2 Unix SMB/CIFS mplementation.
3 Helper functions for applying replicated objects
5 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "dsdb/samdb/samdb.h"
24 #include <ldb_errors.h>
25 #include "../lib/util/dlinklist.h"
26 #include "librpc/gen_ndr/ndr_misc.h"
27 #include "librpc/gen_ndr/ndr_drsuapi.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "../lib/crypto/crypto.h"
30 #include "../libcli/drsuapi/drsuapi.h"
31 #include "libcli/auth/libcli_auth.h"
32 #include "param/param.h"
34 static WERROR dsdb_repl_merge_working_schema(struct ldb_context *ldb,
35 struct dsdb_schema *dest_schema,
36 const struct dsdb_schema *ref_schema)
38 const struct dsdb_class *cur_class = NULL;
39 const struct dsdb_attribute *cur_attr = NULL;
42 for (cur_class = ref_schema->classes;
44 cur_class = cur_class->next)
46 const struct dsdb_class *tmp1;
47 struct dsdb_class *tmp2;
49 tmp1 = dsdb_class_by_governsID_id(dest_schema,
50 cur_class->governsID_id);
56 * Do a shallow copy so that original next and prev are
57 * not modified, we don't need to do a deep copy
58 * as the rest won't be modified and this is for
59 * a short lived object.
61 tmp2 = talloc(dest_schema, struct dsdb_class);
66 DLIST_ADD(dest_schema->classes, tmp2);
69 for (cur_attr = ref_schema->attributes;
71 cur_attr = cur_attr->next)
73 const struct dsdb_attribute *tmp1;
74 struct dsdb_attribute *tmp2;
76 tmp1 = dsdb_attribute_by_attributeID_id(dest_schema,
77 cur_attr->attributeID_id);
83 * Do a shallow copy so that original next and prev are
84 * not modified, we don't need to do a deep copy
85 * as the rest won't be modified and this is for
86 * a short lived object.
88 tmp2 = talloc(dest_schema, struct dsdb_attribute);
93 DLIST_ADD(dest_schema->attributes, tmp2);
96 ret = dsdb_setup_sorted_accessors(ldb, dest_schema);
97 if (LDB_SUCCESS != ret) {
98 DEBUG(0,("Failed to add new attribute to reference schema!\n"));
99 return WERR_INTERNAL_ERROR;
105 WERROR dsdb_repl_resolve_working_schema(struct ldb_context *ldb,
107 struct dsdb_schema_prefixmap *pfm_remote,
108 uint32_t cycle_before_switching,
109 struct dsdb_schema *initial_schema,
110 struct dsdb_schema *resulting_schema,
111 uint32_t object_count,
112 const struct drsuapi_DsReplicaObjectListItemEx *first_object)
115 struct schema_list *next, *prev;
116 const struct drsuapi_DsReplicaObjectListItemEx *obj;
118 struct schema_list *schema_list = NULL, *schema_list_item, *schema_list_next_item;
120 struct dsdb_schema *working_schema;
121 const struct drsuapi_DsReplicaObjectListItemEx *cur;
122 DATA_BLOB empty_key = data_blob_null;
124 uint32_t ignore_attids[] = {
125 DRSUAPI_ATTID_auxiliaryClass,
126 DRSUAPI_ATTID_mayContain,
127 DRSUAPI_ATTID_mustContain,
128 DRSUAPI_ATTID_possSuperiors,
129 DRSUAPI_ATTID_systemPossSuperiors,
130 DRSUAPI_ATTID_INVALID
133 /* create a list of objects yet to be converted */
134 for (cur = first_object; cur; cur = cur->next_object) {
135 schema_list_item = talloc(mem_ctx, struct schema_list);
136 if (schema_list_item == NULL) {
140 schema_list_item->obj = cur;
141 DLIST_ADD_END(schema_list, schema_list_item);
144 /* resolve objects until all are resolved and in local schema */
146 working_schema = initial_schema;
148 while (schema_list) {
149 uint32_t converted_obj_count = 0;
150 uint32_t failed_obj_count = 0;
152 if (resulting_schema != working_schema) {
154 * If the selfmade schema is not the schema used to
155 * translate and validate replicated object,
156 * Which means that we are using the bootstrap schema
157 * Then we add attributes and classes that were already
158 * translated to the working schema, the idea is that
159 * we might need to add new attributes and classes
160 * to be able to translate critical replicated objects
161 * and without that we wouldn't be able to translate them
163 werr = dsdb_repl_merge_working_schema(ldb,
166 if (!W_ERROR_IS_OK(werr)) {
171 for (schema_list_item = schema_list;
173 schema_list_item=schema_list_next_item) {
174 struct dsdb_extended_replicated_object object;
176 cur = schema_list_item->obj;
179 * Save the next item, now we have saved out
180 * the current one, so we can DLIST_REMOVE it
183 schema_list_next_item = schema_list_item->next;
186 * Convert the objects into LDB messages using the
187 * schema we have so far. It's ok if we fail to convert
188 * an object. We should convert more objects on next pass.
