source4/dsdb/repl/replicated_objects.c

   1 /*
   2    Unix SMB/CIFS mplementation.
   3    Helper functions for applying replicated objects
   4
   5    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19
  20 */
  21
  22 #include "includes.h"
  23 #include "dsdb/samdb/samdb.h"
  24 #include <ldb_errors.h>
  25 #include "../lib/util/dlinklist.h"
  26 #include "librpc/gen_ndr/ndr_misc.h"
  27 #include "librpc/gen_ndr/ndr_drsuapi.h"
  28 #include "librpc/gen_ndr/ndr_drsblobs.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "../libcli/drsuapi/drsuapi.h"
  31 #include "libcli/auth/libcli_auth.h"
  32 #include "param/param.h"
  33
  34 static WERROR dsdb_repl_merge_working_schema(struct ldb_context *ldb,
  35                                              struct dsdb_schema *dest_schema,
  36                                              const struct dsdb_schema *ref_schema)
  37 {
  38         const struct dsdb_class *cur_class = NULL;
  39         const struct dsdb_attribute *cur_attr = NULL;
  40         int ret;
  41
  42         for (cur_class = ref_schema->classes;
  43              cur_class;
  44              cur_class = cur_class->next)
  45         {
  46                 const struct dsdb_class *tmp1;
  47                 struct dsdb_class *tmp2;
  48
  49                 tmp1 = dsdb_class_by_governsID_id(dest_schema,
  50                                                   cur_class->governsID_id);
  51                 if (tmp1 != NULL) {
  52                         continue;
  53                 }
  54
  55                 /*
  56                  * Do a shallow copy so that original next and prev are
  57                  * not modified, we don't need to do a deep copy
  58                  * as the rest won't be modified and this is for
  59                  * a short lived object.
  60                  */
  61                 tmp2 = talloc(dest_schema, struct dsdb_class);
  62                 if (tmp2 == NULL) {
  63                         return WERR_NOMEM;
  64                 }
  65                 *tmp2 = *cur_class;
  66                 DLIST_ADD(dest_schema->classes, tmp2);
  67         }
  68
  69         for (cur_attr = ref_schema->attributes;
  70              cur_attr;
  71              cur_attr = cur_attr->next)
  72         {
  73                 const struct dsdb_attribute *tmp1;
  74                 struct dsdb_attribute *tmp2;
  75
  76                 tmp1 = dsdb_attribute_by_attributeID_id(dest_schema,
  77                                                 cur_attr->attributeID_id);
  78                 if (tmp1 != NULL) {
  79                         continue;
  80                 }
  81
  82                 /*
  83                  * Do a shallow copy so that original next and prev are
  84                  * not modified, we don't need to do a deep copy
  85                  * as the rest won't be modified and this is for
  86                  * a short lived object.
  87                  */
  88                 tmp2 = talloc(dest_schema, struct dsdb_attribute);
  89                 if (tmp2 == NULL) {
  90                         return WERR_NOMEM;
  91                 }
  92                 *tmp2 = *cur_attr;
  93                 DLIST_ADD(dest_schema->attributes, tmp2);
  94         }
  95
  96         ret = dsdb_setup_sorted_accessors(ldb, dest_schema);
  97         if (LDB_SUCCESS != ret) {
  98                 DEBUG(0,("Failed to add new attribute to reference schema!\n"));
  99                 return WERR_INTERNAL_ERROR;
 100         }
 101
 102         return WERR_OK;
 103 }
 104
 105 WERROR dsdb_repl_resolve_working_schema(struct ldb_context *ldb,
 106                                         struct dsdb_schema_prefixmap *pfm_remote,
 107                                         uint32_t cycle_before_switching,
 108                                         struct dsdb_schema *initial_schema,
 109                                         struct dsdb_schema *resulting_schema,
 110                                         uint32_t object_count,
 111                                         const struct drsuapi_DsReplicaObjectListItemEx *first_object)
 112 {
 113         struct schema_list {
 114                 struct schema_list *next, *prev;
 115                 const struct drsuapi_DsReplicaObjectListItemEx *obj;
 116         };
 117         struct schema_list *schema_list = NULL, *schema_list_item, *schema_list_next_item;
 118         WERROR werr;
 119         struct dsdb_schema *working_schema;
 120         const struct drsuapi_DsReplicaObjectListItemEx *cur;
 121         DATA_BLOB empty_key = data_blob_null;
 122         int ret, pass_no;
 123         uint32_t ignore_attids[] = {
 124                         DRSUAPI_ATTID_auxiliaryClass,
 125                         DRSUAPI_ATTID_mayContain,
 126                         DRSUAPI_ATTID_mustContain,
 127                         DRSUAPI_ATTID_possSuperiors,
 128                         DRSUAPI_ATTID_systemPossSuperiors,
 129                         DRSUAPI_ATTID_INVALID
 130         };
 131         TALLOC_CTX *frame = talloc_stackframe();
 132
 133         /* create a list of objects yet to be converted */
 134         for (cur = first_object; cur; cur = cur->next_object) {
 135                 schema_list_item = talloc(frame, struct schema_list);
 136                 if (schema_list_item == NULL) {
 137                         return WERR_NOMEM;
 138                 }
 139
 140                 schema_list_item->obj = cur;
 141                 DLIST_ADD_END(schema_list, schema_list_item);
 142         }
 143
 144         /* resolve objects until all are resolved and in local schema */
 145         pass_no = 1;
 146         working_schema = initial_schema;
 147
 148         while (schema_list) {
 149                 uint32_t converted_obj_count = 0;
 150                 uint32_t failed_obj_count = 0;
 151
 152                 if (resulting_schema != working_schema) {
 153                         /*
 154                          * If the selfmade schema is not the schema used to
 155                          * translate and validate replicated object,
 156                          * Which means that we are using the bootstrap schema
 157                          * Then we add attributes and classes that were already
 158                          * translated to the working schema, the idea is that
 159                          * we might need to add new attributes and classes
 160                          * to be able to translate critical replicated objects
 161                          * and without that we wouldn't be able to translate them
 162                          */
 163                         werr = dsdb_repl_merge_working_schema(ldb,
 164                                                         working_schema,
 165                                                         resulting_schema);
 166                         if (!W_ERROR_IS_OK(werr)) {
 167                                 talloc_free(frame);
 168                                 return werr;
 169                         }
 170                 }
 171
 172                 for (schema_list_item = schema_list;
 173                      schema_list_item;
 174                      schema_list_item=schema_list_next_item) {
 175                         struct dsdb_extended_replicated_object object;
 176
 177                         cur = schema_list_item->obj;
 178
 179                         /*
 180                          * Save the next item, now we have saved out
 181                          * the current one, so we can DLIST_REMOVE it
 182                          * safely
 183                          */
 184                         schema_list_next_item = schema_list_item->next;
 185
 186                         /*
 187                          * Convert the objects into LDB messages using the
 188                          * schema we have so far. It's ok if we fail to convert
 189                          * an object. We should convert more objects on next pass.
