source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpc_server/dcerpc_server.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "param/param.h"
  27 #include "librpc/gen_ndr/ndr_drsblobs.h"
  28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  29 #include "rpc_server/dcerpc_server_proto.h"
  30 #include "../libcli/drsuapi/drsuapi.h"
  31 #include "libcli/security/security.h"
  32
  33 /*
  34   build a DsReplicaObjectIdentifier from a ldb msg
  35  */
  36 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
  37                                                                        struct ldb_message *msg)
  38 {
  39         struct drsuapi_DsReplicaObjectIdentifier *identifier;
  40         struct dom_sid *sid;
  41
  42         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
  43         if (identifier == NULL) {
  44                 return NULL;
  45         }
  46
  47         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
  48         identifier->guid = samdb_result_guid(msg, "objectGUID");
  49
  50         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
  51         if (sid) {
  52                 identifier->sid = *sid;
  53         } else {
  54                 ZERO_STRUCT(identifier->sid);
  55         }
  56         return identifier;
  57 }
  58
  59 /*
  60   drsuapi_DsGetNCChanges for one object
  61 */
  62 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
  63                                           struct ldb_message *msg,
  64                                           struct ldb_context *sam_ctx,
  65                                           struct ldb_dn *ncRoot_dn,
  66                                           struct dsdb_schema *schema,
  67                                           DATA_BLOB *session_key,
  68                                           uint64_t highest_usn,
  69                                           uint32_t replica_flags)
  70 {
  71         const struct ldb_val *md_value;
  72         int i, n;
  73         struct replPropertyMetaDataBlob md;
  74         uint32_t rid = 0;
  75         enum ndr_err_code ndr_err;
  76         uint32_t *attids;
  77         const char *rdn;
  78         const struct dsdb_attribute *rdn_sa;
  79
  80         if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
  81                 obj->is_nc_prefix = true;
  82                 obj->parent_object_guid = NULL;
  83         } else {
  84                 obj->is_nc_prefix = false;
  85                 obj->parent_object_guid = talloc(obj, struct GUID);
  86                 if (obj->parent_object_guid == NULL) {
  87                         return WERR_DS_DRA_INTERNAL_ERROR;
  88                 }
  89                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
  90                 if (GUID_all_zero(obj->parent_object_guid)) {
  91                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
  92                                  ldb_dn_get_linearized(msg->dn)));
  93                         return WERR_DS_DRA_INTERNAL_ERROR;
  94                 }
  95         }
  96         obj->next_object = NULL;
  97
  98         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
  99         if (!md_value) {
 100                 /* nothing to send */
 101                 return WERR_OK;
 102         }
 103
 104         ndr_err = ndr_pull_struct_blob(md_value, obj,
 105                                        lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
 106                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 107         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 108                 return WERR_DS_DRA_INTERNAL_ERROR;
 109         }
 110
 111         if (md.version != 1) {
 112                 return WERR_DS_DRA_INTERNAL_ERROR;
 113         }
 114
 115         rdn = ldb_dn_get_rdn_name(msg->dn);
 116         if (rdn == NULL) {
 117                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 118                 return WERR_DS_DRA_INTERNAL_ERROR;
 119         }
 120
 121         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 122         if (rdn_sa == NULL) {
 123                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 124                          rdn, ldb_dn_get_linearized(msg->dn)));
 125                 return WERR_DS_DRA_INTERNAL_ERROR;
 126         }
 127
 128         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 129         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 130
 131         obj->object.identifier = get_object_identifier(obj, msg);
 132         if (obj->object.identifier == NULL) {
 133                 return WERR_NOMEM;
 134         }
 135         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 136
 137         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 138         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 139                 /* if the attribute has not changed, and it is not the
 140                    instanceType then don't include it */
 141                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 142                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
 143
 144                 /* don't include the rDN */
 145                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 146