190 werr = dsdb_convert_object_ex(ldb, working_schema,
196 schema_list_item, &object);
197 if (!W_ERROR_IS_OK(werr)) {
198 DEBUG(4,("debug: Failed to convert schema "
199 "object %s into ldb msg, "
200 "will try during next loop\n",
201 cur->object.identifier->dn));
206 * Convert the schema from ldb_message format
207 * (OIDs as OID strings) into schema, using
208 * the remote prefixMap
210 * It's not likely, but possible to get the
211 * same object twice and we should keep
214 werr = dsdb_schema_set_el_from_ldb_msg_dups(ldb,
218 if (!W_ERROR_IS_OK(werr)) {
219 DEBUG(4,("debug: failed to convert "
220 "object %s into a schema element, "
221 "will try during next loop: %s\n",
222 ldb_dn_get_linearized(object.msg->dn),
226 DEBUG(8,("Converted object %s into a schema element\n",
227 ldb_dn_get_linearized(object.msg->dn)));
228 DLIST_REMOVE(schema_list, schema_list_item);
229 TALLOC_FREE(schema_list_item);
230 converted_obj_count++;
235 DEBUG(4,("Schema load pass %d: converted %d, %d of %d objects left to be converted.\n",
236 pass_no, converted_obj_count, failed_obj_count, object_count));
238 /* check if we converted any objects in this pass */
239 if (converted_obj_count == 0) {
240 DEBUG(0,("Can't continue Schema load: "
241 "didn't manage to convert any objects: "
242 "all %d remaining of %d objects "
243 "failed to convert\n",
244 failed_obj_count, object_count));
245 return WERR_INTERNAL_ERROR;
249 * Don't try to load the schema if there is missing object
250 * _and_ we are on the first pass as some critical objects
253 if (failed_obj_count == 0 || pass_no > cycle_before_switching) {
254 /* prepare for another cycle */
255 working_schema = resulting_schema;
257 ret = dsdb_setup_sorted_accessors(ldb, working_schema);
258 if (LDB_SUCCESS != ret) {
259 DEBUG(0,("Failed to create schema-cache indexes!\n"));
260 return WERR_INTERNAL_ERROR;
270 * Multi-pass working schema creation
272 * - shallow copy initial schema supplied
273 * - create a working schema in multiple passes
274 * until all objects are resolved
275 * Working schema is a schema with Attributes, Classes
276 * and indexes, but w/o subClassOf, possibleSupperiors etc.
277 * It is to be used just us cache for converting attribute values.
279 WERROR dsdb_repl_make_working_schema(struct ldb_context *ldb,
280 const struct dsdb_schema *initial_schema,
281 const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr,
282 uint32_t object_count,
283 const struct drsuapi_DsReplicaObjectListItemEx *first_object,
284 const DATA_BLOB *gensec_skey,
286 struct dsdb_schema **_schema_out)
289 struct dsdb_schema_prefixmap *pfm_remote;
290 struct dsdb_schema *working_schema;
292 /* make a copy of the iniatial_scheam so we don't mess with it */
293 working_schema = dsdb_schema_copy_shallow(mem_ctx, ldb, initial_schema);
294 if (!working_schema) {
295 DEBUG(0,(__location__ ": schema copy failed!\n"));
299 /* we are going to need remote prefixMap for decoding */
300 werr = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true,
301 mem_ctx, &pfm_remote, NULL);
302 if (!W_ERROR_IS_OK(werr)) {
303 DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s",
308 werr = dsdb_repl_resolve_working_schema(ldb, mem_ctx,
310 0, /* cycle_before_switching */
315 if (!W_ERROR_IS_OK(werr)) {
316 DEBUG(0, ("%s: dsdb_repl_resolve_working_schema() failed: %s",
317 __location__, win_errstr(werr)));
321 *_schema_out = working_schema;
326 static bool dsdb_attid_in_list(const uint32_t attid_list[], uint32_t attid)
332 for (cur = attid_list; *cur != DRSUAPI_ATTID_INVALID; cur++) {
340 WERROR dsdb_convert_object_ex(struct ldb_context *ldb,
341 const struct dsdb_schema *schema,
342 struct ldb_dn *partition_dn,
343 const struct dsdb_schema_prefixmap *pfm_remote,
