2 Unix SMB/CIFS mplementation.
3 KCC service periodic handling
5 Copyright (C) Andrew Tridgell 2009
6 based on repl service code
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/events/events.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "auth/auth.h"
27 #include "smbd/service.h"
28 #include "lib/messaging/irpc.h"
29 #include "dsdb/kcc/kcc_connection.h"
30 #include "dsdb/kcc/kcc_service.h"
31 #include <ldb_errors.h>
32 #include "../lib/util/dlinklist.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "librpc/gen_ndr/ndr_drsblobs.h"
36 #include "librpc/gen_ndr/ndr_irpc_c.h"
37 #include "param/param.h"
38 #include "dsdb/common/util.h"
41 * see if two repsFromToBlob blobs are for the same source DSA
43 static bool kccsrv_same_source_dsa(struct repsFromToBlob
*r1
, struct repsFromToBlob
*r2
)
45 return GUID_equal(&r1
->ctr
.ctr1
.source_dsa_obj_guid
,
46 &r2
->ctr
.ctr1
.source_dsa_obj_guid
);
50 * see if a repsFromToBlob is in a list
52 static bool reps_in_list(struct repsFromToBlob
*r
, struct repsFromToBlob
*reps
, uint32_t count
)
55 for (i
=0; i
<count
; i
++) {
56 if (kccsrv_same_source_dsa(r
, &reps
[i
])) {
64 make sure we only add repsFrom entries for DCs who are masters for
67 static bool check_MasterNC(struct kccsrv_partition
*p
, struct repsFromToBlob
*r
,
68 struct ldb_result
*res
)
70 struct repsFromTo1
*r1
= &r
->ctr
.ctr1
;
71 struct GUID invocation_id
= r1
->source_dsa_invocation_id
;
75 /* we are expecting only version 1 */
76 SMB_ASSERT(r
->version
== 1);
78 tmp_ctx
= talloc_new(p
);
83 for (i
=0; i
<res
->count
; i
++) {
84 struct ldb_message
*msg
= res
->msgs
[i
];
85 struct ldb_message_element
*el
;
88 struct GUID id2
= samdb_result_guid(msg
, "invocationID");
89 if (GUID_all_zero(&id2
) ||
90 !GUID_equal(&invocation_id
, &id2
)) {
94 el
= ldb_msg_find_element(msg
, "msDS-hasMasterNCs");
95 if (!el
|| el
->num_values
== 0) {
96 el
= ldb_msg_find_element(msg
, "hasMasterNCs");
97 if (!el
|| el
->num_values
== 0) {
101 for (j
=0; j
<el
->num_values
; j
++) {
102 dn
= ldb_dn_from_ldb_val(tmp_ctx
, p
->service
->samdb
, &el
->values
[j
]);
103 if (!ldb_dn_validate(dn
)) {
107 if (ldb_dn_compare(dn
, p
->dn
) == 0) {
108 DEBUG(5,("%s %s match on %s in %s\n",
109 r1
->other_info
->dns_name
,
111 ldb_dn_get_linearized(dn
),
112 ldb_dn_get_linearized(msg
->dn
)));
113 talloc_free(tmp_ctx
);
119 talloc_free(tmp_ctx
);
123 struct kccsrv_notify_drepl_server_state
{
124 struct dreplsrv_refresh r
;
127 static void kccsrv_notify_drepl_server_done(struct tevent_req
*subreq
);
130 * Force dreplsrv to update its state as topology is changed
132 static void kccsrv_notify_drepl_server(struct kccsrv_service
*s
,
135 struct kccsrv_notify_drepl_server_state
*state
;
136 struct dcerpc_binding_handle
*irpc_handle
;
137 struct tevent_req
*subreq
;
139 state
= talloc_zero(s
, struct kccsrv_notify_drepl_server_state
);
144 irpc_handle
