2 Unix SMB/CIFS implementation.
4 implement the DRSUpdateRefs call
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "param/param.h"
27 #include "librpc/gen_ndr/ndr_drsblobs.h"
28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
29 #include "rpc_server/dcerpc_server_proto.h"
30 #include "../libcli/drsuapi/drsuapi.h"
31 #include "libcli/security/security.h"
34 drsuapi_DsGetNCChanges for one object
36 static WERROR
get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx
*obj
,
37 struct ldb_message
*msg
,
38 struct ldb_context
*sam_ctx
,
39 struct ldb_dn
*ncRoot_dn
,
40 struct dsdb_schema
*schema
,
41 DATA_BLOB
*session_key
,
43 uint32_t replica_flags
)
45 const struct ldb_val
*md_value
;
47 struct ldb_dn
*obj_dn
;
48 struct replPropertyMetaDataBlob md
;
51 enum ndr_err_code ndr_err
;
54 const struct dsdb_attribute
*rdn_sa
;
56 if (ldb_dn_compare(ncRoot_dn
, msg
->dn
) == 0) {
57 obj
->is_nc_prefix
= true;
58 obj
->parent_object_guid
= NULL
;
60 obj
->is_nc_prefix
= false;
61 obj
->parent_object_guid
= talloc(obj
, struct GUID
);
62 if (obj
->parent_object_guid
== NULL
) {
63 return WERR_DS_DRA_INTERNAL_ERROR
;
65 *obj
->parent_object_guid
= samdb_result_guid(msg
, "parentGUID");
66 if (GUID_all_zero(obj
->parent_object_guid
)) {
67 DEBUG(0,(__location__
": missing parentGUID for %s\n",
68 ldb_dn_get_linearized(msg
->dn
)));
69 return WERR_DS_DRA_INTERNAL_ERROR
;
72 obj
->next_object
= NULL
;
74 md_value
= ldb_msg_find_ldb_val(msg
, "replPropertyMetaData");
80 ndr_err
= ndr_pull_struct_blob(md_value
, obj
,
81 lp_iconv_convenience(ldb_get_opaque(sam_ctx
, "loadparm")), &md
,
82 (ndr_pull_flags_fn_t
)ndr_pull_replPropertyMetaDataBlob
);
83 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
84 return WERR_DS_DRA_INTERNAL_ERROR
;
87 if (md
.version
!= 1) {
88 return WERR_DS_DRA_INTERNAL_ERROR
;
91 rdn
= ldb_dn_get_rdn_name(msg
->dn
);
93 DEBUG(0,(__location__
": No rDN for %s\n", ldb_dn_get_linearized(msg
->dn
)));
94 return WERR_DS_DRA_INTERNAL_ERROR
;
97 rdn_sa
= dsdb_attribute_by_lDAPDisplayName(schema
, rdn
);
99 DEBUG(0,(__location__
": Can't find dsds_attribute for rDN %s in %s\n",
100 rdn
, ldb_dn_get_linearized(msg
->dn
)));
101 return WERR_DS_DRA_INTERNAL_ERROR
;
104 obj
->meta_data_ctr
= talloc(obj
, struct drsuapi_DsReplicaMetaDataCtr
);
105 attids
= talloc_array(obj
, uint32_t, md
.ctr
.ctr1
.count
);
107 obj
->object
.identifier
= talloc(obj
, struct drsuapi_DsReplicaObjectIdentifier
);
108 obj_dn
= ldb_msg_find_attr_as_dn(sam_ctx
, obj
, msg
, "distinguishedName");
109 obj
->object
.identifier
->dn
= ldb_dn_get_linearized(obj_dn
);
110 obj
->object
.identifier
->guid
= samdb_result_guid(msg
, "objectGUID");
111 sid
= samdb_result_dom_sid(obj
, msg
, "objectSid");
113 dom_sid_split_rid(NULL
, sid
, NULL
, &rid
);
114 obj
->object
.identifier
->sid
= *sid
;
116 ZERO_STRUCT(obj
->object
.identifier
->sid
);
119 obj
->meta_data_ctr
->meta_data
= talloc_array(obj
, struct drsuapi_DsReplicaMetaData
, md
.ctr
.ctr1
.count
);
120 for (n
=i
=0; i
<md
.ctr
.ctr1
.count
; i
++) {
121 /* if the attribute has not changed, and it is not the
122 instanceType then don't include it */
123 if (md
.ctr
.ctr1
.array
[i
].local_usn
< highest_usn
&&
124 md
.ctr
.ctr1
.array
[i
].attid
!= DRSUAPI_ATTRIBUTE_instanceType
) continue;
126 /* don't include the rDN */
127 if (md
.ctr
.ctr1