344 const struct drsuapi_DsReplicaObjectListItemEx *in,
345 const DATA_BLOB *gensec_skey,
346 const uint32_t *ignore_attids,
347 uint32_t dsdb_repl_flags,
349 struct dsdb_extended_replicated_object *out)
352 WERROR status = WERR_OK;
354 struct ldb_message *msg;
355 struct replPropertyMetaDataBlob *md;
357 struct ldb_message_element *instanceType_e = NULL;
358 struct ldb_val guid_value;
359 struct ldb_val parent_guid_value;
360 NTTIME whenChanged = 0;
361 time_t whenChanged_t;
362 const char *whenChanged_s;
363 struct drsuapi_DsReplicaAttribute *name_a = NULL;
364 struct drsuapi_DsReplicaMetaData *name_d = NULL;
365 struct replPropertyMetaData1 *rdn_m = NULL;
366 struct dom_sid *sid = NULL;
371 if (!in->object.identifier) {
375 if (!in->object.identifier->dn || !in->object.identifier->dn[0]) {
379 if (in->object.attribute_ctr.num_attributes != 0 && !in->meta_data_ctr) {
383 if (in->object.attribute_ctr.num_attributes != in->meta_data_ctr->count) {
387 sid = &in->object.identifier->sid;
388 if (sid->num_auths > 0) {
389 rid = sid->sub_auths[sid->num_auths - 1];
392 msg = ldb_msg_new(mem_ctx);
393 W_ERROR_HAVE_NO_MEMORY(msg);
395 msg->dn = ldb_dn_new(msg, ldb, in->object.identifier->dn);
396 W_ERROR_HAVE_NO_MEMORY(msg->dn);
398 msg->num_elements = in->object.attribute_ctr.num_attributes;
399 msg->elements = talloc_array(msg, struct ldb_message_element,
400 msg->num_elements + 1); /* +1 because of the RDN attribute */
401 W_ERROR_HAVE_NO_MEMORY(msg->elements);
403 md = talloc(mem_ctx, struct replPropertyMetaDataBlob);
404 W_ERROR_HAVE_NO_MEMORY(md);
408 md->ctr.ctr1.count = in->meta_data_ctr->count;
409 md->ctr.ctr1.reserved = 0;
410 md->ctr.ctr1.array = talloc_array(mem_ctx,
411 struct replPropertyMetaData1,
412 md->ctr.ctr1.count + 1); /* +1 because of the RDN attribute */
413 W_ERROR_HAVE_NO_MEMORY(md->ctr.ctr1.array);
415 for (i=0, attr_count=0; i < in->meta_data_ctr->count; i++, attr_count++) {
416 struct drsuapi_DsReplicaAttribute *a;
417 struct drsuapi_DsReplicaMetaData *d;
418 struct replPropertyMetaData1 *m;
419 struct ldb_message_element *e;
422 a = &in->object.attribute_ctr.attributes[i];
423 d = &in->meta_data_ctr->meta_data[i];
424 m = &md->ctr.ctr1.array[attr_count];
425 e = &msg->elements[attr_count];
427 if (dsdb_attid_in_list(ignore_attids, a->attid)) {
432 if (GUID_all_zero(&d->originating_invocation_id)) {
433 status = WERR_DS_SRC_GUID_MISMATCH;
434 DEBUG(0, ("Refusing replication of object containing invalid zero invocationID on attribute %d of %s: %s\n",
436 ldb_dn_get_linearized(msg->dn),
437 win_errstr(status)));
441 if (a->attid == DRSUAPI_ATTID_instanceType) {
442 if (instanceType_e != NULL) {
448 for (j=0; j<a->value_ctr.num_values; j++) {
449 status = drsuapi_decrypt_attribute(a->value_ctr.values[j].blob,
452 if (!W_ERROR_IS_OK(status)) {
456 if (W_ERROR_EQUAL(status, WERR_TOO_MANY_SECRETS)) {
457 WERROR get_name_status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,
458 a, msg->elements, e, NULL);
459 if (W_ERROR_IS_OK(get_name_status)) {
460 DEBUG(0, ("Unxpectedly got secret value %s on %s from DRS server\n",
461 e->name, ldb_dn_get_linearized(msg->dn)));
463 DEBUG(0, ("Unxpectedly got secret value on %s from DRS server",
464 ldb_dn_get_linearized(msg->dn)));
466 } else if (!W_ERROR_IS_OK(status)) {
471 * This function also fills in the local attid value,
472 * based on comparing the remote and local prefixMap
473 * tables. If we don't convert the value, then we can
474 * have invalid values in the replPropertyMetaData we
475 * store on disk, as the prefixMap is per host, not
476 * per-domain. This may be why Microsoft added the
477 * msDS-IntID feature, however this is not used for
478 * extra attributes in the schema partition itself.
