?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:drsuapi: check the source_dsa_invocation_id (bug #9508)
[Samba/gebeck_regimport.git] / source4 / rpc_server / drsuapi / getncchanges.c
blob10965a3e812617b027b828cd658b3d99b7ddca6a
1 /*
2 Unix SMB/CIFS implementation.
3
4 implement the DSGetNCChanges call
5
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "param/param.h"
27 #include "librpc/gen_ndr/ndr_drsblobs.h"
28 #include "librpc/gen_ndr/ndr_drsuapi.h"
29 #include "librpc/gen_ndr/ndr_security.h"
30 #include "libcli/security/security.h"
31 #include "libcli/security/session.h"
32 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
33 #include "rpc_server/dcerpc_server_proto.h"
34 #include "../libcli/drsuapi/drsuapi.h"
35 #include "lib/util/binsearch.h"
36 #include "lib/util/tsort.h"
37 #include "auth/session.h"
38 #include "dsdb/common/util.h"
39
40 /* state of a partially completed getncchanges call */
41 struct drsuapi_getncchanges_state {
42 struct GUID *guids;
43 uint32_t num_records;
44 uint32_t num_processed;
45 struct ldb_dn *ncRoot_dn;
46 bool is_schema_nc;
47 uint64_t min_usn;
48 struct drsuapi_DsReplicaHighWaterMark last_hwm;
49 struct ldb_dn *last_dn;
50 struct drsuapi_DsReplicaLinkedAttribute *la_list;
51 uint32_t la_count;
52 bool la_sorted;
53 uint32_t la_idx;
54 };
55
56 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
57 const struct drsuapi_DsReplicaHighWaterMark *h2)
58 {
59 if (h1->highest_usn < h2->highest_usn) {
60 return -1;
61 } else if (h1->highest_usn > h2->highest_usn) {
62 return 1;
63 } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
64 return -1;
65 } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
66 return 1;
67 } else if (h1->reserved_usn < h2->reserved_usn) {
68 return -1;
69 } else if (h1->reserved_usn > h2->reserved_usn) {
70 return 1;
71 }
72
73 return 0;
74 }
75
76 /*
77 build a DsReplicaObjectIdentifier from a ldb msg
78 */
79 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
80 struct ldb_message *msg)
81 {
82 struct drsuapi_DsReplicaObjectIdentifier *identifier;
83 struct dom_sid *sid;
84
85 identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
86 if (identifier == NULL) {
87 return NULL;
88 }
89
90 identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
91 identifier->guid = samdb_result_guid(msg, "objectGUID");
92
93 sid = samdb_result_dom_sid(identifier, msg, "objectSid");
94 if (sid) {
95 identifier->sid = *sid;
96 } else {
97 ZERO_STRUCT(identifier->sid);
98 }
99 return identifier;
100 }
101
102 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
103 {
104 return GUID_compare(guid1, &guid2);
105 }
106
107 /*
108 see if we can filter an attribute using the uptodateness_vector
109 */
110 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
111 const struct GUID *originating_invocation_id,
112 uint64_t originating_usn)
113 {
114 const struct drsuapi_DsReplicaCursor *c;
115 if (udv == NULL) return false;
116 BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
117 originating_invocation_id, udv_compare, c);
118 if (c && originating_usn <= c->highest_usn) {
119 return true;
120 }
121 return false;
122
123 }
124
125 static int attid_cmp(enum drsuapi_DsAttributeId a1, enum drsuapi_DsAttributeId a2)
126 {
127 if (a1 == a2) return 0;
128 return ((uint32_t)a1) > ((uint32_t)a2) ? 1 : -1;
129 }
130
131 /*
132 check if an attribute is in a partial_attribute_set
133 */
134 static bool check_partial_attribute_set(const struct dsdb_attribute *sa,
135 struct drsuapi_DsPartialAttributeSet *pas)
136 {
137 enum drsuapi_DsAttributeId *result;
138 BINARY_ARRAY_SEARCH_V(pas->attids, pas->num_attids, (enum drsuapi_DsAttributeId)sa->attributeID_id,
139 attid_cmp, result);
140 return result != NULL;
141 }
142
143
144 /*
145 drsuapi_DsGetNCChanges for one object
146 */
147 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
148 struct ldb_message *msg,
149 struct ldb_context *sam_ctx,
150 struct ldb_dn *ncRoot_dn,
151 bool is_schema_nc,
152 struct dsdb_schema *schema,
153 DATA_BLOB *session_key,
154 uint64_t highest_usn,
155 uint32_t replica_flags,
156 struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
157 struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
158 enum drsuapi_DsExtendedOperation extended_op,
159 bool force_object_return)
160 {
161 const struct ldb_val *md_value;
162 uint32_t i, n;
163 struct replPropertyMetaDataBlob md;
164 uint32_t rid = 0;
165 enum ndr_err_code ndr_err;
166 uint32_t *attids;
167 const char *rdn;
168 const struct dsdb_attribute *rdn_sa;
169 unsigned int instanceType;
170 struct dsdb_syntax_ctx syntax_ctx;
171
172 /* make dsdb sytanx context for conversions */
173 dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
174 syntax_ctx.is_schema_nc = is_schema_nc;
175
176 instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
177 if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
178 obj->is_nc_prefix = true;
179 obj->parent_object_guid = NULL;
180 } else {
181 obj->is_nc_prefix = false;
182 obj->parent_object_guid = talloc(obj, struct GUID);
183 if (obj->parent_object_guid == NULL) {
184 return WERR_DS_DRA_INTERNAL_ERROR;
185 }
186 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
187 if (GUID_all_zero(obj->parent_object_guid)) {
188 DEBUG(0,(__location__ ": missing parentGUID for %s\n",
189 ldb_dn_get_linearized(msg->dn)));
190 return WERR_DS_DRA_INTERNAL_ERROR;
191 }
192 }
193 obj->next_object = NULL;
194
195 md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
196 if (!md_value) {
197 /* nothing to send */
198 return WERR_OK;
199 }
200
201 if (instanceType & INSTANCE_TYPE_UNINSTANT) {
202 /* don't send uninstantiated objects */
203 return WERR_OK;
204 }
205
206 ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
207 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
208 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
209 return WERR_DS_DRA_INTERNAL_ERROR;
210 }
211
212 if (md.version != 1) {
213 return WERR_DS_DRA_INTERNAL_ERROR;
214 }
215
216 rdn = ldb_dn_get_rdn_name(msg->dn);
217 if (rdn == NULL) {
218 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
219 return WERR_DS_DRA_INTERNAL_ERROR;
220 }
221
222 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
223 if (rdn_sa == NULL) {
224 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
225 rdn, ldb_dn_get_linearized(msg->dn)));
226 return WERR_DS_DRA_INTERNAL_ERROR;
227 }
228
229 obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
230 attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
231
232 obj->object.identifier = get_object_identifier(obj, msg);
233 if (obj->object.identifier == NULL) {
234 return WERR_NOMEM;
235 }
236 dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
237
238 obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
239 for (n=i=0; i<md.ctr.ctr1.count; i++) {
240 const struct dsdb_attribute *sa;
241 bool force_attribute = false;
242
243 /* if the attribute has not changed, and it is not the
244 instanceType then don't include it */
245 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
246 extended_op != DRSUAPI_EXOP_REPL_SECRET &&
247 md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
248
249 /* don't include the rDN */
250 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
251
252 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
253 if (!sa) {
254 DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
255 (unsigned int)md.ctr.ctr1.array[i].attid,
256 ldb_dn_get_linearized(msg->dn)));
257 return WERR_DS_DRA_INTERNAL_ERROR;
258 }
259
260 if (sa->linkID) {
261 struct ldb_message_element *el;
262 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
263 if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
264 /* don't send upgraded links inline */
265 continue;
266 }
267 }
268
269 if (extended_op == DRSUAPI_EXOP_REPL_SECRET &&
270 !dsdb_attr_in_rodc_fas(sa)) {
271 force_attribute = true;
272 DEBUG(4,("Forcing attribute %s in %s\n",
273 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
274 }
275
276 /* filter by uptodateness_vector */
277 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
278 !force_attribute &&
279 udv_filter(uptodateness_vector,
280 &md.ctr.ctr1.array[i].originating_invocation_id,
281 md.ctr.ctr1.array[i].originating_usn)) {
282 continue;
283 }
284
285 /* filter by partial_attribute_set */
286 if (partial_attribute_set && !check_partial_attribute_set(sa, partial_attribute_set)) {
287 continue;
288 }
289
290 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
291 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
292 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
293 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
294 attids[n] = md.ctr.ctr1.array[i].attid;
295 n++;
296 }
297
298 /* ignore it if its an empty change. Note that renames always
299 * change the 'name' attribute, so they won't be ignored by
300 * this
301
302 * the force_object_return check is used to force an empty
303 * object return when we timeout in the getncchanges loop.
