4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/dom_sid.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/security.h"
52 #include "libcli/security/session.h"
53 #include "lib/util/tsort.h"
55 struct replmd_private {
57 struct la_entry *la_list;
59 struct la_backlink *la_backlinks;
61 struct nc_entry *prev, *next;
64 uint64_t mod_usn_urgent;
69 struct la_entry *next, *prev;
70 struct drsuapi_DsReplicaLinkedAttribute *la;
73 struct replmd_replicated_request {
74 struct ldb_module *module;
75 struct ldb_request *req;
77 const struct dsdb_schema *schema;
79 /* the controls we pass down */
80 struct ldb_control **controls;
82 /* details for the mode where we apply a bunch of inbound replication meessages */
84 uint32_t index_current;
85 struct dsdb_extended_replicated_objects *objs;
87 struct ldb_message *search_msg;
93 enum urgent_situation {
94 REPL_URGENT_ON_CREATE = 1,
95 REPL_URGENT_ON_UPDATE = 2,
96 REPL_URGENT_ON_DELETE = 4
100 static const struct {
101 const char *update_name;
102 enum urgent_situation repl_situation;
103 } urgent_objects[] = {
104 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
106 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
109 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
113 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
114 static const char *urgent_attrs[] = {
117 "userAccountControl",
122 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
123 enum urgent_situation situation)
126 for (i=0; urgent_objects[i].update_name; i++) {
128 if ((situation & urgent_objects[i].repl_situation) == 0) {
132 for (j=0; j<objectclass_el->num_values; j++) {
133 const struct ldb_val *v = &objectclass_el->values[j];
134 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
142 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
144 if (ldb_attr_in_list(urgent_attrs, el->name)) {
151 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
154 initialise the module
155 allocate the private structure and build the list
156 of partition DNs for use by replmd_notify()
158 static int replmd_init(struct ldb_module *module)
160 struct replmd_private *replmd_private;
161 struct ldb_context *ldb = ldb_module_get_ctx(module);
163 replmd_private = talloc_zero(module, struct replmd_private);
164 if (replmd_private == NULL) {
166 return LDB_ERR_OPERATIONS_ERROR;
168 ldb_module_set_private(module, replmd_private);
170 return ldb_next_init(module);
174 cleanup our per-transaction contexts
176 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
178 talloc_free(replmd_private->la_ctx);
179 replmd_private->la_list = NULL;
180 replmd_private->la_ctx = NULL;
182 talloc_free(replmd_private->bl_ctx);
183 replmd_private->la_backlinks = NULL;
184 replmd_private->bl_ctx = NULL;
189 struct la_backlink *next, *prev;
190 const char *attr_name;
191 struct GUID forward_guid, target_guid;
196 process a backlinks we accumulated during a transaction, adding and
197 deleting the backlinks from the target objects
199 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
201 struct ldb_dn *target_dn, *source_dn;
203 struct ldb_context *ldb = ldb_module_get_ctx(module);
204 struct ldb_message *msg;
205 TALLOC_CTX *tmp_ctx = talloc_new(bl);
211 - construct ldb_message
212 - either an add or a delete
214 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
215 if (ret != LDB_SUCCESS) {
216 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
217 GUID_string(bl, &bl->target_guid)));
221 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
222 if (ret != LDB_SUCCESS) {
223 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
224 GUID_string(bl, &bl->forward_guid));
225 talloc_free(tmp_ctx);
229 msg = ldb_msg_new(tmp_ctx);
231 ldb_module_oom(module);
232 talloc_free(tmp_ctx);
233 return LDB_ERR_OPERATIONS_ERROR;
236 /* construct a ldb_message for adding/deleting the backlink */
238 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
240 ldb_module_oom(module);
241 talloc_free(tmp_ctx);
242 return LDB_ERR_OPERATIONS_ERROR;
244 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
245 if (ret != LDB_SUCCESS) {
246 talloc_free(tmp_ctx);
249 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
251 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
252 if (ret != LDB_SUCCESS) {
253 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
254 bl->active?"add":"remove",
255 ldb_dn_get_linearized(source_dn),
256 ldb_dn_get_linearized(target_dn),
258 talloc_free(tmp_ctx);
261 talloc_free(tmp_ctx);
266 add a backlink to the list of backlinks to add/delete in the prepare
