4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2013
6 Copyright (C) Andrew Tridgell 2005-2009
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010-2011
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
59 struct replmd_private {
61 struct la_entry *la_list;
63 struct la_backlink *la_backlinks;
65 struct nc_entry *prev, *next;
68 uint64_t mod_usn_urgent;
73 struct la_entry *next, *prev;
74 struct drsuapi_DsReplicaLinkedAttribute *la;
77 struct replmd_replicated_request {
78 struct ldb_module *module;
79 struct ldb_request *req;
81 const struct dsdb_schema *schema;
83 /* the controls we pass down */
84 struct ldb_control **controls;
86 /* details for the mode where we apply a bunch of inbound replication meessages */
88 uint32_t index_current;
89 struct dsdb_extended_replicated_objects *objs;
91 struct ldb_message *search_msg;
99 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar);
100 static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete);
102 enum urgent_situation {
103 REPL_URGENT_ON_CREATE = 1,
104 REPL_URGENT_ON_UPDATE = 2,
105 REPL_URGENT_ON_DELETE = 4
108 enum deletion_state {
109 OBJECT_NOT_DELETED=1,
116 static void replmd_deletion_state(struct ldb_module *module,
117 const struct ldb_message *msg,
118 enum deletion_state *current_state,
119 enum deletion_state *next_state)
122 bool enabled = false;
125 *current_state = OBJECT_REMOVED;
126 if (next_state != NULL) {
127 *next_state = OBJECT_REMOVED;
132 ret = dsdb_recyclebin_enabled(module, &enabled);
133 if (ret != LDB_SUCCESS) {
137 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
139 *current_state = OBJECT_TOMBSTONE;
140 if (next_state != NULL) {
141 *next_state = OBJECT_REMOVED;
146 if (ldb_msg_check_string_attribute(msg, "isRecycled", "TRUE")) {
147 *current_state = OBJECT_RECYCLED;
148 if (next_state != NULL) {
149 *next_state = OBJECT_REMOVED;
154 *current_state = OBJECT_DELETED;
155 if (next_state != NULL) {
156 *next_state = OBJECT_RECYCLED;
161 *current_state = OBJECT_NOT_DELETED;
162 if (next_state == NULL) {
167 *next_state = OBJECT_DELETED;
169 *next_state = OBJECT_TOMBSTONE;
173 static const struct {
174 const char *update_name;
175 enum urgent_situation repl_situation;
176 } urgent_objects[] = {
177 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
178 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
179 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
180 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
181 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
182 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
186 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
187 static const char *urgent_attrs[] = {
190 "userAccountControl",
195 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
196 enum urgent_situation situation)
199 for (i=0; urgent_objects[i].update_name; i++) {
201 if ((situation & urgent_objects[i].repl_situation) == 0) {
205 for (j=0; j<objectclass_el->num_values; j++) {
206 const struct ldb_val *v = &objectclass_el->values[j];
207 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
215 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
217 if (ldb_attr_in_list(urgent_attrs, el->name)) {
224 static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar);
227 initialise the module
228 allocate the private structure and build the list
229 of partition DNs for use by replmd_notify()
231 static int replmd_init(struct ldb_module *module)
233 struct replmd_private *replmd_private;
234 struct ldb_context *ldb = ldb_module_get_ctx(module);
236 replmd_private = talloc_zero(module, struct replmd_private);
237 if (replmd_private == NULL) {
239 return LDB_ERR_OPERATIONS_ERROR;
241 ldb_module_set_private(module, replmd_private);
243 return ldb_next_init(module);
247 cleanup our per-transaction contexts
249 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
251 talloc_free(replmd_private->la_ctx);
252 replmd_private->la_list = NULL;
253 replmd_private->la_ctx = NULL;
255 talloc_free(replmd_private->bl_ctx);
256 replmd_private->la_backlinks = NULL;
257 replmd_private->bl_ctx = NULL;
262 struct la_backlink *next, *prev;
263 const char *attr_name;
264 struct GUID forward_guid, target_guid;
269 process a backlinks we accumulated during a transaction, adding and
270 deleting the backlinks from the target objects
272 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
274 struct ldb_dn *target_dn, *source_dn;
276 struct ldb_context *ldb = ldb_module_get_ctx(module);
277 struct ldb_message *msg;
278 TALLOC_CTX *tmp_ctx = talloc_new(bl);
284 - construct ldb_message
285 - either an add or a delete
287 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
288 if (ret != LDB_SUCCESS) {
289 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
290 GUID_string(bl, &bl->target_guid)));
294 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
295 if (ret != LDB_SUCCESS) {
296 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
297 GUID_string(bl, &bl->forward_guid));
298 talloc_free(tmp_ctx);
302 msg = ldb_msg_new(tmp_ctx);
304 ldb_module_oom(module);
305 talloc_free(tmp_ctx);
306 return LDB_ERR_OPERATIONS_ERROR;
309 /* construct a ldb_message for adding/deleting the backlink */
311 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
313 ldb_module_oom(module);
314 talloc_free(tmp_ctx);
315 return LDB_ERR_OPERATIONS_ERROR;
317 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
318 if (ret != LDB_SUCCESS) {
319 talloc_free(tmp_ctx);
322 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
324 /* a backlink should never be single valued. Unfortunately the
325 exchange schema has a attribute
326 msExchBridgeheadedLocalConnectorsDNBL which is single
327 valued and a backlink. We need to cope with that by
328 ignoring the single value flag */
329 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
331 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
332 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
333 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
334 cope with possible corruption where the backlink has
335 already been removed */
336 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
337 ldb_dn_get_linearized(target_dn),
338 ldb_dn_get_linearized(source_dn),
339 ldb_errstring(ldb)));
341 } else if (ret != LDB_SUCCESS) {
342 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
343 bl->active?"add":"remove",
344 ldb_dn_get_linearized(source_dn),
345 ldb_dn_get_linearized(target_dn),
347 talloc_free(tmp_ctx);
350 talloc_free(tmp_ctx);
355 add a backlink to the list of backlinks to add/delete in the prepare
358 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
359 struct GUID *forward_guid, struct GUID *target_guid,
360 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
362 const struct dsdb_attribute *target_attr;
363 struct la_backlink *bl;
364 struct replmd_private *replmd_private =
365 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
367 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
370 * windows 2003 has a broken schema where the
371 * definition of msDS-IsDomainFor is missing (which is
372 * supposed to be the backlink of the
373 * msDS-HasDomainNCs attribute
378 /* see if its already in the list */
379 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
380 if (GUID_equal(forward_guid, &bl->forward_guid) &&
381 GUID_equal(target_guid, &bl->target_guid) &&
382 (target_attr->lDAPDisplayName == bl->attr_name ||
383 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
389 /* we found an existing one */
390 if (bl->active == active) {
393 DLIST_REMOVE(replmd_private->la_backlinks, bl);
398 if (replmd_private->bl_ctx == NULL) {
399 replmd_private->bl_ctx = talloc_new(replmd_private);
400 if (replmd_private->bl_ctx == NULL) {
401 ldb_module_oom(module);
402 return LDB_ERR_OPERATIONS_ERROR;
407 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
409 ldb_module_oom(module);
410 return LDB_ERR_OPERATIONS_ERROR;
413 /* Ensure the schema does not go away before the bl->attr_name is used */
414 if (!talloc_reference(bl, schema)) {
416 ldb_module_oom(module);
417 return LDB_ERR_OPERATIONS_ERROR;
420 bl->attr_name = target_attr->lDAPDisplayName;
421 bl->forward_guid = *forward_guid;
422 bl->target_guid = *target_guid;
425 /* the caller may ask for this backlink to be processed
428 int ret = replmd_process_backlink(module, bl, NULL);
433 DLIST_ADD(replmd_private->la_backlinks, bl);
440 * Callback for most write operations in this module:
442 * notify the repl task that a object has changed. The notifies are
443 * gathered up in the replmd_private structure then written to the
444 * @REPLCHANGED object in each partition during the prepare_commit
446 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
449 struct replmd_replicated_request *ac =
450 talloc_get_type_abort(req->context, struct replmd_replicated_request);
451 struct replmd_private *replmd_private =
452 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
453 struct nc_entry *modified_partition;
454 struct ldb_control *partition_ctrl;
455 const struct dsdb_control_current_partition *partition;
457 struct ldb_control **controls;
459 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
461 controls = ares->controls;
462 if (ldb_request_get_control(ac->req,
463 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
465 * Remove the current partition control from what we pass up
466 * the chain if it hasn't been requested manually.
468 controls = ldb_controls_except_specified(ares->controls, ares,
472 if (ares->error != LDB_SUCCESS) {
473 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
474 return ldb_module_done(ac->req, controls,
475 ares->response, ares->error);
478 if (ares->type != LDB_REPLY_DONE) {
479 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
480 return ldb_module_done(ac->req, NULL,
481 NULL, LDB_ERR_OPERATIONS_ERROR);
484 if (!partition_ctrl) {
485 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
486 return ldb_module_done(ac->req, NULL,
487 NULL, LDB_ERR_OPERATIONS_ERROR);
490 partition = talloc_get_type_abort(partition_ctrl->data,
491 struct dsdb_control_current_partition);
493 if (ac->seq_num > 0) {
494 for (modified_partition = replmd_private->ncs; modified_partition;
495 modified_partition = modified_partition->next) {
496 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
501 if (modified_partition == NULL) {
502 modified_partition = talloc_zero(replmd_private, struct nc_entry);
503 if (!modified_partition) {
504 ldb_oom(ldb_module_get_ctx(ac->module));
505 return ldb_module_done(ac->req, NULL,
506 NULL, LDB_ERR_OPERATIONS_ERROR);
508 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
509 if (!modified_partition->dn) {
510 ldb_oom(ldb_module_get_ctx(ac->module));
511 return ldb_module_done(ac->req, NULL,
512 NULL, LDB_ERR_OPERATIONS_ERROR);
514 DLIST_ADD(replmd_private->ncs, modified_partition);
517 if (ac->seq_num > modified_partition->mod_usn) {
518 modified_partition->mod_usn = ac->seq_num;
520 modified_partition->mod_usn_urgent = ac->seq_num;
525 if (ac->apply_mode) {
526 ret = replmd_replicated_apply_isDeleted(ac);
527 if (ret != LDB_SUCCESS) {
528 return ldb_module_done(ac->req, NULL, NULL, ret);
532 /* free the partition control container here, for the
533 * common path. Other cases will have it cleaned up
534 * eventually with the ares */
535 talloc_free(partition_ctrl);
536 return ldb_module_done(ac->req, controls,
537 ares->response, LDB_SUCCESS);
543 * update a @REPLCHANGED record in each partition if there have been
544 * any writes of replicated data in the partition
546 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
548 struct replmd_private *replmd_private =
549 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
551 while (replmd_private->ncs) {
553 struct nc_entry *modified_partition = replmd_private->ncs;
555 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
556 modified_partition->mod_usn,
557 modified_partition->mod_usn_urgent, parent);
558 if (ret != LDB_SUCCESS) {
559 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
560 ldb_dn_get_linearized(modified_partition->dn)));
563 DLIST_REMOVE(replmd_private->ncs, modified_partition);
564 talloc_free(modified_partition);
572 created a replmd_replicated_request context
574 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
575 struct ldb_request *req)
577 struct ldb_context *ldb;
578 struct replmd_replicated_request *ac;
580 ldb = ldb_module_get_ctx(module);
582 ac = talloc_zero(req, struct replmd_replicated_request);
591 ac->schema = dsdb_get_schema(ldb, ac);
593 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
594 "replmd_modify: no dsdb_schema loaded");
595 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
603 add a time element to a record
605 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
607 struct ldb_message_element *el;
611 if (ldb_msg_find_element(msg, attr) != NULL) {
615 s = ldb_timestring(msg, t);
617 return LDB_ERR_OPERATIONS_ERROR;
620 ret = ldb_msg_add_string(msg, attr, s);
621 if (ret != LDB_SUCCESS) {
625 el = ldb_msg_find_element(msg, attr);
626 /* always set as replace. This works because on add ops, the flag
628 el->flags = LDB_FLAG_MOD_REPLACE;
634 add a uint64_t element to a record
636 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
637 const char *attr, uint64_t v)
639 struct ldb_message_element *el;
642 if (ldb_msg_find_element(msg, attr) != NULL) {
646 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
647 if (ret != LDB_SUCCESS) {
651 el = ldb_msg_find_element(msg, attr);
652 /* always set as replace. This works because on add ops, the flag
654 el->flags = LDB_FLAG_MOD_REPLACE;
659 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
660 const struct replPropertyMetaData1 *m2,
661 const uint32_t *rdn_attid)
663 if (m1->attid == m2->attid) {
668 * the rdn attribute should be at the end!
669 * so we need to return a value greater than zero
670 * which means m1 is greater than m2
672 if (m1->attid == *rdn_attid) {
677 * the rdn attribute should be at the end!
678 * so we need to return a value less than zero
679 * which means m2 is greater than m1
681 if (m2->attid == *rdn_attid) {
685 return m1->attid > m2->attid ? 1 : -1;
688 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
689 const struct dsdb_schema *schema,
692 const char *rdn_name;
693 const struct dsdb_attribute *rdn_sa;
695 rdn_name = ldb_dn_get_rdn_name(dn);
697 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
698 return LDB_ERR_OPERATIONS_ERROR;
701 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
702 if (rdn_sa == NULL) {
703 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
704 return LDB_ERR_OPERATIONS_ERROR;
707 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
708 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
710 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
715 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
716 const struct ldb_message_element *e2,
717 const struct dsdb_schema *schema)
719 const struct dsdb_attribute *a1;
720 const struct dsdb_attribute *a2;
723 * TODO: make this faster by caching the dsdb_attribute pointer
724 * on the ldb_messag_element
727 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
728 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
731 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
735 return strcasecmp(e1->name, e2->name);
737 if (a1->attributeID_id == a2->attributeID_id) {
740 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
743 static void replmd_ldb_message_sort(struct ldb_message *msg,
744 const struct dsdb_schema *schema)
746 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
749 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
750 const struct GUID *invocation_id, uint64_t seq_num,
751 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
755 fix up linked attributes in replmd_add.
