?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:dsdb/dirsync: remove unused 'deletedattr' variable
[Samba/gebeck_regimport.git] / source4 / dsdb / samdb / ldb_modules / dirsync.c
blobf75ec521d3ef9576af165e8434deb548933ca319
1 /*
2 SAMDB control module
3
4 Copyright (C) Matthieu Patou <mat@matws.net> 2011
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20
21 #include "includes.h"
22 #include "ldb/include/ldb.h"
23 #include "ldb/include/ldb_errors.h"
24 #include "ldb/include/ldb_module.h"
25 #include "libcli/security/security.h"
26 #include "librpc/gen_ndr/drsblobs.h"
27 #include "librpc/gen_ndr/ndr_drsblobs.h"
28 #include "librpc/ndr/libndr.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "dsdb/samdb/ldb_modules/util.h"
31
32 #define LDAP_DIRSYNC_OBJECT_SECURITY 0x01
33 #define LDAP_DIRSYNC_ANCESTORS_FIRST_ORDER 0x800
34 #define LDAP_DIRSYNC_PUBLIC_DATA_ONLY 0x2000
35 #define LDAP_DIRSYNC_INCREMENTAL_VALUES 0x80000000
36
37
38 struct dirsync_context {
39 struct ldb_module *module;
40 struct ldb_request *req;
41
42 /*
43 * We keep a track of the number of attributes that we
44 * add just for the need of the implementation
45 * it will be usefull to track then entries that needs not to
46 * be returned because there is no real change
47 */
48
49 unsigned int nbDefaultAttrs;
50 uint64_t highestUSN;
51 uint64_t fromreqUSN;
52 uint32_t cursor_size;
53 bool noextended;
54 bool linkIncrVal;
55 bool localonly;
56 bool partial;
57 bool assystem;
58 int functional_level;
59 const struct GUID *our_invocation_id;
60 const struct dsdb_schema *schema;
61 struct ldb_dn *nc_root;
62 struct drsuapi_DsReplicaCursor *cursors;
63 };
64
65
66 static int dirsync_filter_entry(struct ldb_request *req,
67 struct ldb_message *msg,
68 struct ldb_control **controls,
69 struct dirsync_context *dsc,
70 bool referral)
71 {
72 struct ldb_context *ldb;
73 uint64_t val;
74 enum ndr_err_code ndr_err;
75 uint32_t n;
76 int i;
77 unsigned int size, j;
78 struct ldb_val *replMetaData = NULL;
79 struct replPropertyMetaDataBlob rmd;
80 const struct dsdb_attribute *attr;
81 const char **listAttr = NULL;
82 bool namereturned = false;
83 bool nameasked = false;
84 NTSTATUS status;
85 /* Ajustment for the added attributes, it will reduce the number of
86 * expected to be here attributes*/
87 unsigned int delta = 0;
88 const char **myaccept = NULL;
89 const char *emptyaccept[] = { NULL };
90 const char *extendedaccept[] = { "GUID", "SID", "WKGUID", NULL };
91 const char *rdn = NULL;
92 struct ldb_message_element *el;
93 struct ldb_message *newmsg;
94 bool keep = false;
95 /*
96 * Where we asked to do extended dn ?
97 * if so filter out everything bug GUID, SID, WKGUID,
98 * if not filter out everything (just keep the dn).
99 */
100 if ( dsc->noextended == true ) {
101 myaccept = emptyaccept;
102 } else {
103 myaccept = extendedaccept;
104 }
105 ldb = ldb_module_get_ctx(dsc->module);
106
107 if (msg->num_elements == 0) {
108 /*
109 * Entry that we don't really have access to
110 */
111 return LDB_SUCCESS;
112 }
113 ldb_dn_extended_filter(msg->dn, myaccept);
114
115 /*
116 * If the RDN starts with CN then the CN attribute is never returned
117 */
118 rdn = ldb_dn_get_rdn_name(msg->dn);
119
120 /*
121 * if objectGUID is asked and we are dealing for the referrals entries and
122 * the usn searched is 0 then we didn't count the objectGUID as an automatically
123 * returned attribute, do to so we increament delta.
124 */
125 if (referral == true &&
126 ldb_attr_in_list(req->op.search.attrs, "objectGUID") &&
127 dsc->fromreqUSN == 0) {
128 delta++;
129 }
130
131
132 /*
133 * In terms of big O notation this is not the best algorithm,
134 * but we try our best not to make the worse one.
135 * We are obliged to run through the n message's elements
136 * and through the p elements of the replPropertyMetaData.
137 *
138 * It turns out that we are crawling twice the message's elements
139 * the first crawl is to remove the non replicated and generated
140 * attributes. The second one is to remove attributes that haven't
141 * a USN > as the requested one.
142 *
143 * In the second crawl we are reading the list of elements in the
144 * replPropertyMetaData for each remaining replicated attribute.
145 * In order to keep the list small
146 *
147 * We have a O(n'*p') complexity, in worse case n' = n and p' = p
148 * but in most case n' = n/2 (at least half of returned attributes
149 * are not replicated or generated) and p' is small as we
150 * list only the attribute that have been modified since last interogation
151 *
152 */
153 newmsg = talloc_zero(dsc->req, struct ldb_message);
154 if (newmsg == NULL) {
155 return ldb_oom(ldb);
156 }
157 for (i = msg->num_elements - 1; i >= 0; i--) {
158 attr = dsdb_attribute_by_lDAPDisplayName(dsc->schema, msg->elements[i].name);
159 if (ldb_attr_cmp(msg->elements[i].name, "uSNChanged") == 0) {
160 /* Read the USN it will used at the end of the filtering
161 * to update the max USN in the cookie if we
162 * decide to keep this entry
163 */
164 val = strtoull((const char*)msg->elements[i].values[0].data, NULL, 0);
165 continue;
166 }
167
168 if (ldb_attr_cmp(msg->elements[i].name,
169 "replPropertyMetaData") == 0) {
170 replMetaData = (talloc_steal(dsc, &msg->elements[i].values[0]));
171 continue;
172 }
173 }
174
175 if (replMetaData == NULL) {
176 bool guidfound = false;
177
178 /*
179 * We are in the case of deleted object where we don't have the
180 * right to read it.
181 */
182 if (!ldb_msg_find_attr_as_uint(msg, "isDeleted", 0)) {
183 /*
184 * This is not a deleted item and we don't
185 * have the replPropertyMetaData.