 190                          */
 191                         werr = dsdb_convert_object_ex(ldb, working_schema,
 192                                                       NULL,
 193                                                       pfm_remote,
 194                                                       cur, &empty_key,
 195                                                       ignore_attids,
 196                                                       0,
 197                                                       schema_list_item, &object);
 198                         if (!W_ERROR_IS_OK(werr)) {
 199                                 DEBUG(4,("debug: Failed to convert schema "
 200                                          "object %s into ldb msg, "
 201                                          "will try during next loop\n",
 202                                          cur->object.identifier->dn));
 203
 204                                 failed_obj_count++;
 205                         } else {
 206                                 /*
 207                                  * Convert the schema from ldb_message format
 208                                  * (OIDs as OID strings) into schema, using
 209                                  * the remote prefixMap
 210                                  *
 211                                  * It's not likely, but possible to get the
 212                                  * same object twice and we should keep
 213                                  * the last instance.
 214                                  */
 215                                 werr = dsdb_schema_set_el_from_ldb_msg_dups(ldb,
 216                                                                 resulting_schema,
 217                                                                 object.msg,
 218                                                                 true);
 219                                 if (!W_ERROR_IS_OK(werr)) {
 220                                         DEBUG(4,("debug: failed to convert "
 221                                                  "object %s into a schema element, "
 222                                                  "will try during next loop: %s\n",
 223                                                  ldb_dn_get_linearized(object.msg->dn),
 224                                                  win_errstr(werr)));
 225                                         failed_obj_count++;
 226                                 } else {
 227                                         DEBUG(8,("Converted object %s into a schema element\n",
 228                                                  ldb_dn_get_linearized(object.msg->dn)));
 229                                         DLIST_REMOVE(schema_list, schema_list_item);
 230                                         TALLOC_FREE(schema_list_item);
 231                                         converted_obj_count++;
 232                                 }
 233                         }
 234                 }
 235
 236                 DEBUG(4,("Schema load pass %d: converted %d, %d of %d objects left to be converted.\n",
 237                          pass_no, converted_obj_count, failed_obj_count, object_count));
 238
 239                 /* check if we converted any objects in this pass */
 240                 if (converted_obj_count == 0) {
 241                         DEBUG(0,("Can't continue Schema load: "
 242                                  "didn't manage to convert any objects: "
 243                                  "all %d remaining of %d objects "
 244                                  "failed to convert\n",
 245                                  failed_obj_count, object_count));
 246                         talloc_free(frame);
 247                         return WERR_INTERNAL_ERROR;
 248                 }
 249
 250                 /*
 251                  * Don't try to load the schema if there is missing object
 252                  * _and_ we are on the first pass as some critical objects
 253                  * might be missing.
 254                  */
 255                 if (failed_obj_count == 0 || pass_no > cycle_before_switching) {
 256                         /* prepare for another cycle */
 257                         working_schema = resulting_schema;
 258
 259                         ret = dsdb_setup_sorted_accessors(ldb, working_schema);
 260                         if (LDB_SUCCESS != ret) {
 261                                 DEBUG(0,("Failed to create schema-cache indexes!\n"));
 262                                 talloc_free(frame);
 263                                 return WERR_INTERNAL_ERROR;
 264                         }
 265                 }
 266                 pass_no++;
 267         }
 268
 269         talloc_free(frame);
 270         return WERR_OK;
 271 }
 272
 273 /**
 274  * Multi-pass working schema creation
 275  * Function will:
 276  *  - shallow copy initial schema supplied
 277  *  - create a working schema in multiple passes
 278  *    until all objects are resolved
 279  * Working schema is a schema with Attributes, Classes
 280  * and indexes, but w/o subClassOf, possibleSupperiors etc.
 281  * It is to be used just us cache for converting attribute values.
 282  */
 283 WERROR dsdb_repl_make_working_schema(struct ldb_context *ldb,
 284                                      const struct dsdb_schema *initial_schema,
 285                                      const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr,
 286                                      uint32_t object_count,
 287                                      const struct drsuapi_DsReplicaObjectListItemEx *first_object,
 288                                      const DATA_BLOB *gensec_skey,
 289                                      TALLOC_CTX *mem_ctx,
 290                                      struct dsdb_schema **_schema_out)
 291 {
 292         WERROR werr;
 293         struct dsdb_schema_prefixmap *pfm_remote;
 294         uint32_t r;
 295         struct dsdb_schema *working_schema;
 296
 297         /* make a copy of the iniatial_scheam so we don't mess with it */
 298         working_schema = dsdb_schema_copy_shallow(mem_ctx, ldb, initial_schema);
 299         if (!working_schema) {
 300                 DEBUG(0,(__location__ ": schema copy failed!\n"));
 301                 return WERR_NOMEM;
 302         }
 303         working_schema->resolving_in_progress = true;
 304
 305         /* we are going to need remote prefixMap for decoding */
 306         werr = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true,
 307                                                 working_schema, &pfm_remote, NULL);
 308         if (!W_ERROR_IS_OK(werr)) {
 309                 DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s",
 310                          win_errstr(werr)));
 311                 talloc_free(working_schema);
 312                 return werr;
 313         }
 314
 315         for (r=0; r < pfm_remote->length; r++) {
 316                 const struct dsdb_schema_prefixmap_oid *rm = &pfm_remote->prefixes[r];
 317                 bool found_oid = false;
 318                 uint32_t l;
 319
 320                 for (l=0; l < working_schema->prefixmap->length; l++) {
 321                         const struct dsdb_schema_prefixmap_oid *lm = &working_schema->prefixmap->prefixes[l];
 322                         int cmp;
 323
 324                         cmp = data_blob_cmp(&rm->bin_oid, &lm->bin_oid);
 325                         if (cmp == 0) {
 326                                 found_oid = true;
 327                                 break;
 328                         }
 329                 }
 330
 331                 if (found_oid) {
 332                         continue;
 333                 }
 334
 335                 /*
 336                  * We prefer the same is as we got from the remote peer
 337                  * if there's no conflict.