756 This involves setting up the right meta-data in extended DN
757 components, and creating backlinks to the object
759 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
760 uint64_t seq_num, const struct GUID *invocationId, time_t t,
761 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
764 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
765 struct ldb_context *ldb = ldb_module_get_ctx(module);
767 /* We will take a reference to the schema in replmd_add_backlink */
768 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
771 unix_to_nt_time(&now, t);
773 for (i=0; i<el->num_values; i++) {
774 struct ldb_val *v = &el->values[i];
775 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
776 struct GUID target_guid;
780 /* note that the DN already has the extended
781 components from the extended_dn_store module */
782 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
783 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
784 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
785 if (ret != LDB_SUCCESS) {
786 talloc_free(tmp_ctx);
789 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
790 if (ret != LDB_SUCCESS) {
791 talloc_free(tmp_ctx);
796 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
797 seq_num, seq_num, now, 0, false);
798 if (ret != LDB_SUCCESS) {
799 talloc_free(tmp_ctx);
803 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
804 if (ret != LDB_SUCCESS) {
805 talloc_free(tmp_ctx);
810 talloc_free(tmp_ctx);
816 intercept add requests
818 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
820 struct samldb_msds_intid_persistant *msds_intid_struct;
821 struct ldb_context *ldb;
822 struct ldb_control *control;
823 struct replmd_replicated_request *ac;
824 enum ndr_err_code ndr_err;
825 struct ldb_request *down_req;
826 struct ldb_message *msg;
827 const DATA_BLOB *guid_blob;
829 struct replPropertyMetaDataBlob nmd;
830 struct ldb_val nmd_value;
831 const struct GUID *our_invocation_id;
832 time_t t = time(NULL);
837 unsigned int functional_level;
839 bool allow_add_guid = false;
840 bool remove_current_guid = false;
841 bool is_urgent = false;
842 struct ldb_message_element *objectclass_el;
844 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
845 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
847 allow_add_guid = true;
850 /* do not manipulate our control entries */
851 if (ldb_dn_is_special(req->op.add.message->dn)) {
852 return ldb_next_request(module, req);
855 ldb = ldb_module_get_ctx(module);
857 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
859 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
860 if (guid_blob != NULL) {
861 if (!allow_add_guid) {
862 ldb_set_errstring(ldb,
863 "replmd_add: it's not allowed to add an object with objectGUID!");
864 return LDB_ERR_UNWILLING_TO_PERFORM;
866 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
867 if (!NT_STATUS_IS_OK(status)) {
868 ldb_set_errstring(ldb,
869 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
870 return LDB_ERR_UNWILLING_TO_PERFORM;
872 /* we remove this attribute as it can be a string and
873 * will not be treated correctly and then we will re-add
874 * it later on in the good format */
875 remove_current_guid = true;
879 guid = GUID_random();
882 ac = replmd_ctx_init(module, req);
884 return ldb_module_oom(module);
887 functional_level = dsdb_functional_level(ldb);
889 /* Get a sequence number from the backend */
890 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
891 if (ret != LDB_SUCCESS) {
896 /* get our invocationId */
897 our_invocation_id = samdb_ntds_invocation_id(ldb);
898 if (!our_invocation_id) {
899 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
900 "replmd_add: unable to find invocationId\n");
902 return LDB_ERR_OPERATIONS_ERROR;
905 /* we have to copy the message as the caller might have it as a const */
906 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
910 return LDB_ERR_OPERATIONS_ERROR;
913 /* generated times */
914 unix_to_nt_time(&now, t);
915 time_str = ldb_timestring(msg, t);
919 return LDB_ERR_OPERATIONS_ERROR;
921 if (remove_current_guid) {
922 ldb_msg_remove_attr(msg,"objectGUID");
926 * remove autogenerated attributes
928 ldb_msg_remove_attr(msg, "whenCreated");
929 ldb_msg_remove_attr(msg, "whenChanged");
930 ldb_msg_remove_attr(msg, "uSNCreated");
931 ldb_msg_remove_attr(msg, "uSNChanged");
932 ldb_msg_remove_attr(msg, "replPropertyMetaData");
935 * readd replicated attributes
937 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
938 if (ret != LDB_SUCCESS) {
944 /* build the replication meta_data */
947 nmd.ctr.ctr1.count = msg->num_elements;
948 nmd.ctr.ctr1.array = talloc_array(msg,
949 struct replPropertyMetaData1,
951 if (!nmd.ctr.ctr1.array) {
954 return LDB_ERR_OPERATIONS_ERROR;
957 for (i=0; i < msg->num_elements; i++) {
958 struct ldb_message_element *e = &msg->elements[i];
959 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
960 const struct dsdb_attribute *sa;
962 if (e->name[0] == '@') continue;
964 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
966 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
967 "replmd_add: attribute '%s' not defined in schema\n",
970 return LDB_ERR_NO_SUCH_ATTRIBUTE;
973 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
974 /* if the attribute is not replicated (0x00000001)
975 * or constructed (0x00000004) it has no metadata
980 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
981 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
982 if (ret != LDB_SUCCESS) {
986 /* linked attributes are not stored in
987 replPropertyMetaData in FL above w2k */
991 m->attid = sa->attributeID_id;
993 if (m->attid == 0x20030) {
994 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
997 if (rdn_val == NULL) {
1000 return LDB_ERR_OPERATIONS_ERROR;
1003 rdn = (const char*)rdn_val->data;
1004 if (strcmp(rdn, "Deleted Objects") == 0) {
1006 * Set the originating_change_time to 29/12/9999 at 23:59:59
1007 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1009 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1011 m->originating_change_time = now;
1014 m->originating_change_time = now;
1016 m->originating_invocation_id = *our_invocation_id;
1017 m->originating_usn = ac->seq_num;
1018 m->local_usn = ac->seq_num;
1022 /* fix meta data count */
1023 nmd.ctr.ctr1.count = ni;
1026 * sort meta data array, and move the rdn attribute entry to the end
1028 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
1029 if (ret != LDB_SUCCESS) {
1034 /* generated NDR encoded values */
1035 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
1037 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1038 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1041 return LDB_ERR_OPERATIONS_ERROR;
1045 * add the autogenerated values
1047 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
1048 if (ret != LDB_SUCCESS) {
1053 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
1054 if (ret != LDB_SUCCESS) {
1059 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
1060 if (ret != LDB_SUCCESS) {
1065 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1066 if (ret != LDB_SUCCESS) {
1071 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1072 if (ret != LDB_SUCCESS) {
1079 * sort the attributes by attid before storing the object
1081 replmd_ldb_message_sort(msg, ac->schema);
1083 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1084 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1085 REPL_URGENT_ON_CREATE);
1087 ac->is_urgent = is_urgent;
1088 ret = ldb_build_add_req(&down_req, ldb, ac,
1091 ac, replmd_op_callback,
1094 LDB_REQ_SET_LOCATION(down_req);
1095 if (ret != LDB_SUCCESS) {
1100 /* current partition control is needed by "replmd_op_callback" */
1101 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1102 ret = ldb_request_add_control(down_req,
1103 DSDB_CONTROL_CURRENT_PARTITION_OID,
1105 if (ret != LDB_SUCCESS) {
1111 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1112 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1113 if (ret != LDB_SUCCESS) {
1119 /* mark the control done */
1121 control->critical = 0;
1123 if (ldb_dn_compare_base(ac->schema->base_dn, req->op.add.message->dn) != 0) {
1125 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
1126 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1127 if (msds_intid_struct) {
1128 msds_intid_struct->usn = ac->seq_num;
1131 /* go on with the call chain */
1132 return ldb_next_request(module, down_req);
1137 * update the replPropertyMetaData for one element
1139 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1140 struct ldb_message *msg,
1141 struct ldb_message_element *el,
1142 struct ldb_message_element *old_el,
1143 struct replPropertyMetaDataBlob *omd,
1144 const struct dsdb_schema *schema,
1146 const struct GUID *our_invocation_id,
1148 struct ldb_request *req)
1151 const struct dsdb_attribute *a;
1152 struct replPropertyMetaData1 *md1;
1153 bool may_skip = false;
1155 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1157 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1158 /* allow this to make it possible for dbcheck
1159 to remove bad attributes */
1163 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1165 return LDB_ERR_OPERATIONS_ERROR;
1168 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1173 * if the attribute's value haven't changed, and this isn't
1174 * just a delete of everything then return LDB_SUCCESS Unless
1175 * we have the provision control or if the attribute is
1176 * interSiteTopologyGenerator as this page explain:
1177 * http://support.microsoft.com/kb/224815 this attribute is
1178 * periodicaly written by the DC responsible for the intersite
1179 * generation in a given site
1181 * Unchanged could be deleting or replacing an already-gone
1182 * thing with an unconstrained delete/empty replace or a
1183 * replace with the same value, but not an add with the same
1184 * value because that could be about adding a duplicate (which
1185 * is for someone else to error out on).
1187 if (old_el != NULL && ldb_msg_element_equal_ordered(el, old_el)) {
1188 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1191 } else if (old_el == NULL && el->num_values == 0) {
1192 if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
1194 } else if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
1200 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1201 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1203 * allow this to make it possible for dbcheck
1204 * to rebuild broken metadata
1210 for (i=0; i<omd->ctr.ctr1.count; i++) {
1211 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1214 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1215 /* linked attributes are not stored in
1216 replPropertyMetaData in FL above w2k, but we do
1217 raise the seqnum for the object */
1218 if (*seq_num == 0 &&
1219 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1220 return LDB_ERR_OPERATIONS_ERROR;
1225 if (i == omd->ctr.ctr1.count) {
1226 /* we need to add a new one */
1227 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1228 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1229 if (omd->ctr.ctr1.array == NULL) {
1231 return LDB_ERR_OPERATIONS_ERROR;
1233 omd->ctr.ctr1.count++;
1234 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1237 /* Get a new sequence number from the backend. We only do this
1238 * if we have a change that requires a new
1239 * replPropertyMetaData element
1241 if (*seq_num == 0) {
1242 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1243 if (ret != LDB_SUCCESS) {
1244 return LDB_ERR_OPERATIONS_ERROR;
1248 md1 = &omd->ctr.ctr1.array[i];
1250 md1->attid = a->attributeID_id;
1251 if (md1->attid == 0x20030) {
1252 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1255 if (rdn_val == NULL) {
1257 return LDB_ERR_OPERATIONS_ERROR;
1260 rdn = (const char*)rdn_val->data;
1261 if (strcmp(rdn, "Deleted Objects") == 0) {
1263 * Set the originating_change_time to 29/12/9999 at 23:59:59
1264 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1266 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1268 md1->originating_change_time = now;
1271 md1->originating_change_time = now;
1273 md1->originating_invocation_id = *our_invocation_id;
1274 md1->originating_usn = *seq_num;
1275 md1->local_usn = *seq_num;
1280 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1282 uint32_t count = omd.ctr.ctr1.count;
1285 for (i=0; i < count; i++) {
1286 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1287 if (max < m.local_usn) {
1295 * update the replPropertyMetaData object each time we modify an
1296 * object. This is needed for DRS replication, as the merge on the
1297 * client is based on this object
1299 static int replmd_update_rpmd(struct ldb_module *module,
1300 const struct dsdb_schema *schema,
1301 struct ldb_request *req,
1302 const char * const *rename_attrs,
1303 struct ldb_message *msg, uint64_t *seq_num,
1305 bool *is_urgent, bool *rodc)
1307 const struct ldb_val *omd_value;
1308 enum ndr_err_code ndr_err;
1309 struct replPropertyMetaDataBlob omd;
1312 const struct GUID *our_invocation_id;
1314 const char * const *attrs = NULL;
1315 const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1316 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1317 struct ldb_result *res;
1318 struct ldb_context *ldb;
1319 struct ldb_message_element *objectclass_el;
1320 enum urgent_situation situation;
1321 bool rmd_is_provided;
1324 attrs = rename_attrs;
1329 ldb = ldb_module_get_ctx(module);
1331 our_invocation_id = samdb_ntds_invocation_id(ldb);
1332 if (!our_invocation_id) {
1333 /* this happens during an initial vampire while
1334 updating the schema */
1335 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1339 unix_to_nt_time(&now, t);
1341 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1342 rmd_is_provided = true;
1344 rmd_is_provided = false;
1347 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1348 * otherwise we consider we are updating */
1349 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1350 situation = REPL_URGENT_ON_DELETE;
1351 } else if (rename_attrs) {
1352 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1354 situation = REPL_URGENT_ON_UPDATE;
1357 if (rmd_is_provided) {
1358 /* In this case the change_replmetadata control was supplied */
1359 /* We check that it's the only attribute that is provided
1360 * (it's a rare case so it's better to keep the code simplier)
1361 * We also check that the highest local_usn is bigger than
1364 if( msg->num_elements != 1 ||
1365 strncmp(msg->elements[0].name,
1366 "replPropertyMetaData", 20) ) {
1367 DEBUG(0,(__location__ ": changereplmetada control called without "\
1368 "a specified replPropertyMetaData attribute or with others\n"));
1369 return LDB_ERR_OPERATIONS_ERROR;
1371 if (situation != REPL_URGENT_ON_UPDATE) {
1372 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1373 return LDB_ERR_OPERATIONS_ERROR;
1375 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1377 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1378 ldb_dn_get_linearized(msg->dn)));
1379 return LDB_ERR_OPERATIONS_ERROR;
1381 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1382 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1383 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1384 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1385 ldb_dn_get_linearized(msg->dn)));
1386 return LDB_ERR_OPERATIONS_ERROR;
1388 *seq_num = find_max_local_usn(omd);
1390 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1391 DSDB_FLAG_NEXT_MODULE |
1392 DSDB_SEARCH_SHOW_RECYCLED |
1393 DSDB_SEARCH_SHOW_EXTENDED_DN |
1394 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1395 DSDB_SEARCH_REVEAL_INTERNALS, req);
1397 if (ret != LDB_SUCCESS) {
1401 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1402 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1407 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1408 if (*seq_num <= db_seq) {
1409 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1410 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1411 (long long)*seq_num, (long long)db_seq));
1412 return LDB_ERR_OPERATIONS_ERROR;
1416 /* search for the existing replPropertyMetaDataBlob. We need
1417 * to use REVEAL and ask for DNs in storage format to support
1418 * the check for values being the same in
1419 * replmd_update_rpmd_element()
1421 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1422 DSDB_FLAG_NEXT_MODULE |
1423 DSDB_SEARCH_SHOW_RECYCLED |
1424 DSDB_SEARCH_SHOW_EXTENDED_DN |
1425 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1426 DSDB_SEARCH_REVEAL_INTERNALS, req);
1427 if (ret != LDB_SUCCESS) {
1431 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1432 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1437 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1439 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1440 ldb_dn_get_linearized(msg->dn)));
1441 return LDB_ERR_OPERATIONS_ERROR;
1444 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1445 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1446 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1447 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1448 ldb_dn_get_linearized(msg->dn)));
1449 return LDB_ERR_OPERATIONS_ERROR;
1452 if (omd.version != 1) {
1453 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1454 omd.version, ldb_dn_get_linearized(msg->dn)));
1455 return LDB_ERR_OPERATIONS_ERROR;
1458 for (i=0; i<msg->num_elements; i++) {
1459 struct ldb_message_element *old_el;
1460 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1461 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1462 our_invocation_id, now, req);