186 * Do not return it
187 */
188 return LDB_SUCCESS;
189 }
190 newmsg->dn = ldb_dn_new(newmsg, ldb, "");
191 if (newmsg->dn == NULL) {
192 return ldb_oom(ldb);
193 }
194
195 el = ldb_msg_find_element(msg, "objectGUID");
196 if ( el != NULL) {
197 guidfound = true;
198 }
199 /*
200 * We expect to find the GUID in the object,
201 * if it turns out not to be the case sometime
202 * well will uncomment the code bellow
203 */
204 SMB_ASSERT(guidfound == true);
205 /*
206 if (guidfound == false) {
207 struct GUID guid;
208 struct ldb_val *new_val;
209 DATA_BLOB guid_blob;
210
211 tmp[0] = '\0';
212 txt = strrchr(txt, ':');
213 if (txt == NULL) {
214 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
215 }
216 txt++;
217
218 status = GUID_from_string(txt, &guid);
219 if (!NT_STATUS_IS_OK(status)) {
220 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
221 }
222
223 status = GUID_to_ndr_blob(&guid, msg, &guid_blob);
224 if (!NT_STATUS_IS_OK(status)) {
225 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
226 }
227
228 new_val = talloc(msg, struct ldb_val);
229 if (new_val == NULL) {
230 return ldb_oom(ldb);
231 }
232 new_val->data = talloc_steal(new_val, guid_blob.data);
233 new_val->length = guid_blob.length;
234 if (ldb_msg_add_value(msg, "objectGUID", new_val, NULL) != 0) {
235 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
236 }
237 }
238 */
239 ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD);
240 talloc_steal(newmsg->elements, el->name);
241 talloc_steal(newmsg->elements, el->values);
242
243 talloc_free(msg);
244 return ldb_module_send_entry(dsc->req, msg, controls);
245 }
246
247 ndr_err = ndr_pull_struct_blob(replMetaData, dsc, &rmd,
248 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
249 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
250 ldb_set_errstring(ldb, "Unable to unmarshall replPropertyMetaData");
251 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
252 }
253 if (ldb_attr_in_list(req->op.search.attrs, "name") ||
254 ldb_attr_in_list(req->op.search.attrs, "*")) {
255 nameasked = true;
256 }
257
258 /*
259 * If we don't have an USN and no updateness array then we skip the
260 * test phase this is an optimisation for the case when you
261 * first query the DC without a cookie.
262 * As this query is most probably the one
263 * that will return the biggest answer, skipping this part
264 * will really save time.
265 */
266 if (ldb_dn_compare(dsc->nc_root, msg->dn) == 0) {
267 /* If we have name then we expect to have parentGUID,
268 * it will not be the case for the root of the NC
269 */
270 delta++;
271 }
272
273 if (dsc->fromreqUSN > 0 || dsc->cursors != NULL) {
274 j = 0;
275 /*
276 * Allocate an array of size(replMetaData) of char*
277 * we know that it will be oversized but it's a short lived element
278 */
279 listAttr = talloc_array(msg, const char*, rmd.ctr.ctr1.count + 1);
280 if (listAttr == NULL) {
281 return ldb_oom(ldb);
282 }
283 for (n=0; n < rmd.ctr.ctr1.count; n++) {
284 struct replPropertyMetaData1 *omd = &rmd.ctr.ctr1.array[n];
285 if (omd->local_usn > dsc->fromreqUSN) {
286 const struct dsdb_attribute *a = dsdb_attribute_by_attributeID_id(dsc->schema,
287 omd->attid);
288 if (!dsc->localonly) {
289 struct drsuapi_DsReplicaCursor *tab = dsc->cursors;
290 uint32_t l;
291 for (l=0; l < dsc->cursor_size; l++) {
292 if (GUID_equal(&tab[l].source_dsa_invocation_id, &omd->originating_invocation_id) &&
293 tab[l].highest_usn >= omd->originating_usn) {
294 /*
295 * If we have in the uptodateness vector an entry
296 * with the same invocation id as the originating invocation
297 * and if the usn in the vector is greater or equal to
298 * the one in originating_usn, then it means that this entry
299 * has already been sent (from another DC) to the client
300 * no need to resend it one more time.
301 */
302 goto skip;
303 }
304 }
305 /* If we are here it's because we have a usn > (max(usn of vectors))*/
306 }
307 if (namereturned == false &&
308 nameasked == true &&
309 ldb_attr_cmp(a->lDAPDisplayName, "name") == 0) {
310 namereturned = true;
311 if (ldb_dn_compare(dsc->nc_root, msg->dn) == 0) {
312 delta++;
313 }
314 }
315 listAttr[j] = a->lDAPDisplayName;
316 j++;
317 skip:
318 continue;
319 }
320 }
321 size = j;
322 } else {
323 size = 0;
324 if (ldb_attr_in_list(req->op.search.attrs, "*") ||
325 ldb_attr_in_list(req->op.search.attrs, "name")) {
326 namereturned = true;
327 }
328 }
329
330
331 /*
332 * Let's loop around the remaining elements
333 * to see which one are in the listAttr.
334 * If they are in this array it means that
335 * their localusn > usn from the request (in the cookie)
336 * if not we remove the attribute.
337 */
338 for (i = msg->num_elements - 1; i >= 0; i--) {
339 el = &(msg->elements[i]);
340 attr = dsdb_attribute_by_lDAPDisplayName(dsc->schema,
341 el->name);
342 const char *ldapattrname = el->name;
343 keep = false;
344
345 if (attr->linkID & 1) {
346 /*
347 * Attribute is a backlink so let's remove it
348 */
349 continue;
350 }
351
352 if (ldb_attr_cmp(msg->elements[i].name,
353 "replPropertyMetaData") == 0) {
354 continue;
355 }
356
357 if ((attr->systemFlags & (DS_FLAG_ATTR_NOT_REPLICATED | DS_FLAG_ATTR_IS_CONSTRUCTED))) {
358 if (ldb_attr_cmp(attr->lDAPDisplayName, "objectGUID") != 0 &&
359 ldb_attr_cmp(attr->lDAPDisplayName, "parentGUID") != 0) {
360 /*
361 * Attribute is constructed or not replicated, let's get rid of it
362 */
363 continue;
364 } else {
365 /* Let's keep the attribute that we forced to be added
366 * even if they are not in the replicationMetaData
367 * or are just generated
368 */
369 if (namereturned == false &&
370 (ldb_attr_cmp(attr->lDAPDisplayName, "parentGUID") == 0)) {
371 delta++;
372 continue;
373 }
374 if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
375 return ldb_error(ldb,
376 LDB_ERR_OPERATIONS_ERROR,
377 "Unable to add attribute");
378 }
379 talloc_steal(newmsg->elements, el->name);
380 talloc_steal(newmsg->elements, el->values);
381 continue;
382 }
383 }
384
385 if (ldb_attr_cmp(msg->elements[i].name, rdn) == 0) {
386 /*
387 * We have an attribute that is the same as the start of the RDN
388 * (ie. attribute CN with rdn CN=).
