static bool reps_in_list(struct repsFromToBlob *r, struct repsFromToBlob *reps, uint32_t count)
54 uint32_t i;
55 for (i=0; i<count; i++) {
56 if (kccsrv_same_source_dsa(r, &reps[i])) {
57 return true;
60 return false;
64 make sure we only add repsFrom entries for DCs who are masters for
65 the partition
67 static bool check_MasterNC(struct kccsrv_partition *p, struct repsFromToBlob *r,
68 struct ldb_result *res)
70 struct repsFromTo1 *r1 = &r->ctr.ctr1;
71 struct GUID invocation_id = r1->source_dsa_invocation_id;
72 unsigned int i, j;
73 TALLOC_CTX *tmp_ctx;
75 /* we are expecting only version 1 */
76 SMB_ASSERT(r->version == 1);
78 tmp_ctx = talloc_new(p);
79 if (!tmp_ctx) {
80 return false;
83 for (i=0; i<res->count; i++) {
84 struct ldb_message *msg = res->msgs[i];
85 struct ldb_message_element *el;
86 struct ldb_dn *dn;
88 struct GUID id2 = samdb_result_guid(msg, "invocationID");
89 if (GUID_all_zero(&id2) ||
90 !GUID_equal(&invocation_id, &id2)) {
91 continue;
94 el = ldb_msg_find_element(msg, "msDS-hasMasterNCs");
95 if (!el || el->num_values == 0) {
96 el = ldb_msg_find_element(msg, "hasMasterNCs");
97 if (!el || el->num_values == 0) {
98 continue;
101 for (j=0; j<el->num_values; j++) {
102 dn = ldb_dn_from_ldb_val(tmp_ctx, p->service->samdb, &el->values[j]);
103 if (!ldb_dn_validate(dn)) {
104 talloc_free(dn);
105 continue;
107 if (ldb_dn_compare(dn, p->dn) == 0) {
108 DEBUG(5,("%s %s match on %s in %s\n",
109 r1->other_info->dns_name,
110 el->name,
111 ldb_dn_get_linearized(dn),
112 ldb_dn_get_linearized(msg->dn)));
113 talloc_free(tmp_ctx);
114 return true;
116 talloc_free(dn);
119 talloc_free(tmp_ctx);
120 return false;
123 struct kccsrv_notify_drepl_server_state {
124 struct dreplsrv_refresh r;
127 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq);
130 * Force dreplsrv to update its state as topology is changed
132 static void kccsrv_notify_drepl_server(struct kccsrv_service *s,
133 TALLOC_CTX *mem_ctx)
135 struct kccsrv_notify_drepl_server_state *state;
136 struct dcerpc_binding_handle *irpc_handle;
137 struct tevent_req *subreq;
139 state = talloc_zero(s, struct kccsrv_notify_drepl_server_state);
140 if (state == NULL) {
141 return;
144 irpc_handle = irpc_binding_handle_by_name(state, s->task->msg_ctx,
145 "dreplsrv", &ndr_table_irpc);
146 if (irpc_handle == NULL) {
147 /* dreplsrv is not running yet */
148 TALLOC_FREE(state);
149 return;
152 subreq = dcerpc_dreplsrv_refresh_r_send(state, s->task->event_ctx,
153 irpc_handle, &state->r);
154 if (subreq == NULL) {
155 TALLOC_FREE(state);
156 return;
158 tevent_req_set_callback(subreq, kccsrv_notify_drepl_server_done, state);
161 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq)
163 struct kccsrv_notify_drepl_server_state *state =
164 tevent_req_callback_data(subreq,
165 struct kccsrv_notify_drepl_server_state);
167 dcerpc_dreplsrv_refresh_r_recv(subreq, state);
168 TALLOC_FREE(subreq);
170 /* we don't care about errors */
171 TALLOC_FREE(state);
174 uint32_t kccsrv_replica_flags(struct kccsrv_service *s)
176 if (s->am_rodc) {
177 return DRSUAPI_DRS_INIT_SYNC |
178 DRSUAPI_DRS_PER_SYNC |
179 DRSUAPI_DRS_ADD_REF |
180 DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
181 DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP |
182 DRSUAPI_DRS_NONGC_RO_REP;
184 return DRSUAPI_DRS_INIT_SYNC |
185 DRSUAPI_DRS_PER_SYNC |
186 DRSUAPI_DRS_ADD_REF |
187 DRSUAPI_DRS_WRIT_REP;
191 * add any missing repsFrom structures to our partitions
193 NTSTATUS kccsrv_add_repsFrom(struct kccsrv_service *s, TALLOC_CTX *mem_ctx,