.array
[i
].attid
== rdn_sa
->attributeID_id
) continue;
129 obj
->meta_data_ctr
->meta_data
[n
].originating_change_time
= md
.ctr
.ctr1
.array
[i
].originating_change_time
;
130 obj
->meta_data_ctr
->meta_data
[n
].version
= md
.ctr
.ctr1
.array
[i
].version
;
131 obj
->meta_data_ctr
->meta_data
[n
].originating_invocation_id
= md
.ctr
.ctr1
.array
[i
].originating_invocation_id
;
132 obj
->meta_data_ctr
->meta_data
[n
].originating_usn
= md
.ctr
.ctr1
.array
[i
].originating_usn
;
133 attids
[n
] = md
.ctr
.ctr1
.array
[i
].attid
;
138 note that if n==0 we still need to send the change, as it
139 could be a rename, which changes the uSNChanged, but not any
140 of the replicated attributes
143 obj
->meta_data_ctr
->count
= n
;
145 obj
->object
.flags
= DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER
;
146 obj
->object
.attribute_ctr
.num_attributes
= obj
->meta_data_ctr
->count
;
147 obj
->object
.attribute_ctr
.attributes
= talloc_array(obj
, struct drsuapi_DsReplicaAttribute
,
148 obj
->object
.attribute_ctr
.num_attributes
);
151 * Note that the meta_data array and the attributes array must
152 * be the same size and in the same order
154 for (i
=0; i
<obj
->object
.attribute_ctr
.num_attributes
; i
++) {
155 struct ldb_message_element
*el
;
157 const struct dsdb_attribute
*sa
;
159 sa
= dsdb_attribute_by_attributeID_id(schema
, attids
[i
]);
161 DEBUG(0,("Unable to find attributeID %u in schema\n", attids
[i
]));
162 return WERR_DS_DRA_INTERNAL_ERROR
;
165 el
= ldb_msg_find_element(msg
, sa
->lDAPDisplayName
);
167 /* this happens for attributes that have been removed */
168 DEBUG(5,("No element '%s' for attributeID %u in message\n",
169 sa
->lDAPDisplayName
, attids
[i
]));
170 ZERO_STRUCT(obj
->object
.attribute_ctr
.attributes
[i
]);
171 obj
->object
.attribute_ctr
.attributes
[i
].attid
= attids
[i
];
173 werr
= dsdb_attribute_ldb_to_drsuapi(sam_ctx
, schema
, el
, obj
,
174 &obj
->object
.attribute_ctr
.attributes
[i
]);
175 if (!W_ERROR_IS_OK(werr
)) {
176 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
177 sa
->lDAPDisplayName
, win_errstr(werr
)));
180 /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
181 * check if attribute is secret and send a null value
183 if (replica_flags
& DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING
) {
184 drsuapi_process_secret_attribute(&obj
->object
.attribute_ctr
.attributes
[i
],
185 &obj
->meta_data_ctr
->meta_data
[i
]);
187 /* some attributes needs to be encrypted
189 werr
= drsuapi_encrypt_attribute(obj
, session_key
, rid
,
190 &obj
->object
.attribute_ctr
.attributes
[i
]);
191 if (!W_ERROR_IS_OK(werr
)) {
192 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
193 sa
->lDAPDisplayName
, win_errstr(werr
)));
203 load replUpToDateVector from a DN
205 static WERROR
load_udv(struct ldb_context
*sam_ctx
, TALLOC_CTX
*mem_ctx
,
206 struct ldb_dn
*dn
, struct replUpToDateVectorBlob
*ouv
)
208 const char *attrs
[] = { "replUpToDateVector", NULL
};
209 struct ldb_result
*res
= NULL
;
210 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
211 struct ldb_message_element
*el
;
212 enum ndr_err_code ndr_err
;
216 if (ldb_search(sam_ctx
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, NULL
) != LDB_SUCCESS
||
218 DEBUG(0,("load_udv: failed to read partition object\n"));
219 talloc_free(tmp_ctx
);