 338                  */
 339                 werr = dsdb_schema_pfm_add_entry(working_schema->prefixmap,
 340                                                  rm->bin_oid, &rm->id, NULL);
 341                 if (!W_ERROR_IS_OK(werr)) {
 342                         DEBUG(0,(__location__ ": Failed to merge remote prefixMap: %s",
 343                                  win_errstr(werr)));
 344                         talloc_free(working_schema);
 345                         return werr;
 346                 }
 347         }
 348
 349         werr = dsdb_repl_resolve_working_schema(ldb,
 350                                                 pfm_remote,
 351                                                 0, /* cycle_before_switching */
 352                                                 working_schema,
 353                                                 working_schema,
 354                                                 object_count,
 355                                                 first_object);
 356         if (!W_ERROR_IS_OK(werr)) {
 357                 DEBUG(0, ("%s: dsdb_repl_resolve_working_schema() failed: %s",
 358                           __location__, win_errstr(werr)));
 359                 talloc_free(working_schema);
 360                 return werr;
 361         }
 362
 363         working_schema->resolving_in_progress = false;
 364
 365         *_schema_out = working_schema;
 366
 367         return WERR_OK;
 368 }
 369
 370 static bool dsdb_attid_in_list(const uint32_t attid_list[], uint32_t attid)
 371 {
 372         const uint32_t *cur;
 373         if (!attid_list) {
 374                 return false;
 375         }
 376         for (cur = attid_list; *cur != DRSUAPI_ATTID_INVALID; cur++) {
 377                 if (*cur == attid) {
 378                         return true;
 379                 }
 380         }
 381         return false;
 382 }
 383
 384 WERROR dsdb_convert_object_ex(struct ldb_context *ldb,
 385                               const struct dsdb_schema *schema,
 386                               struct ldb_dn *partition_dn,
 387                               const struct dsdb_schema_prefixmap *pfm_remote,
 388                               const struct drsuapi_DsReplicaObjectListItemEx *in,
 389                               const DATA_BLOB *gensec_skey,
 390                               const uint32_t *ignore_attids,
 391                               uint32_t dsdb_repl_flags,
 392                               TALLOC_CTX *mem_ctx,
 393                               struct dsdb_extended_replicated_object *out)
 394 {
 395         WERROR status = WERR_OK;
 396         uint32_t i;
 397         struct ldb_message *msg;
 398         struct replPropertyMetaDataBlob *md;
 399         int instanceType;
 400         struct ldb_message_element *instanceType_e = NULL;
 401         NTTIME whenChanged = 0;
 402         time_t whenChanged_t;
 403         const char *whenChanged_s;
 404         struct dom_sid *sid = NULL;
 405         uint32_t rid = 0;
 406         uint32_t attr_count;
 407
 408         if (!in->object.identifier) {
 409                 return WERR_FOOBAR;
 410         }
 411
 412         if (!in->object.identifier->dn || !in->object.identifier->dn[0]) {
 413                 return WERR_FOOBAR;
 414         }
 415
 416         if (in->object.attribute_ctr.num_attributes != 0 && !in->meta_data_ctr) {
 417                 return WERR_FOOBAR;
 418         }
 419
 420         if (in->object.attribute_ctr.num_attributes != in->meta_data_ctr->count) {
 421                 return WERR_FOOBAR;
 422         }
 423
 424         sid = &in->object.identifier->sid;
 425         if (sid->num_auths > 0) {
 426                 rid = sid->sub_auths[sid->num_auths - 1];
 427         }
 428
 429         msg = ldb_msg_new(mem_ctx);
 430         W_ERROR_HAVE_NO_MEMORY(msg);
 431
 432         msg->dn                 = ldb_dn_new(msg, ldb, in->object.identifier->dn);
 433         W_ERROR_HAVE_NO_MEMORY(msg->dn);
 434
 435         msg->num_elements       = in->object.attribute_ctr.num_attributes;
 436         msg->elements           = talloc_array(msg, struct ldb_message_element,
 437                                                msg->num_elements);
 438         W_ERROR_HAVE_NO_MEMORY(msg->elements);
 439
 440         md = talloc(mem_ctx, struct replPropertyMetaDataBlob);
 441         W_ERROR_HAVE_NO_MEMORY(md);
 442
 443         md->version             = 1;
 444         md->reserved            = 0;
 445         md->ctr.ctr1.count      = in->meta_data_ctr->count;
 446         md->ctr.ctr1.reserved   = 0;
 447         md->ctr.ctr1.array      = talloc_array(mem_ctx,
 448                                                struct replPropertyMetaData1,
 449                                                md->ctr.ctr1.count);
 450         W_ERROR_HAVE_NO_MEMORY(md->ctr.ctr1.array);
 451
 452         for (i=0, attr_count=0; i < in->meta_data_ctr->count; i++, attr_count++) {
 453                 struct drsuapi_DsReplicaAttribute *a;
 454                 struct drsuapi_DsReplicaMetaData *d;
 455                 struct replPropertyMetaData1 *m;
 456                 struct ldb_message_element *e;
 457                 uint32_t j;
 458
 459                 a = &in->object.attribute_ctr.attributes[i];
 460                 d = &in->meta_data_ctr->meta_data[i];
 461                 m = &md->ctr.ctr1.array[attr_count];
 462                 e = &msg->elements[attr_count];
 463
 464                 if (dsdb_attid_in_list(ignore_attids, a->attid)) {
 465                         attr_count--;
 466                         continue;
 467                 }
 468
 469                 if (GUID_all_zero(&d->originating_invocation_id)) {
 470                         status = WERR_DS_SRC_GUID_MISMATCH;
 471                         DEBUG(0, ("Refusing replication of object containing invalid zero invocationID on attribute %d of %s: %s\n",
 472                                   a->attid,
 473                                   ldb_dn_get_linearized(msg->dn),
 474                                   win_errstr(status)));