269 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
270 struct GUID *forward_guid, struct GUID *target_guid,
271 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
273 const struct dsdb_attribute *target_attr;
274 struct la_backlink *bl;
275 struct replmd_private *replmd_private =
276 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
278 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
281 * windows 2003 has a broken schema where the
282 * definition of msDS-IsDomainFor is missing (which is
283 * supposed to be the backlink of the
284 * msDS-HasDomainNCs attribute
289 /* see if its already in the list */
290 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
291 if (GUID_equal(forward_guid, &bl->forward_guid) &&
292 GUID_equal(target_guid, &bl->target_guid) &&
293 (target_attr->lDAPDisplayName == bl->attr_name ||
294 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
300 /* we found an existing one */
301 if (bl->active == active) {
304 DLIST_REMOVE(replmd_private->la_backlinks, bl);
309 if (replmd_private->bl_ctx == NULL) {
310 replmd_private->bl_ctx = talloc_new(replmd_private);
311 if (replmd_private->bl_ctx == NULL) {
312 ldb_module_oom(module);
313 return LDB_ERR_OPERATIONS_ERROR;
318 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
320 ldb_module_oom(module);
321 return LDB_ERR_OPERATIONS_ERROR;
324 /* Ensure the schema does not go away before the bl->attr_name is used */
325 if (!talloc_reference(bl, schema)) {
327 ldb_module_oom(module);
328 return LDB_ERR_OPERATIONS_ERROR;
331 bl->attr_name = target_attr->lDAPDisplayName;
332 bl->forward_guid = *forward_guid;
333 bl->target_guid = *target_guid;
336 /* the caller may ask for this backlink to be processed
339 int ret = replmd_process_backlink(module, bl);
344 DLIST_ADD(replmd_private->la_backlinks, bl);
351 * Callback for most write operations in this module:
353 * notify the repl task that a object has changed. The notifies are
354 * gathered up in the replmd_private structure then written to the
355 * @REPLCHANGED object in each partition during the prepare_commit
357 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
360 struct replmd_replicated_request *ac =
361 talloc_get_type_abort(req->context, struct replmd_replicated_request);
362 struct replmd_private *replmd_private =
363 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
364 struct nc_entry *modified_partition;
365 struct ldb_control *partition_ctrl;
366 const struct dsdb_control_current_partition *partition;
368 struct ldb_control **controls;
370 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
372 /* Remove the 'partition' control from what we pass up the chain */
373 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
375 if (ares->error != LDB_SUCCESS) {
376 return ldb_module_done(ac->req, controls,
377 ares->response, ares->error);
380 if (ares->type != LDB_REPLY_DONE) {
381 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
382 return ldb_module_done(ac->req, NULL,
383 NULL, LDB_ERR_OPERATIONS_ERROR);
386 if (!partition_ctrl) {
387 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
388 return ldb_module_done(ac->req, NULL,
389 NULL, LDB_ERR_OPERATIONS_ERROR);
392 partition = talloc_get_type_abort(partition_ctrl->data,
393 struct dsdb_control_current_partition);
395 if (ac->seq_num > 0) {
396 for (modified_partition = replmd_private->ncs; modified_partition;
397 modified_partition = modified_partition->next) {
398 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
403 if (modified_partition == NULL) {
404 modified_partition = talloc_zero(replmd_private, struct nc_entry);
405 if (!modified_partition) {
406 ldb_oom(ldb_module_get_ctx(ac->module));
407 return ldb_module_done(ac->req, NULL,
408 NULL, LDB_ERR_OPERATIONS_ERROR);
410 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
411 if (!modified_partition->dn) {
412 ldb_oom(ldb_module_get_ctx(ac->module));
413 return ldb_module_done(ac->req, NULL,
414 NULL, LDB_ERR_OPERATIONS_ERROR);
416 DLIST_ADD(replmd_private->ncs, modified_partition);
419 if (ac->seq_num > modified_partition->mod_usn) {
420 modified_partition->mod_usn = ac->seq_num;
422 modified_partition->mod_usn_urgent = ac->seq_num;
427 if (ac->apply_mode) {
431 ret = replmd_replicated_apply_next(ac);
432 if (ret != LDB_SUCCESS) {
433 return ldb_module_done(ac->req, NULL, NULL, ret);
437 /* free the partition control container here, for the
438 * common path. Other cases will have it cleaned up
439 * eventually with the ares */
440 talloc_free(partition_ctrl);
441 return ldb_module_done(ac->req,