480 status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,
483 W_ERROR_NOT_OK_RETURN(status);
485 m->version = d->version;
486 m->originating_change_time = d->originating_change_time;
487 m->originating_invocation_id = d->originating_invocation_id;
488 m->originating_usn = d->originating_usn;
491 if (d->originating_change_time > whenChanged) {
492 whenChanged = d->originating_change_time;
495 if (a->attid == DRSUAPI_ATTID_name) {
501 msg->num_elements = attr_count;
502 md->ctr.ctr1.count = attr_count;
504 rdn_m = &md->ctr.ctr1.array[md->ctr.ctr1.count];
508 struct ldb_message_element *el;
509 const char *rdn_name = NULL;
510 const struct ldb_val *rdn_value = NULL;
511 const struct dsdb_attribute *rdn_attr = NULL;
515 * We only need the schema calls for the RDN in this
516 * codepath, and by doing this we avoid needing to
517 * have the dsdb_attribute_by_lDAPDisplayName accessor
518 * working during the schema load.
520 rdn_name = ldb_dn_get_rdn_name(msg->dn);
521 rdn_attr = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
525 rdn_attid = rdn_attr->attributeID_id;
526 rdn_value = ldb_dn_get_rdn_val(msg->dn);
528 el = ldb_msg_find_element(msg, rdn_attr->lDAPDisplayName);
530 ret = ldb_msg_add_value(msg, rdn_attr->lDAPDisplayName, rdn_value, NULL);
531 if (ret != LDB_SUCCESS) {
535 if (el->num_values != 1) {
536 DEBUG(0,(__location__ ": Unexpected num_values=%u\n",
540 if (!ldb_val_equal_exact(&el->values[0], rdn_value)) {
541 DEBUG(0,(__location__ ": RDN value changed? '%*.*s' '%*.*s'\n",
542 (int)el->values[0].length, (int)el->values[0].length, el->values[0].data,
543 (int)rdn_value->length, (int)rdn_value->length, rdn_value->data));
548 rdn_m->attid = rdn_attid;
549 rdn_m->version = name_d->version;
550 rdn_m->originating_change_time = name_d->originating_change_time;
551 rdn_m->originating_invocation_id = name_d->originating_invocation_id;
552 rdn_m->originating_usn = name_d->originating_usn;
553 rdn_m->local_usn = 0;
554 md->ctr.ctr1.count++;
558 if (instanceType_e == NULL) {
562 instanceType = ldb_msg_find_attr_as_int(msg, "instanceType", 0);
564 if ((instanceType & INSTANCE_TYPE_IS_NC_HEAD)
565 && partition_dn != NULL) {
566 int partition_dn_cmp = ldb_dn_compare(partition_dn, msg->dn);
567 if (partition_dn_cmp != 0) {
568 DEBUG(4, ("Remote server advised us of a new partition %s while processing %s, ignoring\n",
569 ldb_dn_get_linearized(msg->dn),
570 ldb_dn_get_linearized(partition_dn)));
571 return WERR_DS_ADD_REPLICA_INHIBITED;
575 if (dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
576 /* the instanceType type for partial_replica
577 replication is sent via DRS with TYPE_WRITE set, but
578 must be used on the client with TYPE_WRITE removed
580 if (instanceType & INSTANCE_TYPE_WRITE) {
582 * Make sure we do not change the order
586 * instanceType_e->num_values = 0
588 * ldb_msg_remove_attr(msg, "instanceType");
590 struct ldb_message_element *e;
592 e = ldb_msg_find_element(msg, "instanceType");
593 if (e != instanceType_e) {
594 DEBUG(0,("instanceType_e[%p] changed to e[%p]\n",
599 instanceType_e->num_values = 0;
601 instanceType &= ~INSTANCE_TYPE_WRITE;
602 if (ldb_msg_add_fmt(msg, "instanceType", "%d", instanceType) != LDB_SUCCESS) {
603 return WERR_INTERNAL_ERROR;
607 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
608 DEBUG(0, ("Refusing to replicate %s from a read-only repilca into a read-write replica!\n",
609 ldb_dn_get_linearized(msg->dn)));
610 return WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA;
614 whenChanged_t = nt_time_to_unix(whenChanged);
615 whenChanged_s = ldb_timestring(msg, whenChanged_t);
616 W_ERROR_HAVE_NO_MEMORY(whenChanged_s);
618 nt_status = GUID_to_ndr_blob(&in->object.identifier->guid, msg, &guid_value);