 475                         return status;
 476                 }
 477
 478                 if (a->attid == DRSUAPI_ATTID_instanceType) {
 479                         if (instanceType_e != NULL) {
 480                                 return WERR_FOOBAR;
 481                         }
 482                         instanceType_e = e;
 483                 }
 484
 485                 for (j=0; j<a->value_ctr.num_values; j++) {
 486                         status = drsuapi_decrypt_attribute(a->value_ctr.values[j].blob,
 487                                                            gensec_skey, rid,
 488                                                            dsdb_repl_flags, a);
 489                         if (!W_ERROR_IS_OK(status)) {
 490                                 break;
 491                         }
 492                 }
 493                 if (W_ERROR_EQUAL(status, WERR_TOO_MANY_SECRETS)) {
 494                         WERROR get_name_status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,
 495                                                                                a, msg->elements, e, NULL);
 496                         if (W_ERROR_IS_OK(get_name_status)) {
 497                                 DEBUG(0, ("Unxpectedly got secret value %s on %s from DRS server\n",
 498                                           e->name, ldb_dn_get_linearized(msg->dn)));
 499                         } else {
 500                                 DEBUG(0, ("Unxpectedly got secret value on %s from DRS server",
 501                                           ldb_dn_get_linearized(msg->dn)));
 502                         }
 503                 } else if (!W_ERROR_IS_OK(status)) {
 504                         return status;
 505                 }
 506
 507                 /*
 508                  * This function also fills in the local attid value,
 509                  * based on comparing the remote and local prefixMap
 510                  * tables.  If we don't convert the value, then we can
 511                  * have invalid values in the replPropertyMetaData we
 512                  * store on disk, as the prefixMap is per host, not
 513                  * per-domain.  This may be why Microsoft added the
 514                  * msDS-IntID feature, however this is not used for
 515                  * extra attributes in the schema partition itself.
 516                  */
 517                 status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,
 518                                                        a, msg->elements, e,
 519                                                        &m->attid);
 520                 W_ERROR_NOT_OK_RETURN(status);
 521
 522                 m->version                      = d->version;
 523                 m->originating_change_time      = d->originating_change_time;
 524                 m->originating_invocation_id    = d->originating_invocation_id;
 525                 m->originating_usn              = d->originating_usn;
 526                 m->local_usn                    = 0;
 527
 528                 if (a->attid == DRSUAPI_ATTID_name) {
 529                         const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
 530                         if (rdn_val == NULL) {
 531                                 DEBUG(0, ("Unxpectedly unable to get RDN from %s for validation",
 532                                           ldb_dn_get_linearized(msg->dn)));
 533                                 return WERR_FOOBAR;
 534                         }
 535                         if (e->num_values != 1) {
 536                                 DEBUG(0, ("Unxpectedly got wrong number of attribute values (got %u, expected 1) when checking RDN against name of %s",
 537                                           e->num_values,
 538                                           ldb_dn_get_linearized(msg->dn)));
 539                                 return WERR_FOOBAR;
 540                         }
 541                         if (data_blob_cmp(rdn_val,
 542                                           &e->values[0]) != 0) {
 543                                 DEBUG(0, ("Unxpectedly got mismatching RDN values when checking RDN against name of %s",
 544                                           ldb_dn_get_linearized(msg->dn)));
 545                                 return WERR_FOOBAR;
 546                         }
 547                 }
 548                 if (d->originating_change_time > whenChanged) {
 549                         whenChanged = d->originating_change_time;
 550                 }
 551
 552         }
 553
 554         msg->num_elements = attr_count;
 555         md->ctr.ctr1.count = attr_count;
 556
 557         if (instanceType_e == NULL) {
 558                 return WERR_FOOBAR;
 559         }
 560
 561         instanceType = ldb_msg_find_attr_as_int(msg, "instanceType", 0);
 562
 563         if ((instanceType & INSTANCE_TYPE_IS_NC_HEAD)
 564             && partition_dn != NULL) {
 565                 int partition_dn_cmp = ldb_dn_compare(partition_dn, msg->dn);
 566                 if (partition_dn_cmp != 0) {
 567                         DEBUG(4, ("Remote server advised us of a new partition %s while processing %s, ignoring\n",
 568                                   ldb_dn_get_linearized(msg->dn),
 569                                   ldb_dn_get_linearized(partition_dn)));
 570                         return WERR_DS_ADD_REPLICA_INHIBITED;
 571                 }
 572         }
 573
 574         if (dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
 575                 /* the instanceType type for partial_replica
 576                    replication is sent via DRS with TYPE_WRITE set, but
 577                    must be used on the client with TYPE_WRITE removed
 578                 */
 579                 if (instanceType & INSTANCE_TYPE_WRITE) {
 580                         /*
 581                          * Make sure we do not change the order
 582                          * of msg->elements!