1463 if (ret != LDB_SUCCESS) {
1467 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1468 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1474 * replmd_update_rpmd_element has done an update if the
1477 if (*seq_num != 0) {
1478 struct ldb_val *md_value;
1479 struct ldb_message_element *el;
1481 /*if we are RODC and this is a DRSR update then its ok*/
1482 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1483 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1484 unsigned instanceType;
1486 ret = samdb_rodc(ldb, rodc);
1487 if (ret != LDB_SUCCESS) {
1488 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1490 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1491 return LDB_ERR_REFERRAL;
1494 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1495 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1496 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1497 "cannot change replicated attribute on partial replica");
1501 md_value = talloc(msg, struct ldb_val);
1502 if (md_value == NULL) {
1504 return LDB_ERR_OPERATIONS_ERROR;
1507 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1508 if (ret != LDB_SUCCESS) {
1512 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1513 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1514 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1515 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1516 ldb_dn_get_linearized(msg->dn)));
1517 return LDB_ERR_OPERATIONS_ERROR;
1520 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1521 if (ret != LDB_SUCCESS) {
1522 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1523 ldb_dn_get_linearized(msg->dn)));
1528 el->values = md_value;
1535 struct dsdb_dn *dsdb_dn;
1540 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1542 return GUID_compare(pdn1->guid, pdn2->guid);
1545 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1546 unsigned int count, struct GUID *guid,
1549 struct parsed_dn *ret;
1551 if (dn && GUID_all_zero(guid)) {
1552 /* when updating a link using DRS, we sometimes get a
1553 NULL GUID. We then need to try and match by DN */
1554 for (i=0; i<count; i++) {
1555 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1556 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1562 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1567 get a series of message element values as an array of DNs and GUIDs
1568 the result is sorted by GUID
1570 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1571 struct ldb_message_element *el, struct parsed_dn **pdn,
1572 const char *ldap_oid, struct ldb_request *parent)
1575 struct ldb_context *ldb = ldb_module_get_ctx(module);
1582 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1584 ldb_module_oom(module);
1585 return LDB_ERR_OPERATIONS_ERROR;
1588 for (i=0; i<el->num_values; i++) {
1589 struct ldb_val *v = &el->values[i];
1592 struct parsed_dn *p;
1596 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1597 if (p->dsdb_dn == NULL) {
1598 return LDB_ERR_INVALID_DN_SYNTAX;
1601 dn = p->dsdb_dn->dn;
1603 p->guid = talloc(*pdn, struct GUID);
1604 if (p->guid == NULL) {
1605 ldb_module_oom(module);
1606 return LDB_ERR_OPERATIONS_ERROR;
1609 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1610 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1611 /* we got a DN without a GUID - go find the GUID */
1612 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1613 if (ret != LDB_SUCCESS) {
1614 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1615 ldb_dn_get_linearized(dn));
1616 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1617 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1618 ldb_attr_cmp(el->name, "member") == 0) {
1619 return LDB_ERR_UNWILLING_TO_PERFORM;
1623 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1624 if (ret != LDB_SUCCESS) {
1627 } else if (!NT_STATUS_IS_OK(status)) {
1628 return LDB_ERR_OPERATIONS_ERROR;
1631 /* keep a pointer to the original ldb_val */
1635 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1641 build a new extended DN, including all meta data fields
1643 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1644 RMD_ADDTIME = originating_add_time
1645 RMD_INVOCID = originating_invocation_id
1646 RMD_CHANGETIME = originating_change_time
1647 RMD_ORIGINATING_USN = originating_usn
1648 RMD_LOCAL_USN = local_usn
1649 RMD_VERSION = version
1651 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1652 const struct GUID *invocation_id, uint64_t seq_num,
1653 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1655 struct ldb_dn *dn = dsdb_dn->dn;
1656 const char *tstring, *usn_string, *flags_string;
1657 struct ldb_val tval;
1659 struct ldb_val usnv, local_usnv;
1660 struct ldb_val vers, flagsv;
1663 const char *dnstring;
1665 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1667 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1669 return LDB_ERR_OPERATIONS_ERROR;
1671 tval = data_blob_string_const(tstring);
1673 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1675 return LDB_ERR_OPERATIONS_ERROR;
1677 usnv = data_blob_string_const(usn_string);
1679 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1681 return LDB_ERR_OPERATIONS_ERROR;
1683 local_usnv = data_blob_string_const(usn_string);
1685 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1687 return LDB_ERR_OPERATIONS_ERROR;
1689 vers = data_blob_string_const(vstring);
1691 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1692 if (!NT_STATUS_IS_OK(status)) {
1693 return LDB_ERR_OPERATIONS_ERROR;
1696 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1697 if (!flags_string) {
1698 return LDB_ERR_OPERATIONS_ERROR;
1700 flagsv = data_blob_string_const(flags_string);
1702 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1703 if (ret != LDB_SUCCESS) return ret;
1704 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1705 if (ret != LDB_SUCCESS) return ret;
1706 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1707 if (ret != LDB_SUCCESS) return ret;
1708 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1709 if (ret != LDB_SUCCESS) return ret;
1710 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1711 if (ret != LDB_SUCCESS) return ret;
1712 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1713 if (ret != LDB_SUCCESS) return ret;
1714 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1715 if (ret != LDB_SUCCESS) return ret;
1717 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1718 if (dnstring == NULL) {
1719 return LDB_ERR_OPERATIONS_ERROR;
1721 *v = data_blob_string_const(dnstring);
1726 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1727 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1728 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1729 uint32_t version, bool deleted);
1732 check if any links need upgrading from w2k format
1734 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1736 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1739 for (i=0; i<count; i++) {
1744 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1745 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1749 /* it's an old one that needs upgrading */
1750 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1752 if (ret != LDB_SUCCESS) {
1760 update an extended DN, including all meta data fields
1762 see replmd_build_la_val for value names
1764 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1765 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1766 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1767 uint32_t version, bool deleted)
1769 struct ldb_dn *dn = dsdb_dn->dn;
1770 const char *tstring, *usn_string, *flags_string;
1771 struct ldb_val tval;
1773 struct ldb_val usnv, local_usnv;
1774 struct ldb_val vers, flagsv;
1775 const struct ldb_val *old_addtime;
1776 uint32_t old_version;
1779 const char *dnstring;
1781 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1783 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1785 return LDB_ERR_OPERATIONS_ERROR;
1787 tval = data_blob_string_const(tstring);
1789 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1791 return LDB_ERR_OPERATIONS_ERROR;
1793 usnv = data_blob_string_const(usn_string);
1795 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1797 return LDB_ERR_OPERATIONS_ERROR;
1799 local_usnv = data_blob_string_const(usn_string);
1801 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1802 if (!NT_STATUS_IS_OK(status)) {
1803 return LDB_ERR_OPERATIONS_ERROR;
1806 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1807 if (!flags_string) {
1808 return LDB_ERR_OPERATIONS_ERROR;
1810 flagsv = data_blob_string_const(flags_string);
1812 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1813 if (ret != LDB_SUCCESS) return ret;
1815 /* get the ADDTIME from the original */
1816 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1817 if (old_addtime == NULL) {
1818 old_addtime = &tval;
1820 if (dsdb_dn != old_dsdb_dn ||
1821 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1822 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1823 if (ret != LDB_SUCCESS) return ret;
1826 /* use our invocation id */
1827 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1828 if (ret != LDB_SUCCESS) return ret;
1830 /* changetime is the current time */
1831 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1832 if (ret != LDB_SUCCESS) return ret;
1834 /* update the USN */
1835 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1836 if (ret != LDB_SUCCESS) return ret;
1838 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1839 if (ret != LDB_SUCCESS) return ret;
1841 /* increase the version by 1 */
1842 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1843 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1844 version = old_version+1;
1846 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1847 vers = data_blob_string_const(vstring);
1848 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1849 if (ret != LDB_SUCCESS) return ret;
1851 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1852 if (dnstring == NULL) {
1853 return LDB_ERR_OPERATIONS_ERROR;
1855 *v = data_blob_string_const(dnstring);
1861 handle adding a linked attribute
1863 static int replmd_modify_la_add(struct ldb_module *module,
1864 const struct dsdb_schema *schema,
1865 struct ldb_message *msg,
1866 struct ldb_message_element *el,
1867 struct ldb_message_element *old_el,
1868 const struct dsdb_attribute *schema_attr,
1871 struct GUID *msg_guid,
1872 struct ldb_request *parent)
1875 struct parsed_dn *dns, *old_dns;
1876 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1878 struct ldb_val *new_values = NULL;
1879 unsigned int num_new_values = 0;
1880 unsigned old_num_values = old_el?old_el->num_values:0;
1881 const struct GUID *invocation_id;
1882 struct ldb_context *ldb = ldb_module_get_ctx(module);
1885 unix_to_nt_time(&now, t);
1887 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1888 if (ret != LDB_SUCCESS) {
1889 talloc_free(tmp_ctx);
1893 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1894 if (ret != LDB_SUCCESS) {
1895 talloc_free(tmp_ctx);
1899 invocation_id = samdb_ntds_invocation_id(ldb);
1900 if (!invocation_id) {
1901 talloc_free(tmp_ctx);
1902 return LDB_ERR_OPERATIONS_ERROR;
1905 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1906 if (ret != LDB_SUCCESS) {
1907 talloc_free(tmp_ctx);
1911 /* for each new value, see if it exists already with the same GUID */
1912 for (i=0; i<el->num_values; i++) {
1913 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1915 /* this is a new linked attribute value */
1916 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1917 if (new_values == NULL) {
1918 ldb_module_oom(module);
1919 talloc_free(tmp_ctx);
1920 return LDB_ERR_OPERATIONS_ERROR;
1922 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1923 invocation_id, seq_num, seq_num, now, 0, false);
1924 if (ret != LDB_SUCCESS) {
1925 talloc_free(tmp_ctx);
1930 /* this is only allowed if the GUID was
1931 previously deleted. */
1932 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1934 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1935 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1936 el->name, GUID_string(tmp_ctx, p->guid));
1937 talloc_free(tmp_ctx);
1938 /* error codes for 'member' need to be
1940 if (ldb_attr_cmp(el->name, "member") == 0) {
1941 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1943 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1946 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1947 invocation_id, seq_num, seq_num, now, 0, false);
1948 if (ret != LDB_SUCCESS) {
1949 talloc_free(tmp_ctx);
1954 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1955 if (ret != LDB_SUCCESS) {
1956 talloc_free(tmp_ctx);
1961 /* add the new ones on to the end of the old values, constructing a new el->values */
1962 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1964 old_num_values+num_new_values);
1965 if (el->values == NULL) {
1966 ldb_module_oom(module);
1967 return LDB_ERR_OPERATIONS_ERROR;
1970 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1971 el->num_values = old_num_values + num_new_values;
1973 talloc_steal(msg->elements, el->values);
1974 talloc_steal(el->values, new_values);
1976 talloc_free(tmp_ctx);
1978 /* we now tell the backend to replace all existing values
1979 with the one we have constructed */
1980 el->flags = LDB_FLAG_MOD_REPLACE;
1987 handle deleting all active linked attributes
1989 static int replmd_modify_la_delete(struct ldb_module *module,
1990 const struct dsdb_schema *schema,
1991 struct ldb_message *msg,
1992 struct ldb_message_element *el,
1993 struct ldb_message_element *old_el,
1994 const struct dsdb_attribute *schema_attr,
1997 struct GUID *msg_guid,
1998 struct ldb_request *parent)
2001 struct parsed_dn *dns, *old_dns;
2002 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2004 const struct GUID *invocation_id;
2005 struct ldb_context *ldb = ldb_module_get_ctx(module);
2008 unix_to_nt_time(&now, t);
2010 /* check if there is nothing to delete */
2011 if ((!old_el || old_el->num_values == 0) &&
2012 el->num_values == 0) {
2016 if (!old_el || old_el->num_values == 0) {
2017 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2020 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2021 if (ret != LDB_SUCCESS) {
2022 talloc_free(tmp_ctx);
2026 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2027 if (ret != LDB_SUCCESS) {
2028 talloc_free(tmp_ctx);
2032 invocation_id = samdb_ntds_invocation_id(ldb);
2033 if (!invocation_id) {
2034 return LDB_ERR_OPERATIONS_ERROR;
2037 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
2038 if (ret != LDB_SUCCESS) {
2039 talloc_free(tmp_ctx);
2045 /* see if we are being asked to delete any links that
2046 don't exist or are already deleted */
2047 for (i=0; i<el->num_values; i++) {
2048 struct parsed_dn *p = &dns[i];
2049 struct parsed_dn *p2;
2052 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
2054 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
2055 el->name, GUID_string(tmp_ctx, p->guid));
2056 if (ldb_attr_cmp(el->name, "member") == 0) {
2057 return LDB_ERR_UNWILLING_TO_PERFORM;
2059 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2062 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
2063 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
2064 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
2065 el->name, GUID_string(tmp_ctx, p->guid));
2066 if (ldb_attr_cmp(el->name, "member") == 0) {
2067 return LDB_ERR_UNWILLING_TO_PERFORM;
2069 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2074 /* for each new value, see if it exists already with the same GUID
2075 if it is not already deleted and matches the delete list then delete it
2077 for (i=0; i<old_el->num_values; i++) {
2078 struct parsed_dn *p = &old_dns[i];
2081 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
2085 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
2086 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2088 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2089 invocation_id, seq_num, seq_num, now, 0, true);
2090 if (ret != LDB_SUCCESS) {
2091 talloc_free(tmp_ctx);
2095 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
2096 if (ret != LDB_SUCCESS) {
2097 talloc_free(tmp_ctx);
2102 el->values = talloc_steal(msg->elements, old_el->values);
2103 el->num_values = old_el->num_values;
2105 talloc_free(tmp_ctx);
2107 /* we now tell the backend to replace all existing values
2108 with the one we have constructed */
2109 el->flags = LDB_FLAG_MOD_REPLACE;
2115 handle replacing a linked attribute
2117 static int replmd_modify_la_replace(struct ldb_module *module,
2118 const struct dsdb_schema *schema,
2119 struct ldb_message *msg,
2120 struct ldb_message_element *el,
2121 struct ldb_message_element *old_el,
2122 const struct dsdb_attribute *schema_attr,
2125 struct GUID *msg_guid,
2126 struct ldb_request *parent)
2129 struct parsed_dn *dns, *old_dns;
2130 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2132 const struct GUID *invocation_id;
2133 struct ldb_context *ldb = ldb_module_get_ctx(module);
2134 struct ldb_val *new_values = NULL;
2135 unsigned int num_new_values = 0;
2136 unsigned int old_num_values = old_el?old_el->num_values:0;
2139 unix_to_nt_time(&now, t);
2141 /* check if there is nothing to replace */
2142 if ((!old_el || old_el->num_values == 0) &&
2143 el->num_values == 0) {
2147 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2148 if (ret != LDB_SUCCESS) {
2149 talloc_free(tmp_ctx);
2153 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2154 if (ret != LDB_SUCCESS) {