304 * This allows us to return an empty object, which keeps the
305 * client happy while preventing timeouts
306 */
307 if (n == 0 ||
308 (n == 1 &&
309 attids[0] == DRSUAPI_ATTID_instanceType &&
310 !force_object_return)) {
311 talloc_free(obj->meta_data_ctr);
312 obj->meta_data_ctr = NULL;
313 return WERR_OK;
314 }
315
316 obj->meta_data_ctr->count = n;
317
318 obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
319 obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
320 obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
321 obj->object.attribute_ctr.num_attributes);
322 if (obj->object.attribute_ctr.attributes == NULL) {
323 return WERR_NOMEM;
324 }
325
326 /*
327 * Note that the meta_data array and the attributes array must
328 * be the same size and in the same order
329 */
330 for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
331 struct ldb_message_element *el;
332 WERROR werr;
333 const struct dsdb_attribute *sa;
334
335 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
336 if (!sa) {
337 DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
338 return WERR_DS_DRA_INTERNAL_ERROR;
339 }
340
341 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
342 if (el == NULL) {
343 /* this happens for attributes that have been removed */
344 DEBUG(5,("No element '%s' for attributeID %u in message\n",
345 sa->lDAPDisplayName, attids[i]));
346 ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
347 obj->object.attribute_ctr.attributes[i].attid =
348 dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
349 } else {
350 werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
351 &obj->object.attribute_ctr.attributes[i]);
352 if (!W_ERROR_IS_OK(werr)) {
353 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
354 sa->lDAPDisplayName, win_errstr(werr)));
355 return werr;
356 }
357 /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
358 * check if attribute is secret and send a null value
359 */
360 if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
361 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
362 &obj->meta_data_ctr->meta_data[i]);
363 }
364 /* some attributes needs to be encrypted
365 before being sent */
366 werr = drsuapi_encrypt_attribute(obj, session_key, rid,
367 &obj->object.attribute_ctr.attributes[i]);
368 if (!W_ERROR_IS_OK(werr)) {
369 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
370 sa->lDAPDisplayName, win_errstr(werr)));
371 return werr;
372 }
373 }
374 }
375
376 return WERR_OK;
377 }
378
379 /*
380 add one linked attribute from an object to the list of linked
381 attributes in a getncchanges request
382 */
383 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
384 struct ldb_context *sam_ctx,
385 const struct dsdb_schema *schema,
386 const struct dsdb_attribute *sa,
387 struct ldb_message *msg,
388 struct dsdb_dn *dsdb_dn,
389 struct drsuapi_DsReplicaLinkedAttribute **la_list,
390 uint32_t *la_count)
391 {
392 struct drsuapi_DsReplicaLinkedAttribute *la;
393 bool active;
394 NTSTATUS status;
395 WERROR werr;
396
397 (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
398 W_ERROR_HAVE_NO_MEMORY(*la_list);
399
400 la = &(*la_list)[*la_count];
401
402 la->identifier = get_object_identifier(*la_list, msg);
403 W_ERROR_HAVE_NO_MEMORY(la->identifier);
404
405 active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
406
407 if (!active) {
408 /* We have to check that the inactive link still point to an existing object */
409 struct GUID guid;
410 struct ldb_dn *tdn;
411 int ret;
412 const char *v;
413
414 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
415 if (strncmp(v, "TRUE", 4) == 0) {
416 /*
417 * Note: we skip the transmition of the deleted link even if the other part used to
418 * know about it because when we transmit the deletion of the object, the link will
419 * be deleted too due to deletion of object where link points and Windows do so.
420 */
421 if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
422 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
423 /*
424 * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
425 * if it join an existing domain with deleted objets, it firsts impose to have a
426 * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
427 * either during initial replication or after the getNCChanges.
428 * Behavior of samba has been changed to always have this attribute if it's present in the schema.
429 *
430 * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
431 * If FL >=2K8R2 we are sure that this attribute will be here.
432 * For this kind of forest level we do not return the link if the object is recycled
433 * (isRecycled = true).
434 */
435 if (strncmp(v, "TRUE", 4) == 0) {
436 DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
437 ldb_dn_get_linearized(msg->dn)));
438 return WERR_OK;
439 }
440 } else {
441 return WERR_OK;
442 }
443 }
444 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
445 if (!NT_STATUS_IS_OK(status)) {
446 DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
447 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
448 return ntstatus_to_werror(status);
449 }
450 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, &tdn);
451 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
452 DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
453 GUID_string(mem_ctx, &guid)));
454 return WERR_OK;
455 } else if (ret != LDB_SUCCESS) {
456 DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
457 GUID_string(mem_ctx, &guid),
458 ret));
459 return WERR_OK;
460 }
461 }
462 la->attid = sa->attributeID_id;
463 la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
464
465 status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
466 if (!NT_STATUS_IS_OK(status)) {
467 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
468 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
469 return ntstatus_to_werror(status);
470 }
471 status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
472 if (!NT_STATUS_IS_OK(status)) {
473 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
474 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
475 return ntstatus_to_werror(status);
476 }
477 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
478 if (!NT_STATUS_IS_OK(status)) {
479 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
480 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
481 return ntstatus_to_werror(status);
482 }
483 status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
484 if (!NT_STATUS_IS_OK(status)) {
485 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
486 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
487 return ntstatus_to_werror(status);
488 }
489
490 status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
491 if (!NT_STATUS_IS_OK(status)) {
492 /* this is possible for upgraded links */
493 la->originating_add_time = la->meta_data.originating_change_time;
494 }
495
496 werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
497 W_ERROR_NOT_OK_RETURN(werr);
498
499 (*la_count)++;
500 return WERR_OK;
501 }
502
503
504 /*
505 add linked attributes from an object to the list of linked
506 attributes in a getncchanges request
507 */
508 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
509 TALLOC_CTX *mem_ctx,
510 struct ldb_dn *ncRoot_dn,
511 struct dsdb_schema *schema,
512 uint64_t highest_usn,
513 uint32_t replica_flags,
514 struct ldb_message *msg,
515 struct drsuapi_DsReplicaLinkedAttribute **la_list,
516 uint32_t *la_count,
517 struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
518 {
519 unsigned int i;