= irpc_binding_handle_by_name(state
, s
->task
->msg_ctx
,
145 "dreplsrv", &ndr_table_irpc
);
146 if (irpc_handle
== NULL
) {
147 /* dreplsrv is not running yet */
152 subreq
= dcerpc_dreplsrv_refresh_r_send(state
, s
->task
->event_ctx
,
153 irpc_handle
, &state
->r
);
154 if (subreq
== NULL
) {
158 tevent_req_set_callback(subreq
, kccsrv_notify_drepl_server_done
, state
);
161 static void kccsrv_notify_drepl_server_done(struct tevent_req
*subreq
)
163 struct kccsrv_notify_drepl_server_state
*state
=
164 tevent_req_callback_data(subreq
,
165 struct kccsrv_notify_drepl_server_state
);
167 dcerpc_dreplsrv_refresh_r_recv(subreq
, state
);
170 /* we don't care about errors */
174 uint32_t kccsrv_replica_flags(struct kccsrv_service
*s
)
177 return DRSUAPI_DRS_INIT_SYNC
|
178 DRSUAPI_DRS_PER_SYNC
|
179 DRSUAPI_DRS_ADD_REF
|
180 DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING
|
181 DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP
|
182 DRSUAPI_DRS_NONGC_RO_REP
;
184 return DRSUAPI_DRS_INIT_SYNC
|
185 DRSUAPI_DRS_PER_SYNC
|
186 DRSUAPI_DRS_ADD_REF
|
187 DRSUAPI_DRS_WRIT_REP
;
191 * add any missing repsFrom structures to our partitions
193 NTSTATUS
kccsrv_add_repsFrom(struct kccsrv_service
*s
, TALLOC_CTX
*mem_ctx
,
194 struct repsFromToBlob
*reps
, uint32_t count
,
195 struct ldb_result
*res
)
197 struct kccsrv_partition
*p
;
198 bool notify_dreplsrv
= false;
199 uint32_t replica_flags
= kccsrv_replica_flags(s
);
201 /* update the repsFrom on all partitions */
202 for (p
=s
->partitions
; p
; p
=p
->next
) {
203 struct repsFromToBlob
*our_reps
;
207 bool modified
= false;
209 werr
= dsdb_loadreps(s
->samdb
, mem_ctx
, p
->dn
, "repsFrom", &our_reps
, &our_count
);
210 if (!W_ERROR_IS_OK(werr
)) {
211 DEBUG(0,(__location__
": Failed to load repsFrom from %s - %s\n",
212 ldb_dn_get_linearized(p
->dn
), ldb_errstring(s
->samdb
)));
213 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
216 /* see if the entry already exists */
217 for (i
=0; i
<count
; i
++) {
218 for (j
=0; j
<our_count
; j
++) {
219 if (kccsrv_same_source_dsa(&reps
[i
], &our_reps
[j
])) {
220 /* we already have this one -
221 check the replica_flags are right */
222 if (replica_flags
!= our_reps
[j
].ctr
.ctr1
.replica_flags
) {
223 /* we need to update the old one with
226 our_reps
[j
].ctr
.ctr1
.replica_flags
= replica_flags
;
232 if (j
== our_count
) {
233 /* we don't have the new one - add it
236 if (res
&& !check_MasterNC(p
, &reps
[i
], res
)) {
237 /* its not a master, we don't
238 want to pull from it */
241 /* we need to add it to our repsFrom */
242 our_reps
= talloc_realloc(mem_ctx
, our_reps
, struct repsFromToBlob
, our_count
+1);
243 NT_STATUS_HAVE_NO_MEMORY(our_reps
);
244 our_reps
[our_count
] = reps
[i
];
245 our_reps
[our_count
].ctr
.ctr1
.replica_flags
= replica_flags
;
248 DEBUG(4,(__location__
": Added repsFrom for %s\n",
249 reps
[i
].ctr
.ctr1
.other_info
->dns_name
