source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpc_server/dcerpc_server.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "param/param.h"
  27 #include "librpc/gen_ndr/ndr_drsblobs.h"
  28 #include "librpc/gen_ndr/ndr_drsuapi.h"
  29 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  30 #include "rpc_server/dcerpc_server_proto.h"
  31 #include "../libcli/drsuapi/drsuapi.h"
  32 #include "libcli/security/security.h"
  33 #include "lib/util/binsearch.h"
  34
  35 /*
  36   build a DsReplicaObjectIdentifier from a ldb msg
  37  */
  38 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
  39                                                                        struct ldb_message *msg)
  40 {
  41         struct drsuapi_DsReplicaObjectIdentifier *identifier;
  42         struct dom_sid *sid;
  43
  44         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
  45         if (identifier == NULL) {
  46                 return NULL;
  47         }
  48
  49         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
  50         identifier->guid = samdb_result_guid(msg, "objectGUID");
  51
  52         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
  53         if (sid) {
  54                 identifier->sid = *sid;
  55         } else {
  56                 ZERO_STRUCT(identifier->sid);
  57         }
  58         return identifier;
  59 }
  60
  61 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
  62 {
  63         return GUID_compare(guid1, &guid2);
  64 }
  65
  66 /*
  67   see if we can filter an attribute using the uptodateness_vector
  68  */
  69 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
  70                        const struct GUID *originating_invocation_id,
  71                        uint64_t originating_usn)
  72 {
  73         const struct drsuapi_DsReplicaCursor *c;
  74         if (udv == NULL) return false;
  75         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
  76                             originating_invocation_id, udv_compare, c);
  77         if (c && originating_usn <= c->highest_usn) {
  78                 return true;
  79         }
  80         return false;
  81
  82 }
  83
  84 /*
  85   drsuapi_DsGetNCChanges for one object
  86 */
  87 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
  88                                           struct ldb_message *msg,
  89                                           struct ldb_context *sam_ctx,
  90                                           struct ldb_dn *ncRoot_dn,
  91                                           struct dsdb_schema *schema,
  92                                           DATA_BLOB *session_key,
  93                                           uint64_t highest_usn,
  94                                           uint32_t replica_flags,
  95                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
  96 {
  97         const struct ldb_val *md_value;
  98         int i, n;
  99         struct replPropertyMetaDataBlob md;
 100         uint32_t rid = 0;
 101         enum ndr_err_code ndr_err;
 102         uint32_t *attids;
 103         const char *rdn;
 104         const struct dsdb_attribute *rdn_sa;
 105
 106         if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
 107                 obj->is_nc_prefix = true;
 108                 obj->parent_object_guid = NULL;
 109         } else {
 110                 obj->is_nc_prefix = false;
 111                 obj->parent_object_guid = talloc(obj, struct GUID);
 112                 if (obj->parent_object_guid == NULL) {
 113                         return WERR_DS_DRA_INTERNAL_ERROR;
 114                 }
 115                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 116                 if (GUID_all_zero(obj->parent_object_guid)) {
 117                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 118                                  ldb_dn_get_linearized(msg->dn)));
 119                         return WERR_DS_DRA_INTERNAL_ERROR;
 120                 }
 121         }
 122         obj->next_object = NULL;
 123
 124         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 125         if (!md_value) {
 126                 /* nothing to send */
 127                 return WERR_OK;
 128         }
 129
 130         ndr_err = ndr_pull_struct_blob(md_value, obj,
 131                                        lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
 132                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 133         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 134                 return WERR_DS_DRA_INTERNAL_ERROR;
 135         }
 136
 137         if (md.version != 1) {
 138                 return WERR_DS_DRA_INTERNAL_ERROR;
 139         }
 140
 141         rdn = ldb_dn_get_rdn_name(msg->dn);
 142         if (rdn == NULL) {
 143                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 144                 return WERR_DS_DRA_INTERNAL_ERROR;
 145         }
 146
 147         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 148         if (rdn_sa == NULL) {
 149                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 150                          rdn, ldb_dn_get_linearized(msg->dn)));
 151                 return WERR_DS_DRA_INTERNAL_ERROR;
 152         }
 153
 154         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 155         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 156
 157         obj->object.identifier = get_object_identifier(obj, msg);
 158         if (obj->object.identifier == NULL) {
 159                 return WERR_NOMEM;
 160         }
 161         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 162
 163         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 164         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 165                 const struct dsdb_attribute *sa;
 166                 /* if the attribute has not changed, and it is not the
 167                    instanceType then don't include it */