389 */
390 continue;
391 }
392
393 if (ldb_attr_cmp(attr->lDAPDisplayName, "instanceType") == 0) {
394 if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
395 return ldb_error(ldb,
396 LDB_ERR_OPERATIONS_ERROR,
397 "Unable to add attribute");
398 }
399 talloc_steal(newmsg->elements, el->name);
400 talloc_steal(newmsg->elements, el->values);
401 continue;
402 }
403 /* For links, when our functional level > windows 2000
404 * we use the RMD_LOCAL_USN information to decide wether
405 * we return the attribute or not.
406 * For windows 2000 this information is in the replPropertyMetaData
407 * so it will be handled like any other replicated attribute
408 */
409
410 if (dsc->functional_level > DS_DOMAIN_FUNCTION_2000 &&
411 attr->linkID != 0 ) {
412 int k;
413 /*
414 * Elements for incremental changes on linked attributes
415 */
416 struct ldb_message_element *el_incr_add = NULL;
417 struct ldb_message_element *el_incr_del = NULL;
418 /*
419 * Attribute is a forwardlink so let's remove it
420 */
421
422 for (k = el->num_values -1; k >= 0; k--) {
423 char *dn_ln;
424 uint32_t flags = 0;
425 uint32_t tmp_usn = 0;
426 uint32_t tmp_usn2 = 0;
427 struct GUID invocation_id = GUID_zero();
428 struct dsdb_dn *dn = dsdb_dn_parse(msg, ldb, &el->values[k], attr->syntax->ldap_oid);
429 struct ldb_dn *copydn;
430 if (dn == NULL) {
431 ldb_set_errstring(ldb, "Cannot parse DN");
432 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
433 }
434
435 copydn = ldb_dn_copy(msg, dn->dn);
436 if (copydn == NULL) {
437 ldb_oom(ldb);
438 }
439
440 status = dsdb_get_extended_dn_uint32(dn->dn, &tmp_usn, "RMD_LOCAL_USN");
441 if (!NT_STATUS_IS_OK(status)) {
442 talloc_free(dn);
443 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
444 }
445 status = dsdb_get_extended_dn_guid(dn->dn, &invocation_id, "RMD_INVOCID");
446 if (!NT_STATUS_IS_OK(status)) {
447 talloc_free(dn);
448 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
449 }
450
451 status = dsdb_get_extended_dn_uint32(dn->dn, &flags, "RMD_FLAGS");
452 if (!NT_STATUS_IS_OK(status)) {
453 talloc_free(dn);
454 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
455 }
456
457 status = dsdb_get_extended_dn_uint32(dn->dn, &tmp_usn2, "RMD_ORIGINATING_USN");
458 if (!NT_STATUS_IS_OK(status)) {
459 talloc_free(dn);
460 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
461 }
462
463 ldb_dn_extended_filter(dn->dn, myaccept);
464 dn_ln = ldb_dn_get_extended_linearized(dn, dn->dn, 1);
465 if (dn_ln == NULL)
466 {
467 talloc_free(dn);
468 ldb_set_errstring(ldb, "Cannot linearize dn");
469 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
470 }
471
472 talloc_free(el->values[k].data);
473 el->values[k].data = (uint8_t*)talloc_steal(el->values, dn_ln);
474 if (el->values[k].data == NULL) {
475 talloc_free(dn);
476 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
477 }
478 el->values[k].length = strlen(dn_ln);
479
480
481 if (tmp_usn > dsc->fromreqUSN) {
482 if (!dsc->localonly) {
483 struct drsuapi_DsReplicaCursor *tab = dsc->cursors;
484 uint32_t l;
485
486 for (l=0; l < dsc->cursor_size; l++) {
487 if (GUID_equal(&tab[l].source_dsa_invocation_id, &invocation_id) &&
488 tab[l].highest_usn >= tmp_usn2) {
489 /*
490 * If we have in the uptodateness vector an entry
491 * with the same invocation id as the originating invocation
492 * and if the usn in the vector is greater or equal to
493 * the one in originating_usn, then it means that this entry
494 * has already been sent (from another DC) to the client
495 * no need to resend it one more time.