));
253 /* remove any stale ones */
254 for (i
=0; i
<our_count
; i
++) {
255 if (!reps_in_list(&our_reps
[i
], reps
, count
) ||
256 (res
&& !check_MasterNC(p
, &our_reps
[i
], res
))) {
257 DEBUG(4,(__location__
": Removed repsFrom for %s\n",
258 our_reps
[i
].ctr
.ctr1
.other_info
->dns_name
));
259 memmove(&our_reps
[i
], &our_reps
[i
+1], (our_count
-(i
+1))*sizeof(our_reps
[0]));
267 werr
= dsdb_savereps(s
->samdb
, mem_ctx
, p
->dn
, "repsFrom", our_reps
, our_count
);
268 if (!W_ERROR_IS_OK(werr
)) {
269 DEBUG(0,(__location__
": Failed to save repsFrom to %s - %s\n",
270 ldb_dn_get_linearized(p
->dn
), ldb_errstring(s
->samdb
)));
271 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
273 /* dreplsrv should refresh its state */
274 notify_dreplsrv
= true;
277 /* remove stale repsTo entries */
279 werr
= dsdb_loadreps(s
->samdb
, mem_ctx
, p
->dn
, "repsTo", &our_reps
, &our_count
);
280 if (!W_ERROR_IS_OK(werr
)) {
281 DEBUG(0,(__location__
": Failed to load repsTo from %s - %s\n",
282 ldb_dn_get_linearized(p
->dn
), ldb_errstring(s
->samdb
)));
283 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
286 /* remove any stale ones */
287 for (i
=0; i
<our_count
; i
++) {
288 if (!reps_in_list(&our_reps
[i
], reps
, count
)) {
289 DEBUG(4,(__location__
": Removed repsTo for %s\n",
290 our_reps
[i
].ctr
.ctr1
.other_info
->dns_name
));
291 memmove(&our_reps
[i
], &our_reps
[i
+1], (our_count
-(i
+1))*sizeof(our_reps
[0]));
299 werr
= dsdb_savereps(s
->samdb
, mem_ctx
, p
->dn
, "repsTo", our_reps
, our_count
);
300 if (!W_ERROR_IS_OK(werr
)) {
301 DEBUG(0,(__location__
": Failed to save repsTo to %s - %s\n",
302 ldb_dn_get_linearized(p
->dn
), ldb_errstring(s
->samdb
)));
303 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
305 /* dreplsrv should refresh its state */
306 notify_dreplsrv
= true;
310 /* notify dreplsrv toplogy has changed */
311 if (notify_dreplsrv
) {
312 kccsrv_notify_drepl_server(s
, mem_ctx
);
321 form a unique list of DNs from a search result and a given set of attributes
323 static int kccsrv_dn_list(struct ldb_context
*ldb
, struct ldb_result
*res
,
326 struct ldb_dn
***dn_list
, int *dn_count
)
329 struct ldb_dn
**nc_list
= NULL
;
332 nc_list
= talloc_array(mem_ctx
, struct ldb_dn
*, 0);
333 if (nc_list
== NULL
) {
334 return LDB_ERR_OPERATIONS_ERROR
;
337 /* gather up a list of all NCs in this forest */
338 for (i
=0; i
<res
->count
; i
++) {
339 struct ldb_message
*msg
= res
->msgs
[i
];
341 for (j
=0; attrs
[j
]; j
++) {
342 struct ldb_message_element
*el
;
345 el
= ldb_msg_find_element(msg
, attrs
[j
]);
346 if (el
== NULL
) continue;
347 for (k
=0; k
<el
->num_values
; k
++) {
349 dn
= ldb_dn_from_ldb_val(nc_list
, ldb
, &el
->values
[k
]);
352 for (l
=0; l
<nc_count
; l
++) {
353 if (ldb_dn_compare(nc_list
[l
], dn
) == 0) break;
355 if (l
< nc_count
) continue;
356 nc_list
= talloc_realloc(mem_ctx
, nc_list