 168                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 169                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
 170
 171                 /* don't include the rDN */
 172                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 173
 174                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 175                 if (sa->linkID) {
 176                         struct ldb_message_element *el;
 177                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 178                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 179                                 /* don't send upgraded links inline */
 180                                 continue;
 181                         }
 182                 }
 183
 184                 /* filter by uptodateness_vector */
 185                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType &&
 186                     udv_filter(uptodateness_vector,
 187                                &md.ctr.ctr1.array[i].originating_invocation_id,
 188                                md.ctr.ctr1.array[i].originating_usn)) {
 189                         continue;
 190                 }
 191
 192                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 193                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 194                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 195                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 196                 attids[n] = md.ctr.ctr1.array[i].attid;
 197                 n++;
 198         }
 199
 200         /* ignore it if its an empty change. Note that renames always
 201          * change the 'name' attribute, so they won't be ignored by
 202          * this */
 203         if (n == 0 ||
 204             (n == 1 && attids[0] == DRSUAPI_ATTRIBUTE_instanceType)) {
 205                 talloc_free(obj->meta_data_ctr);
 206                 obj->meta_data_ctr = NULL;
 207                 return WERR_OK;
 208         }
 209
 210         obj->meta_data_ctr->count = n;
 211
 212         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 213         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 214         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 215                                                             obj->object.attribute_ctr.num_attributes);
 216
 217         /*
 218          * Note that the meta_data array and the attributes array must
 219          * be the same size and in the same order
 220          */
 221         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 222                 struct ldb_message_element *el;
 223                 WERROR werr;
 224                 const struct dsdb_attribute *sa;
 225
 226                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 227                 if (!sa) {
 228                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 229                         return WERR_DS_DRA_INTERNAL_ERROR;
 230                 }
 231
 232                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 233                 if (el == NULL) {
 234                         /* this happens for attributes that have been removed */
 235                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 236                                  sa->lDAPDisplayName, attids[i]));
 237                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 238                         obj->object.attribute_ctr.attributes[i].attid = attids[i];
 239                 } else {
 240                         werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
 241                                                              &obj->object.attribute_ctr.attributes[i]);
 242                         if (!W_ERROR_IS_OK(werr)) {
 243                                 DEBUG(0,("Unable to convert %s to DRS object - %s\n",
 244                                          sa->lDAPDisplayName, win_errstr(werr)));
 245                                 return werr;
 246                         }
 247                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 248                          * check if attribute is secret and send a null value
 249                          */
 250                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 251                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 252                                                                  &obj->meta_data_ctr->meta_data[i]);
 253                         }
 254                         /* some attributes needs to be encrypted
 255                            before being sent */
 256                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 257                                                          &obj->object.attribute_ctr.attributes[i]);
 258                         if (!W_ERROR_IS_OK(werr)) {
 259                                 DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
 260                                          sa->lDAPDisplayName, win_errstr(werr)));
 261                                 return werr;
 262                         }
 263                 }
 264         }
 265
 266         return WERR_OK;
 267 }
 268
 269
 270 /*
 271   add one linked attribute from an object to the list of linked
 272   attributes in a getncchanges request
 273  */
 274 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 275                                     struct ldb_context *sam_ctx,
 276                                     const struct dsdb_schema *schema,
 277                                     const struct dsdb_attribute *sa,
 278                                     struct ldb_message *msg,
 279                                     struct dsdb_dn *dsdb_dn,
 280                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 281                                     uint32_t *la_count)
 282 {
 283         struct drsuapi_DsReplicaLinkedAttribute *la;
 284         bool active;