 147                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 148                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 149                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 150                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 151                 attids[n] = md.ctr.ctr1.array[i].attid;
 152                 n++;
 153         }
 154
 155         /*
 156           note that if n==0 we still need to send the change, as it
 157           could be a rename, which changes the uSNChanged, but not any
 158           of the replicated attributes
 159          */
 160
 161         obj->meta_data_ctr->count = n;
 162
 163         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 164         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 165         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 166                                                             obj->object.attribute_ctr.num_attributes);
 167
 168         /*
 169          * Note that the meta_data array and the attributes array must
 170          * be the same size and in the same order
 171          */
 172         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 173                 struct ldb_message_element *el;
 174                 WERROR werr;
 175                 const struct dsdb_attribute *sa;
 176
 177                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 178                 if (!sa) {
 179                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 180                         return WERR_DS_DRA_INTERNAL_ERROR;
 181                 }
 182
 183                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 184                 if (el == NULL) {
 185                         /* this happens for attributes that have been removed */
 186                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 187                                  sa->lDAPDisplayName, attids[i]));
 188                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 189                         obj->object.attribute_ctr.attributes[i].attid = attids[i];
 190                 } else {
 191                         werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
 192                                                              &obj->object.attribute_ctr.attributes[i]);
 193                         if (!W_ERROR_IS_OK(werr)) {
 194                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
 195                                          sa->lDAPDisplayName, win_errstr(werr)));
 196                                 return werr;
 197                         }
 198                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 199                          * check if attribute is secret and send a null value
 200                          */
 201                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 202                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 203                                                                  &obj->meta_data_ctr->meta_data[i]);
 204                         }
 205                         /* some attributes needs to be encrypted
 206                            before being sent */
 207                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 208                                                          &obj->object.attribute_ctr.attributes[i]);
 209                         if (!W_ERROR_IS_OK(werr)) {
 210                                 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
 211                                          sa->lDAPDisplayName, win_errstr(werr)));
 212                                 return werr;
 213                         }
 214                 }
 215         }
 216
 217         return WERR_OK;
 218 }
 219
 220
 221 /*
 222   add one linked attribute from an object to the list of linked
 223   attributes in a getncchanges request
 224  */
 225 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 226                                     struct ldb_context *sam_ctx,
 227                                     const struct dsdb_schema *schema,
 228                                     const struct dsdb_attribute *sa,
 229                                     struct ldb_message *msg,
 230                                     struct ldb_message_element *el,
 231                                     struct dsdb_dn *dsdb_dn,
 232                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 233                                     uint32_t *la_count)
 234 {
 235         struct drsuapi_DsReplicaLinkedAttribute *la;
 236         bool active;
 237         NTSTATUS status;
 238         struct ldb_message_element val_el;
 239         struct ldb_val v;
 240         WERROR werr;
 241         struct drsuapi_DsReplicaAttribute drs;
 242
 243         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 244         W_ERROR_HAVE_NO_MEMORY(*la_list);
 245
 246         la = &(*la_list)[*la_count];
 247
 248         la->identifier = get_object_identifier(*la_list, msg);
 249         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 250
 251         active = ldb_dn_get_extended_component(dsdb_dn->dn, "DELETED")?false:true;
 252