2155 talloc_free(tmp_ctx);
2159 invocation_id = samdb_ntds_invocation_id(ldb);
2160 if (!invocation_id) {
2161 return LDB_ERR_OPERATIONS_ERROR;
2164 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2165 if (ret != LDB_SUCCESS) {
2166 talloc_free(tmp_ctx);
2170 /* mark all the old ones as deleted */
2171 for (i=0; i<old_num_values; i++) {
2172 struct parsed_dn *old_p = &old_dns[i];
2173 struct parsed_dn *p;
2174 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2176 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2178 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2179 if (ret != LDB_SUCCESS) {
2180 talloc_free(tmp_ctx);
2184 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2186 /* we don't delete it if we are re-adding it */
2190 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2191 invocation_id, seq_num, seq_num, now, 0, true);
2192 if (ret != LDB_SUCCESS) {
2193 talloc_free(tmp_ctx);
2198 /* for each new value, either update its meta-data, or add it
2201 for (i=0; i<el->num_values; i++) {
2202 struct parsed_dn *p = &dns[i], *old_p;
2205 (old_p = parsed_dn_find(old_dns,
2206 old_num_values, p->guid, NULL)) != NULL) {
2207 /* update in place */
2208 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2209 old_p->dsdb_dn, invocation_id,
2210 seq_num, seq_num, now, 0, false);
2211 if (ret != LDB_SUCCESS) {
2212 talloc_free(tmp_ctx);
2217 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2219 if (new_values == NULL) {
2220 ldb_module_oom(module);
2221 talloc_free(tmp_ctx);
2222 return LDB_ERR_OPERATIONS_ERROR;
2224 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2225 invocation_id, seq_num, seq_num, now, 0, false);
2226 if (ret != LDB_SUCCESS) {
2227 talloc_free(tmp_ctx);
2233 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2234 if (ret != LDB_SUCCESS) {
2235 talloc_free(tmp_ctx);
2240 /* add the new values to the end of old_el */
2241 if (num_new_values != 0) {
2242 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2243 struct ldb_val, old_num_values+num_new_values);
2244 if (el->values == NULL) {
2245 ldb_module_oom(module);
2246 return LDB_ERR_OPERATIONS_ERROR;
2248 memcpy(&el->values[old_num_values], &new_values[0],
2249 sizeof(struct ldb_val)*num_new_values);
2250 el->num_values = old_num_values + num_new_values;
2251 talloc_steal(msg->elements, new_values);
2253 el->values = old_el->values;
2254 el->num_values = old_el->num_values;
2255 talloc_steal(msg->elements, el->values);
2258 talloc_free(tmp_ctx);
2260 /* we now tell the backend to replace all existing values
2261 with the one we have constructed */
2262 el->flags = LDB_FLAG_MOD_REPLACE;
2269 handle linked attributes in modify requests
2271 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2272 struct ldb_message *msg,
2273 uint64_t seq_num, time_t t,
2274 struct ldb_request *parent)
2276 struct ldb_result *res;
2279 struct ldb_context *ldb = ldb_module_get_ctx(module);
2280 struct ldb_message *old_msg;
2282 const struct dsdb_schema *schema;
2283 struct GUID old_guid;
2286 /* there the replmd_update_rpmd code has already
2287 * checked and saw that there are no linked
2292 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2293 /* don't do anything special for linked attributes */
2297 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2298 DSDB_FLAG_NEXT_MODULE |
2299 DSDB_SEARCH_SHOW_RECYCLED |
2300 DSDB_SEARCH_REVEAL_INTERNALS |
2301 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2303 if (ret != LDB_SUCCESS) {
2306 schema = dsdb_get_schema(ldb, res);
2308 return LDB_ERR_OPERATIONS_ERROR;
2311 old_msg = res->msgs[0];
2313 old_guid = samdb_result_guid(old_msg, "objectGUID");
2315 for (i=0; i<msg->num_elements; i++) {
2316 struct ldb_message_element *el = &msg->elements[i];
2317 struct ldb_message_element *old_el, *new_el;
2318 const struct dsdb_attribute *schema_attr
2319 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2321 ldb_asprintf_errstring(ldb,
2322 "%s: attribute %s is not a valid attribute in schema",
2323 __FUNCTION__, el->name);
2324 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2326 if (schema_attr->linkID == 0) {
2329 if ((schema_attr->linkID & 1) == 1) {
2330 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2333 /* Odd is for the target. Illegal to modify */
2334 ldb_asprintf_errstring(ldb,
2335 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2336 return LDB_ERR_UNWILLING_TO_PERFORM;
2338 old_el = ldb_msg_find_element(old_msg, el->name);
2339 switch (el->flags & LDB_FLAG_MOD_MASK) {
2340 case LDB_FLAG_MOD_REPLACE:
2341 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2343 case LDB_FLAG_MOD_DELETE:
2344 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2346 case LDB_FLAG_MOD_ADD:
2347 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2350 ldb_asprintf_errstring(ldb,
2351 "invalid flags 0x%x for %s linked attribute",
2352 el->flags, el->name);
2353 return LDB_ERR_UNWILLING_TO_PERFORM;
2355 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2356 ldb_asprintf_errstring(ldb,
2357 "Attribute %s is single valued but more than one value has been supplied",
2359 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2361 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2366 if (ret != LDB_SUCCESS) {
2370 ldb_msg_remove_attr(old_msg, el->name);
2372 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2373 new_el->num_values = el->num_values;
2374 new_el->values = talloc_steal(msg->elements, el->values);
2376 /* TODO: this relises a bit too heavily on the exact
2377 behaviour of ldb_msg_find_element and
2378 ldb_msg_remove_element */
2379 old_el = ldb_msg_find_element(msg, el->name);
2381 ldb_msg_remove_element(msg, old_el);
2392 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2394 struct samldb_msds_intid_persistant *msds_intid_struct;
2395 struct ldb_context *ldb;
2396 struct replmd_replicated_request *ac;
2397 struct ldb_request *down_req;
2398 struct ldb_message *msg;
2399 time_t t = time(NULL);
2401 bool is_urgent = false, rodc = false;
2402 unsigned int functional_level;
2403 const DATA_BLOB *guid_blob;
2404 struct ldb_control *sd_propagation_control;
2406 /* do not manipulate our control entries */
2407 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2408 return ldb_next_request(module, req);
2411 sd_propagation_control = ldb_request_get_control(req,
2412 DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
2413 if (sd_propagation_control != NULL) {
2414 if (req->op.mod.message->num_elements != 1) {
2415 return ldb_module_operr(module);
2417 ret = strcmp(req->op.mod.message->elements[0].name,
2418 "nTSecurityDescriptor");
2420 return ldb_module_operr(module);
2423 return ldb_next_request(module, req);
2426 ldb = ldb_module_get_ctx(module);
2428 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2430 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2431 if ( guid_blob != NULL ) {
2432 ldb_set_errstring(ldb,
2433 "replmd_modify: it's not allowed to change the objectGUID!");
2434 return LDB_ERR_CONSTRAINT_VIOLATION;
2437 ac = replmd_ctx_init(module, req);
2439 return ldb_module_oom(module);
2442 functional_level = dsdb_functional_level(ldb);
2444 /* we have to copy the message as the caller might have it as a const */
2445 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2449 return LDB_ERR_OPERATIONS_ERROR;
2452 ldb_msg_remove_attr(msg, "whenChanged");
2453 ldb_msg_remove_attr(msg, "uSNChanged");
2455 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2456 msg, &ac->seq_num, t, &is_urgent, &rodc);
2457 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2458 struct loadparm_context *lp_ctx;
2461 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2462 struct loadparm_context);
2464 referral = talloc_asprintf(req,
2466 lpcfg_dnsdomain(lp_ctx),
2467 ldb_dn_get_linearized(msg->dn));
2468 ret = ldb_module_send_referral(req, referral);
2473 if (ret != LDB_SUCCESS) {
2478 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2479 if (ret != LDB_SUCCESS) {
2485 * - replace the old object with the newly constructed one
2488 ac->is_urgent = is_urgent;
2490 ret = ldb_build_mod_req(&down_req, ldb, ac,
2493 ac, replmd_op_callback,
2495 LDB_REQ_SET_LOCATION(down_req);
2496 if (ret != LDB_SUCCESS) {
2501 /* current partition control is needed by "replmd_op_callback" */
2502 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2503 ret = ldb_request_add_control(down_req,
2504 DSDB_CONTROL_CURRENT_PARTITION_OID,
2506 if (ret != LDB_SUCCESS) {
2512 /* If we are in functional level 2000, then
2513 * replmd_modify_handle_linked_attribs will have done
2515 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2516 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2517 if (ret != LDB_SUCCESS) {
2523 talloc_steal(down_req, msg);
2525 /* we only change whenChanged and uSNChanged if the seq_num
2527 if (ac->seq_num != 0) {
2528 ret = add_time_element(msg, "whenChanged", t);
2529 if (ret != LDB_SUCCESS) {
2535 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2536 if (ret != LDB_SUCCESS) {
2543 if (!ldb_dn_compare_base(ac->schema->base_dn, msg->dn)) {
2544 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
2545 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
2546 if (msds_intid_struct) {
2547 msds_intid_struct->usn = ac->seq_num;
2551 /* go on with the call chain */
2552 return ldb_next_request(module, down_req);
2555 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2558 handle a rename request
2560 On a rename we need to do an extra ldb_modify which sets the
2561 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2563 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2565 struct ldb_context *ldb;
2566 struct replmd_replicated_request *ac;
2568 struct ldb_request *down_req;
2570 /* do not manipulate our control entries */
2571 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2572 return ldb_next_request(module, req);
2575 ldb = ldb_module_get_ctx(module);
2577 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2579 ac = replmd_ctx_init(module, req);
2581 return ldb_module_oom(module);
2584 ret = ldb_build_rename_req(&down_req, ldb, ac,
2585 ac->req->op.rename.olddn,
2586 ac->req->op.rename.newdn,
2588 ac, replmd_rename_callback,
2590 LDB_REQ_SET_LOCATION(down_req);
2591 if (ret != LDB_SUCCESS) {
2596 /* go on with the call chain */
2597 return ldb_next_request(module, down_req);
2600 /* After the rename is compleated, update the whenchanged etc */
2601 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2603 struct ldb_context *ldb;
2604 struct replmd_replicated_request *ac;
2605 struct ldb_request *down_req;
2606 struct ldb_message *msg;
2607 const struct dsdb_attribute *rdn_attr;
2608 const char *rdn_name;
2609 const struct ldb_val *rdn_val;
2610 const char *attrs[5] = { NULL, };
2611 time_t t = time(NULL);
2613 bool is_urgent = false, rodc = false;
2615 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2616 ldb = ldb_module_get_ctx(ac->module);
2618 if (ares->error != LDB_SUCCESS) {
2619 return ldb_module_done(ac->req, ares->controls,
2620 ares->response, ares->error);
2623 if (ares->type != LDB_REPLY_DONE) {
2624 ldb_set_errstring(ldb,
2625 "invalid ldb_reply_type in callback");
2627 return ldb_module_done(ac->req, NULL, NULL,
2628 LDB_ERR_OPERATIONS_ERROR);
2632 * - replace the old object with the newly constructed one
2635 msg = ldb_msg_new(ac);
2638 return LDB_ERR_OPERATIONS_ERROR;
2641 msg->dn = ac->req->op.rename.newdn;
2643 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2644 if (rdn_name == NULL) {
2646 return ldb_module_done(ac->req, NULL, NULL,
2650 /* normalize the rdn attribute name */
2651 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2652 if (rdn_attr == NULL) {
2654 return ldb_module_done(ac->req, NULL, NULL,
2657 rdn_name = rdn_attr->lDAPDisplayName;
2659 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2660 if (rdn_val == NULL) {
2662 return ldb_module_done(ac->req, NULL, NULL,
2666 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2668 return ldb_module_done(ac->req, NULL, NULL,
2671 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2673 return ldb_module_done(ac->req, NULL, NULL,
2676 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2678 return ldb_module_done(ac->req, NULL, NULL,
2681 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2683 return ldb_module_done(ac->req, NULL, NULL,
2688 * here we let replmd_update_rpmd() only search for
2689 * the existing "replPropertyMetaData" and rdn_name attributes.
2691 * We do not want the existing "name" attribute as
2692 * the "name" attribute needs to get the version
2693 * updated on rename even if the rdn value hasn't changed.
2695 * This is the diff of the meta data, for a moved user
2696 * on a w2k8r2 server:
2699 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2700 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2701 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2702 * version : 0x00000001 (1)
2703 * reserved : 0x00000000 (0)
2704 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2705 * local_usn : 0x00000000000037a5 (14245)
2706 * array: struct replPropertyMetaData1
2707 * attid : DRSUAPI_ATTID_name (0x90001)
2708 * - version : 0x00000001 (1)
2709 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2710 * + version : 0x00000002 (2)
2711 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2712 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2713 * - originating_usn : 0x00000000000037a5 (14245)
2714 * - local_usn : 0x00000000000037a5 (14245)
2715 * + originating_usn : 0x0000000000003834 (14388)
2716 * + local_usn : 0x0000000000003834 (14388)
2717 * array: struct replPropertyMetaData1
2718 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2719 * version : 0x00000004 (4)
2721 attrs[0] = "replPropertyMetaData";
2722 attrs[1] = "objectClass";
2723 attrs[2] = "instanceType";
2724 attrs[3] = rdn_name;
2727 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2728 msg, &ac->seq_num, t, &is_urgent, &rodc);
2729 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2730 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2731 struct loadparm_context *lp_ctx;
2734 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2735 struct loadparm_context);
2737 referral = talloc_asprintf(req,
2739 lpcfg_dnsdomain(lp_ctx),
2740 ldb_dn_get_linearized(olddn));
2741 ret = ldb_module_send_referral(req, referral);
2743 return ldb_module_done(req, NULL, NULL, ret);
2746 if (ret != LDB_SUCCESS) {
2748 return ldb_module_done(ac->req, NULL, NULL, ret);
2751 if (ac->seq_num == 0) {
2753 return ldb_module_done(ac->req, NULL, NULL,
2755 "internal error seq_num == 0"));
2757 ac->is_urgent = is_urgent;
2759 ret = ldb_build_mod_req(&down_req, ldb, ac,
2762 ac, replmd_op_callback,
2764 LDB_REQ_SET_LOCATION(down_req);
2765 if (ret != LDB_SUCCESS) {
2770 /* current partition control is needed by "replmd_op_callback" */
2771 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2772 ret = ldb_request_add_control(down_req,
2773 DSDB_CONTROL_CURRENT_PARTITION_OID,
2775 if (ret != LDB_SUCCESS) {
2781 talloc_steal(down_req, msg);
2783 ret = add_time_element(msg, "whenChanged", t);
2784 if (ret != LDB_SUCCESS) {
2790 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2791 if (ret != LDB_SUCCESS) {
2797 /* go on with the call chain - do the modify after the rename */
2798 return ldb_next_request(ac->module, down_req);
2802 * remove links from objects that point at this object when an object
2803 * is deleted. We remove it from the NEXT module per MS-DRSR 5.160
2804 * RemoveObj which states that link removal due to the object being
2805 * deleted is NOT an originating update - they just go away!
2808 static int replmd_delete_remove_link(struct ldb_module *module,
2809 const struct dsdb_schema *schema,
2811 struct ldb_message_element *el,
2812 const struct dsdb_attribute *sa,
2813 struct ldb_request *parent)
2816 TALLOC_CTX *tmp_ctx = talloc_new(module);
2817 struct ldb_context *ldb = ldb_module_get_ctx(module);
2819 for (i=0; i<el->num_values; i++) {
2820 struct dsdb_dn *dsdb_dn;
2824 struct ldb_message *msg;
2825 const struct dsdb_attribute *target_attr;
2826 struct ldb_message_element *el2;
2827 struct ldb_val dn_val;
2829 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2833 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2835 talloc_free(tmp_ctx);
2836 return LDB_ERR_OPERATIONS_ERROR;
2839 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2840 if (!NT_STATUS_IS_OK(status)) {
2841 talloc_free(tmp_ctx);
2842 return LDB_ERR_OPERATIONS_ERROR;
2845 /* remove the link */
2846 msg = ldb_msg_new(tmp_ctx);
2848 ldb_module_oom(module);
2849 talloc_free(tmp_ctx);
2850 return LDB_ERR_OPERATIONS_ERROR;
2854 msg->dn = dsdb_dn->dn;
2856 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2857 if (target_attr == NULL) {
2861 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2862 if (ret != LDB_SUCCESS) {
2863 ldb_module_oom(module);
2864 talloc_free(tmp_ctx);
2865 return LDB_ERR_OPERATIONS_ERROR;
2867 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2868 el2->values = &dn_val;
2869 el2->num_values = 1;
2871 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2872 if (ret != LDB_SUCCESS) {
2873 talloc_free(tmp_ctx);
2877 talloc_free(tmp_ctx);
2883 handle update of replication meta data for deletion of objects
2885 This also handles the mapping of delete to a rename operation
2886 to allow deletes to be replicated.
2888 It also handles the incoming deleted objects, to ensure they are
2889 fully deleted here. In that case re_delete is true, and we do not
2890 use this as a signal to change the deleted state, just reinforce it.