 285         NTSTATUS status;
 286         WERROR werr;
 287
 288         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 289         W_ERROR_HAVE_NO_MEMORY(*la_list);
 290
 291         la = &(*la_list)[*la_count];
 292
 293         la->identifier = get_object_identifier(*la_list, msg);
 294         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 295
 296         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 297
 298         la->attid = sa->attributeID_id;
 299         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 300
 301         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 302         if (!NT_STATUS_IS_OK(status)) {
 303                 return ntstatus_to_werror(status);
 304         }
 305         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 306         if (!NT_STATUS_IS_OK(status)) {
 307                 return ntstatus_to_werror(status);
 308         }
 309         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 310         if (!NT_STATUS_IS_OK(status)) {
 311                 return ntstatus_to_werror(status);
 312         }
 313         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 314         if (!NT_STATUS_IS_OK(status)) {
 315                 return ntstatus_to_werror(status);
 316         }
 317         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return ntstatus_to_werror(status);
 320         }
 321
 322         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 323         W_ERROR_NOT_OK_RETURN(werr);
 324
 325         (*la_count)++;
 326         return WERR_OK;
 327 }
 328
 329
 330 /*
 331   add linked attributes from an object to the list of linked
 332   attributes in a getncchanges request
 333  */
 334 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 335                                        TALLOC_CTX *mem_ctx,
 336                                        struct ldb_dn *ncRoot_dn,
 337                                        struct dsdb_schema *schema,
 338                                        uint64_t highest_usn,
 339                                        uint32_t replica_flags,
 340                                        struct ldb_message *msg,
 341                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 342                                        uint32_t *la_count,
 343                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 344 {
 345         int i;
 346         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 347         uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
 348
 349         for (i=0; i<msg->num_elements; i++) {
 350                 struct ldb_message_element *el = &msg->elements[i];
 351                 const struct dsdb_attribute *sa;
 352                 int j;
 353
 354                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 355
 356                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 357                         /* we only want forward links */
 358                         continue;
 359                 }
 360
 361                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 362                         /* its an old style link, it will have been
 363                          * sent in the main replication data */
 364                         continue;
 365                 }
 366
 367                 for (j=0; j<el->num_values; j++) {
 368                         struct dsdb_dn *dsdb_dn;
 369                         uint64_t local_usn;
 370                         NTSTATUS status;
 371                         WERROR werr;
 372
 373                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 374                         if (dsdb_dn == NULL) {
 375                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 376                                          el->name, ldb_dn_get_linearized(msg->dn)));
 377                                 talloc_free(tmp_ctx);
 378                                 return WERR_DS_DRA_INTERNAL_ERROR;
 379                         }
 380
 381                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 382                         if (!NT_STATUS_IS_OK(status)) {
 383                                 /* this can happen for attributes
 384                                    given to us with old style meta
 385                                    data */
 386                                 continue;
 387                         }
 388
 389                         if (local_usn > uSNChanged) {
 390                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 391                                          el->name, ldb_dn_get_linearized(msg->dn)));
 392                                 talloc_free(tmp_ctx);
 393                                 return WERR_DS_DRA_INTERNAL_ERROR;
 394                         }
 395
 396                         if (local_usn < highest_usn) {
 397                                 continue;
 398                         }
 399
 400                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
 401                                                      dsdb_dn, la_list, la_count);
 402                         if (!W_ERROR_IS_OK(werr)) {
 403                                 talloc_free(tmp_ctx);
 404                                 return werr;
 405                         }
 406                 }
 407         }
 408
 409         talloc_free(tmp_ctx);
 410         return WERR_OK;
 411 }
 412
 413 /*
 414   load replUpToDateVector from a DN
 415  */
 416 static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 417                        struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
 418 {
 419         const char *attrs[] = { "replUpToDateVector", NULL };
 420         struct ldb_result *res = NULL;
 421         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 422         struct ldb_message_element *el;
 423         enum ndr_err_code ndr_err;
 424
 425         ZERO_STRUCTP(ouv);
 426
 427         if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