496 */
497 goto skip_link;
498 }
499 }
500 /* If we are here it's because we have a usn > (max(usn of vectors))*/
501 keep = true;
502 } else {
503 keep = true;
504 }
505 /* If we are here it's because the link is more recent than either any
506 * originating usn or local usn
507 */
508
509 if (dsc->linkIncrVal == true) {
510 struct ldb_message_element *tmpel;
511 if (flags & DSDB_RMD_FLAG_DELETED) {
512 /* We have to check that the inactive link still point to an existing object */
513 struct GUID guid;
514 struct ldb_dn *tdn;
515 int ret;
516
517 status = dsdb_get_extended_dn_guid(copydn, &guid, "GUID");
518 if (!NT_STATUS_IS_OK(status)) {
519 DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
520 el->name, ldb_dn_get_linearized(copydn)));
521 return ldb_operr(ldb);
522 }
523 ret = dsdb_module_dn_by_guid(dsc->module, newmsg, &guid, &tdn, req);
524 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
525 DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
526 GUID_string(newmsg, &guid)));
527 continue;
528 } else if (ret != LDB_SUCCESS) {
529 DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
530 GUID_string(newmsg, &guid),
531 ret));
532 continue;
533 }
534 tmpel = el_incr_del;
535 } else {
536 tmpel = el_incr_add;
537 }
538
539 if (tmpel == NULL) {
540 tmpel = talloc_zero(newmsg, struct ldb_message_element);
541 if (tmpel == NULL) {
542 return ldb_oom(ldb);
543 }
544 tmpel->values = talloc_array(tmpel, struct ldb_val, 1);
545 if (tmpel->values == NULL) {
546 return ldb_oom(ldb);
547 }
548 if (flags & DSDB_RMD_FLAG_DELETED) {
549 tmpel->name = talloc_asprintf(tmpel,
550 "%s;range=0-0",
551 el->name);
552 }
553 else {
554 tmpel->name = talloc_asprintf(tmpel,
555 "%s;range=1-1",
556 el->name);
557 }
558 if (tmpel->name == NULL) {
559 return ldb_oom(ldb);
560 }
561 tmpel->num_values = 1;
562 } else {
563 tmpel->num_values += 1;
564 tmpel->values = talloc_realloc(tmpel,
565 tmpel->values,
566 struct ldb_val,
567 tmpel->num_values);
568 if (tmpel->values == NULL) {
569 return ldb_oom(ldb);
570 }
571 tmpel = tmpel;
572 }
573 tmpel->values[tmpel->num_values -1].data =talloc_steal(tmpel->values, el->values[k].data);
574 tmpel->values[tmpel->num_values -1].length = el->values[k].length;
575
576 if (flags & DSDB_RMD_FLAG_DELETED) {
577 el_incr_del = tmpel;
578 } else {
579 el_incr_add = tmpel;
580 }
581 }
582 }
583
584 if (dsc->linkIncrVal == false) {
585 if (flags & DSDB_RMD_FLAG_DELETED) {
586 if (k < (el->num_values - 1)) {
587 memmove(el->values + k,
588 el->values + (k + 1),
589 ((el->num_values - 1) - k)*sizeof(*el->values));
590 }
591 el->num_values--;
592 }
593 }
594 skip_link:
595 talloc_free(dn);
596
597 }
598 if (keep == true) {
599 if (dsc->linkIncrVal == false) {
600 if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
601 return ldb_error(ldb,
602 LDB_ERR_OPERATIONS_ERROR,
603 "Unable to add attribute");
604 }
605 talloc_steal(newmsg->elements, el->name);
606 talloc_steal(newmsg->elements, el->values);
607 } else {
608 if (el_incr_del) {
609 if (ldb_msg_add(newmsg, el_incr_del, LDB_FLAG_MOD_ADD))
610 return ldb_error(ldb,
611 LDB_ERR_OPERATIONS_ERROR,
612 "Unable to add attribute");
613 }
614 if (el_incr_add) {
615 if (ldb_msg_add(newmsg, el_incr_add, LDB_FLAG_MOD_ADD))
616 return ldb_error(ldb,
617 LDB_ERR_OPERATIONS_ERROR,
618 "Unable to add attribute");
619 }
620 }
621 }
622 continue;
623 }
624
625 if (listAttr) {
626 for (j=0; j<size; j++) {
627 /*
628 * We mark attribute that has already been seen well
629 * as seen. So that after attribute that are still in
630 * listAttr are attributes that has been modified after
631 * the requested USN but not present in the attributes
632 * returned by the ldb search.
633 * That is to say attributes that have been removed
634 */
635 if (listAttr[j] && ldb_attr_cmp(listAttr[j], ldapattrname) == 0) {
636 listAttr[j] = NULL;
637 keep = true;
638 continue;
639 }
640 }
641 } else {
642 keep = true;
643 }
644
645 if (keep == true) {
646 if (ldb_msg_add(newmsg, el, LDB_FLAG_MOD_ADD) != LDB_SUCCESS) {
647 return ldb_error(ldb,
648 LDB_ERR_OPERATIONS_ERROR,
649 "Unable to add attribute");
650 }
651 talloc_steal(newmsg->elements, el->name);
652 talloc_steal(newmsg->elements, el->values);
653 continue;
654 }
655 }
656
657 /*
658 * Here we run through the list of attributes returned
659 * in the propertyMetaData.
660 * Entries of this list have usn > requested_usn,
661 * entries that are also present in the message have been
662 * replaced by NULL, so at this moment the list contains
663 * only elements that have a usn > requested_usn and that
664 * haven't been seen. It's attributes that were removed.
665 * We add them to the message like empty elements.
666 */
667 for (j=0; j<size; j++) {
668 if (listAttr[j] && (
669 ldb_attr_in_list(req->op.search.attrs, "*") ||
670 ldb_attr_in_list(req->op.search.attrs, listAttr[j])) &&
671 (ldb_attr_cmp(listAttr[j], rdn) != 0) &&
672 (ldb_attr_cmp(listAttr[j], "instanceType") != 0)) {
673 ldb_msg_add_empty(newmsg, listAttr[j], LDB_FLAG_MOD_DELETE, NULL);
674 }
675 }
676 talloc_free(listAttr);
677
678 if ((newmsg->num_elements - ( dsc->nbDefaultAttrs - delta)) > 0) {
679 /*
680 * After cleaning attributes there is still some attributes that were not added just
681 * for the purpose of the control (objectGUID, instanceType, ...)
682 */
683
684 newmsg->dn = talloc_steal(newmsg, msg->dn);
685 if (val > dsc->highestUSN) {
686 dsc->highestUSN = val;
687 }
688 talloc_free(msg);
689 return ldb_module_send_entry(dsc->req, newmsg, controls);
690 } else {
691 talloc_free(msg);
692 return LDB_SUCCESS;
693 }
694 }
695
696
697 static int dirsync_create_vector(struct ldb_request *req,
698 struct ldb_reply *ares,
699 struct dirsync_context *dsc,
700 struct ldapControlDirSyncCookie *cookie,
701 struct ldb_context *ldb)
702 {
703 struct ldb_result *resVector;
704 const char* attrVector[] = {"replUpToDateVector", NULL };
705 uint64_t highest_usn;
706 uint32_t count = 1;
707 int ret;
708 struct drsuapi_DsReplicaCursor *tab;
709
710 ret = ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &highest_usn);
711 if (ret != LDB_SUCCESS) {
712 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR, "Unable to get highest USN from current NC");
713 }
714
715 /* If we have a full answer then the highest USN
716 * is not the highest USN from the result set but the
717 * highest of the naming context, unless the sequence is not updated yet.