 583                          *
 584                          * That's why we use
 585                          * instanceType_e->num_values = 0
 586                          * instead of
 587                          * ldb_msg_remove_attr(msg, "instanceType");
 588                          */
 589                         struct ldb_message_element *e;
 590
 591                         e = ldb_msg_find_element(msg, "instanceType");
 592                         if (e != instanceType_e) {
 593                                 DEBUG(0,("instanceType_e[%p] changed to e[%p]\n",
 594                                          instanceType_e, e));
 595                                 return WERR_FOOBAR;
 596                         }
 597
 598                         instanceType_e->num_values = 0;
 599
 600                         instanceType &= ~INSTANCE_TYPE_WRITE;
 601                         if (ldb_msg_add_fmt(msg, "instanceType", "%d", instanceType) != LDB_SUCCESS) {
 602                                 return WERR_INTERNAL_ERROR;
 603                         }
 604                 }
 605         } else {
 606                 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
 607                         DEBUG(0, ("Refusing to replicate %s from a read-only repilca into a read-write replica!\n",
 608                                   ldb_dn_get_linearized(msg->dn)));
 609                         return WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA;
 610                 }
 611         }
 612
 613         whenChanged_t = nt_time_to_unix(whenChanged);
 614         whenChanged_s = ldb_timestring(msg, whenChanged_t);
 615         W_ERROR_HAVE_NO_MEMORY(whenChanged_s);
 616
 617         out->object_guid = in->object.identifier->guid;
 618
 619         if (in->parent_object_guid == NULL) {
 620                 out->parent_guid = NULL;
 621         } else {
 622                 out->parent_guid = talloc(mem_ctx, struct GUID);
 623                 W_ERROR_HAVE_NO_MEMORY(out->parent_guid);
 624                 *out->parent_guid = *in->parent_object_guid;
 625         }
 626
 627         out->msg                = msg;
 628         out->when_changed       = whenChanged_s;
 629         out->meta_data          = md;
 630         return WERR_OK;
 631 }
 632
 633 WERROR dsdb_replicated_objects_convert(struct ldb_context *ldb,
 634                                        const struct dsdb_schema *schema,
 635                                        struct ldb_dn *partition_dn,
 636                                        const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr,
 637                                        uint32_t object_count,
 638                                        const struct drsuapi_DsReplicaObjectListItemEx *first_object,
 639                                        uint32_t linked_attributes_count,
 640                                        const struct drsuapi_DsReplicaLinkedAttribute *linked_attributes,
 641                                        const struct repsFromTo1 *source_dsa,
 642                                        const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector,
 643                                        const DATA_BLOB *gensec_skey,
 644                                        uint32_t dsdb_repl_flags,
 645                                        TALLOC_CTX *mem_ctx,
 646                                        struct dsdb_extended_replicated_objects **objects)
 647 {
 648         WERROR status;
 649         struct dsdb_schema_prefixmap *pfm_remote;
 650         struct dsdb_extended_replicated_objects *out;
 651         const struct drsuapi_DsReplicaObjectListItemEx *cur;
 652         struct dsdb_syntax_ctx syntax_ctx;
 653         uint32_t i;
 654
 655         out = talloc_zero(mem_ctx, struct dsdb_extended_replicated_objects);
 656         W_ERROR_HAVE_NO_MEMORY(out);
 657         out->version            = DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION;
 658         out->dsdb_repl_flags    = dsdb_repl_flags;
 659
 660         /*
 661          * Ensure schema is kept valid for as long as 'out'
 662          * which may contain pointers to it
 663          */
 664         schema = talloc_reference(out, schema);
 665         W_ERROR_HAVE_NO_MEMORY(schema);
 666
 667         status = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true,
 668                                                   out, &pfm_remote, NULL);
 669         if (!W_ERROR_IS_OK(status)) {
 670                 DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s",
 671                          win_errstr(status)));
 672                 talloc_free(out);
 673                 return status;
 674         }
 675
 676         /* use default syntax conversion context */
 677         dsdb_syntax_ctx_init(&syntax_ctx, ldb, schema);
 678         syntax_ctx.pfm_remote = pfm_remote;
 679
 680         if (ldb_dn_compare(partition_dn, ldb_get_schema_basedn(ldb)) != 0) {
 681                 /*
 682                  * check for schema changes in case
 683                  * we are not replicating Schema NC
 684                  */
 685                 status = dsdb_schema_info_cmp(schema, mapping_ctr);
 686                 if (!W_ERROR_IS_OK(status)) {
 687                         DEBUG(4,("Can't replicate %s because remote schema has changed since we last replicated the schema\n",
 688                                  ldb_dn_get_linearized(partition_dn)));
 689                         talloc_free(out);
 690                         return status;
 691                 }
 692         }
 693
 694         out->partition_dn       = partition_dn;
 695
 696         out->source_dsa         = source_dsa;
 697         out->uptodateness_vector= uptodateness_vector;
 698
 699         out->num_objects        = 0;
 700         out->objects            = talloc_array(out,
 701                                                struct dsdb_extended_replicated_object,
 702                                                object_count);
 703         W_ERROR_HAVE_NO_MEMORY_AND_FREE(out->objects, out);
 704
 705         for (i=0, cur = first_object; cur; cur = cur->next_object, i++) {
 706                 if (i == object_count) {
 707                         talloc_free(out);
 708                         return WERR_FOOBAR;
 709                 }
 710
 711                 status = dsdb_convert_object_ex(ldb, schema, out->partition_dn,
 712                                                 pfm_remote,
 713                                                 cur, gensec_skey,
 714                                                 NULL,
 715                                                 dsdb_repl_flags,
 716                                                 out->objects,
 717                                                 &out->objects[out->num_objects]);
 718
 719                 /*
 720                  * Check to see if we have been advised of a
 721                  * subdomain or new application partition.  We don't
 722                  * want to start on that here, instead the caller
 723                  * should consider if it would like to replicate it
 724                  * based on the cross-ref object.
 725                  */
 726                 if (W_ERROR_EQUAL(status, WERR_DS_ADD_REPLICA_INHIBITED)) {
 727                         continue;
 728                 }
 729
 730                 if (!W_ERROR_IS_OK(status)) {
 731                         talloc_free(out);
 732                         DEBUG(0,("Failed to convert object %s: %s\n",
 733                                  cur->object.identifier->dn,
 734                                  win_errstr(status)));
 735                         return status;
 736                 }
 737
 738                 /* Assuming we didn't skip or error, increment the number of objects */
 739                 out->num_objects++;
 740         }
 741         out->objects = talloc_realloc(out, out->objects,
 742                                       struct dsdb_extended_replicated_object,
 743                                       out->num_objects);
 744         if (out->num_objects != 0 && out->objects == NULL) {
 745                 talloc_free(out);
 746                 return WERR_FOOBAR;
 747         }
 748         if (i != object_count) {
 749                 talloc_free(out);
 750                 return WERR_FOOBAR;
 751         }
 752
 753         out->linked_attributes = talloc_array(out,
 754                                               struct drsuapi_DsReplicaLinkedAttribute,
 755                                               linked_attributes_count);
 756         W_ERROR_HAVE_NO_MEMORY_AND_FREE(out->linked_attributes, out);
 757
 758         for (i=0; i < linked_attributes_count; i++) {
 759                 const struct drsuapi_DsReplicaLinkedAttribute *ra = &linked_attributes[i];
 760                 struct drsuapi_DsReplicaLinkedAttribute *la = &out->linked_attributes[i];
 761
 762                 if (ra->identifier == NULL) {
 763                         talloc_free(out);
 764                         return WERR_BAD_NET_RESP;
 765                 }
 766
 767                 *la = *ra;
 768
 769                 la->identifier = talloc_zero(out->linked_attributes,
 770                                              struct drsuapi_DsReplicaObjectIdentifier);
 771                 W_ERROR_HAVE_NO_MEMORY_AND_FREE(la->identifier, out);
 772
 773                 /*
 774                  * We typically only get the guid filled
 775                  * and the repl_meta_data module only cares abouf
 776                  * the guid.