520 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
521 uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
522
523 for (i=0; i<msg->num_elements; i++) {
524 struct ldb_message_element *el = &msg->elements[i];
525 const struct dsdb_attribute *sa;
526 unsigned int j;
527
528 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
529
530 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
531 /* we only want forward links */
532 continue;
533 }
534
535 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
536 /* its an old style link, it will have been
537 * sent in the main replication data */
538 continue;
539 }
540
541 for (j=0; j<el->num_values; j++) {
542 struct dsdb_dn *dsdb_dn;
543 uint64_t local_usn;
544 NTSTATUS status;
545 WERROR werr;
546
547 dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
548 if (dsdb_dn == NULL) {
549 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
550 el->name, ldb_dn_get_linearized(msg->dn)));
551 talloc_free(tmp_ctx);
552 return WERR_DS_DRA_INTERNAL_ERROR;
553 }
554
555 status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
556 if (!NT_STATUS_IS_OK(status)) {
557 /* this can happen for attributes
558 given to us with old style meta
559 data */
560 continue;
561 }
562
563 if (local_usn > uSNChanged) {
564 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
565 el->name, ldb_dn_get_linearized(msg->dn)));
566 talloc_free(tmp_ctx);
567 return WERR_DS_DRA_INTERNAL_ERROR;
568 }
569
570 if (local_usn < highest_usn) {
571 continue;
572 }
573
574 werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
575 dsdb_dn, la_list, la_count);
576 if (!W_ERROR_IS_OK(werr)) {
577 talloc_free(tmp_ctx);
578 return werr;
579 }
580 }
581 }
582
583 talloc_free(tmp_ctx);
584 return WERR_OK;
585 }
586
587 /*
588 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
589 */
590 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
591 struct ldb_dn *ncRoot_dn,
592 struct drsuapi_DsReplicaCursor2CtrEx *udv)
593 {
594 int ret;
595
596 udv->version = 2;
597 udv->reserved1 = 0;
598 udv->reserved2 = 0;
599
600 ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
601 if (ret != LDB_SUCCESS) {
602 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
603 ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
604 return WERR_DS_DRA_INTERNAL_ERROR;
605 }
606
607 return WERR_OK;
608 }
609
610
611 /* comparison function for linked attributes - see CompareLinks() in
612 * MS-DRSR section 4.1.10.5.17 */
613 static int linked_attribute_compare(const struct drsuapi_DsReplicaLinkedAttribute *la1,
614 const struct drsuapi_DsReplicaLinkedAttribute *la2,
615 struct ldb_context *sam_ctx)
616 {
617 int c;
618 WERROR werr;
619 TALLOC_CTX *tmp_ctx;
620 const struct dsdb_schema *schema;
621 const struct dsdb_attribute *schema_attrib;
622 struct dsdb_dn *dn1, *dn2;
623 struct GUID guid1, guid2;
624 NTSTATUS status;
625
626 c = GUID_compare(&la1->identifier->guid,
627 &la2->identifier->guid);
628 if (c != 0) return c;
629
630 if (la1->attid != la2->attid) {
631 return la1->attid < la2->attid? -1:1;
632 }
633
634 if ((la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
635 (la2->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
636 return (la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
637 }
638
639 /* we need to get the target GUIDs to compare */
640 tmp_ctx = talloc_new(sam_ctx);
641
642 schema = dsdb_get_schema(sam_ctx, tmp_ctx);
643 schema_attrib = dsdb_attribute_by_attributeID_id(schema, la1->attid);
644
645 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la1->value.blob, &dn1);
646 if (!W_ERROR_IS_OK(werr)) {
647 DEBUG(0,(__location__ ": Bad la1 blob in sort\n"));
648 talloc_free(tmp_ctx);
649 return 0;
650 }
651
652 werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la2->value.blob, &dn2);
653 if (!W_ERROR_IS_OK(werr)) {
654 DEBUG(0,(__location__ ": Bad la2 blob in sort\n"));
655 talloc_free(tmp_ctx);
656 return 0;
657 }
658
659 status = dsdb_get_extended_dn_guid(dn1->dn, &guid1, "GUID");
660 if (!NT_STATUS_IS_OK(status)) {
661 DEBUG(0,(__location__ ": Bad la1 guid in sort\n"));
662 talloc_free(tmp_ctx);
663 return 0;
664 }
665 status = dsdb_get_extended_dn_guid(dn2->dn, &guid2, "GUID");
666 if (!NT_STATUS_IS_OK(status)) {
667 DEBUG(0,(__location__ ": Bad la2 guid in sort\n"));
668 talloc_free(tmp_ctx);
669 return 0;
670 }
671
672 talloc_free(tmp_ctx);
673
674 return GUID_compare(&guid1, &guid2);
675 }
676
677 struct drsuapi_changed_objects {
678 struct ldb_dn *dn;
679 struct GUID guid;
680 uint64_t usn;
681 };
682
683 /*
684 sort the objects we send by tree order
685 */
686 static int site_res_cmp_parent_order(struct drsuapi_changed_objects *m1,
687 struct drsuapi_changed_objects *m2)
688 {
689 return ldb_dn_compare(m2->dn, m1->dn);
690 }
691
692 /*
693 sort the objects we send first by uSNChanged
694 */
695 static int site_res_cmp_dn_usn_order(struct drsuapi_changed_objects *m1,
696 struct drsuapi_changed_objects *m2)
697 {
698 unsigned usnchanged1, usnchanged2;
699 unsigned cn1, cn2;
700
701 cn1 = ldb_dn_get_comp_num(m1->dn);
702 cn2 = ldb_dn_get_comp_num(m2->dn);
703 if (cn1 != cn2) {
704 return cn1 > cn2 ? 1 : -1;
705 }
706 usnchanged1 = m1->usn;
707 usnchanged2 = m2->usn;
708 if (usnchanged1 == usnchanged2) {
709 return 0;
710 }
711 return usnchanged1 > usnchanged2 ? 1 : -1;
712 }
713
714
715 /*
716 handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
717 */
718 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
719 TALLOC_CTX *mem_ctx,
720 struct drsuapi_DsGetNCChangesRequest10 *req10,
721 struct drsuapi_DsGetNCChangesCtr6 *ctr6)
722 {
723 struct ldb_dn *rid_manager_dn, *req_dn;
724 int ret;
725 struct ldb_context *ldb = b_state->sam_ctx;
726 struct ldb_result *ext_res;
727 struct dsdb_fsmo_extended_op *exop;
728 bool is_us;
729
730 /*
731 steps:
732 - verify that the DN being asked for is the RID Manager DN
733 - verify that we are the RID Manager
734 */
735
736 /* work out who is the RID Manager */
737 ret = samdb_rid_manager_dn(ldb, mem_ctx, &rid_manager_dn);
738 if (ret != LDB_SUCCESS) {
739 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
740 return WERR_DS_DRA_INTERNAL_ERROR;
741 }
742
743 req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
744 if (!ldb_dn_validate(req_dn) ||
745 ldb_dn_compare(req_dn, rid_manager_dn) != 0) {
746 /* that isn't the RID Manager DN */
747 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
748 drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
749 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
750 return WERR_OK;
751 }
752
753 /* find the DN of the RID Manager */
754 ret = samdb_reference_dn_is_our_ntdsa(ldb, rid_manager_dn, "fSMORoleOwner", &is_us);
755 if (ret != LDB_SUCCESS) {
756 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
757 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
758 return WERR_DS_DRA_INTERNAL_ERROR;
759 }
760
761 if (!is_us) {
762 /* we're not the RID Manager - go away */
763 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
764 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
765 return WERR_OK;
766 }
767
768 exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
769 W_ERROR_HAVE_NO_MEMORY(exop);
770
771 exop->fsmo_info = req10->fsmo_info;
772 exop->destination_dsa_guid = req10->destination_dsa_guid;
773
774 ret = ldb_transaction_start(ldb);
775 if (ret != LDB_SUCCESS) {
776 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
777 ldb_errstring(ldb)));
778 return WERR_DS_DRA_INTERNAL_ERROR;
779 }
780
781 /*
782 * FIXME (kim): this is a temp hack to return just few object,
783 * but not the whole domain NC.