 253         la->attid = sa->attributeID_id;
 254         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 255
 256         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 return ntstatus_to_werror(status);
 259         }
 260         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 261         if (!NT_STATUS_IS_OK(status)) {
 262                 return ntstatus_to_werror(status);
 263         }
 264         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 return ntstatus_to_werror(status);
 267         }
 268         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 269         if (!NT_STATUS_IS_OK(status)) {
 270                 return ntstatus_to_werror(status);
 271         }
 272         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 return ntstatus_to_werror(status);
 275         }
 276
 277         /* we need a message_element with just one value in it */
 278         v = data_blob_string_const(dsdb_dn_get_linearized(*la_list, dsdb_dn));
 279
 280         val_el = *el;
 281         val_el.values = &v;
 282         val_el.num_values = 1;
 283
 284         werr = sa->syntax->ldb_to_drsuapi(sam_ctx, schema, sa, &val_el, *la_list, &drs);
 285         W_ERROR_NOT_OK_RETURN(werr);
 286
 287         if (drs.value_ctr.num_values != 1) {
 288                 DEBUG(1,(__location__ ": Failed to build DRS blob for linked attribute %s in %s\n",
 289                          el->name, ldb_dn_get_linearized(msg->dn)));
 290                 return WERR_DS_DRA_INTERNAL_ERROR;
 291         }
 292
 293         la->value.blob = drs.value_ctr.values[0].blob;
 294
 295         (*la_count)++;
 296         return WERR_OK;
 297 }
 298
 299
 300 /*
 301   add linked attributes from an object to the list of linked
 302   attributes in a getncchanges request
 303  */
 304 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 305                                        TALLOC_CTX *mem_ctx,
 306                                        struct ldb_dn *ncRoot_dn,
 307                                        struct dsdb_schema *schema,
 308                                        uint64_t highest_usn,
 309                                        uint32_t replica_flags,
 310                                        struct ldb_message *msg,
 311                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 312                                        uint32_t *la_count)
 313 {
 314         int i;
 315         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 316
 317         for (i=0; i<msg->num_elements; i++) {
 318                 struct ldb_message_element *el = &msg->elements[i];
 319                 const struct dsdb_attribute *sa;
 320                 int j;
 321
 322                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 323
 324                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 325                         /* we only want forward links */
 326                         continue;
 327                 }
 328
 329                 for (j=0; j<el->num_values; j++) {
 330                         struct dsdb_dn *dsdb_dn;
 331                         uint64_t local_usn;
 332                         NTSTATUS status;
 333                         WERROR werr;
 334
 335                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 336                         if (dsdb_dn == NULL) {
 337                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 338                                          el->name, ldb_dn_get_linearized(msg->dn)));
 339                                 talloc_free(tmp_ctx);
 340                                 return WERR_DS_DRA_INTERNAL_ERROR;
 341                         }
 342
 343                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 344                         if (!NT_STATUS_IS_OK(status)) {
 345                                 /* this can happen for attributes
 346                                    given to us with old style meta
 347                                    data */
 348                                 continue;
 349                         }
 350
 351                         if (local_usn < highest_usn) {
 352                                 continue;
 353                         }
 354
 355                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
 356                                                      el, dsdb_dn, la_list, la_count);
 357                         if (!W_ERROR_IS_OK(werr)) {
 358                                 talloc_free(tmp_ctx);
 359                                 return werr;
 360                         }
 361                 }
 362         }
 363
 364         talloc_free(tmp_ctx);
 365         return WERR_OK;
 366 }
 367
 368 /*
 369   load replUpToDateVector from a DN
 370  */
 371 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 372                        struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
 373 {
 374         const char *attrs[] = { "replUpToDateVector", NULL };
 375         struct ldb_result *res = NULL;
 376         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 377         struct ldb_message_element *el;
 378         enum ndr_err_code ndr_err;
 379
 380         ZERO_STRUCTP(ouv);
 381
 382         if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