 777                  */
 778                 la->identifier->guid = ra->identifier->guid;
 779
 780                 if (ra->value.blob != NULL) {
 781                         la->value.blob = talloc_zero(out->linked_attributes,
 782                                                      DATA_BLOB);
 783                         W_ERROR_HAVE_NO_MEMORY_AND_FREE(la->value.blob, out);
 784
 785                         if (ra->value.blob->length != 0) {
 786                                 *la->value.blob = data_blob_dup_talloc(la->value.blob,
 787                                                                        *ra->value.blob);
 788                                 W_ERROR_HAVE_NO_MEMORY_AND_FREE(la->value.blob->data, out);
 789                         }
 790                 }
 791
 792                 status = dsdb_attribute_drsuapi_remote_to_local(&syntax_ctx,
 793                                                                 ra->attid,
 794                                                                 &la->attid,
 795                                                                 NULL);
 796                 if (!W_ERROR_IS_OK(status)) {
 797                         DEBUG(0,(__location__": linked_attribute[%u] attid 0x%08X not found: %s\n",
 798                                  i, ra->attid, win_errstr(status)));
 799                         return status;
 800                 }
 801         }
 802
 803         out->linked_attributes_count = linked_attributes_count;
 804
 805         /* free pfm_remote, we won't need it anymore */
 806         talloc_free(pfm_remote);
 807
 808         *objects = out;
 809         return WERR_OK;
 810 }
 811
 812 /**
 813  * Commits a list of replicated objects.
 814  *
 815  * @param working_schema dsdb_schema to be used for resolving
 816  *                       Classes/Attributes during Schema replication. If not NULL,
 817  *                       it will be set on ldb and used while committing replicated objects
 818  */
 819 WERROR dsdb_replicated_objects_commit(struct ldb_context *ldb,
 820                                       struct dsdb_schema *working_schema,
 821                                       struct dsdb_extended_replicated_objects *objects,
 822                                       uint64_t *notify_uSN)
 823 {
 824         WERROR werr;
 825         struct ldb_result *ext_res;
 826         struct dsdb_schema *cur_schema = NULL;
 827         struct dsdb_schema *new_schema = NULL;
 828         int ret;
 829         uint64_t seq_num1, seq_num2;
 830         bool used_global_schema = false;
 831
 832         TALLOC_CTX *tmp_ctx = talloc_new(objects);
 833         if (!tmp_ctx) {
 834                 DEBUG(0,("Failed to start talloc\n"));
 835                 return WERR_NOMEM;
 836         }
 837
 838         /* TODO: handle linked attributes */
 839
 840         /* wrap the extended operation in a transaction
 841            See [MS-DRSR] 3.3.2 Transactions
 842          */
 843         ret = ldb_transaction_start(ldb);
 844         if (ret != LDB_SUCCESS) {
 845                 DEBUG(0,(__location__ " Failed to start transaction\n"));
 846                 return WERR_FOOBAR;
 847         }
 848
 849         ret = dsdb_load_partition_usn(ldb, objects->partition_dn, &seq_num1, NULL);
 850         if (ret != LDB_SUCCESS) {
 851                 DEBUG(0,(__location__ " Failed to load partition uSN\n"));
 852                 ldb_transaction_cancel(ldb);
 853                 TALLOC_FREE(tmp_ctx);
 854                 return WERR_FOOBAR;
 855         }
 856
 857         /*
 858          * Set working_schema for ldb in case we are replicating from Schema NC.
 859          * Schema won't be reloaded during Replicated Objects commit, as it is
 860          * done in a transaction. So we need some way to search for newly
 861          * added Classes and Attributes
 862          */
 863         if (working_schema) {
 864                 /* store current schema so we can fall back in case of failure */
 865                 cur_schema = dsdb_get_schema(ldb, tmp_ctx);
 866                 used_global_schema = dsdb_uses_global_schema(ldb);
 867
 868                 ret = dsdb_reference_schema(ldb, working_schema, false);
 869                 if (ret != LDB_SUCCESS) {
 870                         DEBUG(0,(__location__ "Failed to reference working schema - %s\n",
 871                                  ldb_strerror(ret)));
 872                         /* TODO: Map LDB Error to NTSTATUS? */
 873                         ldb_transaction_cancel(ldb);
 874                         TALLOC_FREE(tmp_ctx);
 875                         return WERR_INTERNAL_ERROR;
 876                 }
 877         }
 878
 879         ret = ldb_extended(ldb, DSDB_EXTENDED_REPLICATED_OBJECTS_OID, objects, &ext_res);
 880         if (ret != LDB_SUCCESS) {
 881                 /* restore previous schema */
 882                 if (used_global_schema) {
 883                         dsdb_set_global_schema(ldb);
 884                 } else if (cur_schema) {
 885                         dsdb_reference_schema(ldb, cur_schema, false);
 886                 }
 887
 888                 if (!W_ERROR_EQUAL(objects->error, WERR_DS_DRA_MISSING_PARENT)) {
 889                         DEBUG(1,("Failed to apply records: %s: %s\n",
 890                                  ldb_errstring(ldb), ldb_strerror(ret)));
 891                 } else {
 892                         DEBUG(3,("Missing parent while attempting to apply records: %s\n",
 893                                  ldb_errstring(ldb)));
 894                 }
 895                 ldb_transaction_cancel(ldb);
 896                 TALLOC_FREE(tmp_ctx);
 897
 898                 if (!W_ERROR_IS_OK(objects->error)) {
 899                         return objects->error;
 900                 }
 901                 return WERR_FOOBAR;
 902         }
 903         talloc_free(ext_res);
 904
 905         /* Save our updated prefixMap */
 906         if (working_schema) {
 907                 werr = dsdb_write_prefixes_from_schema_to_ldb(working_schema,
 908                                                               ldb,
 909                                                               working_schema);
 910                 if (!W_ERROR_IS_OK(werr)) {
 911                         /* restore previous schema */
 912                         if (used_global_schema) {
 913                                 dsdb_set_global_schema(ldb);
 914                         } else if (cur_schema ) {
 915                                 dsdb_reference_schema(ldb, cur_schema, false);
 916                         }