 428             res->count < 1) {
 429                 DEBUG(0,("load_udv: failed to read partition object\n"));
 430                 talloc_free(tmp_ctx);
 431                 return WERR_DS_DRA_INTERNAL_ERROR;
 432         }
 433
 434         el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
 435         if (el == NULL || el->num_values < 1) {
 436                 talloc_free(tmp_ctx);
 437                 ouv->version = 2;
 438                 return WERR_OK;
 439         }
 440
 441         ndr_err = ndr_pull_struct_blob(&el->values[0],
 442                                        mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
 443                                        ouv,
 444                                        (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
 445         talloc_free(tmp_ctx);
 446         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 447                 DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
 448                          ldb_dn_get_linearized(dn)));
 449                 return WERR_DS_DRA_INTERNAL_ERROR;
 450         }
 451
 452         return WERR_OK;
 453
 454 }
 455
 456 /*
 457   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 458  */
 459 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 460                                  struct ldb_dn *ncRoot_dn,
 461                                  struct drsuapi_DsReplicaCursor2CtrEx *udv,
 462                                  uint64_t highestUSN)
 463 {
 464         WERROR werr;
 465         struct drsuapi_DsReplicaCursor2 *tmp_cursor;
 466         NTTIME now;
 467         time_t t = time(NULL);
 468         struct replUpToDateVectorBlob ouv;
 469         int i;
 470
 471         werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
 472         if (!W_ERROR_IS_OK(werr)) {
 473                 return werr;
 474         }
 475
 476         tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
 477         tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
 478         tmp_cursor->highest_usn = highestUSN;
 479         unix_to_nt_time(&now, t);
 480         tmp_cursor->last_sync_success = now;
 481
 482         udv->count = ouv.ctr.ctr2.count;
 483         udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
 484
 485         for (i=0; i<udv->count; i++) {
 486                 if (GUID_equal(&tmp_cursor->source_dsa_invocation_id,
 487                                &udv->cursors[i].source_dsa_invocation_id)) {
 488                         udv->cursors[i] = *tmp_cursor;
 489                         break;
 490                 }
 491         }
 492         if (i == udv->count) {
 493                 udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count+1);
 494                 if (!udv->cursors) {
 495                         return WERR_DS_DRA_INTERNAL_ERROR;
 496                 }
 497                 udv->cursors[udv->count] = *tmp_cursor;
 498                 udv->count++;
 499         }
 500
 501         qsort(udv->cursors, udv->count,
 502               sizeof(struct drsuapi_DsReplicaCursor2),
 503               (comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
 504
 505         return WERR_OK;
 506 }
 507
 508
 509 /* comparison function for linked attributes - see CompareLinks() in
 510  * MS-DRSR section 4.1.10.5.17 */
 511 static int linked_attribute_compare(const struct drsuapi_DsReplicaLinkedAttribute *la1,
 512                                     const struct drsuapi_DsReplicaLinkedAttribute *la2,
 513                                     struct ldb_context *sam_ctx)
 514 {
 515         int c;
 516         WERROR werr;
 517         TALLOC_CTX *tmp_ctx;
 518         const struct dsdb_schema *schema;
 519         const struct dsdb_attribute *schema_attrib;
 520         struct dsdb_dn *dn1, *dn2;
 521         struct GUID guid1, guid2;
 522         NTSTATUS status;
 523
 524         c = GUID_compare(&la1->identifier->guid,
 525                          &la2->identifier->guid);
 526         if (c != 0) return c;
 527
 528         if (la1->attid != la2->attid) {
 529                 return la1->attid < la2->attid? -1:1;
 530         }
 531
 532         if ((la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
 533             (la2->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
 534                 return (la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
 535         }
 536
 537         /* we need to get the target GUIDs to compare */
 538         tmp_ctx = talloc_new(sam_ctx);
 539
 540         schema = dsdb_get_schema(sam_ctx);
 541         schema_attrib = dsdb_attribute_by_attributeID_id(schema, la1->attid);
 542
 543         werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la1->value.blob, &dn1);
 544         if (!W_ERROR_IS_OK(werr)) {
 545                 DEBUG(0,(__location__ ": Bad la1 blob in sort\n"));
 546                 talloc_free(tmp_ctx);
 547                 return 0;
 548         }
 549
 550         werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la2->value.blob, &dn2);
 551         if (!W_ERROR_IS_OK(werr)) {
 552                 DEBUG(0,(__location__ ": Bad la2 blob in sort\n"));
 553                 talloc_free(tmp_ctx);
 554                 return 0;
 555         }
 556
 557         status = dsdb_get_extended_dn_guid(dn1->dn, &guid1, "GUID");
 558         if (!NT_STATUS_IS_OK(status)) {
 559                 DEBUG(0,(__location__ ": Bad la1 guid in sort\n"));
 560                 talloc_free(tmp_ctx);
 561                 return 0;
 562         }
 563         status = dsdb_get_extended_dn_guid(dn2->dn, &guid2, "GUID");
 564         if (!NT_STATUS_IS_OK(status)) {
 565                 DEBUG(0,(__location__ ": Bad la2 guid in sort\n"));
 566                 talloc_free(tmp_ctx);
 567                 return 0;
 568         }
 569
 570         talloc_free(tmp_ctx);
 571
 572         return GUID_compare(&guid1, &guid2);
 573 }
 574
 575
 576 /*
 577   sort the objects we send by tree order
 578  */