194 struct repsFromToBlob *reps, uint32_t count,
195 struct ldb_result *res)
197 struct kccsrv_partition *p;
198 bool notify_dreplsrv = false;
199 uint32_t replica_flags = kccsrv_replica_flags(s);
201 /* update the repsFrom on all partitions */
202 for (p=s->partitions; p; p=p->next) {
203 struct repsFromToBlob *our_reps;
204 uint32_t our_count;
205 WERROR werr;
206 uint32_t i, j;
207 bool modified = false;
209 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsFrom", &our_reps, &our_count);
210 if (!W_ERROR_IS_OK(werr)) {
211 DEBUG(0,(__location__ ": Failed to load repsFrom from %s - %s\n",
212 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
213 return NT_STATUS_INTERNAL_DB_CORRUPTION;
216 /* see if the entry already exists */
217 for (i=0; i<count; i++) {
218 for (j=0; j<our_count; j++) {
219 if (kccsrv_same_source_dsa(&reps[i], &our_reps[j])) {
220 /* we already have this one -
221 check the replica_flags are right */
222 if (replica_flags != our_reps[j].ctr.ctr1.replica_flags) {
223 /* we need to update the old one with
224 * the new flags
226 our_reps[j].ctr.ctr1.replica_flags = replica_flags;
227 modified = true;
229 break;
232 if (j == our_count) {
233 /* we don't have the new one - add it
234 * if it is a master
236 if (res && !check_MasterNC(p, &reps[i], res)) {
237 /* its not a master, we don't
238 want to pull from it */
239 continue;
241 /* we need to add it to our repsFrom */
242 our_reps = talloc_realloc(mem_ctx, our_reps, struct repsFromToBlob, our_count+1);
243 NT_STATUS_HAVE_NO_MEMORY(our_reps);
244 our_reps[our_count] = reps[i];
245 our_reps[our_count].ctr.ctr1.replica_flags = replica_flags;
246 our_count++;
247 modified = true;
248 DEBUG(4,(__location__ ": Added repsFrom for %s\n",
249 reps[i].ctr.ctr1.other_info->dns_name));
253 /* remove any stale ones */
254 for (i=0; i<our_count; i++) {
255 if (!reps_in_list(&our_reps[i], reps, count) ||
256 (res && !check_MasterNC(p, &our_reps[i], res))) {
257 DEBUG(4,(__location__ ": Removed repsFrom for %s\n",
258 our_reps[i].ctr.ctr1.other_info->dns_name));
259 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
260 our_count--;
261 i--;
262 modified = true;
266 if (modified) {
267 werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsFrom", our_reps, our_count);
268 if (!W_ERROR_IS_OK(werr)) {
269 DEBUG(0,(__location__ ": Failed to save repsFrom to %s - %s\n",
270 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
271 return NT_STATUS_INTERNAL_DB_CORRUPTION;
273 /* dreplsrv should refresh its state */
274 notify_dreplsrv = true;
277 /* remove stale repsTo entries */
278 modified = false;
279 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsTo", &our_reps, &our_count);
280 if (!W_ERROR_IS_OK(werr)) {
281 DEBUG(0,(__location__ ": Failed to load repsTo from %s - %s\n",
282 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
283 return NT_STATUS_INTERNAL_DB_CORRUPTION;
286 /* remove any stale ones */
287 for (i=0; i<our_count; i++) {
288 if (!reps_in_list(&our_reps[i], reps, count)) {
289 DEBUG(4,(__location__ ": Removed repsTo for %s\n",
290 our_reps[i].ctr.ctr1.other_info->dns_name));
291 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
292 our_count--;
293 i--;
294 modified = true;
298 if (modified) {
299 werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsTo", our_reps, our_count);
300 if (!W_ERROR_IS_OK(werr)) {
301 DEBUG(0,(__location__ ": Failed to save repsTo to %s - %s\n",
302 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