718 */
719 if (highest_usn > dsc->highestUSN) {
720 dsc->highestUSN = highest_usn;
721 }
722
723
724 ret = dsdb_module_search_dn(dsc->module, dsc, &resVector,
725 dsc->nc_root,
726 attrVector,
727 DSDB_FLAG_NEXT_MODULE, req);
728 if (ret != LDB_SUCCESS) {
729 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
730 "Unable to get replUpToDateVector for current NC");
731 }
732
733 if (resVector->count != 0) {
734 DATA_BLOB blob;
735 uint32_t i;
736 struct ldb_message_element *el = ldb_msg_find_element(resVector->msgs[0], "replUpToDateVector");
737 if (el) {
738 enum ndr_err_code ndr_err;
739 struct replUpToDateVectorBlob utd;
740 blob.data = el->values[0].data;
741 blob.length = el->values[0].length;
742 ndr_err = ndr_pull_struct_blob(&blob, dsc, &utd,
743 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
744
745 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
746 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
747 "Unable to pull replUpToDateVectorBlob structure");
748 }
749
750
751 count += utd.ctr.ctr2.count;
752 tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
753 if (tab == NULL) {
754 return ldb_oom(ldb);
755 }
756 for (i=1; i < count; i++) {
757 memset(&tab[i], 0, sizeof(struct drsuapi_DsReplicaCursor));
758 tab[i].highest_usn = utd.ctr.ctr2.cursors[i-1].highest_usn;
759 tab[i].source_dsa_invocation_id = utd.ctr.ctr2.cursors[i-1].source_dsa_invocation_id;
760 }
761 } else {
762 tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
763 if (tab == NULL) {
764 return ldb_oom(ldb);
765 }
766 }
767 } else {
768 /*
769 * No replUpToDateVector ? it happens quite often (1 DC,
770 * other DCs didn't update ...
771 */
772 tab = talloc_array(cookie, struct drsuapi_DsReplicaCursor, count);
773 if (tab == NULL) {
774 return ldb_oom(ldb);
775 }
776 }
777 /* Our vector is always the first */
778 tab[0].highest_usn = dsc->highestUSN;
779 tab[0].source_dsa_invocation_id = *(dsc->our_invocation_id);
780
781
782 /* We have to add the updateness vector that we have*/
783 /* Version is always 1 in dirsync cookies */
784 cookie->blob.extra.uptodateness_vector.version = 1;
785 cookie->blob.extra.uptodateness_vector.reserved = 0;
786 cookie->blob.extra.uptodateness_vector.ctr.ctr1.count = count;
787 cookie->blob.extra.uptodateness_vector.ctr.ctr1.reserved = 0;
788 cookie->blob.extra.uptodateness_vector.ctr.ctr1.cursors = tab;
789
790 return LDB_SUCCESS;
791 }
792
793 static int dirsync_search_callback(struct ldb_request *req, struct ldb_reply *ares)
794 {
795 int ret;
796 struct dirsync_context *dsc;
797 struct ldb_result *res, *res2;
798 struct ldb_dirsync_control *control;
799 struct ldapControlDirSyncCookie *cookie;
800 struct ldb_context *ldb;
801 struct ldb_dn *dn;
802 struct ldb_val *val;
803 DATA_BLOB *blob;
804 NTTIME now;
805 const char *attrs[] = { "objectGUID", NULL };
806 enum ndr_err_code ndr_err;
807 char *tmp;
808 uint32_t flags;
809
810 dsc = talloc_get_type_abort(req->context, struct dirsync_context);
811 ldb = ldb_module_get_ctx(dsc->module);
812 if (!ares) {
813 return ldb_module_done(dsc->req, NULL, NULL,
814 LDB_ERR_OPERATIONS_ERROR);
815 }
816 if (ares->error != LDB_SUCCESS) {
817 return ldb_module_done(dsc->req, ares->controls,
818 ares->response, ares->error);
819 }
820
821 switch (ares->type) {
822 case LDB_REPLY_ENTRY:
823 return dirsync_filter_entry(req, ares->message, ares->controls, dsc, false);
824
825 case LDB_REPLY_REFERRAL:
826 /* Skip the ldap(s):// so up to 8 chars,
827 * we don't care to be precise as the goal is to be in
828 * the name of DC, then we search the next '/'
829 * as it will be the last char before the DN of the referal
830 */
831 if (strncmp(ares->referral, "ldap://", 7) == 0) {
832 tmp = ares->referral + 7;
833 } else if (strncmp(ares->referral, "ldaps://", 8) == 0) {
834 tmp = ares->referral + 8;
835 } else {
836 return ldb_operr(ldb);
837 }
838
839 tmp = strchr(tmp, '/');
840 tmp++;
841
842 dn = ldb_dn_new(dsc, ldb, tmp);
843 if (dn == NULL) {
844 return ldb_oom(ldb);
845 }
846
847 flags = DSDB_FLAG_NEXT_MODULE |
848 DSDB_SEARCH_SHOW_DELETED |
849 DSDB_SEARCH_SHOW_EXTENDED_DN;
850
851 if (dsc->assystem) {
852 flags = flags | DSDB_FLAG_AS_SYSTEM;
853 }
854
855 ret = dsdb_module_search_tree(dsc->module, dsc, &res,
856 dn, LDB_SCOPE_BASE,
857 req->op.search.tree,
858 req->op.search.attrs,
859 flags, req);
860
861 if (ret != LDB_SUCCESS) {
862 talloc_free(dn);
863 return ret;
864 }
865
866 if (res->count > 1) {
867 char *ldbmsg = talloc_asprintf(dn, "LDB returned more than result for dn: %s", tmp);
868 if (ldbmsg) {
869 ldb_set_errstring(ldb, ldbmsg);
870 }
871 talloc_free(dn);
872 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
873 } else if (res->count == 0) {
874 /* if nothing is returned then it means that we don't
875 * have access to it.