784 * We should remove this hack and implement a 'scope'
785 * building function to return just the set of object
786 * documented for DRSUAPI_EXOP_FSMO_RID_ALLOC extended_op
787 */
788 ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &req10->highwatermark.highest_usn);
789
790 ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
791 if (ret != LDB_SUCCESS) {
792 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
793 ldb_errstring(ldb)));
794 ldb_transaction_cancel(ldb);
795 return WERR_DS_DRA_INTERNAL_ERROR;
796 }
797
798 ret = ldb_transaction_commit(ldb);
799 if (ret != LDB_SUCCESS) {
800 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
801 ldb_errstring(ldb)));
802 return WERR_DS_DRA_INTERNAL_ERROR;
803 }
804
805 talloc_free(ext_res);
806
807 DEBUG(2,("Allocated RID pool for server %s\n",
808 GUID_string(mem_ctx, &req10->destination_dsa_guid)));
809
810 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
811
812 return WERR_OK;
813 }
814
815 /*
816 return an array of SIDs from a ldb_message given an attribute name
817 assumes the SIDs are in extended DN format
818 */
819 static WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
820 struct ldb_message *msg,
821 TALLOC_CTX *mem_ctx,
822 const char *attr,
823 const struct dom_sid ***sids)
824 {
825 struct ldb_message_element *el;
826 unsigned int i;
827
828 el = ldb_msg_find_element(msg, attr);
829 if (!el) {
830 *sids = NULL;
831 return WERR_OK;
832 }
833
834 (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
835 W_ERROR_HAVE_NO_MEMORY(*sids);
836
837 for (i=0; i<el->num_values; i++) {
838 struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, sam_ctx, &el->values[i]);
839 NTSTATUS status;
840 struct dom_sid *sid;
841
842 sid = talloc(*sids, struct dom_sid);
843 W_ERROR_HAVE_NO_MEMORY(sid);
844 status = dsdb_get_extended_dn_sid(dn, sid, "SID");
845 if (!NT_STATUS_IS_OK(status)) {
846 return WERR_INTERNAL_DB_CORRUPTION;
847 }
848 (*sids)[i] = sid;
849 }
850 (*sids)[i] = NULL;
851
852 return WERR_OK;
853 }
854
855
856 /*
857 return an array of SIDs from a ldb_message given an attribute name
858 assumes the SIDs are in NDR form
859 */
860 static WERROR samdb_result_sid_array_ndr(struct ldb_context *sam_ctx,
861 struct ldb_message *msg,
862 TALLOC_CTX *mem_ctx,
863 const char *attr,
864 const struct dom_sid ***sids)
865 {
866 struct ldb_message_element *el;
867 unsigned int i;
868
869 el = ldb_msg_find_element(msg, attr);
870 if (!el) {
871 *sids = NULL;
872 return WERR_OK;
873 }
874
875 (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
876 W_ERROR_HAVE_NO_MEMORY(*sids);
877
878 for (i=0; i<el->num_values; i++) {
879 enum ndr_err_code ndr_err;
880 struct dom_sid *sid;
881
882 sid = talloc(*sids, struct dom_sid);
883 W_ERROR_HAVE_NO_MEMORY(sid);
884
885 ndr_err = ndr_pull_struct_blob(&el->values[i], sid, sid,
886 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
887 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
888 return WERR_INTERNAL_DB_CORRUPTION;
889 }
890 (*sids)[i] = sid;
891 }
892 (*sids)[i] = NULL;
893
894 return WERR_OK;
895 }
896
897 /*
898 see if any SIDs in list1 are in list2
899 */
900 static bool sid_list_match(const struct dom_sid **list1, const struct dom_sid **list2)
901 {
902 unsigned int i, j;
903 /* do we ever have enough SIDs here to worry about O(n^2) ? */
904 for (i=0; list1[i]; i++) {
905 for (j=0; list2[j]; j++) {
906 if (dom_sid_equal(list1[i], list2[j])) {
907 return true;
908 }
909 }
910 }
911 return false;
912 }
913
914 /*
915 handle a DRSUAPI_EXOP_REPL_SECRET call
916 */
917 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
918 TALLOC_CTX *mem_ctx,
919 struct drsuapi_DsGetNCChangesRequest10 *req10,
920 struct dom_sid *user_sid,
921 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
922 bool has_get_all_changes)
923 {
924 struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
925 struct ldb_dn *obj_dn, *rodc_dn, *krbtgt_link_dn;
926 int ret;
927 const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", NULL };
928 const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
929 struct ldb_result *rodc_res, *obj_res;
930 const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
931 WERROR werr;
932
933 DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
934 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
935
936 /*
937 * we need to work out if we will allow this DC to
938 * replicate the secrets for this object
939 *
940 * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
941 * of this function
942 */
943
944 if (b_state->sam_ctx_system == NULL) {
945 /* this operation needs system level access */
946 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
947 return WERR_DS_DRA_SOURCE_DISABLED;
948 }
949
950 /*
951 * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
952 *
953 * The pseudo code indicate
954 * revealsecrets = true
955 * if IsRevealSecretRequest(msgIn) then
956 * if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
957 * then
958 * if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
959 * <... check if this account is ok to be replicated on this DC ...>
960 * <... and if not reveal secrets = no ...>
961 * else
962 * reveal secrets = false
963 * endif
964 * endif
965 * endif
966 *
967 * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
968 * then you can do EXOP_REPL_SECRETS
969 */
970 if (has_get_all_changes) {
971 goto allowed;
972 }
973
974 obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
975 if (!ldb_dn_validate(obj_dn)) goto failed;
976
977 rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
978 dom_sid_string(mem_ctx, user_sid));
979 if (!ldb_dn_validate(rodc_dn)) goto failed;
980
981 /* do the two searches we need */
982 ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
983 DSDB_SEARCH_SHOW_EXTENDED_DN);
984 if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
985
986 ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
987 if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
988
989 /* if the object SID is equal to the user_sid, allow */
990 if (dom_sid_equal(user_sid,
991 samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid"))) {
992 goto allowed;
993 }
994
995 /* an RODC is allowed to get its own krbtgt account secrets */
996 krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
997 rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
998 if (krbtgt_link_dn != NULL &&
999 ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1000 goto allowed;
1001 }
1002
1003 /* but it isn't allowed to get anyone elses krbtgt secrets */
1004 if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1005 obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1006 goto denied;
1007 }
1008
1009 if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1010 "userAccountControl", 0) &
1011 UF_INTERDOMAIN_TRUST_ACCOUNT) {
1012 goto denied;
1013 }
1014
1015 werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1016 mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1017 if (!W_ERROR_IS_OK(werr)) {
1018 goto denied;
1019 }
1020
1021 werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1022 mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1023 if (!W_ERROR_IS_OK(werr)) {
1024 goto denied;
1025 }
1026
1027 werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1028 mem_ctx, "tokenGroups", &token_sids);
1029 if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1030 goto denied;
1031 }
1032
1033 if (never_reveal_sids &&
1034 sid_list_match(token_sids, never_reveal_sids)) {
1035 goto denied;
1036 }
1037
1038 if (reveal_sids &&
1039 sid_list_match(token_sids, reveal_sids)) {
1040 goto allowed;
1041 }
1042
1043 /* default deny */
1044 denied:
1045 DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1046 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1047 ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1048 return WERR_DS_DRA_ACCESS_DENIED;
1049
1050 allowed:
1051 DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1052 ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1053 ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1054 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1055 req10->highwatermark.highest_usn = 0;
1056 return WERR_OK;
1057
1058 failed:
1059 DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1060 ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1061 ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1062 return WERR_DS_DRA_BAD_DN;
1063 }
1064
1065
1066 /*
1067 handle a DRSUAPI_EXOP_REPL_OBJ call
1068 */
1069 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1070 TALLOC_CTX *mem_ctx,
1071 struct drsuapi_DsGetNCChangesRequest10 *req10,
1072 struct dom_sid *user_sid,
1073 struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1074 {
1075 struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1076