220 return WERR_DS_DRA_INTERNAL_ERROR
;
223 el
= ldb_msg_find_element(res
->msgs
[0], "replUpToDateVector");
224 if (el
== NULL
|| el
->num_values
< 1) {
225 talloc_free(tmp_ctx
);
230 ndr_err
= ndr_pull_struct_blob(&el
->values
[0],
231 mem_ctx
, lp_iconv_convenience(ldb_get_opaque(sam_ctx
, "loadparm")),
233 (ndr_pull_flags_fn_t
)ndr_pull_replUpToDateVectorBlob
);
234 talloc_free(tmp_ctx
);
235 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
236 DEBUG(0,(__location__
": Failed to parse replUpToDateVector for %s\n",
237 ldb_dn_get_linearized(dn
)));
238 return WERR_DS_DRA_INTERNAL_ERROR
;
246 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
248 static WERROR
get_nc_changes_udv(struct ldb_context
*sam_ctx
,
249 struct ldb_dn
*ncRoot_dn
,
250 struct drsuapi_DsReplicaCursor2CtrEx
*udv
,
254 struct drsuapi_DsReplicaCursor2
*tmp_cursor
;
256 time_t t
= time(NULL
);
257 struct replUpToDateVectorBlob ouv
;
259 werr
= load_udv(sam_ctx
, udv
, ncRoot_dn
, &ouv
);
260 if (!W_ERROR_IS_OK(werr
)) {
264 tmp_cursor
= talloc(udv
, struct drsuapi_DsReplicaCursor2
);
265 tmp_cursor
->source_dsa_invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
266 tmp_cursor
->highest_usn
= highestUSN
;
267 unix_to_nt_time(&now
, t
);
268 tmp_cursor
->last_sync_success
= now
;
270 udv
->count
= ouv
.ctr
.ctr2
.count
+ 1;
271 udv
->cursors
= talloc_steal(udv
, ouv
.ctr
.ctr2
.cursors
);
272 udv
->cursors
= talloc_realloc(udv
, udv
->cursors
, struct drsuapi_DsReplicaCursor2
, udv
->count
);
274 return WERR_DS_DRA_INTERNAL_ERROR
;
276 udv
->cursors
[udv
->count
- 1] = *tmp_cursor
;
278 qsort(udv
->cursors
, udv
->count
,
279 sizeof(struct drsuapi_DsReplicaCursor2
),
280 (comparison_fn_t
)drsuapi_DsReplicaCursor2_compare
);
285 /* state of a partially completed getncchanges call */
286 struct drsuapi_getncchanges_state
{
287 struct ldb_result
*site_res
;
289 struct ldb_dn
*ncRoot_dn
;
291 uint64_t highest_usn
;
295 drsuapi_DsGetNCChanges
297 see MS-DRSR 4.1.10.5.2 for basic logic of this function
299 WERROR
dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
300 struct drsuapi_DsGetNCChanges
*r
)
302 struct drsuapi_DsReplicaObjectIdentifier
*ncRoot
;
305 struct dsdb_schema
*schema
;
306 struct drsuapi_DsReplicaOIDMapping_Ctr
*ctr
;
307 struct drsuapi_DsReplicaObjectListItemEx
**currentObject
;
309 DATA_BLOB session_key
;
310 const char *attrs
[] = { "*", "distinguishedName",
311 "nTSecurityDescriptor",
313 "replPropertyMetaData",
318 "supplementalCredentials",
321 struct dcesrv_handle
*h
;
322 struct drsuapi_bind_state
*b_state
;
323 struct drsuapi_getncchanges_state
*getnc_state
;
324 struct drsuapi_DsGetNCChangesRequest8
*req8
;
327 DCESRV_PULL_HANDLE_WERR(h
, r
->in
.bind_handle
, DRSUAPI_BIND_HANDLE
);
330 *r
->out
.level_out
= 6;
331 /* TODO: linked attributes*/
332 r
->out
.ctr
->ctr6
.linked_attributes_count
= 0;
333 r
->out
.ctr
->ctr6
.linked_attributes
= NULL
;
335 r
->out
.ctr
->ctr6
.object_count
= 0;
336 r
->out
.ctr
->ctr6
.nc_object_count
= 0;
337 r
->out
.ctr
->ctr6
.more_data
= false;
338 r
->out
.ctr
->ctr6
.uptodateness_vector
= NULL
;
340 /* a RODC doesn't allow for any replication */
341 if (samdb_rodc(ldb_get_opaque(b_state
->sam_ctx
, "loadparm"))) {
342 DEBUG(0,(__location__
": DsGetNCChanges attempt on RODC\n"));
343 return WERR_DS_DRA_SOURCE_DISABLED
;
346 /* Check request revision.