2893 static int replmd_delete_internals(struct ldb_module *module, struct ldb_request *req, bool re_delete)
2895 int ret = LDB_ERR_OTHER;
2896 bool retb, disallow_move_on_delete;
2897 struct ldb_dn *old_dn, *new_dn;
2898 const char *rdn_name;
2899 const struct ldb_val *rdn_value, *new_rdn_value;
2901 struct ldb_context *ldb = ldb_module_get_ctx(module);
2902 const struct dsdb_schema *schema;
2903 struct ldb_message *msg, *old_msg;
2904 struct ldb_message_element *el;
2905 TALLOC_CTX *tmp_ctx;
2906 struct ldb_result *res, *parent_res;
2907 const char *preserved_attrs[] = {
2908 /* yes, this really is a hard coded list. See MS-ADTS
2909 section 3.1.1.5.5.1.1 */
2910 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2911 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2912 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2913 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2914 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2915 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2916 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2917 "whenChanged", NULL};
2918 unsigned int i, el_count = 0;
2919 enum deletion_state deletion_state, next_deletion_state;
2921 if (ldb_dn_is_special(req->op.del.dn)) {
2922 return ldb_next_request(module, req);
2925 tmp_ctx = talloc_new(ldb);
2928 return LDB_ERR_OPERATIONS_ERROR;
2931 schema = dsdb_get_schema(ldb, tmp_ctx);
2933 talloc_free(tmp_ctx);
2934 return LDB_ERR_OPERATIONS_ERROR;
2937 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2939 /* we need the complete msg off disk, so we can work out which
2940 attributes need to be removed */
2941 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2942 DSDB_FLAG_NEXT_MODULE |
2943 DSDB_SEARCH_SHOW_RECYCLED |
2944 DSDB_SEARCH_REVEAL_INTERNALS |
2945 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2946 if (ret != LDB_SUCCESS) {
2947 ldb_asprintf_errstring(ldb_module_get_ctx(module),
2948 "repmd_delete: Failed to %s %s, because we failed to find it: %s",
2949 re_delete ? "re-delete" : "delete",
2950 ldb_dn_get_linearized(old_dn),
2951 ldb_errstring(ldb_module_get_ctx(module)));
2952 talloc_free(tmp_ctx);
2955 old_msg = res->msgs[0];
2957 replmd_deletion_state(module, old_msg,
2959 &next_deletion_state);
2961 /* This supports us noticing an incoming isDeleted and acting on it */
2963 SMB_ASSERT(deletion_state > OBJECT_NOT_DELETED);
2964 next_deletion_state = deletion_state;
2967 if (next_deletion_state == OBJECT_REMOVED) {
2968 struct auth_session_info *session_info =
2969 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2970 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2971 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2972 ldb_dn_get_linearized(old_msg->dn));
2973 return LDB_ERR_UNWILLING_TO_PERFORM;
2976 /* it is already deleted - really remove it this time */
2977 talloc_free(tmp_ctx);
2978 return ldb_next_request(module, req);
2981 rdn_name = ldb_dn_get_rdn_name(old_dn);
2982 rdn_value = ldb_dn_get_rdn_val(old_dn);
2983 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2984 talloc_free(tmp_ctx);
2985 return ldb_operr(ldb);
2988 msg = ldb_msg_new(tmp_ctx);
2990 ldb_module_oom(module);
2991 talloc_free(tmp_ctx);
2992 return LDB_ERR_OPERATIONS_ERROR;
2997 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2998 disallow_move_on_delete =
2999 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
3000 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
3002 /* work out where we will be renaming this object to */
3003 if (!disallow_move_on_delete) {
3004 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
3007 * Deleted Objects itself appears to be deleted, but
3008 * should also not be moved, and we should not move
3009 * objects if we can't find the deleted objects DN
3011 if (re_delete && (ret != LDB_SUCCESS || ldb_dn_compare(old_dn, new_dn) == 0)) {
3012 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
3013 if (new_dn == NULL) {
3014 ldb_module_oom(module);
3015 talloc_free(tmp_ctx);
3016 return LDB_ERR_OPERATIONS_ERROR;
3018 } else if (ret != LDB_SUCCESS) {
3019 /* this is probably an attempted delete on a partition
3020 * that doesn't allow delete operations, such as the
3021 * schema partition */
3022 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
3023 ldb_dn_get_linearized(old_dn));
3024 talloc_free(tmp_ctx);
3025 return LDB_ERR_UNWILLING_TO_PERFORM;
3028 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
3029 if (new_dn == NULL) {
3030 ldb_module_oom(module);
3031 talloc_free(tmp_ctx);
3032 return LDB_ERR_OPERATIONS_ERROR;
3036 if (deletion_state == OBJECT_NOT_DELETED) {
3037 /* get the objects GUID from the search we just did */
3038 guid = samdb_result_guid(old_msg, "objectGUID");
3040 /* Add a formatted child */
3041 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
3043 ldb_dn_escape_value(tmp_ctx, *rdn_value),
3044 GUID_string(tmp_ctx, &guid));
3046 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
3047 ldb_dn_get_linearized(new_dn)));
3048 talloc_free(tmp_ctx);
3049 return LDB_ERR_OPERATIONS_ERROR;
3052 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
3053 if (ret != LDB_SUCCESS) {
3054 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
3055 ldb_module_oom(module);
3056 talloc_free(tmp_ctx);
3059 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3062 * No matter what has happened with other renames etc, try again to
3063 * get this to be under the deleted DN. See MS-DRSR 5.160 RemoveObj
3066 struct ldb_dn *rdn = ldb_dn_copy(tmp_ctx, old_dn);
3067 retb = ldb_dn_remove_base_components(rdn, ldb_dn_get_comp_num(rdn) - 1);
3069 DEBUG(0,(__location__ ": Unable to add a prepare rdn of %s",
3070 ldb_dn_get_linearized(rdn)));
3071 talloc_free(tmp_ctx);
3072 return LDB_ERR_OPERATIONS_ERROR;
3074 SMB_ASSERT(ldb_dn_get_comp_num(rdn) == 1);
3076 retb = ldb_dn_add_child(new_dn, rdn);
3078 DEBUG(0,(__location__ ": Unable to add rdn %s to base dn: %s",
3079 ldb_dn_get_linearized(rdn),
3080 ldb_dn_get_linearized(new_dn)));
3081 talloc_free(tmp_ctx);
3082 return LDB_ERR_OPERATIONS_ERROR;
3087 now we need to modify the object in the following ways:
3089 - add isDeleted=TRUE
3090 - update rDN and name, with new rDN
3091 - remove linked attributes
3092 - remove objectCategory and sAMAccountType
3093 - remove attribs not on the preserved list
3094 - preserved if in above list, or is rDN
3095 - remove all linked attribs from this object
3096 - remove all links from other objects to this object
3097 - add lastKnownParent
3098 - update replPropertyMetaData?
3100 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
3103 if (deletion_state == OBJECT_NOT_DELETED) {
3104 /* we need the storage form of the parent GUID */
3105 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
3106 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
3107 DSDB_FLAG_NEXT_MODULE |
3108 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3109 DSDB_SEARCH_REVEAL_INTERNALS|
3110 DSDB_SEARCH_SHOW_RECYCLED, req);
3111 if (ret != LDB_SUCCESS) {
3112 ldb_asprintf_errstring(ldb_module_get_ctx(module),
3113 "repmd_delete: Failed to %s %s, because we failed to find it's parent (%s): %s",
3114 re_delete ? "re-delete" : "delete",
3115 ldb_dn_get_linearized(old_dn),
3116 ldb_dn_get_linearized(ldb_dn_get_parent(tmp_ctx, old_dn)),
3117 ldb_errstring(ldb_module_get_ctx(module)));
3118 talloc_free(tmp_ctx);
3122 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3123 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
3124 if (ret != LDB_SUCCESS) {
3125 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3126 ldb_module_oom(module);
3127 talloc_free(tmp_ctx);
3130 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3132 if (next_deletion_state == OBJECT_DELETED) {
3133 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
3134 if (ret != LDB_SUCCESS) {
3135 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
3136 ldb_module_oom(module);
3137 talloc_free(tmp_ctx);
3140 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3144 switch (next_deletion_state) {
3146 case OBJECT_RECYCLED:
3147 case OBJECT_TOMBSTONE:
3150 * MS-ADTS 3.1.1.5.5.1.1 Tombstone Requirements
3151 * describes what must be removed from a tombstone
3154 * MS-ADTS 3.1.1.5.5.1.3 Recycled-Object Requirements
3155 * describes what must be removed from a recycled
3161 * we also mark it as recycled, meaning this object can't be
3162 * recovered (we are stripping its attributes).
3163 * This is done only if we have this schema object of course ...
3164 * This behavior is identical to the one of Windows 2008R2 which
3165 * always set the isRecycled attribute, even if the recycle-bin is
3166 * not activated and what ever the forest level is.
3168 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3169 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3170 if (ret != LDB_SUCCESS) {
3171 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3172 ldb_module_oom(module);
3173 talloc_free(tmp_ctx);
3176 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
3179 /* work out which of the old attributes we will be removing */
3180 for (i=0; i<old_msg->num_elements; i++) {
3181 const struct dsdb_attribute *sa;
3182 el = &old_msg->elements[i];
3183 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3185 talloc_free(tmp_ctx);
3186 return LDB_ERR_OPERATIONS_ERROR;
3188 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3189 /* don't remove the rDN */
3192 if (sa->linkID && (sa->linkID & 1)) {
3194 we have a backlink in this object
3195 that needs to be removed. We're not
3196 allowed to remove it directly
3197 however, so we instead setup a
3198 modify to delete the corresponding
3201 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3202 if (ret != LDB_SUCCESS) {
3203 talloc_free(tmp_ctx);
3204 return LDB_ERR_OPERATIONS_ERROR;
3206 /* now we continue, which means we
3207 won't remove this backlink
3212 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
3215 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3216 if (ret != LDB_SUCCESS) {
3217 talloc_free(tmp_ctx);
3218 ldb_module_oom(module);
3223 /* Duplicate with the below - we remove the
3224 * samAccountType as an originating update, in case it
3225 * somehow came back. The objectCategory will have
3226 * gone in the above */
3227 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3228 if (ret != LDB_SUCCESS) {
3229 talloc_free(tmp_ctx);
3230 ldb_module_oom(module);
3236 case OBJECT_DELETED:
3238 * MS-ADTS 3.1.1.5.5.1.2 Deleted-Object Requirements
3239 * describes what must be removed from a deleted
3243 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3244 if (ret != LDB_SUCCESS) {
3245 talloc_free(tmp_ctx);
3246 ldb_module_oom(module);
3250 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3251 if (ret != LDB_SUCCESS) {
3252 talloc_free(tmp_ctx);
3253 ldb_module_oom(module);
3263 if (deletion_state == OBJECT_NOT_DELETED) {
3264 const struct dsdb_attribute *sa;
3266 /* work out what the new rdn value is, for updating the
3267 rDN and name fields */
3268 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3269 if (new_rdn_value == NULL) {
3270 talloc_free(tmp_ctx);
3271 return ldb_operr(ldb);
3274 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3276 talloc_free(tmp_ctx);
3277 return LDB_ERR_OPERATIONS_ERROR;
3280 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3282 if (ret != LDB_SUCCESS) {
3283 talloc_free(tmp_ctx);
3286 el->flags = LDB_FLAG_MOD_REPLACE;
3288 el = ldb_msg_find_element(old_msg, "name");
3290 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3291 if (ret != LDB_SUCCESS) {
3292 talloc_free(tmp_ctx);
3295 el->flags = LDB_FLAG_MOD_REPLACE;
3300 * TODO: Per MS-DRSR 5.160 RemoveObj we should remove links directly, not as an originating update!
3304 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3305 if (ret != LDB_SUCCESS) {
3306 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3307 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3308 talloc_free(tmp_ctx);
3313 * No matter what has happned with other renames, try again to
3314 * get this to be under the deleted DN.
3316 if (strcmp(ldb_dn_get_linearized(old_dn), ldb_dn_get_linearized(new_dn)) != 0) {
3317 /* now rename onto the new DN */
3318 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3319 if (ret != LDB_SUCCESS){
3320 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3321 ldb_dn_get_linearized(old_dn),
3322 ldb_dn_get_linearized(new_dn),
3323 ldb_errstring(ldb)));
3324 talloc_free(tmp_ctx);
3329 talloc_free(tmp_ctx);
3331 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3334 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
3336 return replmd_delete_internals(module, req, false);
3340 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3345 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3347 int ret = LDB_ERR_OTHER;
3348 /* TODO: do some error mapping */
3353 static struct replPropertyMetaData1 *
3354 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3355 enum drsuapi_DsAttributeId attid)
3358 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3360 for (i = 0; i < rpmd_ctr->count; i++) {
3361 if (rpmd_ctr->array[i].attid == attid) {
3362 return &rpmd_ctr->array[i];
3370 return true if an update is newer than an existing entry
3371 see section 5.11 of MS-ADTS
3373 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3374 const struct GUID *update_invocation_id,
3375 uint32_t current_version,
3376 uint32_t update_version,
3377 NTTIME current_change_time,
3378 NTTIME update_change_time)
3380 if (update_version != current_version) {
3381 return update_version > current_version;
3383 if (update_change_time != current_change_time) {
3384 return update_change_time > current_change_time;
3386 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3389 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3390 struct replPropertyMetaData1 *new_m)
3392 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3393 &new_m->originating_invocation_id,
3396 cur_m->originating_change_time,
3397 new_m->originating_change_time);
3404 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3406 const struct ldb_val *rdn_val;
3407 const char *rdn_name;
3408 struct ldb_dn *new_dn;
3410 rdn_val = ldb_dn_get_rdn_val(dn);
3411 rdn_name = ldb_dn_get_rdn_name(dn);
3412 if (!rdn_val || !rdn_name) {
3416 new_dn = ldb_dn_copy(mem_ctx, dn);
3421 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3425 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3427 ldb_dn_escape_value(new_dn, *rdn_val),
3428 GUID_string(new_dn, guid))) {
3437 perform a modify operation which sets the rDN and name attributes to
3438 their current values. This has the effect of changing these
3439 attributes to have been last updated by the current DC. This is
3440 needed to ensure that renames performed as part of conflict
3441 resolution are propogated to other DCs
3443 static int replmd_name_modify(struct replmd_replicated_request *ar,
3444 struct ldb_request *req, struct ldb_dn *dn)
3446 struct ldb_message *msg;
3447 const char *rdn_name;
3448 const struct ldb_val *rdn_val;
3449 const struct dsdb_attribute *rdn_attr;
3452 msg = ldb_msg_new(req);
3458 rdn_name = ldb_dn_get_rdn_name(dn);
3459 if (rdn_name == NULL) {
3463 /* normalize the rdn attribute name */
3464 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3465 if (rdn_attr == NULL) {
3468 rdn_name = rdn_attr->lDAPDisplayName;
3470 rdn_val = ldb_dn_get_rdn_val(dn);
3471 if (rdn_val == NULL) {
3475 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3478 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3481 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3484 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3488 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3489 if (ret != LDB_SUCCESS) {
3490 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3491 ldb_dn_get_linearized(dn),
3492 ldb_errstring(ldb_module_get_ctx(ar->module))));
3502 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3503 ldb_dn_get_linearized(dn)));
3504 return LDB_ERR_OPERATIONS_ERROR;
3509 callback for conflict DN handling where we have renamed the incoming
3510 record. After renaming it, we need to ensure the change of name and
3511 rDN for the incoming record is seen as an originating update by this DC.
3513 This also handles updating lastKnownParent for entries sent to lostAndFound
3515 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3517 struct replmd_replicated_request *ar =
3518 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3519 struct ldb_dn *conflict_dn;
3522 if (ares->error != LDB_SUCCESS) {
3523 /* call the normal callback for everything except success */
3524 return replmd_op_callback(req, ares);
3527 switch (req->operation) {
3529 conflict_dn = req->op.add.message->dn;
3532 conflict_dn = req->op.mod.message->dn;
3535 smb_panic("replmd_op_name_modify_callback called in unknown circumstances");
3538 /* perform a modify of the rDN and name of the record */
3539 ret = replmd_name_modify(ar, req, conflict_dn);
3540 if (ret != LDB_SUCCESS) {
3542 return replmd_op_callback(req, ares);
3545 if (ar->objs->objects[ar->index_current].last_known_parent) {
3546 struct ldb_message *msg = ldb_msg_new(req);
3548 ldb_module_oom(ar->module);
3549 return LDB_ERR_OPERATIONS_ERROR;
3552 msg->dn = req->op.add.message->dn;
3554 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
3555 ldb_dn_get_extended_linearized(msg, ar->objs->objects[ar->index_current].last_known_parent, 1));
3556 if (ret != LDB_SUCCESS) {
3557 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
3558 ldb_module_oom(ar->module);
3561 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
3563 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3564 if (ret != LDB_SUCCESS) {
3565 DEBUG(0,(__location__ ": Failed to modify lastKnownParent of lostAndFound DN '%s' - %s",
3566 ldb_dn_get_linearized(msg->dn),
3567 ldb_errstring(ldb_module_get_ctx(ar->module))));
3573 return replmd_op_callback(req, ares);
3577 callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
3578 This copes with the creation of conflict records in the case where
3579 the DN exists, but with a different objectGUID
3581 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3583 struct ldb_dn *conflict_dn;
3584 struct replmd_replicated_request *ar =
3585 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3586 struct ldb_result *res;
3587 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3589 const struct ldb_val *omd_value;
3590 struct replPropertyMetaDataBlob omd, *rmd;
3591 enum ndr_err_code ndr_err;
3592 bool rename_incoming_record, rodc;
3593 struct replPropertyMetaData1 *rmd_name, *omd_name;
3594 struct ldb_message *msg;
3596 req->callback = callback;
3598 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3599 /* call the normal callback for everything except
3601 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3604 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3605 if (ret != LDB_SUCCESS) {
3606 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module), "Failed to determine if we are an RODC when attempting to form conflict DN: %s", ldb_errstring(ldb_module_get_ctx(ar->module)));
3607 return ldb_module_done(req, ares->controls, ares->response, LDB_ERR_OPERATIONS_ERROR);
3610 * we have a conflict, and need to decide if we will keep the
3611 * new record or the old record
3614 msg = ar->objs->objects[ar->index_current].msg;
3616 switch (req->operation) {
3618 conflict_dn = msg->dn;
3621 conflict_dn = req->op.rename.newdn;
3624 return ldb_module_done(req, ares->controls, ares->response, ldb_module_operr(ar->module));
3629 * We are on an RODC, or were a GC for this
3630 * partition, so we have to fail this until
3631 * someone who owns the partition sorts it
3634 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3635 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3636 " - We must fail the operation until a master for this partition resolves the conflict",
3637 ldb_dn_get_linearized(conflict_dn));
3642 * first we need the replPropertyMetaData attribute from the
3645 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3647 DSDB_FLAG_NEXT_MODULE |
3648 DSDB_SEARCH_SHOW_DELETED |
3649 DSDB_SEARCH_SHOW_RECYCLED, req);
3650 if (ret != LDB_SUCCESS) {
3651 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3652 ldb_dn_get_linearized(conflict_dn)));
3656 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3657 if (omd_value == NULL) {
3658 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3659 ldb_dn_get_linearized(conflict_dn)));
3663 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3664 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3665 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3666 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3667 ldb_dn_get_linearized(conflict_dn)));
3671 rmd = ar->objs->objects[ar->index_current].meta_data;
3673 /* we decide which is newer based on the RPMD on the name
3674 attribute. See [MS-DRSR] ResolveNameConflict */
3675 rmd_name = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3676 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3677 if (!rmd_name || !omd_name) {
3678 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3679 ldb_dn_get_linearized(conflict_dn)));
3683 rename_incoming_record = !(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) &&
3684 !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3686 if (rename_incoming_record) {
3688 struct ldb_dn *new_dn;
3691 * We want to run the original callback here, which
3692 * will return LDB_ERR_ENTRY_ALREADY_EXISTS to the
3693 * caller, which will in turn know to rename the
3694 * incoming record. The error string is set in case
3695 * this isn't handled properly at some point in the
3698 if (req->operation == LDB_RENAME) {
3699 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3700 "Unable to handle incoming renames where this would "
3701 "create a conflict. Incoming record is %s (caller to handle)\n",
3702 ldb_dn_get_extended_linearized(req, conflict_dn, 1));
3707 guid = samdb_result_guid(msg, "objectGUID");
3708 if (GUID_all_zero(&guid)) {
3709 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3710 ldb_dn_get_linearized(conflict_dn)));
3713 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3714 if (new_dn == NULL) {
3715 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3716 ldb_dn_get_linearized(conflict_dn)));
3720 DEBUG(2,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3721 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3723 /* re-submit the request, but with a different
3724 callback, so we don't loop forever. */
3726 req->callback = replmd_op_name_modify_callback;
3728 return ldb_next_request(ar->module, req);
3730 /* we are renaming the existing record */
3732 struct ldb_dn *new_dn;
3734 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3735 if (GUID_all_zero(&guid)) {
3736 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3737 ldb_dn_get_linearized(conflict_dn)));
3741 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3742 if (new_dn == NULL) {
3743 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3744 ldb_dn_get_linearized(conflict_dn)));
3748 DEBUG(2,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3749 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3751 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3752 DSDB_FLAG_OWN_MODULE, req);
3753 if (ret != LDB_SUCCESS) {
3754 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3755 ldb_dn_get_linearized(conflict_dn),
3756 ldb_dn_get_linearized(new_dn),
3757 ldb_errstring(ldb_module_get_ctx(ar->module))));
3762 * now we need to ensure that the rename is seen as an
3763 * originating update. We do that with a modify.