, struct ldb_dn
*, nc_count
+1);
357 if (nc_list
== NULL
) {
358 return LDB_ERR_OPERATIONS_ERROR
;
360 nc_list
[nc_count
] = dn
;
367 (*dn_list
) = nc_list
;
368 (*dn_count
) = nc_count
;
374 look for any additional global catalog partitions that we should be
375 replicating (by looking for msDS-HasDomainNCs), and add them to our
376 hasPartialReplicaNCs NTDS attribute
378 static int kccsrv_gc_update(struct kccsrv_service
*s
, struct ldb_result
*res
)
381 struct ldb_dn
**nc_list
= NULL
;
383 struct ldb_dn
**our_nc_list
= NULL
;
384 int our_nc_count
= 0;
385 const char *attrs1
[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL
};
386 const char *attrs2
[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", "hasPartialReplicaNCs", NULL
};
388 TALLOC_CTX
*tmp_ctx
= talloc_new(res
);
389 struct ldb_result
*res2
;
390 struct ldb_message
*msg
;
392 /* get a complete list of NCs for the forest */
393 ret
= kccsrv_dn_list(s
->samdb
, res
, tmp_ctx
, attrs1
, &nc_list
, &nc_count
);
394 if (ret
!= LDB_SUCCESS
) {
395 DEBUG(1,("Failed to get NC list for GC update - %s\n", ldb_errstring(s
->samdb
)));
396 talloc_free(tmp_ctx
);
400 /* get a list of what NCs we are already replicating */
401 ret
= dsdb_search_dn(s
->samdb
, tmp_ctx
, &res2
, samdb_ntds_settings_dn(s
->samdb
, tmp_ctx
), attrs2
, 0);
402 if (ret
!= LDB_SUCCESS
) {
403 DEBUG(1,("Failed to get our NC list attributes for GC update - %s\n", ldb_errstring(s
->samdb
)));
404 talloc_free(tmp_ctx
);
408 ret
= kccsrv_dn_list(s
->samdb
, res2
, tmp_ctx
, attrs2
, &our_nc_list
, &our_nc_count
);
409 if (ret
!= LDB_SUCCESS
) {
410 DEBUG(1,("Failed to get our NC list for GC update - %s\n", ldb_errstring(s
->samdb
)));
411 talloc_free(tmp_ctx
);
415 msg
= ldb_msg_new(tmp_ctx
);
417 talloc_free(tmp_ctx
);
418 return LDB_ERR_OPERATIONS_ERROR
;
420 msg
->dn
= res2
->msgs
[0]->dn
;
422 /* see if we are missing any */
423 for (i
=0; i
<nc_count
; i
++) {
425 for (j
=0; j
<our_nc_count
; j
++) {
426 if (ldb_dn_compare(nc_list
[i
], our_nc_list
[j
]) == 0) break;
428 if (j
== our_nc_count
) {
430 ret
= ldb_msg_add_string(msg
, "hasPartialReplicaNCs",
431 ldb_dn_get_extended_linearized(msg
, nc_list
[i
], 1));
432 if (ret
!= LDB_SUCCESS
) {
433 talloc_free(tmp_ctx
);
440 if (msg
->num_elements
== 0) {
442 talloc_free(tmp_ctx
);
447 DEBUG(5, ("%d partial replica should be added but we are RODC so we skip\n", msg
->num_elements
));
448 talloc_free(tmp_ctx
);
452 msg
->elements
[0].flags
= LDB_FLAG_MOD_ADD
;
454 ret
= dsdb_modify(s
->samdb
, msg
, 0);
455 if (ret
!= LDB_SUCCESS
) {
456 DEBUG(0,("Failed to add hasPartialReplicaNCs - %s\n",
457 ldb_errstring(s
->samdb
)));
460 talloc_free(tmp_ctx
);
466 this is the core of our initial simple KCC
467 We just add a repsFrom entry for all DCs we find that have nTDSDSA
468 objects, except for ourselves
470 NTSTATUS
kccsrv_simple_update(struct kccsrv_service
*s
, TALLOC_CTX
*mem_ctx