876 */
877 return LDB_SUCCESS;
878 }
879
880 talloc_free(dn);
881 /*
882 * Fetch the objectGUID of the root of current NC
883 */
884 ret = dsdb_module_search_dn(dsc->module, dsc, &res2,
885 req->op.search.base,
886 attrs,
887 DSDB_FLAG_NEXT_MODULE, req);
888
889 if (ret != LDB_SUCCESS) {
890 return ret;
891 }
892 if (res2->msgs[0]->num_elements != 1) {
893 ldb_set_errstring(ldb,
894 "More than 1 attribute returned while looking for objectGUID");
895 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
896 }
897
898 val = res2->msgs[0]->elements[0].values;
899 ret = ldb_msg_add_value(res->msgs[0], "parentGUID", val, NULL);
900 /*
901 * It *very* important to steal otherwise as val is in a subcontext
902 * related to res2, when the value will be one more time stolen
903 * it's elements[x].values that will be stolen, so it's important to
904 * recreate the context hierrachy as if it was done from a ldb_request
905 */
906 talloc_steal(res->msgs[0]->elements[0].values, val);
907 if (ret != LDB_SUCCESS) {
908 return ret;
909 }
910 return dirsync_filter_entry(req, res->msgs[0], res->controls, dsc, true);
911
912 case LDB_REPLY_DONE:
913 /*
914 * Let's add our own control
915 */
916
917 control = talloc_zero(ares->controls, struct ldb_dirsync_control);
918 if (control == NULL) {
919 return ldb_oom(ldb);
920 }
921
922 /*
923 * When outputing flags is used to say more results.
924 * For the moment we didn't honnor the size info */
925
926 control->flags = 0;
927
928 /*
929 * max_attribute is unused cf. 3.1.1.3.4.1.3 LDAP_SERVER_DIRSYNC_OID in MS-ADTS
930 */
931
932 control->max_attributes = 0;
933 cookie = talloc_zero(control, struct ldapControlDirSyncCookie);
934 if (cookie == NULL) {
935 return ldb_oom(ldb);
936 }
937
938 if (!dsc->partial) {
939 ret = dirsync_create_vector(req, ares, dsc, cookie, ldb);
940 if (ret != LDB_SUCCESS) {
941 return ldb_module_done(dsc->req, NULL, NULL, ret);
942 }
943 }
944
945 unix_to_nt_time(&now, time(NULL));
946 cookie->blob.time = now;
947 cookie->blob.highwatermark.highest_usn = dsc->highestUSN;
948 cookie->blob.highwatermark.tmp_highest_usn = dsc->highestUSN;
949 cookie->blob.guid1 = *(dsc->our_invocation_id);
950
951 blob = talloc_zero(control, DATA_BLOB);
952 if (blob == NULL) {
953 return ldb_oom(ldb);
954 }
955
956 ndr_err = ndr_push_struct_blob(blob, blob, cookie,
957 (ndr_push_flags_fn_t)ndr_push_ldapControlDirSyncCookie);
958
959 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
960 ldb_set_errstring(ldb, "Can't marshall ldapControlDirSyncCookie struct");
961 return ldb_module_done(dsc->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
962 }
963 control->cookie = (char *)blob->data;
964 control->cookie_len = blob->length;
965 ldb_reply_add_control(ares, LDB_CONTROL_DIRSYNC_OID, true, control);
966
967 return ldb_module_done(dsc->req, ares->controls,
968 ares->response, LDB_SUCCESS);
969
970 }
971 return LDB_SUCCESS;
972 }
973
974 static int dirsync_ldb_search(struct ldb_module *module, struct ldb_request *req)
975 {
976 struct ldb_control *control;
977 struct ldb_result *acl_res;
978 struct ldb_dirsync_control *dirsync_ctl;
979 struct ldb_request *down_req;
980 struct dirsync_context *dsc;
981 struct ldb_context *ldb;
982 struct ldb_parse_tree *new_tree = req->op.search.tree;
983 uint32_t flags = 0;
984 enum ndr_err_code ndr_err;
985 DATA_BLOB blob;
986 const char **attrs;
987 int ret;
988
989
990 if (ldb_dn_is_special(req->op.search.base)) {
991 return ldb_next_request(module, req);
992 }
993
994 /*
995 * check if there's an extended dn control
996 */
997 control = ldb_request_get_control(req, LDB_CONTROL_DIRSYNC_OID);
998 if (control == NULL) {
999 /* not found go on */
1000 return ldb_next_request(module, req);
1001 }
1002
1003 ldb = ldb_module_get_ctx(module);
1004 /*
1005 * This control must always be critical otherwise we return PROTOCOL error
1006 */
1007 if (!control->critical) {
1008 return ldb_operr(ldb);
1009 }
1010
1011 dsc = talloc_zero(req, struct dirsync_context);
1012 if (dsc == NULL) {
1013 return ldb_oom(ldb);
1014 }
1015 dsc->module = module;
1016 dsc->req = req;
1017 dsc->nbDefaultAttrs = 0;
1018
1019
1020 dirsync_ctl = talloc_get_type(control->data, struct ldb_dirsync_control);
1021 if (dirsync_ctl == NULL) {
1022 return ldb_error(ldb, LDB_ERR_PROTOCOL_ERROR, "No data in dirsync control");
1023 }
1024
1025 ret = dsdb_find_nc_root(ldb, dsc, req->op.search.base, &dsc->nc_root);
1026 if (ret != LDB_SUCCESS) {
1027 return ret;
1028 }
1029
1030 if (ldb_dn_compare(dsc->nc_root, req->op.search.base) != 0) {
1031 if (dirsync_ctl->flags & LDAP_DIRSYNC_OBJECT_SECURITY) {
1032 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1033 "DN is not one of the naming context");
1034 }
1035 else {
1036 return ldb_error(ldb, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS,
1037 "dN is not one of the naming context");
1038 }
1039 }
1040
1041 if (!(dirsync_ctl->flags & LDAP_DIRSYNC_OBJECT_SECURITY)) {
1042 struct dom_sid *sid;
1043 struct security_descriptor *sd = NULL;
1044 const char *acl_attrs[] = { "nTSecurityDescriptor", "objectSid", NULL };
1045 /*
1046 * If we don't have the flag and if we have the "replicate directory change" granted
1047 * then we upgrade ourself to system to not be blocked by the acl
1048 */
1049 /* FIXME we won't check the replicate directory change filtered attribute set
1050 * it should be done so that if attr is not empty then we check that the user
1051 * has also this right
1052 */
1053
1054 /*
1055 * First change to system to get the SD of the root of current NC
1056 * if we don't the acl_read will forbid us the right to read it ...