303 return NT_STATUS_INTERNAL_DB_CORRUPTION;
305 /* dreplsrv should refresh its state */
306 notify_dreplsrv = true;
310 /* notify dreplsrv toplogy has changed */
311 if (notify_dreplsrv) {
312 kccsrv_notify_drepl_server(s, mem_ctx);
315 return NT_STATUS_OK;
321 form a unique list of DNs from a search result and a given set of attributes
323 static int kccsrv_dn_list(struct ldb_context *ldb, struct ldb_result *res,
324 TALLOC_CTX *mem_ctx,
325 const char **attrs,
326 struct ldb_dn ***dn_list, int *dn_count)
328 int i;
329 struct ldb_dn **nc_list = NULL;
330 int nc_count = 0;
332 nc_list = talloc_array(mem_ctx, struct ldb_dn *, 0);
333 if (nc_list == NULL) {
334 return LDB_ERR_OPERATIONS_ERROR;
337 /* gather up a list of all NCs in this forest */
338 for (i=0; i<res->count; i++) {
339 struct ldb_message *msg = res->msgs[i];
340 int j;
341 for (j=0; attrs[j]; j++) {
342 struct ldb_message_element *el;
343 int k;
345 el = ldb_msg_find_element(msg, attrs[j]);
346 if (el == NULL) continue;
347 for (k=0; k<el->num_values; k++) {
348 struct ldb_dn *dn;
349 dn = ldb_dn_from_ldb_val(nc_list, ldb, &el->values[k]);
350 if (dn != NULL) {
351 int l;
352 for (l=0; l<nc_count; l++) {
353 if (ldb_dn_compare(nc_list[l], dn) == 0) break;
355 if (l < nc_count) continue;
356 nc_list = talloc_realloc(mem_ctx, nc_list, struct ldb_dn *, nc_count+1);
357 if (nc_list == NULL) {
358 return LDB_ERR_OPERATIONS_ERROR;
360 nc_list[nc_count] = dn;
361 nc_count++;
367 (*dn_list) = nc_list;
368 (*dn_count) = nc_count;
369 return LDB_SUCCESS;
374 look for any additional global catalog partitions that we should be
375 replicating (by looking for msDS-HasDomainNCs), and add them to our
376 hasPartialReplicaNCs NTDS attribute
378 static int kccsrv_gc_update(struct kccsrv_service *s, struct ldb_result *res)
380 int i;
381 struct ldb_dn **nc_list = NULL;
382 int nc_count = 0;
383 struct ldb_dn **our_nc_list = NULL;
384 int our_nc_count = 0;
385 const char *attrs1[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
386 const char *attrs2[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", "hasPartialReplicaNCs", NULL };
387 int ret;
388 TALLOC_CTX *tmp_ctx = talloc_new(res);
389 struct ldb_result *res2;
390 struct ldb_message *msg;
392 /* get a complete list of NCs for the forest */
393 ret = kccsrv_dn_list(s->samdb, res, tmp_ctx, attrs1, &nc_list, &nc_count);
394 if (ret != LDB_SUCCESS) {
395 DEBUG(1,("Failed to get NC list for GC update - %s\n", ldb_errstring(s->samdb)));
396 talloc_free(tmp_ctx);
397 return ret;
400 /* get a list of what NCs we are already replicating */
401 ret = dsdb_search_dn(s->samdb, tmp_ctx, &res2, samdb_ntds_settings_dn(s->samdb, tmp_ctx), attrs2, 0);
402 if (ret != LDB_SUCCESS) {
403 DEBUG(1,("Failed to get our NC list attributes for GC update - %s\n", ldb_errstring(s->samdb)));
404 talloc_free(tmp_ctx);
405 return ret;
408 ret = kccsrv_dn_list(s->samdb, res2, tmp_ctx, attrs2, &our_nc_list, &our_nc_count);
409 if (ret != LDB_SUCCESS) {
410 DEBUG(1,("Failed to get our NC list for GC update - %s\n", ldb_errstring(s->samdb)));
411 talloc_free(tmp_ctx);
412 return ret;
415 msg = ldb_msg_new(tmp_ctx);
416 if (msg == NULL) {
417 talloc_free(tmp_ctx);
418 return LDB_ERR_OPERATIONS_ERROR;
420 msg->dn = res2->msgs[0]->dn;
422 /* see if we are missing any */
423 for (i=0; i<nc_count; i++) {
424 int j;
425 for (j=0; j<our_nc_count; j++) {
426 if (ldb_dn_compare(nc_list[i], our_nc_list[j]) == 0) break;
428 if (j == our_nc_count) {
429 /* its a new one */