)
472 struct ldb_result
*res
;
475 const char *attrs
[] = { "objectGUID", "invocationID", "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL
};
476 struct repsFromToBlob
*reps
= NULL
;
478 struct kcc_connection_list
*ntds_conn
, *dsa_conn
;
480 ret
= dsdb_search(s
->samdb
, mem_ctx
, &res
, s
->config_dn
, LDB_SCOPE_SUBTREE
,
481 attrs
, DSDB_SEARCH_SHOW_EXTENDED_DN
, "objectClass=nTDSDSA");
482 if (ret
!= LDB_SUCCESS
) {
483 DEBUG(0,(__location__
": Failed nTDSDSA search - %s\n", ldb_errstring(s
->samdb
)));
484 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
487 if (samdb_is_gc(s
->samdb
)) {
488 kccsrv_gc_update(s
, res
);
491 /* get the current list of connections */
492 ntds_conn
= kccsrv_find_connections(s
, mem_ctx
);
494 dsa_conn
= talloc_zero(mem_ctx
, struct kcc_connection_list
);
496 for (i
=0; i
<res
->count
; i
++) {
497 struct repsFromTo1
*r1
;
498 struct GUID ntds_guid
, invocation_id
;
500 ntds_guid
= samdb_result_guid(res
->msgs
[i
], "objectGUID");
501 if (GUID_equal(&ntds_guid
, &s
->ntds_guid
)) {
502 /* don't replicate with ourselves */
506 invocation_id
= samdb_result_guid(res
->msgs
[i
], "invocationID");
508 reps
= talloc_realloc(mem_ctx
, reps
, struct repsFromToBlob
, count
+1);
509 NT_STATUS_HAVE_NO_MEMORY(reps
);
511 ZERO_STRUCT(reps
[count
]);
512 reps
[count
].version
= 1;
513 r1
= &reps
[count
].ctr
.ctr1
;
515 r1
->other_info
= talloc_zero(reps
, struct repsFromTo1OtherInfo
);
516 r1
->other_info
->dns_name
= samdb_ntds_msdcs_dns_name(s
->samdb
, reps
, &ntds_guid
);
517 r1
->source_dsa_obj_guid
= ntds_guid
;
518 r1
->source_dsa_invocation_id
= invocation_id
;
519 r1
->replica_flags
= kccsrv_replica_flags(s
);
520 memset(r1
->schedule
, 0x11, sizeof(r1
->schedule
));
522 dsa_conn
->servers
= talloc_realloc(dsa_conn
, dsa_conn
->servers
,
523 struct kcc_connection
,
524 dsa_conn
->count
+ 1);
525 NT_STATUS_HAVE_NO_MEMORY(dsa_conn
->servers
);
526 dsa_conn
->servers
[dsa_conn
->count
].dsa_guid
= r1
->source_dsa_obj_guid
;
532 kccsrv_apply_connections(s
, ntds_conn
, dsa_conn
);
534 return kccsrv_add_repsFrom(s
, mem_ctx
, reps
, count
, res
);
538 static void kccsrv_periodic_run(struct kccsrv_service
*service
);
540 static void kccsrv_periodic_handler_te(struct tevent_context
*ev
, struct tevent_timer
*te
,
541 struct timeval t
, void *ptr
)
543 struct kccsrv_service
*service
= talloc_get_type(ptr
, struct kccsrv_service
);
546 service
->periodic
.te
= NULL
;
548 kccsrv_periodic_run(service
);
550 status
= kccsrv_periodic_schedule(service
, service
->periodic
.interval
);
551 if (!W_ERROR_IS_OK(status
)) {
552 task_server_terminate(service
->task
, win_errstr(status
), true);
557 WERROR
kccsrv_periodic_schedule(struct kccsrv_service
*service
, uint32_t next_interval
)
560 struct tevent_timer
*new_te
;
561 struct timeval next_time
;
563 /* prevent looping */
564 if (next_interval
== 0) next_interval
= 1;
566 next_time