442 controls_except_specified(controls, ares, partition_ctrl),
443 ares->response, LDB_SUCCESS);
449 * update a @REPLCHANGED record in each partition if there have been
450 * any writes of replicated data in the partition
452 static int replmd_notify_store(struct ldb_module *module)
454 struct replmd_private *replmd_private =
455 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
457 while (replmd_private->ncs) {
459 struct nc_entry *modified_partition = replmd_private->ncs;
461 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
462 modified_partition->mod_usn,
463 modified_partition->mod_usn_urgent);
464 if (ret != LDB_SUCCESS) {
465 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
466 ldb_dn_get_linearized(modified_partition->dn)));
469 DLIST_REMOVE(replmd_private->ncs, modified_partition);
470 talloc_free(modified_partition);
478 created a replmd_replicated_request context
480 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
481 struct ldb_request *req)
483 struct ldb_context *ldb;
484 struct replmd_replicated_request *ac;
486 ldb = ldb_module_get_ctx(module);
488 ac = talloc_zero(req, struct replmd_replicated_request);
497 ac->schema = dsdb_get_schema(ldb, ac);
499 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
500 "replmd_modify: no dsdb_schema loaded");
501 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
509 add a time element to a record
511 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
513 struct ldb_message_element *el;
516 if (ldb_msg_find_element(msg, attr) != NULL) {
520 s = ldb_timestring(msg, t);
522 return LDB_ERR_OPERATIONS_ERROR;
525 if (ldb_msg_add_string(msg, attr, s) != LDB_SUCCESS) {
526 return LDB_ERR_OPERATIONS_ERROR;
529 el = ldb_msg_find_element(msg, attr);
530 /* always set as replace. This works because on add ops, the flag
532 el->flags = LDB_FLAG_MOD_REPLACE;
538 add a uint64_t element to a record
540 static int add_uint64_element(struct ldb_message *msg, const char *attr, uint64_t v)
542 struct ldb_message_element *el;
544 if (ldb_msg_find_element(msg, attr) != NULL) {
548 if (ldb_msg_add_fmt(msg, attr, "%llu", (unsigned long long)v) != LDB_SUCCESS) {
549 return LDB_ERR_OPERATIONS_ERROR;
552 el = ldb_msg_find_element(msg, attr);
553 /* always set as replace. This works because on add ops, the flag
555 el->flags = LDB_FLAG_MOD_REPLACE;
560 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
561 const struct replPropertyMetaData1 *m2,
562 const uint32_t *rdn_attid)
564 if (m1->attid == m2->attid) {
569 * the rdn attribute should be at the end!
570 * so we need to return a value greater than zero
571 * which means m1 is greater than m2
573 if (m1->attid == *rdn_attid) {
578 * the rdn attribute should be at the end!
579 * so we need to return a value less than zero
580 * which means m2 is greater than m1
582 if (m2->attid == *rdn_attid) {
586 return m1->attid > m2->attid ? 1 : -1;
589 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
590 const struct dsdb_schema *schema,
593 const char *rdn_name;
594 const struct dsdb_attribute *rdn_sa;
596 rdn_name = ldb_dn_get_rdn_name(dn);
598 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
599 return LDB_ERR_OPERATIONS_ERROR;
602 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
603 if (rdn_sa == NULL) {
604 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
605 return LDB_ERR_OPERATIONS_ERROR;
608 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
609 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
611 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
616 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
617 const struct ldb_message_element *e2,
618 const struct dsdb_schema *schema)
620 const struct dsdb_attribute *a1;
621 const struct dsdb_attribute *a2;
624 * TODO: make this faster by caching the dsdb_attribute pointer
625 * on the ldb_messag_element
628 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
629 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
632 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
636 return strcasecmp(e1->name, e2->name);
638 if (a1->attributeID_id == a2->attributeID_id) {
641 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
644 static void replmd_ldb_message_sort(struct ldb_message *msg,
645 const struct dsdb_schema *schema)
647 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
650 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
651 const struct GUID *invocation_id, uint64_t seq_num,
652 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
656 fix up linked attributes in replmd_add.