1057 */
1058 ret = dsdb_module_search_dn(module, dsc, &acl_res,
1059 req->op.search.base,
1060 acl_attrs,
1061 DSDB_FLAG_NEXT_MODULE|DSDB_FLAG_AS_SYSTEM, req);
1062
1063 if (ret != LDB_SUCCESS) {
1064 return ret;
1065 }
1066
1067 sid = samdb_result_dom_sid(dsc, acl_res->msgs[0], "objectSid");
1068 /* sid can be null ... */
1069 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), acl_res, acl_res->msgs[0], &sd);
1070
1071 if (ret != LDB_SUCCESS) {
1072 return ret;
1073 }
1074 ret = acl_check_extended_right(dsc, sd, acl_user_token(module), GUID_DRS_GET_CHANGES, SEC_ADS_CONTROL_ACCESS, sid);
1075
1076 if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
1077 return ret;
1078 }
1079 dsc->assystem = true;
1080 ret = ldb_request_add_control(req, LDB_CONTROL_AS_SYSTEM_OID, false, NULL);
1081
1082 if (ret != LDB_SUCCESS) {
1083 return ret;
1084 }
1085 talloc_free(acl_res);
1086 } else {
1087 flags |= DSDB_ACL_CHECKS_DIRSYNC_FLAG;
1088
1089 if (ret != LDB_SUCCESS) {
1090 return ret;
1091 }
1092
1093 }
1094
1095 dsc->functional_level = dsdb_functional_level(ldb);
1096
1097 if (req->op.search.attrs) {
1098 attrs = ldb_attr_list_copy(dsc, req->op.search.attrs);
1099 if (attrs == NULL) {
1100 return ldb_oom(ldb);
1101 }
1102 /*
1103 * Check if we have only "dn" as attribute, if so then
1104 * treat as if "*" was requested
1105 */
1106 if (attrs && attrs[0]) {
1107 if (ldb_attr_cmp(attrs[0], "dn") == 0 && !attrs[1]) {
1108 attrs = talloc_array(dsc, const char*, 2);
1109 if (attrs == NULL) {
1110 return ldb_oom(ldb);
1111 }
1112 attrs[0] = "*";
1113 attrs[1] = NULL;
1114 }
1115 }
1116 /*
1117 * When returning all the attributes return also the SD as
1118 * Windws do so.
1119 */
1120 if (ldb_attr_in_list(attrs, "*")) {
1121 struct ldb_sd_flags_control *sdctr = talloc_zero(dsc, struct ldb_sd_flags_control);
1122 sdctr->secinfo_flags = 0xF;
1123 ret = ldb_request_add_control(req, LDB_CONTROL_SD_FLAGS_OID, false, sdctr);
1124 if (ret != LDB_SUCCESS) {
1125 return ret;
1126 }
1127 attrs = ldb_attr_list_copy_add(dsc, attrs, "parentGUID");
1128 if (attrs == NULL) {
1129 return ldb_oom(ldb);
1130 }
1131 attrs = ldb_attr_list_copy_add(dsc, attrs, "replPropertyMetaData");
1132 if (attrs == NULL) {
1133 return ldb_oom(ldb);
1134 }
1135 /*
1136 * When no attributes are asked we in anycase expect at least 3 attributes:
1137 * * instanceType
1138 * * objectGUID
1139 * * parentGUID
1140 */
1141
1142 dsc->nbDefaultAttrs = 3;
1143 } else {
1144 /*
1145 * We will need this two attributes in the callback
1146 */
1147 attrs = ldb_attr_list_copy_add(dsc, attrs, "usnChanged");
1148 if (attrs == NULL) {
1149 return ldb_operr(ldb);
1150 }
1151 attrs = ldb_attr_list_copy_add(dsc, attrs, "replPropertyMetaData");
1152 if (attrs == NULL) {
1153 return ldb_operr(ldb);
1154 }
1155
1156 if (!ldb_attr_in_list(attrs, "instanceType")) {
1157 attrs = ldb_attr_list_copy_add(dsc, attrs, "instanceType");
1158 if (attrs == NULL) {
1159 return ldb_operr(ldb);
1160 }
1161 dsc->nbDefaultAttrs++;
1162 }
1163
1164 if (!ldb_attr_in_list(attrs, "objectGUID")) {
1165 attrs = ldb_attr_list_copy_add(dsc, attrs, "objectGUID");
1166 if (attrs == NULL) {
1167 return ldb_operr(ldb);
1168 }
1169 }
1170 /*
1171 * Always increment the number of asked attributes as we don't care if objectGUID was asked
1172 * or not for counting the number of "real" attributes returned.
1173 */
1174 dsc->nbDefaultAttrs++;
1175
1176 if (!ldb_attr_in_list(attrs, "parentGUID")) {
1177 attrs = ldb_attr_list_copy_add(dsc, attrs, "parentGUID");
1178 if (attrs == NULL) {
1179 return ldb_operr(ldb);
1180 }
1181 }
1182 dsc->nbDefaultAttrs++;
1183
1184 }
1185 } else {
1186 struct ldb_sd_flags_control *sdctr = talloc_zero(dsc, struct ldb_sd_flags_control);
1187 sdctr->secinfo_flags = 0xF;
1188 ret = ldb_request_add_control(req, LDB_CONTROL_SD_FLAGS_OID, false, sdctr);
1189 attrs = talloc_array(dsc, const char*, 4);
1190 if (attrs == NULL) {
1191 return ldb_operr(ldb);
1192 }
1193 attrs[0] = "*";
1194 attrs[1] = "parentGUID";
1195 attrs[2] = "replPropertyMetaData";
1196 attrs[3] = NULL;
1197 if (ret != LDB_SUCCESS) {
1198 return ret;
1199 }
1200 /*
1201 * When no attributes are asked we in anycase expect at least 3 attributes:
1202 * * instanceType
1203 * * objectGUID
1204 * * parentGUID
1205 */
1206
1207 dsc->nbDefaultAttrs = 3;
1208 }
1209
1210 if (!ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID)) {
1211 ret = ldb_request_add_control(req, LDB_CONTROL_EXTENDED_DN_OID, false, NULL);
1212 if (ret != LDB_SUCCESS) {
1213 return ret;
1214 }
1215 dsc->noextended = true;
1216 }
1217
1218 if (ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS) == NULL) {
1219 ret = ldb_request_add_control(req, LDB_CONTROL_REVEAL_INTERNALS, false, NULL);
1220 if (ret != LDB_SUCCESS) {
1221 return ret;
1222 }
1223 }
1224
1225 if (ldb_request_get_control(req, LDB_CONTROL_SHOW_RECYCLED_OID) == NULL) {
1226 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_RECYCLED_OID, false, NULL);