 579 static int site_res_cmp_parent_order(const struct ldb_message **m1, const struct ldb_message **m2)
 580 {
 581         return ldb_dn_compare((*m2)->dn, (*m1)->dn);
 582 }
 583
 584 /*
 585   sort the objects we send first by uSNChanged
 586  */
 587 static int site_res_cmp_usn_order(const struct ldb_message **m1, const struct ldb_message **m2)
 588 {
 589         unsigned usnchanged1, usnchanged2;
 590         unsigned cn1, cn2;
 591         cn1 = ldb_dn_get_comp_num((*m1)->dn);
 592         cn2 = ldb_dn_get_comp_num((*m2)->dn);
 593         if (cn1 != cn2) {
 594                 return cn1 > cn2 ? 1 : -1;
 595         }
 596         usnchanged1 = ldb_msg_find_attr_as_uint(*m1, "uSNChanged", 0);
 597         usnchanged2 = ldb_msg_find_attr_as_uint(*m2, "uSNChanged", 0);
 598         if (usnchanged1 == usnchanged2) {
 599                 return 0;
 600         }
 601         return usnchanged1 > usnchanged2 ? 1 : -1;
 602 }
 603
 604
 605 /*
 606   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
 607  */
 608 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
 609                                      TALLOC_CTX *mem_ctx,
 610                                      struct drsuapi_DsGetNCChangesRequest8 *req8,
 611                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6)
 612 {
 613         struct ldb_dn *rid_manager_dn, *fsmo_role_dn, *req_dn;
 614         int ret;
 615         struct ldb_context *ldb = b_state->sam_ctx;
 616         struct ldb_result *ext_res;
 617         struct ldb_dn *base_dn;
 618         struct dsdb_fsmo_extended_op *exop;
 619
 620         /*
 621           steps:
 622             - verify that the DN being asked for is the RID Manager DN
 623             - verify that we are the RID Manager
 624          */
 625
 626         /* work out who is the RID Manager */
 627         ret = samdb_rid_manager_dn(ldb, mem_ctx, &rid_manager_dn);
 628         if (ret != LDB_SUCCESS) {
 629                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
 630                 return WERR_DS_DRA_INTERNAL_ERROR;
 631         }
 632
 633         req_dn = ldb_dn_new(mem_ctx, ldb, req8->naming_context->dn);
 634         if (!req_dn ||
 635             !ldb_dn_validate(req_dn) ||
 636             ldb_dn_compare(req_dn, rid_manager_dn) != 0) {
 637                 /* that isn't the RID Manager DN */
 638                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
 639                          req8->naming_context->dn));
 640                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
 641                 return WERR_OK;
 642         }
 643
 644         /* find the DN of the RID Manager */
 645         ret = samdb_reference_dn(ldb, mem_ctx, rid_manager_dn, "fSMORoleOwner", &fsmo_role_dn);
 646         if (ret != LDB_SUCCESS) {
 647                 DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in RID Manager object - %s\n",
 648                          ldb_errstring(ldb)));
 649                 return WERR_DS_DRA_INTERNAL_ERROR;
 650         }
 651
 652         if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
 653                 /* we're not the RID Manager - go away */
 654                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
 655                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
 656                 return WERR_OK;
 657         }
 658
 659         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
 660         W_ERROR_HAVE_NO_MEMORY(exop);
 661
 662         exop->fsmo_info = req8->fsmo_info;
 663         exop->destination_dsa_guid = req8->destination_dsa_guid;
 664
 665         ret = ldb_transaction_start(ldb);
 666         if (ret != LDB_SUCCESS) {
 667                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 668                          ldb_errstring(ldb)));
 669                 return WERR_DS_DRA_INTERNAL_ERROR;
 670         }
 671
 672         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
 673         if (ret != LDB_SUCCESS) {
 674                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
 675                          ldb_errstring(ldb)));
 676                 ldb_transaction_cancel(ldb);
 677                 return WERR_DS_DRA_INTERNAL_ERROR;
 678         }
 679
 680         ret = ldb_transaction_commit(ldb);
 681         if (ret != LDB_SUCCESS) {
 682                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 683                          ldb_errstring(ldb)));
 684                 return WERR_DS_DRA_INTERNAL_ERROR;
 685         }
 686
 687         talloc_free(ext_res);
 688
 689         base_dn = samdb_base_dn(ldb);
 690
 691         DEBUG(2,("Allocated RID pool for server %s\n",
 692                  GUID_string(mem_ctx, &req8->destination_dsa_guid)));
 693
 694         return WERR_OK;
 695 }
 696
 697
 698
 699 /* state of a partially completed getncchanges call */
 700 struct drsuapi_getncchanges_state {
 701         struct ldb_result *site_res;
 702         uint32_t num_sent;
 703         struct ldb_dn *ncRoot_dn;
 704         uint64_t min_usn;
 705         uint64_t highest_usn;
 706         struct ldb_dn *last_dn;
 707         struct drsuapi_DsReplicaLinkedAttribute *la_list;
 708         uint32_t la_count;
 709         struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector;
 710 };
 711
 712 /*
 713   drsuapi_DsGetNCChanges
 714
 715   see MS-DRSR 4.1.10.5.2 for basic logic of this function
 716 */
 717 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 718                                      struct drsuapi_DsGetNCChanges *r)
 719 {
 720         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
 721         int ret;
 722         int i;
 723         struct dsdb_schema *schema;
 724         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
 725         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
 726         NTSTATUS status;
 727         DATA_BLOB session_key;
 728         const char *attrs[] = { "*", "distinguishedName",