657 This involves setting up the right meta-data in extended DN
658 components, and creating backlinks to the object
660 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
661 uint64_t seq_num, const struct GUID *invocationId, time_t t,
662 struct GUID *guid, const struct dsdb_attribute *sa)
665 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
666 struct ldb_context *ldb = ldb_module_get_ctx(module);
668 /* We will take a reference to the schema in replmd_add_backlink */
669 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
672 unix_to_nt_time(&now, t);
674 for (i=0; i<el->num_values; i++) {
675 struct ldb_val *v = &el->values[i];
676 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
677 struct GUID target_guid;
681 /* note that the DN already has the extended
682 components from the extended_dn_store module */
683 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
684 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
685 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
686 if (ret != LDB_SUCCESS) {
687 talloc_free(tmp_ctx);
690 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
691 if (ret != LDB_SUCCESS) {
692 talloc_free(tmp_ctx);
697 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
698 seq_num, seq_num, now, 0, false);
699 if (ret != LDB_SUCCESS) {
700 talloc_free(tmp_ctx);
704 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
705 if (ret != LDB_SUCCESS) {
706 talloc_free(tmp_ctx);
711 talloc_free(tmp_ctx);
717 intercept add requests
719 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
721 struct ldb_context *ldb;
722 struct ldb_control *control;
723 struct replmd_replicated_request *ac;
724 enum ndr_err_code ndr_err;
725 struct ldb_request *down_req;
726 struct ldb_message *msg;
727 const DATA_BLOB *guid_blob;
729 struct replPropertyMetaDataBlob nmd;
730 struct ldb_val nmd_value;
731 const struct GUID *our_invocation_id;
732 time_t t = time(NULL);
737 unsigned int functional_level;
739 bool allow_add_guid = false;
740 bool remove_current_guid = false;
741 bool is_urgent = false;
742 struct ldb_message_element *objectclass_el;
744 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
745 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
747 allow_add_guid = true;
750 /* do not manipulate our control entries */
751 if (ldb_dn_is_special(req->op.add.message->dn)) {
752 return ldb_next_request(module, req);
755 ldb = ldb_module_get_ctx(module);
757 functional_level = dsdb_functional_level(ldb);
759 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
761 ac = replmd_ctx_init(module, req);
763 return LDB_ERR_OPERATIONS_ERROR;
766 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
767 if ( guid_blob != NULL ) {
768 if( !allow_add_guid ) {
769 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
770 "replmd_add: it's not allowed to add an object with objectGUID\n");
772 return LDB_ERR_UNWILLING_TO_PERFORM;
774 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
775 if ( !NT_STATUS_IS_OK(status)) {
776 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
777 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
779 return LDB_ERR_UNWILLING_TO_PERFORM;
781 /* we remove this attribute as it can be a string and will not be treated
782 correctly and then we will readd it latter on in the good format*/
783 remove_current_guid = true;
787 guid = GUID_random();
790 /* Get a sequence number from the backend */
791 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
792 if (ret != LDB_SUCCESS) {
797 /* get our invocationId */
798 our_invocation_id = samdb_ntds_invocation_id(ldb);
799 if (!our_invocation_id) {
800 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
801 "replmd_add: unable to find invocationId\n");
803 return LDB_ERR_OPERATIONS_ERROR;
806 /* we have to copy the message as the caller might have it as a const */
807 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
811 return LDB_ERR_OPERATIONS_ERROR;
814 /* generated times */
815 unix_to_nt_time(&now, t);
816 time_str = ldb_timestring(msg, t);
820 return LDB_ERR_OPERATIONS_ERROR;
822 if (remove_current_guid) {
823 ldb_msg_remove_attr(msg,"objectGUID");
827 * remove autogenerated attributes
829 ldb_msg_remove_attr(msg, "whenCreated");
830 ldb_msg_remove_attr(msg, "whenChanged");
831 ldb_msg_remove_attr(msg, "uSNCreated");
832 ldb_msg_remove_attr(msg, "uSNChanged");
833 ldb_msg_remove_attr(msg, "replPropertyMetaData");
836 * readd replicated attributes
838 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