 917                         DEBUG(0,("Failed to save updated prefixMap: %s\n",
 918                                  win_errstr(werr)));
 919                         TALLOC_FREE(tmp_ctx);
 920                         return werr;
 921                 }
 922         }
 923
 924         ret = ldb_transaction_prepare_commit(ldb);
 925         if (ret != LDB_SUCCESS) {
 926                 /* restore previous schema */
 927                 if (used_global_schema) {
 928                         dsdb_set_global_schema(ldb);
 929                 } else if (cur_schema ) {
 930                         dsdb_reference_schema(ldb, cur_schema, false);
 931                 }
 932                 DEBUG(0,(__location__ " Failed to prepare commit of transaction: %s\n",
 933                          ldb_errstring(ldb)));
 934                 TALLOC_FREE(tmp_ctx);
 935                 return WERR_FOOBAR;
 936         }
 937
 938         ret = dsdb_load_partition_usn(ldb, objects->partition_dn, &seq_num2, NULL);
 939         if (ret != LDB_SUCCESS) {
 940                 /* restore previous schema */
 941                 if (used_global_schema) {
 942                         dsdb_set_global_schema(ldb);
 943                 } else if (cur_schema ) {
 944                         dsdb_reference_schema(ldb, cur_schema, false);
 945                 }
 946                 DEBUG(0,(__location__ " Failed to load partition uSN\n"));
 947                 ldb_transaction_cancel(ldb);
 948                 TALLOC_FREE(tmp_ctx);
 949                 return WERR_FOOBAR;
 950         }
 951
 952         ret = ldb_transaction_commit(ldb);
 953         if (ret != LDB_SUCCESS) {
 954                 /* restore previous schema */
 955                 if (used_global_schema) {
 956                         dsdb_set_global_schema(ldb);
 957                 } else if (cur_schema ) {
 958                         dsdb_reference_schema(ldb, cur_schema, false);
 959                 }
 960                 DEBUG(0,(__location__ " Failed to commit transaction\n"));
 961                 TALLOC_FREE(tmp_ctx);
 962                 return WERR_FOOBAR;
 963         }
 964
 965         if (seq_num1 > *notify_uSN) {
 966                 /*
 967                  * A notify was already required before
 968                  * the current transaction.
 969                  */
 970         } else if (objects->originating_updates) {
 971                 /*
 972                  * Applying the replicated changes
 973                  * required originating updates,
 974                  * so a notify is required.
 975                  */
 976         } else {
 977                 /*
 978                  * There's no need to notify the
 979                  * server about the change we just from it.
 980                  */
 981                 *notify_uSN = seq_num2;
 982         }
 983
 984         /*
 985          * Reset the Schema used by ldb. This will lead to
 986          * a schema cache being refreshed from database.
 987          */
 988         if (working_schema) {
 989                 /* Reload the schema */
 990                 new_schema = dsdb_get_schema(ldb, tmp_ctx);
 991                 /* TODO:
 992                  * If dsdb_get_schema() fails, we just fall back
 993                  * to what we had.  However, the database is probably
 994                  * unable to operate for other users from this
 995                  * point... */
 996                 if (new_schema == NULL || new_schema == working_schema) {
 997                         DBG_ERR("Failed to re-load schema after commit of "
 998                                 "transaction (working: %p/%"PRIu64", new: "
 999                                 "%p/%"PRIu64")\n", new_schema,
1000                                 new_schema != NULL ?
1001                                 new_schema->metadata_usn : 0,
1002                                 working_schema, working_schema->metadata_usn);
1003                         dsdb_reference_schema(ldb, cur_schema, false);
1004                         if (used_global_schema) {
1005                                 dsdb_set_global_schema(ldb);
1006                         }
1007                         TALLOC_FREE(tmp_ctx);
1008                         return WERR_INTERNAL_ERROR;
1009                 } else if (used_global_schema) {
1010                         dsdb_make_schema_global(ldb, new_schema);
1011                 }
1012         }
1013
1014         DEBUG(2,("Replicated %u objects (%u linked attributes) for %s\n",
1015                  objects->num_objects, objects->linked_attributes_count,
1016                  ldb_dn_get_linearized(objects->partition_dn)));
1017
1018         TALLOC_FREE(tmp_ctx);
1019         return WERR_OK;
1020 }
1021
1022 static WERROR dsdb_origin_object_convert(struct ldb_context *ldb,
1023                                          const struct dsdb_schema *schema,
1024                                          const struct drsuapi_DsReplicaObjectListItem *in,
1025                                          TALLOC_CTX *mem_ctx,
1026                                          struct ldb_message **_msg)
1027 {
1028         WERROR status;
1029         unsigned int i;
1030         struct ldb_message *msg;
1031
1032         if (!in->object.identifier) {
1033                 return WERR_FOOBAR;
1034         }
1035
1036         if (!in->object.identifier->dn || !in->object.identifier->dn[0]) {
1037                 return WERR_FOOBAR;
1038         }
1039
1040         msg = ldb_msg_new(mem_ctx);
1041         W_ERROR_HAVE_NO_MEMORY(msg);
1042
1043         msg->dn = ldb_dn_new(msg, ldb, in->object.identifier->dn);
1044         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1045
1046         msg->num_elements       = in->object.attribute_ctr.num_attributes;
1047         msg->elements           = talloc_array(msg, struct ldb_message_element,
1048                                                msg->num_elements);
1049         W_ERROR_HAVE_NO_MEMORY(msg->elements);
1050
1051         for (i=0; i < msg->num_elements; i++) {
1052                 struct drsuapi_DsReplicaAttribute *a;
1053                 struct ldb_message_element *e;
1054
1055                 a = &in->object.attribute_ctr.attributes[i];
1056                 e = &msg->elements[i];
1057
1058                 status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, schema->prefixmap,
1059                                                        a, msg->elements, e, NULL);
1060                 W_ERROR_NOT_OK_RETURN(status);
1061         }
1062
1063
1064         *_msg = msg;
1065
1066         return WERR_OK;
1067 }
1068