619 if (!NT_STATUS_IS_OK(nt_status)) {
620 return ntstatus_to_werror(nt_status);
623 if (in->parent_object_guid) {
624 nt_status = GUID_to_ndr_blob(in->parent_object_guid, msg, &parent_guid_value);
625 if (!NT_STATUS_IS_OK(nt_status)) {
626 return ntstatus_to_werror(nt_status);
629 parent_guid_value = data_blob_null;
633 out->guid_value = guid_value;
634 out->parent_guid_value = parent_guid_value;
635 out->when_changed = whenChanged_s;
640 WERROR dsdb_replicated_objects_convert(struct ldb_context *ldb,
641 const struct dsdb_schema *schema,
642 struct ldb_dn *partition_dn,
643 const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr,
644 uint32_t object_count,
645 const struct drsuapi_DsReplicaObjectListItemEx *first_object,
646 uint32_t linked_attributes_count,
647 const struct drsuapi_DsReplicaLinkedAttribute *linked_attributes,
648 const struct repsFromTo1 *source_dsa,
649 const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector,
650 const DATA_BLOB *gensec_skey,
651 uint32_t dsdb_repl_flags,
653 struct dsdb_extended_replicated_objects **objects)
656 struct dsdb_schema_prefixmap *pfm_remote;
657 struct dsdb_extended_replicated_objects *out;
658 const struct drsuapi_DsReplicaObjectListItemEx *cur;
661 out = talloc_zero(mem_ctx, struct dsdb_extended_replicated_objects);
662 W_ERROR_HAVE_NO_MEMORY(out);
663 out->version = DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION;
664 out->dsdb_repl_flags = dsdb_repl_flags;
667 * Ensure schema is kept valid for as long as 'out'
668 * which may contain pointers to it
670 schema = talloc_reference(out, schema);
671 W_ERROR_HAVE_NO_MEMORY(schema);
673 status = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true,
674 out, &pfm_remote, NULL);
675 if (!W_ERROR_IS_OK(status)) {
676 DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s",
677 win_errstr(status)));
682 if (ldb_dn_compare(partition_dn, ldb_get_schema_basedn(ldb)) != 0) {
684 * check for schema changes in case
685 * we are not replicating Schema NC
687 status = dsdb_schema_info_cmp(schema, mapping_ctr);
688 if (!W_ERROR_IS_OK(status)) {
689 DEBUG(1,("Remote schema has changed while replicating %s\n",
690 ldb_dn_get_linearized(partition_dn)));
696 out->partition_dn = partition_dn;
698 out->source_dsa = source_dsa;
699 out->uptodateness_vector= uptodateness_vector;
701 out->num_objects = 0;
702 out->objects = talloc_array(out,
703 struct dsdb_extended_replicated_object,
705 W_ERROR_HAVE_NO_MEMORY_AND_FREE(out->objects, out);
707 /* pass the linked attributes down to the repl_meta_data
709 out->linked_attributes_count = linked_attributes_count;
710 out->linked_attributes = linked_attributes;
712 for (i=0, cur = first_object; cur; cur = cur->next_object, i++) {
713 if (i == object_count) {
718 status = dsdb_convert_object_ex(ldb, schema, out->partition_dn,
724 &out->objects[out->num_objects]);
727 * Check to see if we have been advised of a
728 * subdomain or new application partition. We don't
729 * want to start on that here, instead the caller
730 * should consider if it would like to replicate it
731 * based on the cross-ref object.
733 if (W_ERROR_EQUAL(status, WERR_DS_ADD_REPLICA_INHIBITED)) {
737 if (!W_ERROR_IS_OK(status)) {
739 DEBUG(0,("Failed to convert object %s: %s\n",
740 cur->object.identifier->dn,
741 win_errstr(status)));
745 /* Assuming we didn't skip or error, increment the number of objects */
748 out->objects = talloc_realloc(out, out->objects,
749 struct dsdb_extended_replicated_object,
751 if (out->num_objects != 0 && out->objects == NULL) {
755 if (i != object_count) {
760 /* free pfm_remote, we won't need it anymore */
761 talloc_free(pfm_remote);
768 * Commits a list of replicated objects.