839 if (ret != LDB_SUCCESS) {
845 /* build the replication meta_data */
848 nmd.ctr.ctr1.count = msg->num_elements;
849 nmd.ctr.ctr1.array = talloc_array(msg,
850 struct replPropertyMetaData1,
852 if (!nmd.ctr.ctr1.array) {
855 return LDB_ERR_OPERATIONS_ERROR;
858 for (i=0; i < msg->num_elements; i++) {
859 struct ldb_message_element *e = &msg->elements[i];
860 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
861 const struct dsdb_attribute *sa;
863 if (e->name[0] == '@') continue;
865 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
867 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
868 "replmd_add: attribute '%s' not defined in schema\n",
871 return LDB_ERR_NO_SUCH_ATTRIBUTE;
874 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
875 /* if the attribute is not replicated (0x00000001)
876 * or constructed (0x00000004) it has no metadata
881 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
882 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
883 if (ret != LDB_SUCCESS) {
887 /* linked attributes are not stored in
888 replPropertyMetaData in FL above w2k */
892 m->attid = sa->attributeID_id;
894 m->originating_change_time = now;
895 m->originating_invocation_id = *our_invocation_id;
896 m->originating_usn = ac->seq_num;
897 m->local_usn = ac->seq_num;
901 /* fix meta data count */
902 nmd.ctr.ctr1.count = ni;
905 * sort meta data array, and move the rdn attribute entry to the end
907 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
908 if (ret != LDB_SUCCESS) {
913 /* generated NDR encoded values */
914 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
916 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
917 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
920 return LDB_ERR_OPERATIONS_ERROR;
924 * add the autogenerated values
926 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
927 if (ret != LDB_SUCCESS) {
932 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
933 if (ret != LDB_SUCCESS) {
938 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
939 if (ret != LDB_SUCCESS) {
944 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
945 if (ret != LDB_SUCCESS) {
950 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
951 if (ret != LDB_SUCCESS) {
958 * sort the attributes by attid before storing the object
960 replmd_ldb_message_sort(msg, ac->schema);
962 objectclass_el = ldb_msg_find_element(msg, "objectClass");
963 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
964 REPL_URGENT_ON_CREATE);
966 ac->is_urgent = is_urgent;
967 ret = ldb_build_add_req(&down_req, ldb, ac,
970 ac, replmd_op_callback,
973 LDB_REQ_SET_LOCATION(down_req);
974 if (ret != LDB_SUCCESS) {
979 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
980 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
981 if (ret != LDB_SUCCESS) {
987 /* mark the control done */
989 control->critical = 0;
992 /* go on with the call chain */
993 return ldb_next_request(module, down_req);
998 * update the replPropertyMetaData for one element
1000 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1001 struct ldb_message *msg,
1002 struct ldb_message_element *el,
1003 struct ldb_message_element *old_el,
1004 struct replPropertyMetaDataBlob *omd,
1005 const struct dsdb_schema *schema,
1007 const struct GUID *our_invocation_id,
1011 const struct dsdb_attribute *a;
1012 struct replPropertyMetaData1 *md1;
1014 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1016 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1018 return LDB_ERR_OPERATIONS_ERROR;
1021 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1025 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1026 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1030 for (i=0; i<omd->ctr.ctr1.count; i++) {
1031 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1034 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1035 /* linked attributes are not stored in
1036 replPropertyMetaData in FL above w2k, but we do
1037 raise the seqnum for the object */
1038 if (*seq_num == 0 &&
1039 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1040 return LDB_ERR_OPERATIONS_ERROR;
1045 if (i == omd->ctr.ctr1.count) {
1046 /* we need to add a new one */
1047 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1048 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1049 if (omd->ctr.ctr1.array == NULL) {
1051 return LDB_ERR_OPERATIONS_ERROR;
1053 omd->ctr.ctr1.count++;
1054 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1057 /* Get a new sequence number from the backend. We only do this