 729                                 "nTSecurityDescriptor",
 730                                 "parentGUID",
 731                                 "replPropertyMetaData",
 732                                 "unicodePwd",
 733                                 "dBCSPwd",
 734                                 "ntPwdHistory",
 735                                 "lmPwdHistory",
 736                                 "supplementalCredentials",
 737                                 NULL };
 738         WERROR werr;
 739         struct dcesrv_handle *h;
 740         struct drsuapi_bind_state *b_state;
 741         struct drsuapi_getncchanges_state *getnc_state;
 742         struct drsuapi_DsGetNCChangesRequest8 *req8;
 743         uint32_t options;
 744         uint32_t max_objects;
 745         struct ldb_dn *search_dn = NULL;
 746
 747         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 748         b_state = h->data;
 749
 750         *r->out.level_out = 6;
 751         /* TODO: linked attributes*/
 752         r->out.ctr->ctr6.linked_attributes_count = 0;
 753         r->out.ctr->ctr6.linked_attributes = NULL;
 754
 755         r->out.ctr->ctr6.object_count = 0;
 756         r->out.ctr->ctr6.nc_object_count = 0;
 757         r->out.ctr->ctr6.more_data = false;
 758         r->out.ctr->ctr6.uptodateness_vector = NULL;
 759
 760         /* a RODC doesn't allow for any replication */
 761         if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
 762                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
 763                 return WERR_DS_DRA_SOURCE_DISABLED;
 764         }
 765
 766         /* Check request revision.
 767            TODO: Adding mappings to req8 from the other levels
 768          */
 769         if (r->in.level != 8) {
 770                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
 771                          r->in.level));
 772                 return WERR_REVISION_MISMATCH;
 773         }
 774
 775         req8 = &r->in.req->req8;
 776
 777         /* Perform access checks. */
 778         /* TODO: we need to support a sync on a specific non-root
 779          * DN. We'll need to find the real partition root here */
 780         ncRoot = req8->naming_context;
 781         if (ncRoot == NULL) {
 782                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
 783                 return WERR_DS_DRA_INVALID_PARAMETER;
 784         }
 785
 786         if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
 787                 return WERR_DS_DRA_INTERNAL_ERROR;
 788         }
 789
 790         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
 791             !(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
 792                 return WERR_DS_DRA_SOURCE_DISABLED;
 793         }
 794
 795
 796         if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
 797                 /* Ignore the _in_ uptpdateness vector*/
 798                 req8->uptodateness_vector = NULL;
 799         }
 800
 801         werr = drs_security_level_check(dce_call, "DsGetNCChanges");
 802         if (!W_ERROR_IS_OK(werr)) {
 803                 return werr;
 804         }
 805
 806         /* we don't yet support extended operations */
 807         switch (req8->extended_op) {
 808         case DRSUAPI_EXOP_NONE:
 809                 break;
 810
 811         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
 812                 werr = getncchanges_rid_alloc(b_state, mem_ctx, req8, &r->out.ctr->ctr6);
 813                 W_ERROR_NOT_OK_RETURN(werr);
 814                 search_dn = samdb_base_dn(b_state->sam_ctx);
 815                 break;
 816
 817         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
 818         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
 819         case DRSUAPI_EXOP_FSMO_REQ_PDC:
 820         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
 821         case DRSUAPI_EXOP_REPL_OBJ:
 822         case DRSUAPI_EXOP_REPL_SECRET:
 823                 DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
 824                          (unsigned)req8->extended_op));
 825                 return WERR_DS_DRA_NOT_SUPPORTED;
 826         }
 827
 828         getnc_state = b_state->getncchanges_state;
 829
 830         /* see if a previous replication has been abandoned */
 831         if (getnc_state) {
 832                 struct ldb_dn *new_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 833                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
 834                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
 835                                  ldb_dn_get_linearized(new_dn),
 836                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
 837                                  ldb_dn_get_linearized(getnc_state->last_dn)));
 838                         talloc_free(getnc_state);
 839                         getnc_state = NULL;
 840                 }
 841         }
 842
 843         if (getnc_state == NULL) {
 844                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
 845                 if (getnc_state == NULL) {
 846                         return WERR_NOMEM;
 847                 }
 848                 b_state->getncchanges_state = getnc_state;
 849                 getnc_state->ncRoot_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
 850         }
 851
 852         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
 853             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
 854                 DEBUG(0,(__location__ ": Bad DN '%s'\n", ncRoot->dn));
 855                 return WERR_DS_DRA_INVALID_PARAMETER;
 856         }
 857
 858         /* we need the session key for encrypting password attributes */
 859         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
 860         if (!NT_STATUS_IS_OK(status)) {
 861                 DEBUG(0,(__location__ ": Failed to get session key\n"));
 862                 return WERR_DS_DRA_INTERNAL_ERROR;
 863         }
 864
 865         /*
