2 Unix SMB/CIFS implementation.
4 implement the DRSUpdateRefs call
6 Copyright (C) Anatoliy Atanasov 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "librpc/gen_ndr/ndr_drsuapi.h"
25 #include "rpc_server/dcerpc_server.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "param/param.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "auth/auth.h"
30 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
31 #include "rpc_server/dcerpc_server_proto.h"
32 #include "../libcli/drsuapi/drsuapi.h"
33 #include "libcli/security/security.h"
36 drsuapi_DsGetNCChanges for one object
38 static WERROR
get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx
*obj
,
39 struct ldb_message
*msg
,
40 struct ldb_context
*sam_ctx
,
41 struct ldb_dn
*ncRoot_dn
,
42 struct dsdb_schema
*schema
,
43 DATA_BLOB
*session_key
,
46 const struct ldb_val
*md_value
;
48 struct ldb_dn
*obj_dn
;
49 struct replPropertyMetaDataBlob md
;
52 enum ndr_err_code ndr_err
;
55 const struct dsdb_attribute
*rdn_sa
;
57 if (ldb_dn_compare(ncRoot_dn
, msg
->dn
) == 0) {
58 obj
->is_nc_prefix
= true;
59 obj
->parent_object_guid
= NULL
;
61 obj
->is_nc_prefix
= false;
62 obj
->parent_object_guid
= talloc(obj
, struct GUID
);
63 *obj
->parent_object_guid
= samdb_result_guid(msg
, "parentGUID");
64 if (GUID_all_zero(obj
->parent_object_guid
)) {
65 struct ldb_dn
*parent_dn
= ldb_dn_copy(msg
, msg
->dn
);
66 if (parent_dn
== NULL
) {
67 return WERR_DS_DRA_INTERNAL_ERROR
;
69 if (ldb_dn_remove_child_components(parent_dn
, 1) != true) {
70 DEBUG(0,(__location__
": Unable to remove DN component\n"));
71 return WERR_DS_DRA_INTERNAL_ERROR
;
73 if (dsdb_find_guid_by_dn(sam_ctx
, parent_dn
, obj
->parent_object_guid
) != LDB_SUCCESS
) {
74 DEBUG(0,(__location__
": Unable to find parent DN %s %s\n",
75 ldb_dn_get_linearized(msg
->dn
), ldb_dn_get_linearized(parent_dn
)));
77 talloc_free(parent_dn
);
80 obj
->next_object
= NULL
;
82 md_value
= ldb_msg_find_ldb_val(msg
, "replPropertyMetaData");
88 ndr_err
= ndr_pull_struct_blob(md_value
, obj
,
89 lp_iconv_convenience(ldb_get_opaque(sam_ctx
, "loadparm")), &md
,
90 (ndr_pull_flags_fn_t
)ndr_pull_replPropertyMetaDataBlob
);
91 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
92 return WERR_DS_DRA_INTERNAL_ERROR
;
95 if (md
.version
!= 1) {
96 return WERR_DS_DRA_INTERNAL_ERROR
;
99 rdn
= ldb_dn_get_rdn_name(msg
->dn
);
101 DEBUG(0,(__location__
": No rDN for %s\n", ldb_dn_get_linearized(msg
->dn
)));
102 return WERR_DS_DRA_INTERNAL_ERROR
;
105 rdn_sa
= dsdb_attribute_by_lDAPDisplayName(schema
, rdn
);
106 if (rdn_sa
== NULL
) {
107 DEBUG(0,(__location__
": Can't find dsds_attribute for rDN %s in %s\n",
108 rdn
, ldb_dn_get_linearized(msg
->dn
)));
109 return WERR_DS_DRA_INTERNAL_ERROR
;
112 obj
->meta_data_ctr
= talloc(obj
, struct drsuapi_DsReplicaMetaDataCtr
);
113 attids
= talloc_array(obj