770 * @param working_schema dsdb_schema to be used for resolving
771 * Classes/Attributes during Schema replication. If not NULL,
772 * it will be set on ldb and used while committing replicated objects
774 WERROR dsdb_replicated_objects_commit(struct ldb_context *ldb,
775 struct dsdb_schema *working_schema,
776 struct dsdb_extended_replicated_objects *objects,
777 uint64_t *notify_uSN)
780 struct ldb_result *ext_res;
781 struct dsdb_schema *cur_schema = NULL;
782 struct dsdb_schema *new_schema = NULL;
784 uint64_t seq_num1, seq_num2;
785 bool used_global_schema = false;
787 TALLOC_CTX *tmp_ctx = talloc_new(objects);
789 DEBUG(0,("Failed to start talloc\n"));
793 /* TODO: handle linked attributes */
795 /* wrap the extended operation in a transaction
796 See [MS-DRSR] 3.3.2 Transactions
798 ret = ldb_transaction_start(ldb);
799 if (ret != LDB_SUCCESS) {
800 DEBUG(0,(__location__ " Failed to start transaction\n"));
804 ret = dsdb_load_partition_usn(ldb, objects->partition_dn, &seq_num1, NULL);
805 if (ret != LDB_SUCCESS) {
806 DEBUG(0,(__location__ " Failed to load partition uSN\n"));
807 ldb_transaction_cancel(ldb);
808 TALLOC_FREE(tmp_ctx);
813 * Set working_schema for ldb in case we are replicating from Schema NC.
814 * Schema won't be reloaded during Replicated Objects commit, as it is
815 * done in a transaction. So we need some way to search for newly
816 * added Classes and Attributes
818 if (working_schema) {
819 /* store current schema so we can fall back in case of failure */
820 cur_schema = dsdb_get_schema(ldb, tmp_ctx);
821 used_global_schema = dsdb_uses_global_schema(ldb);
823 ret = dsdb_reference_schema(ldb, working_schema, false);
824 if (ret != LDB_SUCCESS) {
825 DEBUG(0,(__location__ "Failed to reference working schema - %s\n",
827 /* TODO: Map LDB Error to NTSTATUS? */
828 ldb_transaction_cancel(ldb);
829 TALLOC_FREE(tmp_ctx);
830 return WERR_INTERNAL_ERROR;
834 ret = ldb_extended(ldb, DSDB_EXTENDED_REPLICATED_OBJECTS_OID, objects, &ext_res);
835 if (ret != LDB_SUCCESS) {
836 /* restore previous schema */
837 if (used_global_schema) {
838 dsdb_set_global_schema(ldb);
839 } else if (cur_schema) {
840 dsdb_reference_schema(ldb, cur_schema, false);
843 DEBUG(0,("Failed to apply records: %s: %s\n",
844 ldb_errstring(ldb), ldb_strerror(ret)));
845 ldb_transaction_cancel(ldb);
846 TALLOC_FREE(tmp_ctx);
849 talloc_free(ext_res);
851 /* Save our updated prefixMap */
852 if (working_schema) {
853 werr = dsdb_write_prefixes_from_schema_to_ldb(working_schema,
856 if (!W_ERROR_IS_OK(werr)) {
857 /* restore previous schema */
858 if (used_global_schema) {
859 dsdb_set_global_schema(ldb);
860 } else if (cur_schema ) {
861 dsdb_reference_schema(ldb, cur_schema, false);
863 DEBUG(0,("Failed to save updated prefixMap: %s\n",
865 TALLOC_FREE(tmp_ctx);
870 ret = ldb_transaction_prepare_commit(ldb);
871 if (ret != LDB_SUCCESS) {
872 /* restore previous schema */
873 if (used_global_schema) {
874 dsdb_set_global_schema(ldb);
875 } else if (cur_schema ) {
876 dsdb_reference_schema(ldb, cur_schema, false);
878 DEBUG(0,(__location__ " Failed to prepare commit of transaction: %s\n",
879 ldb_errstring(ldb)));
880 TALLOC_FREE(tmp_ctx);
884 ret = dsdb_load_partition_usn(ldb, objects->partition_dn, &seq_num2, NULL);
885 if (ret != LDB_SUCCESS) {
886 /* restore previous schema */
887 if (used_global_schema) {
888 dsdb_set_global_schema(ldb);
889 } else if (cur_schema ) {
890 dsdb_reference_schema(ldb, cur_schema, false);
892 DEBUG(0,(__location__ " Failed to load partition uSN\n"));
893 ldb_transaction_cancel(ldb);
894 TALLOC_FREE(tmp_ctx);
898 ret = ldb_transaction_commit(ldb);
899 if (ret != LDB_SUCCESS) {
900 /* restore previous schema */
901 if (used_global_schema) {
902 dsdb_set_global_schema(ldb);
903 } else if (cur_schema ) {
904 dsdb_reference_schema(ldb, cur_schema, false);
906 DEBUG(0,(__location__ " Failed to commit transaction\n"));
907 TALLOC_FREE(tmp_ctx);
911 /* if this replication partner didn't need to be notified
912 before this transaction then it still doesn't need to be
913 notified, as the changes came from this server */
914 if (seq_num2 > seq_num1 && seq_num1 <= *notify_uSN) {
915 *notify_uSN = seq_num2;
919 * Reset the Schema used by ldb. This will lead to
920 * a schema cache being refreshed from database.