= timeval_current_ofs(next_interval
, 50);
568 if (service
->periodic
.te
) {
570 * if the timestamp of the new event is higher,
571 * as current next we don't need to reschedule
573 if (timeval_compare(&next_time
, &service
->periodic
.next_event
) > 0) {
578 /* reset the next scheduled timestamp */
579 service
->periodic
.next_event
= next_time
;
581 new_te
= tevent_add_timer(service
->task
->event_ctx
, service
,
582 service
->periodic
.next_event
,
583 kccsrv_periodic_handler_te
, service
);
584 W_ERROR_HAVE_NO_MEMORY(new_te
);
586 tmp_mem
= talloc_new(service
);
587 DEBUG(4,("kccsrv_periodic_schedule(%u) %sscheduled for: %s\n",
589 (service
->periodic
.te
?"re":""),
590 nt_time_string(tmp_mem
, timeval_to_nttime(&next_time
))));
591 talloc_free(tmp_mem
);
593 talloc_free(service
->periodic
.te
);
594 service
->periodic
.te
= new_te
;
599 static void kccsrv_periodic_run(struct kccsrv_service
*service
)
604 DEBUG(4,("kccsrv_periodic_run(): update\n"));
606 mem_ctx
= talloc_new(service
);
608 if (service
->samba_kcc_code
)
609 status
= kccsrv_samba_kcc(service
, mem_ctx
);
611 status
= kccsrv_simple_update(service
, mem_ctx
);
612 if (!NT_STATUS_IS_OK(status
))
613 DEBUG(0,("kccsrv_simple_update failed - %s\n",
617 status
= kccsrv_check_deleted(service
, mem_ctx
);
618 if (!NT_STATUS_IS_OK(status
)) {
619 DEBUG(0,("kccsrv_check_deleted failed - %s\n", nt_errstr(status
)));
621 talloc_free(mem_ctx
);
624 /* Called when samba_kcc script has finished
626 static void samba_kcc_done(struct tevent_req
*subreq
)
628 struct kccsrv_service
*service
=
629 tevent_req_callback_data(subreq
, struct kccsrv_service
);
633 service
->periodic
.subreq
= NULL
;
635 rc
= samba_runcmd_recv(subreq
, &sys_errno
);
639 service
->periodic
.status
=
640 map_nt_error_from_unix_common(sys_errno
);
642 service
->periodic
.status
= NT_STATUS_OK
;
644 if (!NT_STATUS_IS_OK(service
->periodic
.status
))
645 DEBUG(0,(__location__
": Failed samba_kcc - %s\n",
646 nt_errstr(service
->periodic
.status
)));
648 DEBUG(3,("Completed samba_kcc OK\n"));
651 /* Invocation of the samba_kcc python script for replication
652 * topology generation.
654 NTSTATUS
kccsrv_samba_kcc(struct kccsrv_service
*service
,
657 NTSTATUS status
= NT_STATUS_OK
;
658 const char * const *samba_kcc_command
=
659 lpcfg_samba_kcc_command(service
->task
->lp_ctx
);
661 /* kill any existing child */
662 TALLOC_FREE(service
->periodic
.subreq
);
664 DEBUG(2, ("Calling samba_kcc script\n"));
665 service
->periodic
.subreq
= samba_runcmd_send(service
,
666 service
->task
->event_ctx
,
667 timeval_current_ofs(40, 0),
668 2, 0, samba_kcc_command
, NULL
);
670 if (service
->periodic
.subreq
== NULL
) {
671 status
= NT_STATUS_NO_MEMORY
;
674 tevent_req_set_callback(service
->periodic
.subreq
,
675 samba_kcc_done
, service
);
678 if (!NT_STATUS_IS_OK(status
))
679 DEBUG(0,(__location__
": failed - %s\n", nt_errstr(status
)));