430 ret = ldb_msg_add_string(msg, "hasPartialReplicaNCs",
431 ldb_dn_get_extended_linearized(msg, nc_list[i], 1));
432 if (ret != LDB_SUCCESS) {
433 talloc_free(tmp_ctx);
434 return ret;
440 if (msg->num_elements == 0) {
441 /* none to add */
442 talloc_free(tmp_ctx);
443 return LDB_SUCCESS;
446 if (s->am_rodc) {
447 DEBUG(5, ("%d partial replica should be added but we are RODC so we skip\n", msg->num_elements));
448 talloc_free(tmp_ctx);
449 return LDB_SUCCESS;
452 msg->elements[0].flags = LDB_FLAG_MOD_ADD;
454 ret = dsdb_modify(s->samdb, msg, 0);
455 if (ret != LDB_SUCCESS) {
456 DEBUG(0,("Failed to add hasPartialReplicaNCs - %s\n",
457 ldb_errstring(s->samdb)));
460 talloc_free(tmp_ctx);
461 return ret;
466 this is the core of our initial simple KCC
467 We just add a repsFrom entry for all DCs we find that have nTDSDSA
468 objects, except for ourselves
470 NTSTATUS kccsrv_simple_update(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
472 struct ldb_result *res;
473 unsigned int i;
474 int ret;
475 const char *attrs[] = { "objectGUID", "invocationID", "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
476 struct repsFromToBlob *reps = NULL;
477 uint32_t count = 0;
478 struct kcc_connection_list *ntds_conn, *dsa_conn;
480 ret = dsdb_search(s->samdb, mem_ctx, &res, s->config_dn, LDB_SCOPE_SUBTREE,
481 attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "objectClass=nTDSDSA");
482 if (ret != LDB_SUCCESS) {
483 DEBUG(0,(__location__ ": Failed nTDSDSA search - %s\n", ldb_errstring(s->samdb)));
484 return NT_STATUS_INTERNAL_DB_CORRUPTION;
487 if (samdb_is_gc(s->samdb)) {
488 kccsrv_gc_update(s, res);
491 /* get the current list of connections */
492 ntds_conn = kccsrv_find_connections(s, mem_ctx);
494 dsa_conn = talloc_zero(mem_ctx, struct kcc_connection_list);
496 for (i=0; i<res->count; i++) {
497 struct repsFromTo1 *r1;
498 struct GUID ntds_guid, invocation_id;
500 ntds_guid = samdb_result_guid(res->msgs[i], "objectGUID");
501 if (GUID_equal(&ntds_guid, &s->ntds_guid)) {
502 /* don't replicate with ourselves */
503 continue;
506 invocation_id = samdb_result_guid(res->msgs[i], "invocationID");
508 reps = talloc_realloc(mem_ctx, reps, struct repsFromToBlob, count+1);
509 NT_STATUS_HAVE_NO_MEMORY(reps);
511 ZERO_STRUCT(reps[count]);
512 reps[count].version = 1;
513 r1 = &reps[count].ctr.ctr1;
515 r1->other_info = talloc_zero(reps, struct repsFromTo1OtherInfo);
516 r1->other_info->dns_name = samdb_ntds_msdcs_dns_name(s->samdb, reps, &ntds_guid);
517 r1->source_dsa_obj_guid = ntds_guid;
518 r1->source_dsa_invocation_id = invocation_id;
519 r1->replica_flags = kccsrv_replica_flags(s);
520 memset(r1->schedule, 0x11, sizeof(r1->schedule));
522 dsa_conn->servers = talloc_realloc(dsa_conn, dsa_conn->servers,
523 struct kcc_connection,
524 dsa_conn->count + 1);
525 NT_STATUS_HAVE_NO_MEMORY(dsa_conn->servers);
526 dsa_conn->servers[dsa_conn->count].dsa_guid = r1->source_dsa_obj_guid;
527 dsa_conn->count++;
529 count++;
532 kccsrv_apply_connections(s, ntds_conn, dsa_conn);
534 return kccsrv_add_repsFrom(s, mem_ctx, reps, count, res);
538 static void kccsrv_periodic_run(struct kccsrv_service *service);
540 static void kccsrv_periodic_handler_te(struct tevent_context *ev, struct tevent_timer *te,
541 struct timeval t, void *ptr)
543 struct kccsrv_service *service = talloc_get_type(ptr, struct kccsrv_service);
544 WERROR status;
546 service->periodic.te = NULL;
548 kccsrv_periodic_run(service);
550 status = kccsrv_periodic_schedule(service, service->periodic.interval);