3765 ret = replmd_name_modify(ar, req, new_dn);
3766 if (ret != LDB_SUCCESS) {
3770 return ldb_next_request(ar->module, req);
3774 /* on failure do the original callback. This means replication
3775 * will stop with an error, but there is not much else we can
3778 return ldb_module_done(req, ares->controls, ares->response, ares->error);
3782 callback for replmd_replicated_apply_add()
3783 This copes with the creation of conflict records in the case where
3784 the DN exists, but with a different objectGUID
3786 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3788 struct replmd_replicated_request *ar =
3789 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3791 if (ar->objs->objects[ar->index_current].last_known_parent) {
3792 /* This is like a conflict DN, where we put the object in LostAndFound
3793 see MS-DRSR 4.1.10.6.10 FindBestParentObject */
3794 return replmd_op_possible_conflict_callback(req, ares, replmd_op_name_modify_callback);
3797 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
3801 callback for replmd_replicated_handle_rename()
3802 This copes with the creation of conflict records in the case where
3803 the DN exists, but with a different objectGUID
3805 static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
3807 return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
3811 this is called when a new object comes in over DRS
3813 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3815 struct ldb_context *ldb;
3816 struct ldb_request *change_req;
3817 enum ndr_err_code ndr_err;
3818 struct ldb_message *msg;
3819 struct replPropertyMetaDataBlob *md;
3820 struct ldb_val md_value;
3823 bool remote_isDeleted = false;
3825 ldb = ldb_module_get_ctx(ar->module);
3826 msg = ar->objs->objects[ar->index_current].msg;
3827 md = ar->objs->objects[ar->index_current].meta_data;
3829 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3830 if (ret != LDB_SUCCESS) {
3831 return replmd_replicated_request_error(ar, ret);
3834 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3835 if (ret != LDB_SUCCESS) {
3836 return replmd_replicated_request_error(ar, ret);
3839 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3840 if (ret != LDB_SUCCESS) {
3841 return replmd_replicated_request_error(ar, ret);
3844 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3845 if (ret != LDB_SUCCESS) {
3846 return replmd_replicated_request_error(ar, ret);
3849 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3850 if (ret != LDB_SUCCESS) {
3851 return replmd_replicated_request_error(ar, ret);
3854 /* remove any message elements that have zero values */
3855 for (i=0; i<msg->num_elements; i++) {
3856 struct ldb_message_element *el = &msg->elements[i];
3858 if (el->num_values == 0) {
3859 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3861 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3862 msg->num_elements--;
3868 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
3869 "isDeleted", false);
3872 * the meta data array is already sorted by the caller
3874 for (i=0; i < md->ctr.ctr1.count; i++) {
3875 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3877 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3878 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3879 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3880 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3881 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3883 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3884 if (ret != LDB_SUCCESS) {
3885 return replmd_replicated_request_error(ar, ret);
3888 replmd_ldb_message_sort(msg, ar->schema);
3890 if (!remote_isDeleted) {
3891 ret = dsdb_module_schedule_sd_propagation(ar->module,
3892 ar->objs->partition_dn,
3894 if (ret != LDB_SUCCESS) {
3895 return replmd_replicated_request_error(ar, ret);
3899 ar->isDeleted = remote_isDeleted;
3902 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3903 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3907 ret = ldb_build_add_req(&change_req,
3913 replmd_op_add_callback,
3915 LDB_REQ_SET_LOCATION(change_req);
3916 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3918 /* current partition control needed by "repmd_op_callback" */
3919 ret = ldb_request_add_control(change_req,
3920 DSDB_CONTROL_CURRENT_PARTITION_OID,
3922 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3924 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
3925 /* this tells the partition module to make it a
3926 partial replica if creating an NC */
3927 ret = ldb_request_add_control(change_req,
3928 DSDB_CONTROL_PARTIAL_REPLICA,
3930 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3933 return ldb_next_request(ar->module, change_req);
3936 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
3937 struct ldb_reply *ares)
3939 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3940 struct replmd_replicated_request);
3944 return ldb_module_done(ar->req, NULL, NULL,
3945 LDB_ERR_OPERATIONS_ERROR);
3947 if (ares->error != LDB_SUCCESS &&
3948 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3950 * TODO: deal with the above error that the parent object doesn't exist
3953 return ldb_module_done(ar->req, ares->controls,
3954 ares->response, ares->error);
3957 switch (ares->type) {
3958 case LDB_REPLY_ENTRY:
3960 struct ldb_message *parent_msg = ares->message;
3961 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
3962 struct ldb_dn *parent_dn;
3965 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
3966 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
3967 /* Per MS-DRSR 4.1.10.6.10
3968 * FindBestParentObject we need to move this
3969 * new object under a deleted object to
3971 struct ldb_dn *nc_root;
3973 ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
3974 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3975 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3976 "No suitable NC root found for %s. "
3977 "We need to move this object because parent object %s "
3978 "is deleted, but this object is not.",
3979 ldb_dn_get_linearized(msg->dn),
3980 ldb_dn_get_linearized(parent_msg->dn));
3981 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3982 } else if (ret != LDB_SUCCESS) {
3983 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3984 "Unable to find NC root for %s: %s. "
3985 "We need to move this object because parent object %s "
3986 "is deleted, but this object is not.",
3987 ldb_dn_get_linearized(msg->dn),
3988 ldb_errstring(ldb_module_get_ctx(ar->module)),
3989 ldb_dn_get_linearized(parent_msg->dn));
3990 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3993 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
3995 DS_GUID_LOSTANDFOUND_CONTAINER,
3997 if (ret != LDB_SUCCESS) {
3998 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3999 "Unable to find LostAndFound Container for %s "
4000 "in partition %s: %s. "
4001 "We need to move this object because parent object %s "
4002 "is deleted, but this object is not.",
4003 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
4004 ldb_errstring(ldb_module_get_ctx(ar->module)),
4005 ldb_dn_get_linearized(parent_msg->dn));
4006 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
4008 ar->objs->objects[ar->index_current].last_known_parent
4009 = talloc_steal(ar->objs->objects[ar->index_current].msg, parent_msg->dn);
4011 parent_dn = parent_msg->dn;
4014 comp_num = ldb_dn_get_comp_num(msg->dn);
4016 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
4018 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
4021 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
4023 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
4027 case LDB_REPLY_REFERRAL:
4028 /* we ignore referrals */
4031 case LDB_REPLY_DONE:
4032 if (ar->search_msg != NULL) {
4033 ret = replmd_replicated_apply_merge(ar);
4035 ret = replmd_replicated_apply_add(ar);
4037 if (ret != LDB_SUCCESS) {
4038 return ldb_module_done(ar->req, NULL, NULL, ret);
4047 * Look for the parent object, so we put the new object in the right
4048 * place This is akin to NameObject in MS-DRSR - this routine and the
4049 * callbacks find the right parent name, and correct name for this
4053 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
4055 struct ldb_context *ldb;
4059 struct ldb_request *search_req;
4060 static const char *attrs[] = {"isDeleted", NULL};
4062 ldb = ldb_module_get_ctx(ar->module);
4064 if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
4065 if (ar->search_msg != NULL) {
4066 return replmd_replicated_apply_merge(ar);
4068 return replmd_replicated_apply_add(ar);
4072 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
4073 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4075 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4076 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4077 talloc_free(tmp_str);
4079 ret = ldb_build_search_req(&search_req,
4082 ar->objs->partition_dn,
4088 replmd_replicated_apply_search_for_parent_callback,
4090 LDB_REQ_SET_LOCATION(search_req);
4092 ret = dsdb_request_add_controls(search_req,
4093 DSDB_SEARCH_SHOW_RECYCLED|
4094 DSDB_SEARCH_SHOW_DELETED|
4095 DSDB_SEARCH_SHOW_EXTENDED_DN);
4096 if (ret != LDB_SUCCESS) {
4100 return ldb_next_request(ar->module, search_req);
4104 handle renames that come in over DRS replication
4106 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
4107 struct ldb_message *msg,
4108 struct ldb_request *parent)
4110 struct ldb_request *req;
4112 TALLOC_CTX *tmp_ctx = talloc_new(msg);
4113 struct ldb_result *res;
4115 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
4116 ldb_dn_get_linearized(ar->search_msg->dn),
4117 ldb_dn_get_linearized(msg->dn)));
4120 res = talloc_zero(tmp_ctx, struct ldb_result);
4122 talloc_free(tmp_ctx);
4123 return ldb_oom(ldb_module_get_ctx(ar->module));
4126 /* pass rename to the next module
4127 * so it doesn't appear as an originating update */
4128 ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
4129 ar->search_msg->dn, msg->dn,
4132 replmd_op_rename_callback,
4134 LDB_REQ_SET_LOCATION(req);
4135 if (ret != LDB_SUCCESS) {
4136 talloc_free(tmp_ctx);
4140 ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
4141 if (ret != LDB_SUCCESS) {
4142 talloc_free(tmp_ctx);
4146 ret = ldb_next_request(ar->module, req);
4148 if (ret == LDB_SUCCESS) {
4149 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
4152 talloc_free(tmp_ctx);
4157 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
4159 struct ldb_context *ldb;
4160 struct ldb_request *change_req;
4161 enum ndr_err_code ndr_err;
4162 struct ldb_message *msg;
4163 struct replPropertyMetaDataBlob *rmd;
4164 struct replPropertyMetaDataBlob omd;
4165 const struct ldb_val *omd_value;
4166 struct replPropertyMetaDataBlob nmd;
4167 struct ldb_val nmd_value;
4170 unsigned int removed_attrs = 0;
4172 int (*callback)(struct ldb_request *req, struct ldb_reply *ares) = replmd_op_callback;
4173 bool isDeleted = false;
4174 bool local_isDeleted = false;
4175 bool remote_isDeleted = false;
4176 bool take_remote_isDeleted = false;
4177 bool sd_updated = false;
4178 bool renamed = false;
4180 ldb = ldb_module_get_ctx(ar->module);
4181 msg = ar->objs->objects[ar->index_current].msg;
4183 rmd = ar->objs->objects[ar->index_current].meta_data;
4187 /* find existing meta data */
4188 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4190 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4191 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4192 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4193 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4194 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4197 if (omd.version != 1) {
4198 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4202 local_isDeleted = ldb_msg_find_attr_as_bool(ar->search_msg,
4203 "isDeleted", false);
4204 remote_isDeleted = ldb_msg_find_attr_as_bool(msg,
4205 "isDeleted", false);
4207 if (strcmp(ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ar->search_msg->dn)) == 0) {
4211 * handle renames, even just by case that come in over
4212 * DRS. Changes in the parent DN don't hit us here,
4213 * because the search for a parent will clean up those
4216 * We also have already filtered out the case where
4217 * the peer has an older name to what we have (see
4218 * replmd_replicated_apply_search_callback())
4221 ret = replmd_replicated_handle_rename(ar, msg, ar->req);
4225 * This particular error code means that we already tried the
4226 * conflict algrorithm, and the existing record name was newer, so we
4227 * need to rename the incoming record
4229 if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
4232 struct ldb_dn *new_dn;
4233 status = GUID_from_ndr_blob(&ar->objs->objects[ar->index_current].guid_value, &guid);
4234 /* This really, really can't fail */
4235 SMB_ASSERT(NT_STATUS_IS_OK(status));
4237 new_dn = replmd_conflict_dn(msg, msg->dn, &guid);
4238 if (new_dn == NULL) {
4239 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4240 "Failed to form conflict DN for %s\n",
4241 ldb_dn_get_linearized(msg->dn));
4243 return replmd_replicated_request_werror(ar, WERR_NOMEM);
4246 ret = dsdb_module_rename(ar->module, ar->search_msg->dn, new_dn,
4247 DSDB_FLAG_NEXT_MODULE, ar->req);
4248 if (ret != LDB_SUCCESS) {
4249 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
4250 "Failed to rename incoming conflicting dn '%s' (was '%s') to '%s' - %s\n",
4251 ldb_dn_get_linearized(msg->dn),
4252 ldb_dn_get_linearized(ar->search_msg->dn),
4253 ldb_dn_get_linearized(new_dn),
4254 ldb_errstring(ldb_module_get_ctx(ar->module)));
4255 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4258 /* Set the callback to one that will fix up the name to be a conflict DN */
4259 callback = replmd_op_name_modify_callback;
4262 } else if (ret != LDB_SUCCESS) {
4263 ldb_debug(ldb, LDB_DEBUG_FATAL,
4264 "replmd_replicated_request rename %s => %s failed - %s\n",
4265 ldb_dn_get_linearized(ar->search_msg->dn),
4266 ldb_dn_get_linearized(msg->dn),
4267 ldb_errstring(ldb));
4268 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
4273 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
4274 nmd.ctr.ctr1.array = talloc_array(ar,
4275 struct replPropertyMetaData1,
4276 nmd.ctr.ctr1.count);
4277 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4279 /* first copy the old meta data */
4280 for (i=0; i < omd.ctr.ctr1.count; i++) {
4281 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
4286 /* now merge in the new meta data */
4287 for (i=0; i < rmd->ctr.ctr1.count; i++) {
4290 for (j=0; j < ni; j++) {
4293 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
4297 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
4298 /* if we compare equal then do an
4299 update. This is used when a client
4300 asks for a FULL_SYNC, and can be
4301 used to recover a corrupt
4303 cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
4304 &nmd.ctr.ctr1.array[j]);
4306 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
4307 &rmd->ctr.ctr1.array[i]);
4310 /* replace the entry */
4311 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4312 if (ar->seq_num == 0) {
4313 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4314 if (ret != LDB_SUCCESS) {
4315 return replmd_replicated_request_error(ar, ret);
4318 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4319 switch (nmd.ctr.ctr1.array[j].attid) {
4320 case DRSUAPI_ATTID_ntSecurityDescriptor:
4323 case DRSUAPI_ATTID_isDeleted:
4324 take_remote_isDeleted = true;
4333 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4334 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4335 msg->elements[i-removed_attrs].name,
4336 ldb_dn_get_linearized(msg->dn),
4337 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4340 /* we don't want to apply this change so remove the attribute */
4341 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4348 if (found) continue;
4350 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4351 if (ar->seq_num == 0) {
4352 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4353 if (ret != LDB_SUCCESS) {
4354 return replmd_replicated_request_error(ar, ret);
4357 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4358 switch (nmd.ctr.ctr1.array[ni].attid) {
4359 case DRSUAPI_ATTID_ntSecurityDescriptor:
4362 case DRSUAPI_ATTID_isDeleted:
4363 take_remote_isDeleted = true;
4372 * finally correct the size of the meta_data array
4374 nmd.ctr.ctr1.count = ni;
4377 * the rdn attribute (the alias for the name attribute),
4378 * 'cn' for most objects is the last entry in the meta data array
4381 * sort the new meta data array
4383 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
4384 if (ret != LDB_SUCCESS) {
4389 * Work out if this object is deleted, so we can prune any extra attributes. See MS-DRSR 4.1.10.6.9
4392 * This also controls SD propagation below
4394 if (take_remote_isDeleted) {
4395 isDeleted = remote_isDeleted;
4397 isDeleted = local_isDeleted;
4400 ar->isDeleted = isDeleted;
4403 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4405 if (msg->num_elements == 0) {
4406 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4409 return replmd_replicated_apply_isDeleted(ar);
4412 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4413 ar->index_current, msg->num_elements);