347 TODO: Adding mappings to req8 from the other levels
349 if (r
->in
.level
!= 8) {
350 DEBUG(0,(__location__
": Request for DsGetNCChanges with unsupported level %u\n",
352 return WERR_REVISION_MISMATCH
;
355 req8
= &r
->in
.req
->req8
;
357 /* Perform access checks. */
358 /* TODO: we need to support a sync on a specific non-root
359 * DN. We'll need to find the real partition root here */
360 ncRoot
= req8
->naming_context
;
361 if (ncRoot
== NULL
) {
362 DEBUG(0,(__location__
": Request for DsGetNCChanges with no NC\n"));
363 return WERR_DS_DRA_INVALID_PARAMETER
;
366 if (samdb_ntds_options(b_state
->sam_ctx
, &options
) != LDB_SUCCESS
) {
367 return WERR_DS_DRA_INTERNAL_ERROR
;
370 if ((options
& DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL
) &&
371 !(req8
->replica_flags
& DRSUAPI_DRS_SYNC_FORCED
)) {
372 return WERR_DS_DRA_SOURCE_DISABLED
;
376 if (req8
->replica_flags
& DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET
) {
377 /* Ignore the _in_ uptpdateness vector*/
378 req8
->uptodateness_vector
= NULL
;
381 werr
= drs_security_level_check(dce_call
, "DsGetNCChanges");
382 if (!W_ERROR_IS_OK(werr
)) {
386 getnc_state
= b_state
->getncchanges_state
;
388 /* see if a previous replication has been abandoned */
390 struct ldb_dn
*new_dn
= ldb_dn_new(getnc_state
, b_state
->sam_ctx
, ncRoot
->dn
);
391 if (ldb_dn_compare(new_dn
, getnc_state
->ncRoot_dn
) != 0) {
392 DEBUG(0,(__location__
": DsGetNCChanges 2nd replication on different DN %s %s\n",
393 ldb_dn_get_linearized(new_dn
),
394 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
)));
395 talloc_free(getnc_state
);
400 if (getnc_state
== NULL
) {
401 getnc_state
= talloc_zero(b_state
, struct drsuapi_getncchanges_state
);
402 if (getnc_state
== NULL
) {
405 b_state
->getncchanges_state
= getnc_state
;
406 getnc_state
->ncRoot_dn
= ldb_dn_new(getnc_state
, b_state
->sam_ctx
, ncRoot
->dn
);
409 if (!ldb_dn_validate(getnc_state
->ncRoot_dn
) ||
410 ldb_dn_is_null(getnc_state
->ncRoot_dn
)) {
411 DEBUG(0,(__location__
": Bad DN '%s'\n", ncRoot
->dn
));
412 return WERR_DS_DRA_INVALID_PARAMETER
;
415 /* we need the session key for encrypting password attributes */
416 status
= dcesrv_inherited_session_key(dce_call
->conn
, &session_key
);
417 if (!NT_STATUS_IS_OK(status
)) {
418 DEBUG(0,(__location__
": Failed to get session key\n"));
419 return WERR_DS_DRA_INTERNAL_ERROR
;
422 /* we don't yet support extended operations */
423 if (req8
->extended_op
!= DRSUAPI_EXOP_NONE
) {
424 DEBUG(0,(__location__
": Request for DsGetNCChanges extended op 0x%x\n",
425 (unsigned)req8
->extended_op
));
426 return WERR_DS_DRA_NOT_SUPPORTED
;
430 TODO: MS-DRSR section 4.1.10.1.1
431 Work out if this is the start of a new cycle */
433 if (getnc_state