 383             res->count < 1) {
 384                 DEBUG(0,("load_udv: failed to read partition object\n"));
 385                 talloc_free(tmp_ctx);
 386                 return WERR_DS_DRA_INTERNAL_ERROR;
 387         }
 388
 389         el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
 390         if (el == NULL || el->num_values < 1) {
 391                 talloc_free(tmp_ctx);
 392                 ouv->version = 2;
 393                 return WERR_OK;
 394         }
 395
 396         ndr_err = ndr_pull_struct_blob(&el->values[0],
 397                                        mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
 398                                        ouv,
 399                                        (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
 400         talloc_free(tmp_ctx);
 401         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 402                 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
 403                          ldb_dn_get_linearized(dn)));
 404                 return WERR_DS_DRA_INTERNAL_ERROR;
 405         }
 406
 407         return WERR_OK;
 408
 409 }
 410
 411 /*
 412   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 413  */
 414 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 415                                  struct ldb_dn *ncRoot_dn,
 416                                  struct drsuapi_DsReplicaCursor2CtrEx *udv,
 417                                  uint64_t highestUSN)
 418 {
 419         WERROR werr;
 420         struct drsuapi_DsReplicaCursor2 *tmp_cursor;
 421         NTTIME now;
 422         time_t t = time(NULL);
 423         struct replUpToDateVectorBlob ouv;
 424
 425         werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
 426         if (!W_ERROR_IS_OK(werr)) {
 427                 return werr;
 428         }
 429
 430         tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
 431         tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
 432         tmp_cursor->highest_usn = highestUSN;
 433         unix_to_nt_time(&now, t);
 434         tmp_cursor->last_sync_success = now;
 435
 436         udv->count = ouv.ctr.ctr2.count + 1;
 437         udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
 438         udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
 439         if (!udv->cursors) {
 440                 return WERR_DS_DRA_INTERNAL_ERROR;
 441         }
 442         udv->cursors[udv->count - 1] = *tmp_cursor;
 443
 444         qsort(udv->cursors, udv->count,
 445               sizeof(struct drsuapi_DsReplicaCursor2),
 446               (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
 447
 448         return WERR_OK;
 449 }
 450
 451 /* state of a partially completed getncchanges call */
 452 struct drsuapi_getncchanges_state {
 453         struct ldb_result *site_res;
 454         uint32_t num_sent;
 455         struct ldb_dn *ncRoot_dn;
 456         uint64_t min_usn;
 457         uint64_t highest_usn;
 458 };
 459
 460 /*
 461   drsuapi_DsGetNCChanges
 462
 463   see MS-DRSR 4.1.10.5.2 for basic logic of this function
 464 */
 465 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 466                                      struct drsuapi_DsGetNCChanges *r)
 467 {
 468         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
 469         int ret;
 470         int i;
 471         struct dsdb_schema *schema;
 472         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
 473         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
 474         NTSTATUS status;
 475         DATA_BLOB session_key;
 476         const char *attrs[] = { "*", "distinguishedName",
 477                                 "nTSecurityDescriptor",
 478                                 "parentGUID",
 479                                 "replPropertyMetaData",
 480                                 "unicodePwd",
 481                                 "dBCSPwd",
 482                                 "ntPwdHistory",
 483                                 "lmPwdHistory",
 484                                 "supplementalCredentials",
 485                                 NULL };
 486         WERROR werr;
 487         struct dcesrv_handle *h;
 488         struct drsuapi_bind_state *b_state;
 489         struct drsuapi_getncchanges_state *getnc_state;
 490         struct drsuapi_DsGetNCChangesRequest8 *req8;
 491         uint32_t options;
 492
 493         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 494         b_state = h->data;
 495
 496         *r->out.level_out = 6;
 497         /* TODO: linked attributes*/
 498         r->out.ctr->ctr6.linked_attributes_count = 0;
 499         r->out.ctr->ctr6.linked_attributes = NULL;
 500
 501         r->out.ctr->ctr6.object_count = 0;
 502         r->out.ctr->ctr6.nc_object_count = 0;
 503         r->out.ctr->ctr6.more_data = false;
 504         r->out.ctr->ctr6.uptodateness_vector = NULL;
 505
 506         /* a RODC doesn't allow for any replication */
 507         if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
 508                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
 509                 return WERR_DS_DRA_SOURCE_DISABLED;
 510         }
 511
 512         /* Check request revision.