551 if (!W_ERROR_IS_OK(status)) {
552 task_server_terminate(service->task, win_errstr(status), true);
553 return;
557 WERROR kccsrv_periodic_schedule(struct kccsrv_service *service, uint32_t next_interval)
559 TALLOC_CTX *tmp_mem;
560 struct tevent_timer *new_te;
561 struct timeval next_time;
563 /* prevent looping */
564 if (next_interval == 0) next_interval = 1;
566 next_time = timeval_current_ofs(next_interval, 50);
568 if (service->periodic.te) {
570 * if the timestamp of the new event is higher,
571 * as current next we don't need to reschedule
573 if (timeval_compare(&next_time, &service->periodic.next_event) > 0) {
574 return WERR_OK;
578 /* reset the next scheduled timestamp */
579 service->periodic.next_event = next_time;
581 new_te = tevent_add_timer(service->task->event_ctx, service,
582 service->periodic.next_event,
583 kccsrv_periodic_handler_te, service);
584 W_ERROR_HAVE_NO_MEMORY(new_te);
586 tmp_mem = talloc_new(service);
587 DEBUG(4,("kccsrv_periodic_schedule(%u) %sscheduled for: %s\n",
588 next_interval,
589 (service->periodic.te?"re":""),
590 nt_time_string(tmp_mem, timeval_to_nttime(&next_time))));
591 talloc_free(tmp_mem);
593 talloc_free(service->periodic.te);
594 service->periodic.te = new_te;
596 return WERR_OK;
599 static void kccsrv_periodic_run(struct kccsrv_service *service)
601 TALLOC_CTX *mem_ctx;
602 NTSTATUS status;
604 DEBUG(4,("kccsrv_periodic_run(): update\n"));
606 mem_ctx = talloc_new(service);
608 if (service->samba_kcc_code)
609 status = kccsrv_samba_kcc(service, mem_ctx);
610 else {
611 status = kccsrv_simple_update(service, mem_ctx);
612 if (!NT_STATUS_IS_OK(status))
613 DEBUG(0,("kccsrv_simple_update failed - %s\n",
614 nt_errstr(status)));
617 status = kccsrv_check_deleted(service, mem_ctx);
618 if (!NT_STATUS_IS_OK(status)) {
619 DEBUG(0,("kccsrv_check_deleted failed - %s\n", nt_errstr(status)));
621 talloc_free(mem_ctx);
624 /* Called when samba_kcc script has finished
626 static void samba_kcc_done(struct tevent_req *subreq)
628 struct kccsrv_service *service =
629 tevent_req_callback_data(subreq, struct kccsrv_service);
630 int rc;
631 int sys_errno;
633 service->periodic.subreq = NULL;
635 rc = samba_runcmd_recv(subreq, &sys_errno);
636 TALLOC_FREE(subreq);
638 if (rc != 0)
639 service->periodic.status =
640 map_nt_error_from_unix_common(sys_errno);
641 else
642 service->periodic.status = NT_STATUS_OK;
644 if (!NT_STATUS_IS_OK(service->periodic.status))
645 DEBUG(0,(__location__ ": Failed samba_kcc - %s\n",
646 nt_errstr(service->periodic.status)));
647 else
648 DEBUG(3,("Completed samba_kcc OK\n"));
651 /* Invocation of the samba_kcc python script for replication
652 * topology generation.
654 NTSTATUS kccsrv_samba_kcc(struct kccsrv_service *service,
655 TALLOC_CTX *ctxp)
657 NTSTATUS status = NT_STATUS_OK;
658 const char * const *samba_kcc_command =
659 lpcfg_samba_kcc_command(service->task->lp_ctx);
661 /* kill any existing child */
662 TALLOC_FREE(service->periodic.subreq);
664 DEBUG(2, ("Calling samba_kcc script\n"));
665 service->periodic.subreq = samba_runcmd_send(service,
666 service->task->event_ctx,
667 timeval_current_ofs(40, 0),
668 2, 0, samba_kcc_command, NULL);
670 if (service->periodic.subreq == NULL) {
671 status = NT_STATUS_NO_MEMORY;
672 goto xerror;
674 tevent_req_set_callback(service->periodic.subreq,
675 samba_kcc_done, service);
677 xerror:
678 if (!NT_STATUS_IS_OK(status))
679 DEBUG(0,(__location__ ": failed - %s\n", nt_errstr(status)));
680 return status;