->site_res
== NULL
) {
435 enum ldb_scope scope
= LDB_SCOPE_SUBTREE
;
437 getnc_state
->min_usn
= req8
->highwatermark
.highest_usn
;
439 /* Construct response. */
440 search_filter
= talloc_asprintf(mem_ctx
,
441 "(uSNChanged>=%llu)",
442 (unsigned long long)(getnc_state
->min_usn
+1));
444 if (req8
->replica_flags
& DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY
) {
445 search_filter
= talloc_asprintf(mem_ctx
,
446 "(&%s(isCriticalSystemObject=TRUE))",
450 if (req8
->replica_flags
& DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP
) {
451 scope
= LDB_SCOPE_BASE
;
454 DEBUG(6,(__location__
": getncchanges on %s using filter %s\n",
455 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
), search_filter
));
456 ret
= drsuapi_search_with_extended_dn(b_state
->sam_ctx
, getnc_state
, &getnc_state
->site_res
,
457 getnc_state
->ncRoot_dn
, scope
, attrs
,
460 if (ret
!= LDB_SUCCESS
) {
461 return WERR_DS_DRA_INTERNAL_ERROR
;
466 schema
= dsdb_get_schema(b_state
->sam_ctx
);
468 DEBUG(0,("No schema in sam_ctx\n"));
469 return WERR_DS_DRA_INTERNAL_ERROR
;
472 r
->out
.ctr
->ctr6
.naming_context
= talloc(mem_ctx
, struct drsuapi_DsReplicaObjectIdentifier
);
473 *r
->out
.ctr
->ctr6
.naming_context
= *ncRoot
;
475 if (dsdb_find_guid_by_dn(b_state
->sam_ctx
, getnc_state
->ncRoot_dn
,
476 &r
->out
.ctr
->ctr6
.naming_context
->guid
) != LDB_SUCCESS
) {
477 DEBUG(0,(__location__
": Failed to find GUID of ncRoot_dn %s\n",
478 ldb_dn_get_linearized(getnc_state
->ncRoot_dn
)));
479 return WERR_DS_DRA_INTERNAL_ERROR
;
482 /* find the SID if there is one */
483 dsdb_find_sid_by_dn(b_state
->sam_ctx
, getnc_state
->ncRoot_dn
, &r
->out
.ctr
->ctr6
.naming_context
->sid
);
485 dsdb_get_oid_mappings_drsuapi(schema
, true, mem_ctx
, &ctr
);
486 r
->out
.ctr
->ctr6
.mapping_ctr
= *ctr
;
488 r
->out
.ctr
->ctr6
.source_dsa_guid
= *(samdb_ntds_objectGUID(b_state
->sam_ctx
));
489 r
->out
.ctr
->ctr6
.source_dsa_invocation_id
= *(samdb_ntds_invocation_id(b_state
->sam_ctx
));
491 r
->out
.ctr
->ctr6
.old_highwatermark
= req8
->highwatermark
;
492 r
->out
.ctr
->ctr6
.new_highwatermark
= req8
->highwatermark
;
494 r
->out
.ctr
->ctr6
.first_object
= NULL
;
495 currentObject
= &r
->out
.ctr
->ctr6
.first_object
;
497 for(i
=getnc_state
->num_sent
;
498 i
<getnc_state
->site_res
->count
&&
499 (r
->out
.ctr
->ctr6
.object_count
< req8
->max_object_count
);
502 struct drsuapi_DsReplicaObjectListItemEx
*obj
;
503 obj
= talloc_zero(mem_ctx
, struct drsuapi_DsReplicaObjectListItemEx
);
505 uSN
= ldb_msg_find_attr_as_int(getnc_state
->site_res
->msgs
[i
], "uSNChanged", -1);
506 if (uSN
> r
->out
.ctr
->ctr6
.new_highwatermark
.tmp_highest_usn
) {
507 r
->out
.ctr
->ctr6
.new_highwatermark
.tmp_highest_usn
= uSN
;