, uint32_t, md
.ctr
.ctr1
.count
);
115 obj
->meta_data_ctr
->meta_data
= talloc_array(obj
, struct drsuapi_DsReplicaMetaData
, md
.ctr
.ctr1
.count
);
116 for (n
=i
=0; i
<md
.ctr
.ctr1
.count
; i
++) {
117 /* if the attribute has not changed, and it is not the
118 instanceType then don't include it */
119 if (md
.ctr
.ctr1
.array
[i
].local_usn
< highest_usn
&&
120 md
.ctr
.ctr1
.array
[i
].attid
!= DRSUAPI_ATTRIBUTE_instanceType
) continue;
121 /* don't include the rDN */
122 if (md
.ctr
.ctr1
.array
[i
].attid
== rdn_sa
->attributeID_id
) continue;
123 obj
->meta_data_ctr
->meta_data
[n
].originating_change_time
= md
.ctr
.ctr1
.array
[i
].originating_change_time
;
124 obj
->meta_data_ctr
->meta_data
[n
].version
= md
.ctr
.ctr1
.array
[i
].version
;
125 obj
->meta_data_ctr
->meta_data
[n
].originating_invocation_id
= md
.ctr
.ctr1
.array
[i
].originating_invocation_id
;
126 obj
->meta_data_ctr
->meta_data
[n
].originating_usn
= md
.ctr
.ctr1
.array
[i
].originating_usn
;
127 attids
[n
] = md
.ctr
.ctr1
.array
[i
].attid
;
132 note that if n==0 we still need to send the change, as it
133 could be a rename, which changes the uSNChanged, but not any
134 of the replicated attributes
137 obj
->meta_data_ctr
->count
= n
;
139 obj
->object
.identifier
= talloc(obj
, struct drsuapi_DsReplicaObjectIdentifier
);
140 obj_dn
= ldb_msg_find_attr_as_dn(sam_ctx
, obj
, msg
, "distinguishedName");
141 obj
->object
.identifier
->dn
= ldb_dn_get_linearized(obj_dn
);
142 obj
->object
.identifier
->guid
= samdb_result_guid(msg
, "objectGUID");
143 sid
= samdb_result_dom_sid(obj
, msg
, "objectSid");
145 dom_sid_split_rid(NULL
, sid
, NULL
, &rid
);
146 obj
->object
.identifier
->sid
= *sid
;
148 ZERO_STRUCT(obj
->object
.identifier
->sid
);
151 obj
->object
.flags
= DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER
;
152 obj
->object
.attribute_ctr
.num_attributes
= obj
->meta_data_ctr
->count
;
153 obj
->object
.attribute_ctr
.attributes
= talloc_array(obj
, struct drsuapi_DsReplicaAttribute
,
154 obj
->object
.attribute_ctr
.num_attributes
);
157 * Note that the meta_data array and the attributes array must
158 * be the same size and in the same order
160 for (i
=0; i
<obj
->object
.attribute_ctr
.num_attributes
; i
++) {
161 struct ldb_message_element
*el
;
163 const struct dsdb_attribute
*sa
;
165 sa
= dsdb_attribute_by_attributeID_id(schema
, attids
[i
]);
167 DEBUG(0,("Unable to find attributeID %u in schema\n", attids
[i
]));
168 return WERR_DS_DRA_INTERNAL_ERROR
;
171 el
= ldb_msg_find_element(msg
, sa
->lDAPDisplayName
);
173 DEBUG(0,("No element '%s' for attributeID %u in message\n",
174 sa
->lDAPDisplayName
, attids
[i
]));
175 ZERO_STRUCT(obj
->object
.attribute_ctr
.attributes
[i
]);
176 obj
->object
.attribute_ctr
.attributes
[i
].attid
= attids
[i
];
178 werr