1077 DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1078 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1079
1080 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1081 return WERR_OK;
1082 }
1083
1084
1085 /*
1086 handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1087 DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1088 and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1089 */
1090 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1091 TALLOC_CTX *mem_ctx,
1092 struct drsuapi_DsGetNCChangesRequest10 *req10,
1093 struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1094 {
1095 struct ldb_dn *req_dn, *ntds_dn;
1096 int ret;
1097 unsigned int i;
1098 struct ldb_context *ldb = b_state->sam_ctx;
1099 struct ldb_message *msg;
1100 bool is_us;
1101
1102 /*
1103 steps:
1104 - verify that the client dn exists
1105 - verify that we are the current master
1106 */
1107
1108 req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1109 if (!ldb_dn_validate(req_dn)) {
1110 /* that is not a valid dn */
1111 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1112 drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1113 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1114 return WERR_OK;
1115 }
1116
1117 /* retrieve the current role owner */
1118 /* find the DN of the RID Manager */
1119 ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1120 if (ret != LDB_SUCCESS) {
1121 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1122 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1123 return WERR_DS_DRA_INTERNAL_ERROR;
1124 }
1125
1126 if (!is_us) {
1127 /* we're not the RID Manager - go away */
1128 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
1129 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1130 return WERR_OK;
1131 }
1132
1133 /* change the current master */
1134 msg = ldb_msg_new(ldb);
1135 W_ERROR_HAVE_NO_MEMORY(msg);
1136 msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1137 W_ERROR_HAVE_NO_MEMORY(msg->dn);
1138
1139 /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1140 ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, &ntds_dn);
1141 if (ret != LDB_SUCCESS) {
1142 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1143 GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1144 talloc_free(msg);
1145 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1146 return WERR_OK;
1147 }
1148
1149 ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1150 if (ret != 0) {
1151 talloc_free(msg);
1152 return WERR_DS_DRA_INTERNAL_ERROR;
1153 }
1154
1155 for (i=0;i<msg->num_elements;i++) {
1156 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1157 }
1158
1159 ret = ldb_transaction_start(ldb);
1160 if (ret != LDB_SUCCESS) {
1161 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1162 ldb_errstring(ldb)));
1163 return WERR_DS_DRA_INTERNAL_ERROR;
1164 }
1165
1166 ret = ldb_modify(ldb, msg);
1167 if (ret != LDB_SUCCESS) {
1168 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1169 ldb_errstring(ldb)));
1170 ldb_transaction_cancel(ldb);
1171 return WERR_DS_DRA_INTERNAL_ERROR;
1172 }
1173
1174 ret = ldb_transaction_commit(ldb);
1175 if (ret != LDB_SUCCESS) {
1176 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1177 ldb_errstring(ldb)));
1178 return WERR_DS_DRA_INTERNAL_ERROR;
1179 }
1180
1181 ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1182
1183 return WERR_OK;
1184 }
1185
1186 /*
1187 see if this getncchanges request includes a request to reveal secret information
1188 */
1189 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1190 struct drsuapi_DsGetNCChangesRequest10 *req10,
1191 bool *is_secret_request)
1192 {
1193 enum drsuapi_DsExtendedOperation exop;
1194 uint32_t i;
1195 struct dsdb_schema *schema;
1196
1197 *is_secret_request = true;
1198
1199 exop = req10->extended_op;
1200
1201 switch (exop) {
1202 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1203 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1204 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1205 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1206 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1207 /* FSMO exops can reveal secrets */
1208 *is_secret_request = true;
1209 return WERR_OK;
1210 case DRSUAPI_EXOP_REPL_SECRET:
1211 case DRSUAPI_EXOP_REPL_OBJ:
1212 case DRSUAPI_EXOP_NONE:
1213 break;
1214 }
1215
1216 if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1217 *is_secret_request = false;
1218 return WERR_OK;
1219 }
1220
1221 if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1222 req10->partial_attribute_set == NULL) {
1223 /* they want secrets */
1224 *is_secret_request = true;
1225 return WERR_OK;
1226 }
1227
1228 schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1229
1230 /* check the attributes they asked for */
1231 for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1232 const struct dsdb_attribute *sa;
1233 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
1234 if (sa == NULL) {
1235 return WERR_DS_DRA_SCHEMA_MISMATCH;
1236 }
1237 if (!dsdb_attr_in_rodc_fas(sa)) {
1238 *is_secret_request = true;
1239 return WERR_OK;
1240 }
1241 }
1242
1243 if (req10->partial_attribute_set_ex) {
1244 /* check the extended attributes they asked for */
1245 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1246 const struct dsdb_attribute *sa;
1247 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
1248 if (sa == NULL) {
1249 return WERR_DS_DRA_SCHEMA_MISMATCH;
1250 }
1251 if (!dsdb_attr_in_rodc_fas(sa)) {
1252 *is_secret_request = true;
1253 return WERR_OK;
1254 }
1255 }
1256 }
1257
1258 *is_secret_request = false;
1259 return WERR_OK;
1260 }
1261
1262 /*
1263 see if this getncchanges request is only for attributes in the GC
1264 partial attribute set
1265 */
1266 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1267 struct drsuapi_DsGetNCChangesRequest10 *req10,
1268 bool *is_gc_pas_request)
1269 {
1270 enum drsuapi_DsExtendedOperation exop;
1271 uint32_t i;
1272 struct dsdb_schema *schema;
1273
1274 exop = req10->extended_op;
1275
1276 switch (exop) {
1277 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1278 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1279 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1280 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1281 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1282 case DRSUAPI_EXOP_REPL_SECRET:
1283 *is_gc_pas_request = false;
1284 return WERR_OK;
1285 case DRSUAPI_EXOP_REPL_OBJ:
1286 case DRSUAPI_EXOP_NONE:
1287 break;
1288 }
1289
1290 if (req10->partial_attribute_set == NULL) {
1291 /* they want it all */
1292 *is_gc_pas_request = false;
1293 return WERR_OK;
1294 }
1295
1296 schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1297
1298 /* check the attributes they asked for */
1299 for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1300 const struct dsdb_attribute *sa;
1301 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
1302 if (sa == NULL) {
1303 return WERR_DS_DRA_SCHEMA_MISMATCH;
1304 }
1305 if (!sa->isMemberOfPartialAttributeSet) {
1306 *is_gc_pas_request = false;
1307 return WERR_OK;
1308 }
1309 }
1310
1311 if (req10->partial_attribute_set_ex) {
1312 /* check the extended attributes they asked for */
1313 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1314 const struct dsdb_attribute *sa;
1315 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
1316 if (sa == NULL) {
1317 return WERR_DS_DRA_SCHEMA_MISMATCH;
1318 }
1319 if (!sa->isMemberOfPartialAttributeSet) {
1320 *is_gc_pas_request = false;
1321 return WERR_OK;
1322 }
1323 }
1324 }
1325
1326 *is_gc_pas_request = true;
1327 return WERR_OK;
1328 }
1329
1330
1331 /*
1332 map from req8 to req10
1333 */
1334 static struct drsuapi_DsGetNCChangesRequest10 *
1335 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1336 struct drsuapi_DsGetNCChangesRequest8 *req8)
1337 {
1338 struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1339 struct drsuapi_DsGetNCChangesRequest10);
1340 if (req10 == NULL) {
1341 return NULL;
1342 }
1343
1344 req10->destination_dsa_guid = req8->destination_dsa_guid;
1345 req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1346 req10->naming_context = req8->naming_context;
1347 req10->highwatermark = req8->highwatermark;
1348 req10->uptodateness_vector = req8->uptodateness_vector;
1349 req10->replica_flags = req8->replica_flags;
1350 req10->max_object_count = req8->max_object_count;
1351 req10->max_ndr_size = req8->max_ndr_size;
1352 req10->extended_op = req8->extended_op;
1353 req10->fsmo_info = req8->fsmo_info;
1354 req10->partial_attribute_set = req8->partial_attribute_set;
1355 req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1356 req10->mapping_ctr = req8->mapping_ctr;
1357
1358 return req10;
1359 }
1360
1361
1362 /**
1363 * Collects object for normal replication cycle.