 866            TODO: MS-DRSR section 4.1.10.1.1
 867            Work out if this is the start of a new cycle */
 868
 869         if (getnc_state->site_res == NULL) {
 870                 char* search_filter;
 871                 enum ldb_scope scope = LDB_SCOPE_SUBTREE;
 872                 const char *extra_filter;
 873
 874                 extra_filter = lp_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
 875
 876                 getnc_state->min_usn = req8->highwatermark.highest_usn;
 877
 878                 /* Construct response. */
 879                 search_filter = talloc_asprintf(mem_ctx,
 880                                                 "(uSNChanged>=%llu)",
 881                                                 (unsigned long long)(getnc_state->min_usn+1));
 882
 883                 if (extra_filter) {
 884                         search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
 885                 }
 886
 887                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
 888                         search_filter = talloc_asprintf(mem_ctx,
 889                                                         "(&%s(isCriticalSystemObject=TRUE))",
 890                                                         search_filter);
 891                 }
 892
 893                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
 894                         scope = LDB_SCOPE_BASE;
 895                 }
 896
 897                 if (!search_dn) {
 898                         search_dn = getnc_state->ncRoot_dn;
 899                 }
 900
 901                 DEBUG(1,(__location__ ": getncchanges on %s using filter %s\n",
 902                          ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
 903                 ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
 904                                                       search_dn, scope, attrs,
 905                                                       search_filter);
 906                 if (ret != LDB_SUCCESS) {
 907                         return WERR_DS_DRA_INTERNAL_ERROR;
 908                 }
 909
 910                 if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_RETURN_OBJECT_PARENTS) {
 911                         qsort(getnc_state->site_res->msgs,
 912                               getnc_state->site_res->count,
 913                               sizeof(getnc_state->site_res->msgs[0]),
 914                               (comparison_fn_t)site_res_cmp_parent_order);
 915                 } else {
 916                         qsort(getnc_state->site_res->msgs,
 917                               getnc_state->site_res->count,
 918                               sizeof(getnc_state->site_res->msgs[0]),
 919                               (comparison_fn_t)site_res_cmp_usn_order);
 920                 }
 921
 922                 getnc_state->uptodateness_vector = talloc_steal(getnc_state, req8->uptodateness_vector);
 923                 if (getnc_state->uptodateness_vector) {
 924                         /* make sure its sorted */
 925                         qsort(getnc_state->uptodateness_vector->cursors,
 926                               getnc_state->uptodateness_vector->count,
 927                               sizeof(getnc_state->uptodateness_vector->cursors[0]),
 928                               (comparison_fn_t)drsuapi_DsReplicaCursor_compare);
 929                 }
 930         }
 931
 932         /* Prefix mapping */
 933         schema = dsdb_get_schema(b_state->sam_ctx);
 934         if (!schema) {
 935                 DEBUG(0,("No schema in sam_ctx\n"));
 936                 return WERR_DS_DRA_INTERNAL_ERROR;
 937         }
 938
 939         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
 940         *r->out.ctr->ctr6.naming_context = *ncRoot;
 941
 942         if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn,
 943                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
 944                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
 945                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
 946                 return WERR_DS_DRA_INTERNAL_ERROR;
 947         }
 948
 949         /* find the SID if there is one */
 950         dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
 951
 952         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
 953         r->out.ctr->ctr6.mapping_ctr = *ctr;
 954
 955         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
 956         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
 957
 958         r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
 959         r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
 960
 961         r->out.ctr->ctr6.first_object = NULL;
 962         currentObject = &r->out.ctr->ctr6.first_object;
 963
 964         /* use this to force single objects at a time, which is useful
 965          * for working out what object is giving problems
 966          */
 967         max_objects = lp_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
 968         if (req8->max_object_count < max_objects) {
 969                 max_objects = req8->max_object_count;
 970         }
 971
 972         for(i=getnc_state->num_sent;
 973             i<getnc_state->site_res->count &&
 974                     (r->out.ctr->ctr6.object_count < max_objects);
 975             i++) {
 976                 int uSN;
 977                 struct drsuapi_DsReplicaObjectListItemEx *obj;
 978                 struct ldb_message *msg = getnc_state->site_res->msgs[i];
 979
 980                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
 981
 982                 werr = get_nc_changes_build_object(obj, msg,
 983                                                    b_state->sam_ctx, getnc_state->ncRoot_dn,
 984                                                    schema, &session_key, getnc_state->min_usn,
 985                                                    req8->replica_flags, getnc_state->uptodateness_vector);