922 if (working_schema) {
923 struct ldb_message *msg;
924 struct ldb_request *req;
927 working_schema->last_refresh = 0;
928 new_schema = dsdb_get_schema(ldb, tmp_ctx);
930 * If dsdb_get_schema() fails, we just fall back
931 * to what we had. However, the database is probably
932 * unable to operate for other users from this
934 if (new_schema && used_global_schema) {
935 dsdb_make_schema_global(ldb, new_schema);
936 } else if (used_global_schema) {
937 DEBUG(0,("Failed to re-load schema after commit of transaction\n"));
938 dsdb_set_global_schema(ldb);
939 TALLOC_FREE(tmp_ctx);
940 return WERR_INTERNAL_ERROR;
942 DEBUG(0,("Failed to re-load schema after commit of transaction\n"));
943 dsdb_reference_schema(ldb, cur_schema, false);
944 TALLOC_FREE(tmp_ctx);
945 return WERR_INTERNAL_ERROR;
947 msg = ldb_msg_new(tmp_ctx);
949 TALLOC_FREE(tmp_ctx);
952 msg->dn = ldb_dn_new(msg, ldb, "");
953 if (msg->dn == NULL) {
954 TALLOC_FREE(tmp_ctx);
958 ret = ldb_msg_add_string(msg, "schemaUpdateNow", "1");
959 if (ret != LDB_SUCCESS) {
960 TALLOC_FREE(tmp_ctx);
961 return WERR_INTERNAL_ERROR;
964 ret = ldb_build_mod_req(&req, ldb, objects,
968 ldb_op_default_callback,
971 if (ret != LDB_SUCCESS) {
972 TALLOC_FREE(tmp_ctx);
973 return WERR_DS_DRA_INTERNAL_ERROR;
976 ret = ldb_transaction_start(ldb);
977 if (ret != LDB_SUCCESS) {
978 TALLOC_FREE(tmp_ctx);
979 DEBUG(0, ("Autotransaction start failed\n"));
980 return WERR_DS_DRA_INTERNAL_ERROR;
983 ret = ldb_request(ldb, req);
984 if (ret == LDB_SUCCESS) {
985 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
988 if (ret == LDB_SUCCESS) {
989 ret = ldb_transaction_commit(ldb);
991 DEBUG(0, ("Schema update now failed: %s\n",
992 ldb_errstring(ldb)));
993 ldb_transaction_cancel(ldb);
996 if (ret != LDB_SUCCESS) {
997 DEBUG(0, ("Commit failed: %s\n", ldb_errstring(ldb)));
998 TALLOC_FREE(tmp_ctx);
999 return WERR_DS_INTERNAL_FAILURE;
1003 DEBUG(2,("Replicated %u objects (%u linked attributes) for %s\n",
1004 objects->num_objects, objects->linked_attributes_count,
1005 ldb_dn_get_linearized(objects->partition_dn)));
1007 TALLOC_FREE(tmp_ctx);
1011 static WERROR dsdb_origin_object_convert(struct ldb_context *ldb,
1012 const struct dsdb_schema *schema,
1013 const struct drsuapi_DsReplicaObjectListItem *in,
1014 TALLOC_CTX *mem_ctx,
1015 struct ldb_message **_msg)
1019 struct ldb_message *msg;
1021 if (!in->object.identifier) {
1025 if (!in->object.identifier->dn || !in->object.identifier->dn[0]) {
1029 msg = ldb_msg_new(mem_ctx);
1030 W_ERROR_HAVE_NO_MEMORY(msg);
1032 msg->dn = ldb_dn_new(msg, ldb, in->object.identifier->dn);
1033 W_ERROR_HAVE_NO_MEMORY(msg->dn);
1035 msg->num_elements = in->object.attribute_ctr.num_attributes;
1036 msg->elements = talloc_array(msg, struct ldb_message_element,
1038 W_ERROR_HAVE_NO_MEMORY(msg->elements);
1040 for (i=0; i < msg->num_elements; i++) {
1041 struct drsuapi_DsReplicaAttribute *a;
1042 struct ldb_message_element *e;
1044 a = &in->object.attribute_ctr.attributes[i];
1045 e = &msg->elements[i];
1047 status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, schema->prefixmap,
1048 a, msg->elements, e, NULL);
1049 W_ERROR_NOT_OK_RETURN(status);