 513            TODO: Adding mappings to req8 from the other levels
 514          */
 515         if (r->in.level != 8) {
 516                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
 517                          r->in.level));
 518                 return WERR_REVISION_MISMATCH;
 519         }
 520
 521         req8 = &r->in.req->req8;
 522
 523         /* Perform access checks. */
 524         /* TODO: we need to support a sync on a specific non-root
 525          * DN. We'll need to find the real partition root here */
 526         ncRoot = req8->naming_context;
 527         if (ncRoot == NULL) {
 528                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
 529                 return WERR_DS_DRA_INVALID_PARAMETER;
 530         }
 531
 532         if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
 533                 return WERR_DS_DRA_INTERNAL_ERROR;
 534         }
 535
 536         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
 537             !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
 538                 return WERR_DS_DRA_SOURCE_DISABLED;
 539         }
 540
 541
 542         if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
 543                 /* Ignore the _in_ uptpdateness vector*/
 544                 req8->uptodateness_vector = NULL;
 545         }
 546
 547         werr = drs_security_level_check(dce_call, "DsGetNCChanges");
 548         if (!W_ERROR_IS_OK(werr)) {
 549                 return werr;
 550         }
 551
 552         getnc_state = b_state->getncchanges_state;
 553
 554         /* see if a previous replication has been abandoned */
 555         if (getnc_state) {
 556                 struct ldb_dn *new_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 557                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
 558                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
 559                                  ldb_dn_get_linearized(new_dn),
 560                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
 561                         talloc_free(getnc_state);
 562                         getnc_state = NULL;
 563                 }
 564         }
 565
 566         if (getnc_state == NULL) {
 567                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
 568                 if (getnc_state == NULL) {
 569                         return WERR_NOMEM;
 570                 }
 571                 b_state->getncchanges_state = getnc_state;
 572                 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 573         }
 574
 575         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
 576             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
 577                 DEBUG(0,(__location__ ": Bad DN '%s'\n", ncRoot->dn));
 578                 return WERR_DS_DRA_INVALID_PARAMETER;
 579         }
 580
 581         /* we need the session key for encrypting password attributes */
 582         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 DEBUG(0,(__location__ ": Failed to get session key\n"));
 585                 return WERR_DS_DRA_INTERNAL_ERROR;
 586         }
 587
 588         /* we don't yet support extended operations */
 589         if (req8->extended_op != DRSUAPI_EXOP_NONE) {
 590                 DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
 591                          (unsigned)req8->extended_op));
 592                 return WERR_DS_DRA_NOT_SUPPORTED;
 593         }
 594
 595         /*
 596            TODO: MS-DRSR section 4.1.10.1.1
 597            Work out if this is the start of a new cycle */
 598
 599         if (getnc_state->site_res == NULL) {
 600                 char* search_filter;
 601                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
 602
 603                 getnc_state->min_usn = req8->highwatermark.highest_usn;
 604
 605                 /* Construct response. */
 606                 search_filter = talloc_asprintf(mem_ctx,
 607                                                 "(uSNChanged>=%llu)",
 608                                                 (unsigned long long)(getnc_state->min_usn+1));
 609
 610                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
 611                         search_filter = talloc_asprintf(mem_ctx,
 612                                                         "(&%s(isCriticalSystemObject=TRUE))",
 613                                                         search_filter);
 614                 }
 615
 616                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
 617                         scope = LDB_SCOPE_BASE;
 618                 }
 619
 620                 DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
 621                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
 622                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
 623                                                       getnc_state->ncRoot_dn, scope, attrs,
 624                                                       "uSNChanged",
 625                                                       search_filter);
 626                 if (ret != LDB_SUCCESS) {
 627                         return WERR_DS_DRA_INTERNAL_ERROR;
 628                 }
 629         }
 630
 631         /* Prefix mapping */
 632         schema = dsdb_get_schema(b_state->sam_ctx);
 633         if (!schema) {
 634                 DEBUG(0,("No schema in sam_ctx\n"));
 635                 return WERR_DS_DRA_INTERNAL_ERROR;
 636         }
 637
 638         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 639         *r->out.ctr->ctr6.naming_context = *ncRoot;
 640
 641         if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn,
 642                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
 643                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
 644                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
 645                 return WERR_DS_DRA_INTERNAL_ERROR;
 646         }
 647
 648         /* find the SID if there is one */
 649         dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
 650
 651         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