509 if (uSN
> getnc_state
->highest_usn
) {
510 getnc_state
->highest_usn
= uSN
;
513 werr
= get_nc_changes_build_object(obj
, getnc_state
->site_res
->msgs
[i
],
514 b_state
->sam_ctx
, getnc_state
->ncRoot_dn
,
515 schema
, &session_key
, getnc_state
->min_usn
,
516 req8
->replica_flags
);
517 if (!W_ERROR_IS_OK(werr
)) {
521 if (obj
->meta_data_ctr
== NULL
) {
522 DEBUG(0,(__location__
": getncchanges skipping send of object %s\n",
523 ldb_dn_get_linearized(getnc_state
->site_res
->msgs
[i
]->dn
)));
524 /* no attributes to send */
529 r
->out
.ctr
->ctr6
.object_count
++;
531 *currentObject
= obj
;
532 currentObject
= &obj
->next_object
;
535 getnc_state
->num_sent
+= r
->out
.ctr
->ctr6
.object_count
;
537 r
->out
.ctr
->ctr6
.nc_object_count
= getnc_state
->site_res
->count
;
539 /* the client can us to call UpdateRefs on its behalf to
540 re-establish monitoring of the NC */
541 if ((req8
->replica_flags
& DRSUAPI_DRS_ADD_REF
) &&
542 !GUID_all_zero(&req8
->destination_dsa_guid
)) {
543 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq
;
544 ureq
.naming_context
= ncRoot
;
545 ureq
.dest_dsa_dns_name
= talloc_asprintf(mem_ctx
, "%s._msdcs.%s",
546 GUID_string(mem_ctx
, &req8
->destination_dsa_guid
),
547 lp_realm(dce_call
->conn
->dce_ctx
->lp_ctx
));
548 if (!ureq
.dest_dsa_dns_name
) {
551 ureq
.dest_dsa_guid
= req8
->destination_dsa_guid
;
552 ureq
.options
= DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
|
553 DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
|
554 DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK
;
555 werr
= drsuapi_UpdateRefs(b_state
, mem_ctx
, &ureq
);
556 if (!W_ERROR_IS_OK(werr
)) {
557 DEBUG(0,(__location__
": Failed UpdateRefs in DsGetNCChanges - %s\n",
562 if (i
< getnc_state
->site_res
->count
) {
563 r
->out
.ctr
->ctr6
.more_data
= true;
565 r
->out
.ctr
->ctr6
.uptodateness_vector
= talloc(mem_ctx
, struct drsuapi_DsReplicaCursor2CtrEx
);
566 r
->out
.ctr
->ctr6
.uptodateness_vector
->version
= 2;
567 r
->out
.ctr
->ctr6
.uptodateness_vector
->reserved1
= 0;
568 r
->out
.ctr
->ctr6
.uptodateness_vector
->reserved2
= 0;
570 r
->out
.ctr
->ctr6
.new_highwatermark
.highest_usn
= r
->out
.ctr
->ctr6
.new_highwatermark
.tmp_highest_usn
;
572 werr
= get_nc_changes_udv(b_state
->sam_ctx
, getnc_state
->ncRoot_dn
,
573 r
->out
.ctr
->ctr6
.uptodateness_vector
,
574 getnc_state
->highest_usn
);
575 if (!W_ERROR_IS_OK(werr
)) {
579 talloc_free(getnc_state
);
580 b_state
->getncchanges_state
= NULL
;
583 DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d)\n",
584 (unsigned long long)(req8
->highwatermark
.highest_usn
+1),
586 ncRoot
->dn
, r
->out
.ctr
->ctr6
.object_count
,
587 i
, r
->out
.ctr
->ctr6
.more_data
?getnc_state
->site_res
->count
:i
));