1364 */
1365 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1366 TALLOC_CTX *mem_ctx,
1367 struct drsuapi_DsGetNCChangesRequest10 *req10,
1368 struct ldb_dn *search_dn,
1369 const char *extra_filter,
1370 struct ldb_result **search_res)
1371 {
1372 int ret;
1373 char* search_filter;
1374 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1375 //const char *extra_filter;
1376 struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1377 const char *attrs[] = { "uSNChanged",
1378 "objectGUID" ,
1379 NULL };
1380
1381 if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1382 req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1383 scope = LDB_SCOPE_BASE;
1384 }
1385
1386 //extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1387
1388 //getnc_state->min_usn = req10->highwatermark.highest_usn;
1389
1390 /* Construct response. */
1391 search_filter = talloc_asprintf(mem_ctx,
1392 "(uSNChanged>=%llu)",
1393 (unsigned long long)(getnc_state->min_usn+1));
1394
1395 if (extra_filter) {
1396 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1397 }
1398
1399 if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1400 search_filter = talloc_asprintf(mem_ctx,
1401 "(&%s(isCriticalSystemObject=TRUE))",
1402 search_filter);
1403 }
1404
1405 if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1406 scope = LDB_SCOPE_BASE;
1407 }
1408
1409 if (!search_dn) {
1410 search_dn = getnc_state->ncRoot_dn;
1411 }
1412
1413 DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1414 ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1415 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1416 search_dn, scope, attrs,
1417 search_filter);
1418 if (ret != LDB_SUCCESS) {
1419 return WERR_DS_DRA_INTERNAL_ERROR;
1420 }
1421
1422 return WERR_OK;
1423 }
1424
1425 /**
1426 * Collects object for normal replication cycle.
1427 */
1428 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1429 TALLOC_CTX *mem_ctx,
1430 struct drsuapi_DsGetNCChangesRequest10 *req10,
1431 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1432 struct ldb_dn *search_dn,
1433 const char *extra_filter,
1434 struct ldb_result **search_res)
1435 {
1436 /* we have nothing to do in case of ex-op failure */
1437 if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1438 return WERR_OK;
1439 }
1440
1441 /* TODO: implement extended op specific collection
1442 * of objects. Right now we just normal procedure
1443 * for collecting objects */
1444 return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1445 }
1446
1447 /*
1448 drsuapi_DsGetNCChanges
1449
1450 see MS-DRSR 4.1.10.5.2 for basic logic of this function
1451 */
1452 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1453 struct drsuapi_DsGetNCChanges *r)
1454 {
1455 struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
1456 int ret;
1457 uint32_t i;
1458 struct dsdb_schema *schema;
1459 struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
1460 struct drsuapi_DsReplicaObjectListItemEx **currentObject;
1461 NTSTATUS status;
1462 DATA_BLOB session_key;
1463 WERROR werr;
1464 struct dcesrv_handle *h;
1465 struct drsuapi_bind_state *b_state;
1466 struct drsuapi_getncchanges_state *getnc_state;
1467 struct drsuapi_DsGetNCChangesRequest10 *req10;
1468 uint32_t options;
1469 uint32_t max_objects;
1470 uint32_t max_links;
1471 uint32_t link_count = 0;
1472 uint32_t link_total = 0;
1473 uint32_t link_given = 0;
1474 struct ldb_dn *search_dn = NULL;
1475 bool am_rodc, null_scope=false;
1476 enum security_user_level security_level;
1477 struct ldb_context *sam_ctx;
1478 struct dom_sid *user_sid;
1479 bool is_secret_request;
1480 bool is_gc_pas_request;
1481 struct drsuapi_changed_objects *changes;
1482 time_t max_wait;
1483 time_t start = time(NULL);
1484 bool max_wait_reached = false;
1485 bool has_get_all_changes = false;
1486 struct GUID invocation_id;
1487
1488 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
1489 b_state = h->data;
1490
1491 sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
1492
1493 invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1494
1495 *r->out.level_out = 6;
1496 /* TODO: linked attributes*/
1497 r->out.ctr->ctr6.linked_attributes_count = 0;
1498 r->out.ctr->ctr6.linked_attributes = NULL;
1499
1500 r->out.ctr->ctr6.object_count = 0;
1501 r->out.ctr->ctr6.nc_object_count = 0;
1502 r->out.ctr->ctr6.more_data = false;
1503 r->out.ctr->ctr6.uptodateness_vector = NULL;
1504
1505 /* a RODC doesn't allow for any replication */
1506 ret = samdb_rodc(sam_ctx, &am_rodc);
1507 if (ret == LDB_SUCCESS && am_rodc) {
1508 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
1509 return WERR_DS_DRA_SOURCE_DISABLED;
1510 }
1511
1512 /* Check request revision.
1513 */
1514 switch (r->in.level) {
1515 case 8:
1516 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
1517 if (req10 == NULL) {
1518 return WERR_NOMEM;
1519 }
1520 break;
1521 case 10:
1522 req10 = &r->in.req->req10;
1523 break;
1524 default:
1525 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
1526 r->in.level));
1527 return WERR_REVISION_MISMATCH;
1528 }
1529
1530
1531 /* Perform access checks. */
1532 /* TODO: we need to support a sync on a specific non-root
1533 * DN. We'll need to find the real partition root here */
1534 ncRoot = req10->naming_context;
1535 if (ncRoot == NULL) {
1536 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
1537 return WERR_DS_DRA_INVALID_PARAMETER;
1538 }
1539
1540 if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
1541 return WERR_DS_DRA_INTERNAL_ERROR;
1542 }
1543
1544 if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
1545 !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
1546 return WERR_DS_DRA_SOURCE_DISABLED;
1547 }
1548
1549 user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
1550
1551 /* all clients must have GUID_DRS_GET_CHANGES */
1552 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1553 mem_ctx,
1554 dce_call->conn->auth_state.session_info->security_token,
1555 req10->naming_context,
1556 GUID_DRS_GET_CHANGES);
1557 if (!W_ERROR_IS_OK(werr)) {
1558 return werr;
1559 }
1560
1561 /* allowed if the GC PAS and client has
1562 GUID_DRS_GET_FILTERED_ATTRIBUTES */
1563 werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, &is_gc_pas_request);
1564 if (!W_ERROR_IS_OK(werr)) {
1565 return werr;
1566 }
1567 if (is_gc_pas_request) {
1568 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1569 mem_ctx,
1570 dce_call->conn->auth_state.session_info->security_token,
1571 req10->naming_context,
1572 GUID_DRS_GET_FILTERED_ATTRIBUTES);
1573 if (W_ERROR_IS_OK(werr)) {
1574 goto allowed;
1575 }
1576 }
1577
1578 werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, &is_secret_request);
1579 if (!W_ERROR_IS_OK(werr)) {
1580 return werr;
1581 }
1582 if (is_secret_request && req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
1583 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1584 mem_ctx,
1585 dce_call->conn->auth_state.session_info->security_token,
1586 req10->naming_context,
1587 GUID_DRS_GET_ALL_CHANGES);
1588 if (!W_ERROR_IS_OK(werr)) {
1589 return werr;
1590 } else {
1591 has_get_all_changes = true;
1592 }
1593 }
1594
1595 allowed:
1596 /* for non-administrator replications, check that they have
1597 given the correct source_dsa_invocation_id */
1598 security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
1599 samdb_domain_sid(sam_ctx));
1600 if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
1601 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
1602 /* we rely on this flag being unset for RODC requests */
1603 req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
1604 }
1605 }
1606
1607 if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
1608 /* Ignore the _in_ uptpdateness vector*/
1609 req10->uptodateness_vector = NULL;
1610 }
1611
1612 if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
1613 req10->source_dsa_invocation_id = invocation_id;
1614 }
1615
1616 if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
1617 /*
1618 * The given highwatermark is only valid relative to the
1619 * specified source_dsa_invocation_id.