4419 if (sd_updated && !isDeleted) {
4420 ret = dsdb_module_schedule_sd_propagation(ar->module,
4421 ar->objs->partition_dn,
4423 if (ret != LDB_SUCCESS) {
4424 return ldb_operr(ldb);
4428 /* create the meta data value */
4429 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4430 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4431 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4432 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4433 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4437 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4438 * and replPopertyMetaData attributes
4440 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4441 if (ret != LDB_SUCCESS) {
4442 return replmd_replicated_request_error(ar, ret);
4444 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4445 if (ret != LDB_SUCCESS) {
4446 return replmd_replicated_request_error(ar, ret);
4448 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4449 if (ret != LDB_SUCCESS) {
4450 return replmd_replicated_request_error(ar, ret);
4453 replmd_ldb_message_sort(msg, ar->schema);
4455 /* we want to replace the old values */
4456 for (i=0; i < msg->num_elements; i++) {
4457 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4461 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4462 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
4466 ret = ldb_build_mod_req(&change_req,
4474 LDB_REQ_SET_LOCATION(change_req);
4475 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4477 /* current partition control needed by "repmd_op_callback" */
4478 ret = ldb_request_add_control(change_req,
4479 DSDB_CONTROL_CURRENT_PARTITION_OID,
4481 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4483 return ldb_next_request(ar->module, change_req);
4486 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
4487 struct ldb_reply *ares)
4489 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4490 struct replmd_replicated_request);
4494 return ldb_module_done(ar->req, NULL, NULL,
4495 LDB_ERR_OPERATIONS_ERROR);
4497 if (ares->error != LDB_SUCCESS &&
4498 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4499 return ldb_module_done(ar->req, ares->controls,
4500 ares->response, ares->error);
4503 switch (ares->type) {
4504 case LDB_REPLY_ENTRY:
4505 ar->search_msg = talloc_steal(ar, ares->message);
4508 case LDB_REPLY_REFERRAL:
4509 /* we ignore referrals */
4512 case LDB_REPLY_DONE:
4514 struct replPropertyMetaData1 *md_remote;
4515 struct replPropertyMetaData1 *md_local;
4517 struct replPropertyMetaDataBlob omd;
4518 const struct ldb_val *omd_value;
4519 struct replPropertyMetaDataBlob *rmd;
4520 struct ldb_message *msg;
4522 ar->objs->objects[ar->index_current].last_known_parent = NULL;
4525 * This is the ADD case, find the appropriate parent,
4526 * as this object doesn't exist locally:
4528 if (ar->search_msg == NULL) {
4529 ret = replmd_replicated_apply_search_for_parent(ar);
4530 if (ret != LDB_SUCCESS) {
4531 return ldb_module_done(ar->req, NULL, NULL, ret);
4538 * Otherwise, in the MERGE case, work out if we are
4539 * attempting a rename, and if so find the parent the
4540 * newly renamed object wants to belong under (which
4541 * may not be the parent in it's attached string DN
4543 rmd = ar->objs->objects[ar->index_current].meta_data;
4547 /* find existing meta data */
4548 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
4550 enum ndr_err_code ndr_err;
4551 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
4552 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
4553 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4554 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4555 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4558 if (omd.version != 1) {
4559 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4564 * now we need to check for double renames. We could have a
4565 * local rename pending which our replication partner hasn't
4566 * received yet. We choose which one wins by looking at the
4567 * attribute stamps on the two objects, the newer one wins
4569 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
4570 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
4571 /* if there is no name attribute then we have to assume the
4572 object we've received is in fact newer */
4573 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING ||
4574 !md_remote || !md_local ||
4575 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
4576 ret = replmd_replicated_apply_search_for_parent(ar);
4578 msg = ar->objs->objects[ar->index_current].msg;
4580 /* Otherwise, just merge on the existing object, force no rename */
4581 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
4582 ldb_dn_get_linearized(ar->search_msg->dn),
4583 ldb_dn_get_linearized(msg->dn)));
4586 * This assignment ensures that the strcmp()
4587 * in replmd_replicated_apply_merge() avoids
4590 msg->dn = ar->search_msg->dn;
4591 ret = replmd_replicated_apply_merge(ar);
4593 if (ret != LDB_SUCCESS) {
4594 return ldb_module_done(ar->req, NULL, NULL, ret);
4603 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
4605 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
4607 struct ldb_context *ldb;
4611 struct ldb_request *search_req;
4613 if (ar->index_current >= ar->objs->num_objects) {
4614 /* done with it, go to next stage */
4615 return replmd_replicated_uptodate_vector(ar);
4618 ldb = ldb_module_get_ctx(ar->module);
4619 ar->search_msg = NULL;
4620 ar->isDeleted = false;
4622 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
4623 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4625 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4626 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4627 talloc_free(tmp_str);
4629 ret = ldb_build_search_req(&search_req,
4638 replmd_replicated_apply_search_callback,
4640 LDB_REQ_SET_LOCATION(search_req);
4642 ret = dsdb_request_add_controls(search_req, DSDB_SEARCH_SEARCH_ALL_PARTITIONS|DSDB_SEARCH_SHOW_RECYCLED);
4644 if (ret != LDB_SUCCESS) {
4648 return ldb_next_request(ar->module, search_req);
4652 * This is essentially a wrapper for replmd_replicated_apply_next()
4654 * This is needed to ensure that both codepaths call this handler.
4656 static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar)
4658 struct ldb_dn *deleted_objects_dn;
4659 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
4660 int ret = dsdb_get_deleted_objects_dn(ldb_module_get_ctx(ar->module), msg, msg->dn,
4661 &deleted_objects_dn);
4662 if (ar->isDeleted && (ret != LDB_SUCCESS || ldb_dn_compare(msg->dn, deleted_objects_dn) != 0)) {
4664 * Do a delete here again, so that if there is
4665 * anything local that conflicts with this
4666 * object being deleted, it is removed. This
4667 * includes links. See MS-DRSR 4.1.10.6.9
4670 * If the object is already deleted, and there
4671 * is no more work required, it doesn't do
4675 /* This has been updated to point to the DN we eventually did the modify on */
4677 struct ldb_request *del_req;
4678 struct ldb_result *res;
4680 TALLOC_CTX *tmp_ctx = talloc_new(ar);
4682 ret = ldb_oom(ldb_module_get_ctx(ar->module));
4686 res = talloc_zero(tmp_ctx, struct ldb_result);
4688 ret = ldb_oom(ldb_module_get_ctx(ar->module));
4689 talloc_free(tmp_ctx);
4693 /* Build a delete request, which hopefully will artually turn into nothing */
4694 ret = ldb_build_del_req(&del_req, ldb_module_get_ctx(ar->module), tmp_ctx,
4698 ldb_modify_default_callback,
4700 LDB_REQ_SET_LOCATION(del_req);
4701 if (ret != LDB_SUCCESS) {
4702 talloc_free(tmp_ctx);
4707 * This is the guts of the call, call back
4708 * into our delete code, but setting the
4709 * re_delete flag so we delete anything that
4710 * shouldn't be there on a deleted or recycled
4713 ret = replmd_delete_internals(ar->module, del_req, true);
4714 if (ret == LDB_SUCCESS) {
4715 ret = ldb_wait(del_req->handle, LDB_WAIT_ALL);
4718 talloc_free(tmp_ctx);
4719 if (ret != LDB_SUCCESS) {
4724 ar->index_current++;
4725 return replmd_replicated_apply_next(ar);
4728 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
4729 struct ldb_reply *ares)
4731 struct ldb_context *ldb;
4732 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4733 struct replmd_replicated_request);
4734 ldb = ldb_module_get_ctx(ar->module);
4737 return ldb_module_done(ar->req, NULL, NULL,
4738 LDB_ERR_OPERATIONS_ERROR);
4740 if (ares->error != LDB_SUCCESS) {
4741 return ldb_module_done(ar->req, ares->controls,
4742 ares->response, ares->error);
4745 if (ares->type != LDB_REPLY_DONE) {
4746 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
4747 return ldb_module_done(ar->req, NULL, NULL,
4748 LDB_ERR_OPERATIONS_ERROR);
4753 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4756 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
4758 struct ldb_context *ldb;
4759 struct ldb_request *change_req;
4760 enum ndr_err_code ndr_err;
4761 struct ldb_message *msg;
4762 struct replUpToDateVectorBlob ouv;
4763 const struct ldb_val *ouv_value;
4764 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
4765 struct replUpToDateVectorBlob nuv;
4766 struct ldb_val nuv_value;
4767 struct ldb_message_element *nuv_el = NULL;
4768 const struct GUID *our_invocation_id;
4769 struct ldb_message_element *orf_el = NULL;
4770 struct repsFromToBlob nrf;
4771 struct ldb_val *nrf_value = NULL;
4772 struct ldb_message_element *nrf_el = NULL;
4776 time_t t = time(NULL);
4779 uint32_t instanceType;
4781 ldb = ldb_module_get_ctx(ar->module);
4782 ruv = ar->objs->uptodateness_vector;
4788 unix_to_nt_time(&now, t);
4790 if (ar->search_msg == NULL) {
4791 /* this happens for a REPL_OBJ call where we are
4792 creating the target object by replicating it. The
4793 subdomain join code does this for the partition DN
4795 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
4796 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4799 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
4800 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
4801 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
4802 ldb_dn_get_linearized(ar->search_msg->dn)));
4803 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4807 * first create the new replUpToDateVector
4809 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
4811 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
4812 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
4813 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4814 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4815 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4818 if (ouv.version != 2) {
4819 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4824 * the new uptodateness vector will at least
4825 * contain 1 entry, one for the source_dsa
4827 * plus optional values from our old vector and the one from the source_dsa
4829 nuv.ctr.ctr2.count = ouv.ctr.ctr2.count;
4830 if (ruv) nuv.ctr.ctr2.count += ruv->count;
4831 nuv.ctr.ctr2.cursors = talloc_array(ar,
4832 struct drsuapi_DsReplicaCursor2,
4833 nuv.ctr.ctr2.count);
4834 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4836 /* first copy the old vector */
4837 for (i=0; i < ouv.ctr.ctr2.count; i++) {
4838 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
4842 /* get our invocation_id if we have one already attached to the ldb */
4843 our_invocation_id = samdb_ntds_invocation_id(ldb);
4844 if (our_invocation_id == NULL) {
4845 DEBUG(0, ("repl_meta_data: Could not find our own server's invocationID!\n"));
4846 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4849 /* merge in the source_dsa vector is available */
4850 for (i=0; (ruv && i < ruv->count); i++) {
4853 if (our_invocation_id &&
4854 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4855 our_invocation_id)) {
4859 for (j=0; j < ni; j++) {
4860 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4861 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4867 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4868 nuv.ctr.ctr2.cursors[j] = ruv->cursors[i];
4873 if (found) continue;
4875 /* if it's not there yet, add it */
4876 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4881 * finally correct the size of the cursors array
4883 nuv.ctr.ctr2.count = ni;
4888 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4891 * create the change ldb_message
4893 msg = ldb_msg_new(ar);
4894 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4895 msg->dn = ar->search_msg->dn;
4897 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4898 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4899 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4900 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4901 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4903 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4904 if (ret != LDB_SUCCESS) {
4905 return replmd_replicated_request_error(ar, ret);
4907 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4910 * now create the new repsFrom value from the given repsFromTo1 structure
4914 nrf.ctr.ctr1 = *ar->objs->source_dsa;
4915 nrf.ctr.ctr1.last_attempt = now;
4916 nrf.ctr.ctr1.last_success = now;
4917 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
4920 * first see if we already have a repsFrom value for the current source dsa
4921 * if so we'll later replace this value
4923 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4925 for (i=0; i < orf_el->num_values; i++) {
4926 struct repsFromToBlob *trf;
4928 trf = talloc(ar, struct repsFromToBlob);
4929 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4931 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4932 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4933 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4934 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4935 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4938 if (trf->version != 1) {
4939 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4943 * we compare the source dsa objectGUID not the invocation_id
4944 * because we want only one repsFrom value per source dsa
4945 * and when the invocation_id of the source dsa has changed we don't need
4946 * the old repsFrom with the old invocation_id
4948 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4949 &ar->objs->source_dsa->source_dsa_obj_guid)) {
4955 nrf_value = &orf_el->values[i];
4960 * copy over all old values to the new ldb_message
4962 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4963 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4968 * if we haven't found an old repsFrom value for the current source dsa
4969 * we'll add a new value
4972 struct ldb_val zero_value;
4973 ZERO_STRUCT(zero_value);
4974 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4975 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4977 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4980 /* we now fill the value which is already attached to ldb_message */
4981 ndr_err = ndr_push_struct_blob(nrf_value, msg,
4983 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4984 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4985 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4986 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4990 * the ldb_message_element for the attribute, has all the old values and the new one
4991 * so we'll replace the whole attribute with all values
4993 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4995 if (CHECK_DEBUGLVL(4)) {
4996 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4997 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
5001 /* prepare the ldb_modify() request */
5002 ret = ldb_build_mod_req(&change_req,
5008 replmd_replicated_uptodate_modify_callback,
5010 LDB_REQ_SET_LOCATION(change_req);
5011 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5013 return ldb_next_request(ar->module, change_req);
5016 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
5017 struct ldb_reply *ares)
5019 struct replmd_replicated_request *ar = talloc_get_type(req->context,
5020 struct replmd_replicated_request);
5024 return ldb_module_done(ar->req, NULL, NULL,
5025 LDB_ERR_OPERATIONS_ERROR);
5027 if (ares->error != LDB_SUCCESS &&
5028 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
5029 return ldb_module_done(ar->req, ares->controls,
5030 ares->response, ares->error);
5033 switch (ares->type) {
5034 case LDB_REPLY_ENTRY:
5035 ar->search_msg = talloc_steal(ar, ares->message);
5038 case LDB_REPLY_REFERRAL:
5039 /* we ignore referrals */
5042 case LDB_REPLY_DONE:
5043 ret = replmd_replicated_uptodate_modify(ar);
5044 if (ret != LDB_SUCCESS) {
5045 return ldb_module_done(ar->req, NULL, NULL, ret);
5054 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
5056 struct ldb_context *ldb;
5058 static const char *attrs[] = {
5059 "replUpToDateVector",
5064 struct ldb_request *search_req;
5066 ldb = ldb_module_get_ctx(ar->module);
5067 ar->search_msg = NULL;
5069 ret = ldb_build_search_req(&search_req,
5072 ar->objs->partition_dn,
5078 replmd_replicated_uptodate_search_callback,
5080 LDB_REQ_SET_LOCATION(search_req);
5081 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
5083 return ldb_next_request(ar->module, search_req);
5088 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