= dsdb_attribute_ldb_to_drsuapi(sam_ctx
, schema
, el
, obj
,
179 &obj
->object
.attribute_ctr
.attributes
[i
]);
180 if (!W_ERROR_IS_OK(werr
)) {
181 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
182 sa
->lDAPDisplayName
, win_errstr(werr
)));
186 /* some attributes needs to be encrypted
188 werr
= drsuapi_encrypt_attribute(obj
, session_key
, rid
,
189 &obj
->object
.attribute_ctr
.attributes
[i
]);
190 if (!W_ERROR_IS_OK(werr
)) {
191 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
192 sa
->lDAPDisplayName
, win_errstr(werr
)));
202 load replUpToDateVector from a DN
204 static WERROR
load_udv(struct ldb_context
*sam_ctx
, TALLOC_CTX
*mem_ctx
,
205 struct ldb_dn
*dn
, struct replUpToDateVectorBlob
*ouv
)
207 const char *attrs
[] = { "replUpToDateVector", NULL
};
208 struct ldb_result
*res
= NULL
;
209 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
210 struct ldb_message_element
*el
;
211 enum ndr_err_code ndr_err
;
215 if (ldb_search(sam_ctx
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, attrs
, NULL
) != LDB_SUCCESS
||
217 DEBUG(0,("load_udv: failed to read partition object\n"));
218 talloc_free(tmp_ctx
);
219 return WERR_DS_DRA_INTERNAL_ERROR
;
222 el
= ldb_msg_find_element(res
->msgs
[0], "replUpToDateVector");
223 if (el
== NULL
|| el
->num_values
< 1) {
224 talloc_free(tmp_ctx
);
229 ndr_err
= ndr_pull_struct_blob(&el
->values
[0],
230 mem_ctx
, lp_iconv_convenience(ldb_get_opaque(sam_ctx
, "loadparm")),
232 (ndr_pull_flags_fn_t
)ndr_pull_replUpToDateVectorBlob
);
233 talloc_free(tmp_ctx
);
234 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
235 DEBUG(0,(__location__
": Failed to parse replUpToDateVector for %s\n",
236 ldb_dn_get_linearized(dn
)));
237 return WERR_DS_DRA_INTERNAL_ERROR
;
245 fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
247 static WERROR
get_nc_changes_udv(struct ldb_context
*sam_ctx
,
248 struct ldb_dn
*ncRoot_dn
,
249 struct drsuapi_DsReplicaCursor2CtrEx
*udv
)
252 struct drsuapi_DsReplicaCursor2
*tmp_cursor
;
253 uint64_t highest_commited_usn
;
255 time_t t
= time(NULL
);
257 struct replUpToDateVectorBlob ouv
;
259 werr
= load_udv(sam_ctx
, udv
, ncRoot_dn
, &ouv
);
260 if (!W_ERROR_IS_OK(werr
)) {
264 ret
= ldb_sequence_number(sam_ctx
, LDB_SEQ_HIGHEST_SEQ
, &highest_commited_usn
);
265 if (ret
!= LDB_SUCCESS
) {
266 return WERR_DS_DRA_INTERNAL_ERROR
;
269 tmp_cursor
= talloc(udv
, struct drsuapi_DsReplicaCursor2
);
270 tmp_cursor
->source_dsa_invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
271 tmp_cursor
->highest_usn
= highest_commited_usn
;
272 unix_to_nt_time(&now
, t
);
273 tmp_cursor
->last_sync_success
= now
;
275 udv
->count
= ouv
.ctr
.ctr2
.count
+ 1;
276 udv
->cursors
= talloc_steal(udv
, ouv
.ctr
.ctr2
.cursors
);
277 udv
->cursors
= talloc_realloc(udv
, udv
->cursors
, struct drsuapi_DsReplicaCursor2