1620 */
1621 ZERO_STRUCT(req10->highwatermark);
1622 }
1623
1624 getnc_state = b_state->getncchanges_state;
1625
1626 /* see if a previous replication has been abandoned */
1627 if (getnc_state) {
1628 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1629 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
1630 DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
1631 ldb_dn_get_linearized(new_dn),
1632 ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1633 ldb_dn_get_linearized(getnc_state->last_dn)));
1634 talloc_free(getnc_state);
1635 getnc_state = NULL;
1636 }
1637 }
1638
1639 if (getnc_state) {
1640 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
1641 &req10->highwatermark);
1642 if (ret != 0) {
1643 DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
1644 "on DN %s %s highwatermark (last_dn %s)\n",
1645 ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1646 (ret > 0) ? "older" : "newer",
1647 ldb_dn_get_linearized(getnc_state->last_dn)));
1648 talloc_free(getnc_state);
1649 getnc_state = NULL;
1650 }
1651 }
1652
1653 if (getnc_state == NULL) {
1654 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
1655 if (getnc_state == NULL) {
1656 return WERR_NOMEM;
1657 }
1658 b_state->getncchanges_state = getnc_state;
1659 getnc_state->ncRoot_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1660
1661 /* find out if we are to replicate Schema NC */
1662 ret = ldb_dn_compare(getnc_state->ncRoot_dn,
1663 ldb_get_schema_basedn(b_state->sam_ctx));
1664 getnc_state->is_schema_nc = (0 == ret);
1665
1666 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
1667 r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1668 }
1669
1670 /*
1671 * This is the first replication cycle and it is
1672 * a good place to handle extended operations
1673 *
1674 * FIXME: we don't fully support extended operations yet
1675 */
1676 switch (req10->extended_op) {
1677 case DRSUAPI_EXOP_NONE:
1678 break;
1679 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1680 werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1681 W_ERROR_NOT_OK_RETURN(werr);
1682 search_dn = ldb_get_default_basedn(sam_ctx);
1683 break;
1684 case DRSUAPI_EXOP_REPL_SECRET:
1685 werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
1686 user_sid,
1687 &r->out.ctr->ctr6,
1688 has_get_all_changes);
1689 r->out.result = werr;
1690 W_ERROR_NOT_OK_RETURN(werr);
1691 break;
1692 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1693 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1694 W_ERROR_NOT_OK_RETURN(werr);
1695 break;
1696 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1697 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1698 W_ERROR_NOT_OK_RETURN(werr);
1699 break;
1700 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1701 werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1702 W_ERROR_NOT_OK_RETURN(werr);
1703 break;
1704 case DRSUAPI_EXOP_REPL_OBJ:
1705 werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
1706 r->out.result = werr;
1707 W_ERROR_NOT_OK_RETURN(werr);
1708 break;
1709
1710 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1711
1712 DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
1713 (unsigned)req10->extended_op));
1714 return WERR_DS_DRA_NOT_SUPPORTED;
1715 }
1716 }
1717
1718 if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
1719 ldb_dn_is_null(getnc_state->ncRoot_dn)) {
1720 DEBUG(0,(__location__ ": Bad DN '%s'\n",
1721 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1722 return WERR_DS_DRA_INVALID_PARAMETER;
1723 }
1724
1725 /* we need the session key for encrypting password attributes */
1726 status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
1727 if (!NT_STATUS_IS_OK(status)) {
1728 DEBUG(0,(__location__ ": Failed to get session key\n"));
1729 return WERR_DS_DRA_INTERNAL_ERROR;
1730 }
1731
1732 /*
1733 TODO: MS-DRSR section 4.1.10.1.1
1734 Work out if this is the start of a new cycle */
1735
1736 if (getnc_state->guids == NULL) {
1737 const char *extra_filter;
1738 struct ldb_result *search_res = NULL;
1739
1740 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1741
1742 getnc_state->min_usn = req10->highwatermark.highest_usn;
1743
1744 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
1745 werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
1746 search_dn, extra_filter,
1747 &search_res);
1748 } else {
1749 werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
1750 &r->out.ctr->ctr6,
1751 search_dn, extra_filter,
1752 &search_res);
1753 }
1754 W_ERROR_NOT_OK_RETURN(werr);
1755
1756 /* extract out the GUIDs list */
1757 getnc_state->num_records = search_res ? search_res->count : 0;
1758 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
1759 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
1760
1761 changes = talloc_array(getnc_state,
1762 struct drsuapi_changed_objects,
1763 getnc_state->num_records);
1764 W_ERROR_HAVE_NO_MEMORY(changes);
1765
1766 for (i=0; i<getnc_state->num_records; i++) {
1767 changes[i].dn = search_res->msgs[i]->dn;
1768 changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
1769 changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
1770 }
1771
1772 if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
1773 TYPESAFE_QSORT(changes,
1774 getnc_state->num_records,
1775 site_res_cmp_parent_order);
1776 } else {
1777 TYPESAFE_QSORT(changes,
1778 getnc_state->num_records,
1779 site_res_cmp_dn_usn_order);
1780 }
1781
1782 for (i=0; i < getnc_state->num_records; i++) {
1783 getnc_state->guids[i] = changes[i].guid;
1784 if (GUID_all_zero(&getnc_state->guids[i])) {
1785 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
1786 ldb_dn_get_linearized(search_res->msgs[i]->dn)));
1787 return WERR_DS_DRA_INTERNAL_ERROR;
1788 }
1789 }
1790
1791 talloc_free(search_res);
1792 talloc_free(changes);
1793 }
1794
1795 if (req10->uptodateness_vector) {
1796 /* make sure its sorted */
1797 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
1798 req10->uptodateness_vector->count,
1799 drsuapi_DsReplicaCursor_compare);
1800 }
1801
1802 /* Prefix mapping */
1803 schema = dsdb_get_schema(sam_ctx, mem_ctx);
1804 if (!schema) {
1805 DEBUG(0,("No schema in sam_ctx\n"));
1806 return WERR_DS_DRA_INTERNAL_ERROR;
1807 }
1808
1809 r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
1810 *r->out.ctr->ctr6.naming_context = *ncRoot;
1811
1812 if (dsdb_find_guid_by_dn(sam_ctx, getnc_state->ncRoot_dn,
1813 &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
1814 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
1815 ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
1816 return WERR_DS_DRA_INTERNAL_ERROR;
1817 }
1818
1819 /* find the SID if there is one */
1820 dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
1821
1822 dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
1823 r->out.ctr->ctr6.mapping_ctr = *ctr;
1824
1825 r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
1826 r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1827
1828 r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
1829 r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
1830
1831 r->out.ctr->ctr6.first_object = NULL;
1832 currentObject = &r->out.ctr->ctr6.first_object;
1833
1834 /* use this to force single objects at a time, which is useful
1835 * for working out what object is giving problems
1836 */
1837 max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
1838 if (req10->max_object_count < max_objects) {
1839 max_objects = req10->max_object_count;
1840 }
1841 /*
1842 * TODO: work out how the maximum should be calculated
1843 */
1844 max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
1845
1846 /*
1847 * Maximum time that we can spend in a getncchanges
1848 * in order to avoid timeout of the other part.