5090 struct ldb_context *ldb;
5091 struct dsdb_extended_replicated_objects *objs;
5092 struct replmd_replicated_request *ar;
5093 struct ldb_control **ctrls;
5096 struct replmd_private *replmd_private =
5097 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5098 struct dsdb_control_replicated_update *rep_update;
5100 ldb = ldb_module_get_ctx(module);
5102 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
5104 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
5106 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
5107 return LDB_ERR_PROTOCOL_ERROR;
5110 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
5111 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
5112 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
5113 return LDB_ERR_PROTOCOL_ERROR;
5116 ar = replmd_ctx_init(module, req);
5118 return LDB_ERR_OPERATIONS_ERROR;
5120 /* Set the flags to have the replmd_op_callback run over the full set of objects */
5121 ar->apply_mode = true;
5123 ar->schema = dsdb_get_schema(ldb, ar);
5125 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
5127 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
5128 return LDB_ERR_CONSTRAINT_VIOLATION;
5131 ctrls = req->controls;
5133 if (req->controls) {
5134 req->controls = talloc_memdup(ar, req->controls,
5135 talloc_get_size(req->controls));
5136 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
5139 /* This allows layers further down to know if a change came in
5140 over replication and what the replication flags were */
5141 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
5142 if (rep_update == NULL) {
5143 return ldb_module_oom(module);
5145 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
5147 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
5148 if (ret != LDB_SUCCESS) {
5152 /* If this change contained linked attributes in the body
5153 * (rather than in the links section) we need to update
5154 * backlinks in linked_attributes */
5155 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
5156 if (ret != LDB_SUCCESS) {
5160 ar->controls = req->controls;
5161 req->controls = ctrls;
5163 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
5165 /* save away the linked attributes for the end of the
5167 for (i=0; i<ar->objs->linked_attributes_count; i++) {
5168 struct la_entry *la_entry;
5170 if (replmd_private->la_ctx == NULL) {
5171 replmd_private->la_ctx = talloc_new(replmd_private);
5173 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
5174 if (la_entry == NULL) {
5176 return LDB_ERR_OPERATIONS_ERROR;
5178 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
5179 if (la_entry->la == NULL) {
5180 talloc_free(la_entry);
5182 return LDB_ERR_OPERATIONS_ERROR;
5184 *la_entry->la = ar->objs->linked_attributes[i];
5186 /* we need to steal the non-scalars so they stay
5187 around until the end of the transaction */
5188 talloc_steal(la_entry->la, la_entry->la->identifier);
5189 talloc_steal(la_entry->la, la_entry->la->value.blob);
5191 DLIST_ADD(replmd_private->la_list, la_entry);
5194 return replmd_replicated_apply_next(ar);
5198 process one linked attribute structure
5200 static int replmd_process_linked_attribute(struct ldb_module *module,
5201 struct la_entry *la_entry,
5202 struct ldb_request *parent)
5204 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
5205 struct ldb_context *ldb = ldb_module_get_ctx(module);
5206 struct ldb_message *msg;
5207 struct ldb_message *target_msg = NULL;
5208 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
5209 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
5211 const struct dsdb_attribute *attr;
5212 struct dsdb_dn *dsdb_dn;
5213 uint64_t seq_num = 0;
5214 struct ldb_message_element *old_el;
5216 time_t t = time(NULL);
5217 struct ldb_result *res;
5218 struct ldb_result *target_res;
5219 const char *attrs[4];
5220 const char *attrs2[] = { "isDeleted", "isRecycled", NULL };
5221 struct parsed_dn *pdn_list, *pdn;
5222 struct GUID guid = GUID_zero();
5224 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
5225 const struct GUID *our_invocation_id;
5227 enum deletion_state deletion_state = OBJECT_NOT_DELETED;
5228 enum deletion_state target_deletion_state = OBJECT_NOT_DELETED;
5231 linked_attributes[0]:
5232 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
5234 identifier: struct drsuapi_DsReplicaObjectIdentifier
5235 __ndr_size : 0x0000003a (58)
5236 __ndr_size_sid : 0x00000000 (0)
5237 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
5239 __ndr_size_dn : 0x00000000 (0)
5241 attid : DRSUAPI_ATTID_member (0x1F)
5242 value: struct drsuapi_DsAttributeValue
5243 __ndr_size : 0x0000007e (126)
5245 blob : DATA_BLOB length=126
5246 flags : 0x00000001 (1)
5247 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
5248 originating_add_time : Wed Sep 2 22:20:01 2009 EST
5249 meta_data: struct drsuapi_DsReplicaMetaData
5250 version : 0x00000015 (21)
5251 originating_change_time : Wed Sep 2 23:39:07 2009 EST
5252 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
5253 originating_usn : 0x000000000001e19c (123292)
5255 (for cases where the link is to a normal DN)
5256 &target: struct drsuapi_DsReplicaObjectIdentifier3
5257 __ndr_size : 0x0000007e (126)
5258 __ndr_size_sid : 0x0000001c (28)
5259 guid : 7639e594-db75-4086-b0d4-67890ae46031
5260 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
5261 __ndr_size_dn : 0x00000022 (34)
5262 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
5265 /* find the attribute being modified */
5266 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
5268 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
5269 talloc_free(tmp_ctx);
5270 return LDB_ERR_OPERATIONS_ERROR;
5273 attrs[0] = attr->lDAPDisplayName;
5274 attrs[1] = "isDeleted";
5275 attrs[1] = "isRecycled";
5278 /* get the existing message from the db for the object with
5279 this GUID, returning attribute being modified. We will then
5280 use this msg as the basis for a modify call */
5281 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
5282 DSDB_FLAG_NEXT_MODULE |
5283 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5284 DSDB_SEARCH_SHOW_RECYCLED |
5285 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
5286 DSDB_SEARCH_REVEAL_INTERNALS,
5288 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
5289 if (ret != LDB_SUCCESS) {
5290 talloc_free(tmp_ctx);
5293 if (res->count != 1) {
5294 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
5295 GUID_string(tmp_ctx, &la->identifier->guid));
5296 talloc_free(tmp_ctx);
5297 return LDB_ERR_NO_SUCH_OBJECT;
5302 * Check for deleted objects per MS-DRSR 4.1.10.6.13
5303 * ProcessLinkValue, because link updates are not applied to
5304 * recycled and tombstone objects. We don't have to delete
5305 * any existing link, that should have happened when the
5306 * object deletion was replicated or initiated.
5309 replmd_deletion_state(module, msg, &deletion_state, NULL);
5311 if (deletion_state >= OBJECT_RECYCLED) {
5312 talloc_free(tmp_ctx);
5316 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5317 if (old_el == NULL) {
5318 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
5319 if (ret != LDB_SUCCESS) {
5320 ldb_module_oom(module);
5321 talloc_free(tmp_ctx);
5322 return LDB_ERR_OPERATIONS_ERROR;
5325 old_el->flags = LDB_FLAG_MOD_REPLACE;
5328 /* parse the existing links */
5329 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
5330 if (ret != LDB_SUCCESS) {
5331 talloc_free(tmp_ctx);
5335 /* get our invocationId */
5336 our_invocation_id = samdb_ntds_invocation_id(ldb);
5337 if (!our_invocation_id) {
5338 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
5339 talloc_free(tmp_ctx);
5340 return LDB_ERR_OPERATIONS_ERROR;
5343 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
5344 if (ret != LDB_SUCCESS) {
5345 talloc_free(tmp_ctx);
5349 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
5350 if (!W_ERROR_IS_OK(status)) {
5351 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
5352 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
5353 talloc_free(tmp_ctx);
5354 return LDB_ERR_OPERATIONS_ERROR;
5357 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
5358 if (!NT_STATUS_IS_OK(ntstatus) && !active) {
5360 * This strange behaviour (allowing a NULL/missing
5361 * GUID) originally comes from:
5363 * commit e3054ce0fe0f8f62d2f5b2a77893e7a1479128bd
5364 * Author: Andrew Tridgell <tridge@samba.org>
5365 * Date: Mon Dec 21 21:21:55 2009 +1100
5367 * s4-drs: cope better with NULL GUIDS from DRS
5369 * It is valid to get a NULL GUID over DRS for a deleted forward link. We
5370 * need to match by DN if possible when seeing if we should update an
5373 * Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
5376 ret = dsdb_module_search_dn(module, tmp_ctx, &target_res,
5377 dsdb_dn->dn, attrs2,
5378 DSDB_FLAG_NEXT_MODULE |
5379 DSDB_SEARCH_SHOW_RECYCLED |
5380 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5381 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
5383 } else if (!NT_STATUS_IS_OK(ntstatus)) {
5384 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
5386 ldb_dn_get_linearized(dsdb_dn->dn),
5387 ldb_dn_get_linearized(msg->dn));
5388 talloc_free(tmp_ctx);
5389 return LDB_ERR_OPERATIONS_ERROR;
5391 ret = dsdb_module_search(module, tmp_ctx, &target_res,
5392 NULL, LDB_SCOPE_SUBTREE,
5394 DSDB_FLAG_NEXT_MODULE |
5395 DSDB_SEARCH_SHOW_RECYCLED |
5396 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
5397 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
5400 GUID_string(tmp_ctx, &guid));
5403 if (ret != LDB_SUCCESS) {
5404 ldb_asprintf_errstring(ldb_module_get_ctx(module), "Failed to re-resolve GUID %s: %s\n",
5405 GUID_string(tmp_ctx, &guid),
5406 ldb_errstring(ldb_module_get_ctx(module)));
5407 talloc_free(tmp_ctx);
5411 if (target_res->count == 0) {
5412 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
5413 GUID_string(tmp_ctx, &guid),
5414 ldb_dn_get_linearized(dsdb_dn->dn)));
5415 } else if (target_res->count != 1) {
5416 ldb_asprintf_errstring(ldb_module_get_ctx(module), "More than one object found matching objectGUID %s\n",
5417 GUID_string(tmp_ctx, &guid));
5418 talloc_free(tmp_ctx);
5419 return LDB_ERR_OPERATIONS_ERROR;
5421 target_msg = target_res->msgs[0];
5422 dsdb_dn->dn = talloc_steal(dsdb_dn, target_msg->dn);
5426 * Check for deleted objects per MS-DRSR 4.1.10.6.13
5427 * ProcessLinkValue, because link updates are not applied to
5428 * recycled and tombstone objects. We don't have to delete
5429 * any existing link, that should have happened when the
5430 * object deletion was replicated or initiated.
5432 replmd_deletion_state(module, target_msg,
5433 &target_deletion_state, NULL);
5435 if (target_deletion_state >= OBJECT_RECYCLED) {
5436 talloc_free(tmp_ctx);
5440 /* see if this link already exists */
5441 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
5443 /* see if this update is newer than what we have already */
5444 struct GUID invocation_id = GUID_zero();
5445 uint32_t version = 0;
5446 uint32_t originating_usn = 0;
5447 NTTIME change_time = 0;
5448 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
5450 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
5451 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
5452 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
5453 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
5455 if (!replmd_update_is_newer(&invocation_id,
5456 &la->meta_data.originating_invocation_id,
5458 la->meta_data.version,
5460 la->meta_data.originating_change_time)) {
5461 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
5462 old_el->name, ldb_dn_get_linearized(msg->dn),
5463 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
5464 talloc_free(tmp_ctx);
5468 /* get a seq_num for this change */
5469 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5470 if (ret != LDB_SUCCESS) {
5471 talloc_free(tmp_ctx);
5475 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
5476 /* remove the existing backlink */
5477 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
5478 if (ret != LDB_SUCCESS) {
5479 talloc_free(tmp_ctx);
5484 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
5485 &la->meta_data.originating_invocation_id,
5486 la->meta_data.originating_usn, seq_num,
5487 la->meta_data.originating_change_time,
5488 la->meta_data.version,
5490 if (ret != LDB_SUCCESS) {
5491 talloc_free(tmp_ctx);
5496 /* add the new backlink */
5497 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
5498 if (ret != LDB_SUCCESS) {
5499 talloc_free(tmp_ctx);
5504 /* get a seq_num for this change */
5505 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
5506 if (ret != LDB_SUCCESS) {
5507 talloc_free(tmp_ctx);
5511 old_el->values = talloc_realloc(msg->elements, old_el->values,
5512 struct ldb_val, old_el->num_values+1);
5513 if (!old_el->values) {
5514 ldb_module_oom(module);
5515 return LDB_ERR_OPERATIONS_ERROR;
5517 old_el->num_values++;
5519 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
5520 &la->meta_data.originating_invocation_id,
5521 la->meta_data.originating_usn, seq_num,
5522 la->meta_data.originating_change_time,
5523 la->meta_data.version,
5524 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
5525 if (ret != LDB_SUCCESS) {
5526 talloc_free(tmp_ctx);
5531 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
5533 if (ret != LDB_SUCCESS) {
5534 talloc_free(tmp_ctx);
5540 /* we only change whenChanged and uSNChanged if the seq_num
5542 ret = add_time_element(msg, "whenChanged", t);
5543 if (ret != LDB_SUCCESS) {
5544 talloc_free(tmp_ctx);
5549 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
5550 if (ret != LDB_SUCCESS) {
5551 talloc_free(tmp_ctx);
5556 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5557 if (old_el == NULL) {
5558 talloc_free(tmp_ctx);
5559 return ldb_operr(ldb);
5562 ret = dsdb_check_single_valued_link(attr, old_el);
5563 if (ret != LDB_SUCCESS) {
5564 talloc_free(tmp_ctx);
5568 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
5570 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
5571 if (ret != LDB_SUCCESS) {
5572 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
5574 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
5575 talloc_free(tmp_ctx);
5579 talloc_free(tmp_ctx);
5584 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
5586 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
5587 return replmd_extended_replicated_objects(module, req);
5590 return ldb_next_request(module, req);
5595 we hook into the transaction operations to allow us to
5596 perform the linked attribute updates at the end of the whole
5597 transaction. This allows a forward linked attribute to be created
5598 before the object is created. During a vampire, w2k8 sends us linked
5599 attributes before the objects they are part of.
5601 static int replmd_start_transaction(struct ldb_module *module)
5603 /* create our private structure for this transaction */
5604 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
5605 struct replmd_private);
5606 replmd_txn_cleanup(replmd_private);
5608 /* free any leftover mod_usn records from cancelled
5610 while (replmd_private->ncs) {
5611 struct nc_entry *e = replmd_private->ncs;
5612 DLIST_REMOVE(replmd_private->ncs, e);
5616 return ldb_next_start_trans(module);
5620 on prepare commit we loop over our queued la_context structures and
5623 static int replmd_prepare_commit(struct ldb_module *module)
5625 struct replmd_private *replmd_private =
5626 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5627 struct la_entry *la, *prev;
5628 struct la_backlink *bl;
5631 /* walk the list backwards, to do the first entry first, as we
5632 * added the entries with DLIST_ADD() which puts them at the
5633 * start of the list */
5634 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
5635 prev = DLIST_PREV(la);
5636 DLIST_REMOVE(replmd_private->la_list, la);
5637 ret = replmd_process_linked_attribute(module, la, NULL);
5638 if (ret != LDB_SUCCESS) {
5639 replmd_txn_cleanup(replmd_private);
5644 /* process our backlink list, creating and deleting backlinks
5646 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
5647 ret = replmd_process_backlink(module, bl, NULL);
5648 if (ret != LDB_SUCCESS) {
5649 replmd_txn_cleanup(replmd_private);
5654 replmd_txn_cleanup(replmd_private);
5656 /* possibly change @REPLCHANGED */
5657 ret = replmd_notify_store(module, NULL);
5658 if (ret != LDB_SUCCESS) {
5662 return ldb_next_prepare_commit(module);
5665 static int replmd_del_transaction(struct ldb_module *module)
5667 struct replmd_private *replmd_private =
5668 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5669 replmd_txn_cleanup(replmd_private);
5671 return ldb_next_del_trans(module);
5675 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
5676 .name = "repl_meta_data",
5677 .init_context = replmd_init,
5679 .modify = replmd_modify,
5680 .rename = replmd_rename,
5681 .del = replmd_delete,
5682 .extended = replmd_extended,
5683 .start_transaction = replmd_start_transaction,
5684 .prepare_commit = replmd_prepare_commit,
5685 .del_transaction = replmd_del_transaction,
5688 int ldb_repl_meta_data_module_init(const char *version)
5690 LDB_MODULE_CHECK_VERSION(version);
5691 return ldb_register_module(&ldb_repl_meta_data_module_ops);