, udv
->count
);
279 return WERR_DS_DRA_INTERNAL_ERROR
;
281 udv
->cursors
[udv
->count
- 1] = *tmp_cursor
;
283 qsort(udv
->cursors
, udv
->count
,
284 sizeof(struct drsuapi_DsReplicaCursor2
),
285 (comparison_fn_t
)drsuapi_DsReplicaCursor2_compare
);
291 drsuapi_DsGetNCChanges
293 WERROR
dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
294 struct drsuapi_DsGetNCChanges
*r
)
296 struct ldb_result
*site_res
;
297 struct drsuapi_DsReplicaObjectIdentifier
*ncRoot
;
298 struct ldb_context
*sam_ctx
;
299 struct ldb_dn
*ncRoot_dn
;
302 struct dsdb_schema
*schema
;
303 struct drsuapi_DsReplicaOIDMapping_Ctr
*ctr
;
304 struct drsuapi_DsReplicaObjectListItemEx
**currentObject
;
306 DATA_BLOB session_key
;
307 const char *attrs
[] = { "*", "parentGUID", "distinguishedName", NULL
};
311 *r
->out
.level_out
= 6;
312 /* TODO: linked attributes*/
313 r
->out
.ctr
->ctr6
.linked_attributes_count
= 0;
314 r
->out
.ctr
->ctr6
.linked_attributes
= NULL
;
316 r
->out
.ctr
->ctr6
.object_count
= 0;
317 r
->out
.ctr
->ctr6
.more_data
= false;
318 r
->out
.ctr
->ctr6
.uptodateness_vector
= NULL
;
320 /* Check request revision. */
321 if (r
->in
.level
!= 8) {
322 return WERR_REVISION_MISMATCH
;
325 /* Perform access checks. */
326 if (r
->in
.req
->req8
.naming_context
== NULL
) {
327 return WERR_DS_DRA_INVALID_PARAMETER
;
330 ncRoot
= r
->in
.req
->req8
.naming_context
;
331 if (ncRoot
== NULL
) {
332 return WERR_DS_DRA_BAD_NC
;
335 werr
= drs_security_level_check(dce_call
, "DsGetNCChanges");
336 if (!W_ERROR_IS_OK(werr
)) {
341 * connect to the samdb. TODO: We need to check that the caller
342 * has the rights to do this. This exposes all attributes,
343 * including all passwords.
345 sam_ctx
= samdb_connect(mem_ctx
, dce_call
->event_ctx
, dce_call
->conn
->dce_ctx
->lp_ctx
,
346 system_session(mem_ctx
, dce_call
->conn
->dce_ctx
->lp_ctx
));
351 /* we need the session key for encrypting password attributes */
352 status
= dcesrv_inherited_session_key(dce_call
->conn
, &session_key
);
353 if (!NT_STATUS_IS_OK(status
)) {
354 DEBUG(0,(__location__
": Failed to get session key\n"));
355 return WERR_DS_DRA_INTERNAL_ERROR
;
358 /* Construct response. */
359 search_filter
= talloc_asprintf(mem_ctx
,
360 "(uSNChanged>=%llu)",
361 (unsigned long long)(r
->in
.req
->req8
.highwatermark
.highest_usn
+1));
363 if ((r
->in
.req
->req8
.replica_flags
& DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY
)
364 == DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY
) {
365 search_filter
= talloc_asprintf(mem_ctx
,
366 "(&%s(isCriticalSystemObject=true))",
369 ncRoot_dn
= ldb_dn_new(mem_ctx
, sam_ctx
, ncRoot
->dn
);
370 ret
= drsuapi_search_with_extended_dn(sam_ctx
, mem_ctx
, &site_res
,
371 ncRoot_dn
, LDB_SCOPE_SUBTREE
, attrs
,
374 if (ret
!= LDB_SUCCESS
) {
375 return WERR_DS_DRA_INTERNAL_ERROR
;