1058 WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
1059 TALLOC_CTX *mem_ctx,
1060 const struct drsuapi_DsReplicaObjectListItem *first_object,
1062 uint32_t dsdb_repl_flags,
1063 struct drsuapi_DsReplicaObjectIdentifier2 **_ids)
1066 const struct dsdb_schema *schema;
1067 const struct drsuapi_DsReplicaObjectListItem *cur;
1068 struct ldb_message **objects;
1069 struct drsuapi_DsReplicaObjectIdentifier2 *ids;
1071 uint32_t num_objects = 0;
1072 const char * const attrs[] = {
1077 struct ldb_result *res;
1080 for (cur = first_object; cur; cur = cur->next_object) {
1084 if (num_objects == 0) {
1088 ret = ldb_transaction_start(ldb);
1089 if (ret != LDB_SUCCESS) {
1090 return WERR_DS_INTERNAL_FAILURE;
1093 objects = talloc_array(mem_ctx, struct ldb_message *,
1095 if (objects == NULL) {
1096 status = WERR_NOMEM;
1100 schema = dsdb_get_schema(ldb, objects);
1102 return WERR_DS_SCHEMA_NOT_LOADED;
1105 for (i=0, cur = first_object; cur; cur = cur->next_object, i++) {
1106 status = dsdb_origin_object_convert(ldb, schema, cur,
1107 objects, &objects[i]);
1108 if (!W_ERROR_IS_OK(status)) {
1113 ids = talloc_array(mem_ctx,
1114 struct drsuapi_DsReplicaObjectIdentifier2,
1117 status = WERR_NOMEM;
1121 if (dsdb_repl_flags & DSDB_REPL_FLAG_ADD_NCNAME) {
1122 /* check for possible NC creation */
1123 for (i=0; i < num_objects; i++) {
1124 struct ldb_message *msg = objects[i];
1125 struct ldb_message_element *el;
1126 struct ldb_dn *nc_dn;
1128 if (ldb_msg_check_string_attribute(msg, "objectClass", "crossRef") == 0) {
1131 el = ldb_msg_find_element(msg, "nCName");
1132 if (el == NULL || el->num_values != 1) {
1135 nc_dn = ldb_dn_from_ldb_val(objects, ldb, &el->values[0]);
1136 if (!ldb_dn_validate(nc_dn)) {
1139 ret = dsdb_create_partial_replica_NC(ldb, nc_dn);
1140 if (ret != LDB_SUCCESS) {
1141 status = WERR_DS_INTERNAL_FAILURE;
1147 for (i=0; i < num_objects; i++) {
1148 struct dom_sid *sid = NULL;
1149 struct ldb_request *add_req;
1151 DEBUG(6,(__location__ ": adding %s\n",
1152 ldb_dn_get_linearized(objects[i]->dn)));
1154 ret = ldb_build_add_req(&add_req,
1160 ldb_op_default_callback,
1162 if (ret != LDB_SUCCESS) {
1163 status = WERR_DS_INTERNAL_FAILURE;
1167 ret = ldb_request_add_control(add_req, LDB_CONTROL_RELAX_OID, true, NULL);
1168 if (ret != LDB_SUCCESS) {
1169 status = WERR_DS_INTERNAL_FAILURE;
1173 ret = ldb_request(ldb, add_req);
1174 if (ret == LDB_SUCCESS) {
1175 ret = ldb_wait(add_req->handle, LDB_WAIT_ALL);
1177 if (ret != LDB_SUCCESS) {
1178 DEBUG(0,(__location__ ": Failed add of %s - %s\n",
1179 ldb_dn_get_linearized(objects[i]->dn), ldb_errstring(ldb)));
1180 status = WERR_DS_INTERNAL_FAILURE;
1184 talloc_free(add_req);
1186 ret = ldb_search(ldb, objects, &res, objects[i]->dn,
1187 LDB_SCOPE_BASE, attrs,
1189 if (ret != LDB_SUCCESS) {
1190 status = WERR_DS_INTERNAL_FAILURE;
1193 ids[i].guid = samdb_result_guid(res->msgs[0], "objectGUID");
1194 sid = samdb_result_dom_sid(objects, res->msgs[0], "objectSid");
1198 ZERO_STRUCT(ids[i].sid);
1202 ret = ldb_transaction_commit(ldb);
1203 if (ret != LDB_SUCCESS) {
1204 return WERR_DS_INTERNAL_FAILURE;
1207 talloc_free(objects);
1209 *_num = num_objects;
1214 talloc_free(objects);
1215 ldb_transaction_cancel(ldb);