 652         r->out.ctr->ctr6.mapping_ctr = *ctr;
 653
 654         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
 655         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
 656
 657         r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
 658         r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
 659
 660         r->out.ctr->ctr6.first_object = NULL;
 661         currentObject = &r->out.ctr->ctr6.first_object;
 662
 663 #if 0
 664         /* use this to force single objects at a time, which is useful
 665          * for working out what object is giving problems
 666          */
 667         req8->max_object_count = 1;
 668 #endif
 669
 670         for(i=getnc_state->num_sent;
 671             i<getnc_state->site_res->count &&
 672                     (r->out.ctr->ctr6.object_count < req8->max_object_count);
 673             i++) {
 674                 int uSN;
 675                 struct drsuapi_DsReplicaObjectListItemEx *obj;
 676                 struct ldb_message *msg = getnc_state->site_res->msgs[i];
 677
 678                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
 679
 680                 uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
 681                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
 682                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
 683                 }
 684                 if (uSN > getnc_state->highest_usn) {
 685                         getnc_state->highest_usn = uSN;
 686                 }
 687
 688                 werr = get_nc_changes_build_object(obj, msg,
 689                                                    b_state->sam_ctx, getnc_state->ncRoot_dn,
 690                                                    schema, &session_key, getnc_state->min_usn,
 691                                                    req8->replica_flags);
 692                 if (!W_ERROR_IS_OK(werr)) {
 693                         return werr;
 694                 }
 695
 696                 werr = get_nc_changes_add_links(b_state->sam_ctx, mem_ctx,
 697                                                 getnc_state->ncRoot_dn,
 698                                                 schema, getnc_state->min_usn,
 699                                                 req8->replica_flags,
 700                                                 msg,
 701                                                 &r->out.ctr->ctr6.linked_attributes,
 702                                                 &r->out.ctr->ctr6.linked_attributes_count);
 703                 if (!W_ERROR_IS_OK(werr)) {
 704                         return werr;
 705                 }
 706
 707                 if (obj->meta_data_ctr == NULL) {
 708                         DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
 709                                  ldb_dn_get_linearized(msg->dn)));
 710                         /* no attributes to send */
 711                         talloc_free(obj);
 712                         continue;
 713                 }
 714
 715                 r->out.ctr->ctr6.object_count++;
 716
 717                 *currentObject = obj;
 718                 currentObject = &obj->next_object;
 719
 720                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
 721         }
 722
 723         getnc_state->num_sent += r->out.ctr->ctr6.object_count;
 724
 725         r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
 726
 727         /* the client can us to call UpdateRefs on its behalf to
 728            re-establish monitoring of the NC */
 729         if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) &&
 730             !GUID_all_zero(&req8->destination_dsa_guid)) {
 731                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
 732                 ureq.naming_context = ncRoot;
 733                 ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
 734                                                          GUID_string(mem_ctx, &req8->destination_dsa_guid),
 735                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
 736                 if (!ureq.dest_dsa_dns_name) {
 737                         return WERR_NOMEM;
 738                 }
 739                 ureq.dest_dsa_guid = req8->destination_dsa_guid;
 740                 ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
 741                         DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
 742                         DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
 743                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
 744                 if (!W_ERROR_IS_OK(werr)) {
 745                         DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
 746                                  win_errstr(werr)));
 747                 }
 748         }
 749
 750         if (i < getnc_state->site_res->count) {
 751                 r->out.ctr->ctr6.more_data = true;
 752         } else {
 753                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
 754                 r->out.ctr->ctr6.uptodateness_vector->version = 2;
 755                 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
 756                 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
 757
 758                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
 759
 760                 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn,
 761                                           r->out.ctr->ctr6.uptodateness_vector,
 762                                           getnc_state->highest_usn);
 763                 if (!W_ERROR_IS_OK(werr)) {
 764                         return werr;
 765                 }
 766
 767                 talloc_free(getnc_state);
 768                 b_state->getncchanges_state = NULL;
 769         }
 770
 771         DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d)\n",
 772                  (unsigned long long)(req8->highwatermark.highest_usn+1),
 773                  req8->replica_flags,
 774                  ncRoot->dn, r->out.ctr->ctr6.object_count,
 775                  i, r->out.ctr->ctr6.more_data?getnc_state->site_res->count:i));
 776
 777         return WERR_OK;
 778 }