380 schema
= dsdb_get_schema(sam_ctx
);
382 DEBUG(0,("No schema in sam_ctx\n"));
383 return WERR_DS_DRA_INTERNAL_ERROR
;
386 r
->out
.ctr
->ctr6
.naming_context
= talloc(mem_ctx
, struct drsuapi_DsReplicaObjectIdentifier
);
387 *r
->out
.ctr
->ctr6
.naming_context
= *ncRoot
;
389 if (dsdb_find_guid_by_dn(sam_ctx
, ncRoot_dn
, &r
->out
.ctr
->ctr6
.naming_context
->guid
) != LDB_SUCCESS
) {
390 DEBUG(0,(__location__
": Failed to find GUID of ncRoot_dn %s\n",
391 ldb_dn_get_linearized(ncRoot_dn
)));
392 return WERR_DS_DRA_INTERNAL_ERROR
;
395 /* find the SID if there is one */
396 dsdb_find_sid_by_dn(sam_ctx
, ncRoot_dn
, &r
->out
.ctr
->ctr6
.naming_context
->sid
);
398 dsdb_get_oid_mappings_drsuapi(schema
, true, mem_ctx
, &ctr
);
399 r
->out
.ctr
->ctr6
.mapping_ctr
= *ctr
;
401 r
->out
.ctr
->ctr6
.source_dsa_guid
= *(samdb_ntds_objectGUID(sam_ctx
));
402 r
->out
.ctr
->ctr6
.source_dsa_invocation_id
= *(samdb_ntds_invocation_id(sam_ctx
));
404 r
->out
.ctr
->ctr6
.old_highwatermark
= r
->in
.req
->req8
.highwatermark
;
405 r
->out
.ctr
->ctr6
.new_highwatermark
= r
->in
.req
->req8
.highwatermark
;
407 r
->out
.ctr
->ctr6
.uptodateness_vector
= talloc(mem_ctx
, struct drsuapi_DsReplicaCursor2CtrEx
);
408 r
->out
.ctr
->ctr6
.uptodateness_vector
->version
= 2;
409 r
->out
.ctr
->ctr6
.uptodateness_vector
->reserved1
= 0;
410 r
->out
.ctr
->ctr6
.uptodateness_vector
->reserved2
= 0;
412 r
->out
.ctr
->ctr6
.first_object
= NULL
;
413 currentObject
= &r
->out
.ctr
->ctr6
.first_object
;
415 for(i
=0; i
<site_res
->count
; i
++) {
417 struct drsuapi_DsReplicaObjectListItemEx
*obj
;
418 obj
= talloc_zero(mem_ctx
, struct drsuapi_DsReplicaObjectListItemEx
);
420 uSN
= ldb_msg_find_attr_as_int(site_res
->msgs
[i
], "uSNChanged", -1);
421 if (uSN
> r
->out
.ctr
->ctr6
.new_highwatermark
.highest_usn
) {
422 r
->out
.ctr
->ctr6
.new_highwatermark
.tmp_highest_usn
= uSN
;
423 r
->out
.ctr
->ctr6
.new_highwatermark
.highest_usn
= uSN
;
426 werr
= get_nc_changes_build_object(obj
, site_res
->msgs
[i
], sam_ctx
, ncRoot_dn
,
427 schema
, &session_key
, r
->in
.req
->req8
.highwatermark
.highest_usn
);
428 if (!W_ERROR_IS_OK(werr
)) {
432 if (obj
->meta_data_ctr
== NULL
) {
433 /* no attributes to send */
438 r
->out
.ctr
->ctr6
.object_count
++;
440 *currentObject
= obj
;
441 currentObject
= &obj
->next_object
;
444 werr
= get_nc_changes_udv(sam_ctx
, ncRoot_dn
, r
->out
.ctr
->ctr6
.uptodateness_vector
);
445 if (!W_ERROR_IS_OK(werr
)) {
450 DEBUG(3,("DsGetNCChanges with uSNChanged >= %llu on %s gave %u objects\n",
451 (unsigned long long)(r
->in
.req
->req8
.highwatermark
.highest_usn
+1),
452 ncRoot
->dn
, r
->out
.ctr
->ctr6
.object_count
));
454 if (r
->out
.ctr
->ctr6
.object_count
<= 10 && DEBUGLVL(6)) {
455 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges
, NDR_IN
|NDR_OUT
, r
);