 986                 if (!W_ERROR_IS_OK(werr)) {
 987                         return werr;
 988                 }
 989
 990                 werr = get_nc_changes_add_links(b_state->sam_ctx, getnc_state,
 991                                                 getnc_state->ncRoot_dn,
 992                                                 schema, getnc_state->min_usn,
 993                                                 req8->replica_flags,
 994                                                 msg,
 995                                                 &getnc_state->la_list,
 996                                                 &getnc_state->la_count,
 997                                                 getnc_state->uptodateness_vector);
 998                 if (!W_ERROR_IS_OK(werr)) {
 999                         return werr;
1000                 }
1001
1002                 uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
1003                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
1004                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
1005                 }
1006                 if (uSN > getnc_state->highest_usn) {
1007                         getnc_state->highest_usn = uSN;
1008                 }
1009
1010                 if (obj->meta_data_ctr == NULL) {
1011                         DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
1012                                  ldb_dn_get_linearized(msg->dn)));
1013                         /* no attributes to send */
1014                         talloc_free(obj);
1015                         continue;
1016                 }
1017
1018                 r->out.ctr->ctr6.object_count++;
1019
1020                 *currentObject = obj;
1021                 currentObject = &obj->next_object;
1022
1023                 talloc_free(getnc_state->last_dn);
1024                 getnc_state->last_dn = ldb_dn_copy(getnc_state, msg->dn);
1025
1026                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
1027         }
1028
1029         getnc_state->num_sent += r->out.ctr->ctr6.object_count;
1030
1031         r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
1032
1033         /* the client can us to call UpdateRefs on its behalf to
1034            re-establish monitoring of the NC */
1035         if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) &&
1036             !GUID_all_zero(&req8->destination_dsa_guid)) {
1037                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
1038                 ureq.naming_context = ncRoot;
1039                 ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
1040                                                          GUID_string(mem_ctx, &req8->destination_dsa_guid),
1041                                                          lp_realm(dce_call->conn->dce_ctx->lp_ctx));
1042                 if (!ureq.dest_dsa_dns_name) {
1043                         return WERR_NOMEM;
1044                 }
1045                 ureq.dest_dsa_guid = req8->destination_dsa_guid;
1046                 ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
1047                         DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
1048                         DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
1049                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
1050                 if (!W_ERROR_IS_OK(werr)) {
1051                         DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
1052                                  win_errstr(werr)));
1053                 }
1054         }
1055
1056         if (i < getnc_state->site_res->count) {
1057                 r->out.ctr->ctr6.more_data = true;
1058         } else {
1059                 r->out.ctr->ctr6.linked_attributes_count = getnc_state->la_count;
1060                 r->out.ctr->ctr6.linked_attributes = talloc_steal(mem_ctx, getnc_state->la_list);
1061
1062                 ldb_qsort(r->out.ctr->ctr6.linked_attributes, r->out.ctr->ctr6.linked_attributes_count,
1063                           sizeof(r->out.ctr->ctr6.linked_attributes[0]),
1064                           b_state->sam_ctx, (ldb_qsort_cmp_fn_t)linked_attribute_compare);
1065
1066                 r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
1067                 r->out.ctr->ctr6.uptodateness_vector->version = 2;
1068                 r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
1069                 r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
1070
1071                 r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
1072
1073                 werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn,
1074                                           r->out.ctr->ctr6.uptodateness_vector,
1075                                           getnc_state->highest_usn);
1076                 if (!W_ERROR_IS_OK(werr)) {
1077                         return werr;
1078                 }
1079
1080                 talloc_free(getnc_state);
1081                 b_state->getncchanges_state = NULL;
1082         }
1083
1084         if (req8->extended_op != DRSUAPI_EXOP_NONE) {
1085                 r->out.ctr->ctr6.uptodateness_vector = NULL;
1086                 r->out.ctr->ctr6.nc_object_count = 0;
1087                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
1088         }
1089
1090         DEBUG(r->out.ctr->ctr6.more_data?2:1,
1091               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d la=%d)\n",
1092                (unsigned long long)(req8->highwatermark.highest_usn+1),
1093                req8->replica_flags,
1094                ncRoot->dn, r->out.ctr->ctr6.object_count,
1095                i, r->out.ctr->ctr6.more_data?getnc_state->site_res->count:i,
1096                r->out.ctr->ctr6.linked_attributes_count));
1097
1098 #if 0
1099         if (!r->out.ctr->ctr6.more_data) {
1100                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
1101         }
1102 #endif
1103
1104         return WERR_OK;
1105 }