1227 if (ret != LDB_SUCCESS) {
1228 return ret;
1229 }
1230 }
1231
1232 if (ldb_request_get_control(req, LDB_CONTROL_SHOW_DELETED_OID) == NULL) {
1233 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, false, NULL);
1234 if (ret != LDB_SUCCESS) {
1235 return ret;
1236 }
1237 }
1238
1239 if (dirsync_ctl->flags & LDAP_DIRSYNC_INCREMENTAL_VALUES) {
1240 dsc->linkIncrVal = true;
1241 } else {
1242 dsc->linkIncrVal = false;
1243 }
1244
1245 dsc->our_invocation_id = samdb_ntds_invocation_id(ldb);
1246 if (dsc->our_invocation_id == NULL) {
1247 return ldb_operr(ldb);
1248 }
1249
1250 if (dirsync_ctl->cookie_len > 0) {
1251 struct ldapControlDirSyncCookie cookie;
1252
1253 blob.data = (uint8_t *)dirsync_ctl->cookie;
1254 blob.length = dirsync_ctl->cookie_len;
1255 ndr_err = ndr_pull_struct_blob(&blob, dsc, &cookie,
1256 (ndr_pull_flags_fn_t)ndr_pull_ldapControlDirSyncCookie);
1257
1258 /* If we can't unmarshall the cookie into the correct structure we return
1259 * unsupported critical extension
1260 */
1261 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1262 return ldb_error(ldb, LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION,
1263 "Unable to unmarshall cookie as a ldapControlDirSyncCookie structure");
1264 }
1265
1266 /*
1267 * Let's search for the max usn withing the cookie
1268 */
1269 if (GUID_equal(&(cookie.blob.guid1), dsc->our_invocation_id)) {
1270 /*
1271 * Ok, it's our invocation ID so we can treat the demand
1272 * Let's take the highest usn from (tmp)highest_usn
1273 */
1274 dsc->fromreqUSN = cookie.blob.highwatermark.tmp_highest_usn;
1275 dsc->localonly = true;
1276
1277 if (cookie.blob.highwatermark.highest_usn > cookie.blob.highwatermark.tmp_highest_usn) {
1278 dsc->fromreqUSN = cookie.blob.highwatermark.highest_usn;
1279 }
1280 } else {
1281 dsc->localonly = false;
1282 }
1283 if (cookie.blob.extra_length > 0 &&
1284 cookie.blob.extra.uptodateness_vector.ctr.ctr1.count > 0) {
1285 struct drsuapi_DsReplicaCursor cursor;
1286 uint32_t p;
1287 for (p=0; p < cookie.blob.extra.uptodateness_vector.ctr.ctr1.count; p++) {
1288 cursor = cookie.blob.extra.uptodateness_vector.ctr.ctr1.cursors[p];
1289 if (GUID_equal( &(cursor.source_dsa_invocation_id), dsc->our_invocation_id)) {
1290 if (cursor.highest_usn > dsc->fromreqUSN) {
1291 dsc->fromreqUSN = cursor.highest_usn;
1292 }
1293 }
1294 }
1295 dsc->cursors = talloc_steal(dsc,
1296 cookie.blob.extra.uptodateness_vector.ctr.ctr1.cursors);
1297 if (dsc->cursors == NULL) {
1298 return ldb_oom(ldb);
1299 }
1300 dsc->cursor_size = p;
1301 }
1302 }
1303
1304 DEBUG(4, ("Dirsync: searching with min usn > %llu\n",
1305 (long long unsigned int)dsc->fromreqUSN));
1306 if (dsc->fromreqUSN > 0) {
1307 /* FIXME it would be better to use PRId64 */
1308 char *expression = talloc_asprintf(dsc, "(&%s(uSNChanged>=%llu))",
1309 ldb_filter_from_tree(dsc,
1310 req->op.search.tree),
1311 (long long unsigned int)(dsc->fromreqUSN + 1));
1312
1313 if (expression == NULL) {
1314 return ldb_oom(ldb);
1315 }
1316 new_tree = ldb_parse_tree(req, expression);
1317 if (new_tree == NULL) {
1318 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
1319 "Problem while parsing tree");
1320 }
1321
1322 }
1323 /*
1324 * Remove our control from the list of controls
1325 */
1326 if (!ldb_save_controls(control, req, NULL)) {
1327 return ldb_operr(ldb);
1328 }
1329 dsc->schema = dsdb_get_schema(ldb, dsc);
1330 /*
1331 * At the begining we make the hypothesis that we will return a complete
1332 * result set
1333 */
1334
1335 dsc->partial = false;
1336
1337 /*
1338 * 3.1.1.3.4.1.3 of MS-ADTS.pdf specify that if the scope is not subtree
1339 * we treat the search as if subtree was specified
1340 */
1341
1342 ret = ldb_build_search_req_ex(&down_req, ldb, dsc,
1343 req->op.search.base,
1344 LDB_SCOPE_SUBTREE,
1345 new_tree,
1346 attrs,
1347 req->controls,
1348 dsc, dirsync_search_callback,
1349 req);
1350 ldb_req_set_custom_flags(down_req, flags);
1351 LDB_REQ_SET_LOCATION(down_req);
1352 if (ret != LDB_SUCCESS) {
1353 return ret;
1354 }
1355 /* perform the search */
1356 return ldb_next_request(module, down_req);
1357 }
1358
1359 static int dirsync_ldb_init(struct ldb_module *module)
1360 {
1361 int ret;
1362
1363 ret = ldb_mod_register_control(module, LDB_CONTROL_DIRSYNC_OID);
1364 if (ret != LDB_SUCCESS) {
1365 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
1366 "dirsync: Unable to register control with rootdse!\n");
1367 return ldb_operr(ldb_module_get_ctx(module));
1368 }
1369
1370 return ldb_next_init(module);
1371 }
1372
1373 static const struct ldb_module_ops ldb_dirsync_ldb_module_ops = {
1374 .name = "dirsync",
1375 .search = dirsync_ldb_search,
1376 .init_context = dirsync_ldb_init,
1377 };
1378
1379 /*
1380 initialise the module
1381 */
1382 _PUBLIC_ int ldb_dirsync_module_init(const char *version)
1383 {
1384 int ret;
1385 LDB_MODULE_CHECK_VERSION(version);
1386 ret = ldb_register_module(&ldb_dirsync_ldb_module_ops);
1387 return ret;
1388 }
reg import