1849 * 10 seconds by default.
1850 */
1851 max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
1852 for (i=getnc_state->num_processed;
1853 i<getnc_state->num_records &&
1854 !null_scope &&
1855 (r->out.ctr->ctr6.object_count < max_objects)
1856 && !max_wait_reached;
1857 i++) {
1858 int uSN;
1859 struct drsuapi_DsReplicaObjectListItemEx *obj;
1860 struct ldb_message *msg;
1861 static const char * const msg_attrs[] = {
1862 "*",
1863 "nTSecurityDescriptor",
1864 "parentGUID",
1865 "replPropertyMetaData",
1866 DSDB_SECRET_ATTRIBUTES,
1867 NULL };
1868 struct ldb_result *msg_res;
1869 struct ldb_dn *msg_dn;
1870
1871 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
1872 W_ERROR_HAVE_NO_MEMORY(obj);
1873
1874 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
1875 W_ERROR_HAVE_NO_MEMORY(msg_dn);
1876
1877
1878 /* by re-searching here we avoid having a lot of full
1879 * records in memory between calls to getncchanges
1880 */
1881 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
1882 msg_dn,
1883 LDB_SCOPE_BASE, msg_attrs, NULL);
1884 if (ret != LDB_SUCCESS) {
1885 if (ret != LDB_ERR_NO_SUCH_OBJECT) {
1886 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
1887 ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
1888 }
1889 talloc_free(obj);
1890 continue;
1891 }
1892
1893 msg = msg_res->msgs[0];
1894
1895 max_wait_reached = (time(NULL) - start > max_wait);
1896
1897 werr = get_nc_changes_build_object(obj, msg,
1898 sam_ctx, getnc_state->ncRoot_dn,
1899 getnc_state->is_schema_nc,
1900 schema, &session_key, getnc_state->min_usn,
1901 req10->replica_flags,
1902 req10->partial_attribute_set,
1903 req10->uptodateness_vector,
1904 req10->extended_op,
1905 max_wait_reached);
1906 if (!W_ERROR_IS_OK(werr)) {
1907 return werr;
1908 }
1909
1910 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
1911 getnc_state->ncRoot_dn,
1912 schema, getnc_state->min_usn,
1913 req10->replica_flags,
1914 msg,
1915 &getnc_state->la_list,
1916 &getnc_state->la_count,
1917 req10->uptodateness_vector);
1918 if (!W_ERROR_IS_OK(werr)) {
1919 return werr;
1920 }
1921
1922 uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
1923 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
1924 r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
1925 r->out.ctr->ctr6.new_highwatermark.reserved_usn = 0;
1926 }
1927
1928 if (obj->meta_data_ctr == NULL) {
1929 DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
1930 ldb_dn_get_linearized(msg->dn)));
1931 /* no attributes to send */
1932 talloc_free(obj);
1933 continue;
1934 }
1935
1936 r->out.ctr->ctr6.object_count++;
1937
1938 *currentObject = obj;
1939 currentObject = &obj->next_object;
1940
1941 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
1942
1943 talloc_free(getnc_state->last_dn);
1944 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
1945
1946 talloc_free(msg_res);
1947 talloc_free(msg_dn);
1948 }
1949
1950 getnc_state->num_processed = i;
1951
1952 r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
1953
1954 /* the client can us to call UpdateRefs on its behalf to
1955 re-establish monitoring of the NC */
1956 if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
1957 !GUID_all_zero(&req10->destination_dsa_guid)) {
1958 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
1959 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
1960 GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1961 ureq.naming_context = ncRoot;
1962 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(b_state->sam_ctx, mem_ctx,
1963 &req10->destination_dsa_guid);
1964 if (!ureq.dest_dsa_dns_name) {
1965 return WERR_NOMEM;
1966 }
1967 ureq.dest_dsa_guid = req10->destination_dsa_guid;
1968 ureq.options = DRSUAPI_DRS_ADD_REF |
1969 DRSUAPI_DRS_ASYNC_OP |
1970 DRSUAPI_DRS_GETCHG_CHECK;
1971
1972 /* we also need to pass through the
1973 DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
1974 to send notifies using the GC SPN */
1975 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
1976
1977 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
1978 if (!W_ERROR_IS_OK(werr)) {
1979 DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
1980 win_errstr(werr)));
1981 }
1982 }
1983
1984 /*
1985 * TODO:
1986 * This is just a guess, how to calculate the
1987 * number of linked attributes to send, we need to
1988 * find out how to do this right.
1989 */
1990 if (r->out.ctr->ctr6.object_count >= max_links) {
1991 max_links = 0;
1992 } else {
1993 max_links -= r->out.ctr->ctr6.object_count;
1994 }
1995
1996 link_total = getnc_state->la_count;
1997
1998 if (i < getnc_state->num_records) {
1999 r->out.ctr->ctr6.more_data = true;
2000 } else {
2001 /* sort the whole array the first time */
2002 if (!getnc_state->la_sorted) {
2003 LDB_TYPESAFE_QSORT(getnc_state->la_list, getnc_state->la_count,
2004 sam_ctx, linked_attribute_compare);
2005 getnc_state->la_sorted = true;
2006 }
2007
2008 link_count = getnc_state->la_count - getnc_state->la_idx;
2009 link_count = MIN(max_links, link_count);
2010
2011 r->out.ctr->ctr6.linked_attributes_count = link_count;
2012 r->out.ctr->ctr6.linked_attributes = getnc_state->la_list + getnc_state->la_idx;
2013
2014 getnc_state->la_idx += link_count;
2015 link_given = getnc_state->la_idx;
2016
2017 if (getnc_state->la_idx < getnc_state->la_count) {
2018 r->out.ctr->ctr6.more_data = true;
2019 }
2020 }
2021
2022 if (!r->out.ctr->ctr6.more_data) {
2023 talloc_steal(mem_ctx, getnc_state->la_list);
2024
2025 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
2026 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
2027 r->out.ctr->ctr6.new_highwatermark.reserved_usn = 0;
2028
2029 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
2030 r->out.ctr->ctr6.uptodateness_vector);
2031 if (!W_ERROR_IS_OK(werr)) {
2032 return werr;
2033 }
2034
2035 talloc_free(getnc_state);
2036 b_state->getncchanges_state = NULL;
2037 } else {
2038 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
2039 &r->out.ctr->ctr6.new_highwatermark);
2040 if (ret == 0) {
2041 /*
2042 * We need to make sure that we never return the
2043 * same highwatermark within the same replication
2044 * cycle more than once. Otherwise we cannot detect
2045 * when the client uses an unexptected highwatermark.
2046 *
2047 * This is a HACK which is needed because our
2048 * object ordering is wrong and set tmp_highest_usn
2049 * to a value that is higher than what we already
2050 * sent to the client (destination dsa).
2051 */
2052 r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
2053 }
2054
2055 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
2056 }
2057
2058 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2059 r->out.ctr->ctr6.uptodateness_vector = NULL;
2060 r->out.ctr->ctr6.nc_object_count = 0;
2061 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
2062 }
2063
2064 DEBUG(r->out.ctr->ctr6.more_data?4:2,
2065 ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
2066 (unsigned long long)(req10->highwatermark.highest_usn+1),
2067 req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
2068 r->out.ctr->ctr6.object_count,
2069 i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
2070 r->out.ctr->ctr6.linked_attributes_count,
2071 link_given, link_total,
2072 dom_sid_string(mem_ctx, user_sid)));
2073
2074 #if 0
2075 if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
2076 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
2077 }
2078 #endif
2079
2080 return WERR_OK;
2081 }
reg import