1069 WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
1070                                   TALLOC_CTX *mem_ctx,
1071                                   const struct drsuapi_DsReplicaObjectListItem *first_object,
1072                                   uint32_t *_num,
1073                                   uint32_t dsdb_repl_flags,
1074                                   struct drsuapi_DsReplicaObjectIdentifier2 **_ids)
1075 {
1076         WERROR status;
1077         const struct dsdb_schema *schema;
1078         const struct drsuapi_DsReplicaObjectListItem *cur;
1079         struct ldb_message **objects;
1080         struct drsuapi_DsReplicaObjectIdentifier2 *ids;
1081         uint32_t i;
1082         uint32_t num_objects = 0;
1083         const char * const attrs[] = {
1084                 "objectGUID",
1085                 "objectSid",
1086                 NULL
1087         };
1088         struct ldb_result *res;
1089         int ret;
1090
1091         for (cur = first_object; cur; cur = cur->next_object) {
1092                 num_objects++;
1093         }
1094
1095         if (num_objects == 0) {
1096                 return WERR_OK;
1097         }
1098
1099         ret = ldb_transaction_start(ldb);
1100         if (ret != LDB_SUCCESS) {
1101                 return WERR_DS_INTERNAL_FAILURE;
1102         }
1103
1104         objects = talloc_array(mem_ctx, struct ldb_message *,
1105                                num_objects);
1106         if (objects == NULL) {
1107                 status = WERR_NOMEM;
1108                 goto cancel;
1109         }
1110
1111         schema = dsdb_get_schema(ldb, objects);
1112         if (!schema) {
1113                 return WERR_DS_SCHEMA_NOT_LOADED;
1114         }
1115
1116         for (i=0, cur = first_object; cur; cur = cur->next_object, i++) {
1117                 status = dsdb_origin_object_convert(ldb, schema, cur,
1118                                                     objects, &objects[i]);
1119                 if (!W_ERROR_IS_OK(status)) {
1120                         goto cancel;
1121                 }
1122         }
1123
1124         ids = talloc_array(mem_ctx,
1125                            struct drsuapi_DsReplicaObjectIdentifier2,
1126                            num_objects);
1127         if (ids == NULL) {
1128                 status = WERR_NOMEM;
1129                 goto cancel;
1130         }
1131
1132         if (dsdb_repl_flags & DSDB_REPL_FLAG_ADD_NCNAME) {
1133                 /* check for possible NC creation */
1134                 for (i=0; i < num_objects; i++) {
1135                         struct ldb_message *msg = objects[i];
1136                         struct ldb_message_element *el;
1137                         struct ldb_dn *nc_dn;
1138
1139                         if (ldb_msg_check_string_attribute(msg, "objectClass", "crossRef") == 0) {
1140                                 continue;
1141                         }
1142                         el = ldb_msg_find_element(msg, "nCName");
1143                         if (el == NULL || el->num_values != 1) {
1144                                 continue;
1145                         }
1146                         nc_dn = ldb_dn_from_ldb_val(objects, ldb, &el->values[0]);
1147                         if (!ldb_dn_validate(nc_dn)) {
1148                                 continue;
1149                         }
1150                         ret = dsdb_create_partial_replica_NC(ldb, nc_dn);
1151                         if (ret != LDB_SUCCESS) {
1152                                 status = WERR_DS_INTERNAL_FAILURE;
1153                                 goto cancel;
1154                         }
1155                 }
1156         }
1157
1158         for (i=0; i < num_objects; i++) {
1159                 struct dom_sid *sid = NULL;
1160                 struct ldb_request *add_req;
1161
1162                 DEBUG(6,(__location__ ": adding %s\n",
1163                          ldb_dn_get_linearized(objects[i]->dn)));
1164
1165                 ret = ldb_build_add_req(&add_req,
1166                                         ldb,
1167                                         objects,
1168                                         objects[i],
1169                                         NULL,
1170                                         NULL,
1171                                         ldb_op_default_callback,
1172                                         NULL);
1173                 if (ret != LDB_SUCCESS) {
1174                         status = WERR_DS_INTERNAL_FAILURE;
1175                         goto cancel;
1176                 }
1177
1178                 ret = ldb_request_add_control(add_req, LDB_CONTROL_RELAX_OID, true, NULL);
1179                 if (ret != LDB_SUCCESS) {
1180                         status = WERR_DS_INTERNAL_FAILURE;
1181                         goto cancel;
1182                 }
1183
1184                 ret = ldb_request(ldb, add_req);
1185                 if (ret == LDB_SUCCESS) {
1186                         ret = ldb_wait(add_req->handle, LDB_WAIT_ALL);
1187                 }
1188                 if (ret != LDB_SUCCESS) {
1189                         DEBUG(0,(__location__ ": Failed add of %s - %s\n",
1190                                  ldb_dn_get_linearized(objects[i]->dn), ldb_errstring(ldb)));
1191                         status = WERR_DS_INTERNAL_FAILURE;
1192                         goto cancel;
1193                 }
1194
1195                 talloc_free(add_req);
1196
1197                 ret = ldb_search(ldb, objects, &res, objects[i]->dn,
1198                                  LDB_SCOPE_BASE, attrs,
1199                                  "(objectClass=*)");
1200                 if (ret != LDB_SUCCESS) {
1201                         status = WERR_DS_INTERNAL_FAILURE;
1202                         goto cancel;
1203                 }
1204                 ids[i].guid = samdb_result_guid(res->msgs[0], "objectGUID");
1205                 sid = samdb_result_dom_sid(objects, res->msgs[0], "objectSid");
1206                 if (sid) {
1207                         ids[i].sid = *sid;
1208                 } else {
1209                         ZERO_STRUCT(ids[i].sid);
1210                 }
1211         }
1212
1213         ret = ldb_transaction_commit(ldb);
1214         if (ret != LDB_SUCCESS) {
1215                 return WERR_DS_INTERNAL_FAILURE;
1216         }
1217
1218         talloc_free(objects);
1219
1220         *_num = num_objects;
1221         *_ids = ids;
1222         return WERR_OK;
1223
1224 cancel:
1225         talloc_free(objects);
1226         ldb_transaction_cancel(ldb);
1227         return status;
1228 }