1058 * if we have a change that requires a new
1059 * replPropertyMetaData element
1061 if (*seq_num == 0) {
1062 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1063 if (ret != LDB_SUCCESS) {
1064 return LDB_ERR_OPERATIONS_ERROR;
1068 md1 = &omd->ctr.ctr1.array[i];
1070 md1->attid = a->attributeID_id;
1071 md1->originating_change_time = now;
1072 md1->originating_invocation_id = *our_invocation_id;
1073 md1->originating_usn = *seq_num;
1074 md1->local_usn = *seq_num;
1079 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1081 uint32_t count = omd.ctr.ctr1.count;
1084 for (i=0; i < count; i++) {
1085 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1086 if (max < m.local_usn) {
1094 * update the replPropertyMetaData object each time we modify an
1095 * object. This is needed for DRS replication, as the merge on the
1096 * client is based on this object
1098 static int replmd_update_rpmd(struct ldb_module *module,
1099 const struct dsdb_schema *schema,
1100 struct ldb_request *req,
1101 struct ldb_message *msg, uint64_t *seq_num,
1105 const struct ldb_val *omd_value;
1106 enum ndr_err_code ndr_err;
1107 struct replPropertyMetaDataBlob omd;
1110 const struct GUID *our_invocation_id;
1112 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1113 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1114 struct ldb_result *res;
1115 struct ldb_context *ldb;
1116 struct ldb_message_element *objectclass_el;
1117 enum urgent_situation situation;
1118 bool rodc, rmd_is_provided;
1120 ldb = ldb_module_get_ctx(module);
1122 our_invocation_id = samdb_ntds_invocation_id(ldb);
1123 if (!our_invocation_id) {
1124 /* this happens during an initial vampire while
1125 updating the schema */
1126 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1130 unix_to_nt_time(&now, t);
1132 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1133 rmd_is_provided = true;
1135 rmd_is_provided = false;
1138 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1139 * otherwise we consider we are updating */
1140 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1141 situation = REPL_URGENT_ON_DELETE;
1143 situation = REPL_URGENT_ON_UPDATE;
1146 if (rmd_is_provided) {
1147 /* In this case the change_replmetadata control was supplied */
1148 /* We check that it's the only attribute that is provided
1149 * (it's a rare case so it's better to keep the code simplier)
1150 * We also check that the highest local_usn is bigger than
1153 if( msg->num_elements != 1 ||
1154 strncmp(msg->elements[0].name,
1155 "replPropertyMetaData", 20) ) {
1156 DEBUG(0,(__location__ ": changereplmetada control called without "\
1157 "a specified replPropertyMetaData attribute or with others\n"));
1158 return LDB_ERR_OPERATIONS_ERROR;
1160 if (situation == REPL_URGENT_ON_DELETE) {
1161 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1162 return LDB_ERR_OPERATIONS_ERROR;
1164 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1166 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1167 ldb_dn_get_linearized(msg->dn)));
1168 return LDB_ERR_OPERATIONS_ERROR;
1170 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1171 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1172 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1173 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1174 ldb_dn_get_linearized(msg->dn)));
1175 return LDB_ERR_OPERATIONS_ERROR;
1177 *seq_num = find_max_local_usn(omd);
1179 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1180 DSDB_FLAG_NEXT_MODULE |
1181 DSDB_SEARCH_SHOW_RECYCLED |
1182 DSDB_SEARCH_SHOW_EXTENDED_DN |
1183 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1184 DSDB_SEARCH_REVEAL_INTERNALS);
1186 if (ret != LDB_SUCCESS || res->count != 1) {
1187 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1188 ldb_dn_get_linearized(msg->dn)));
1189 return LDB_ERR_OPERATIONS_ERROR;
1192 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1193 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1198 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1199 if (*seq_num <= db_seq) {
1200 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1201 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1202 (long long)*seq_num, (long long)db_seq));
1203 return LDB_ERR_OPERATIONS_ERROR;
1207 /* search for the existing replPropertyMetaDataBlob. We need
1208 * to use REVEAL and ask for DNs in storage format to support
1209 * the check for values being the same in
1210 * replmd_update_rpmd_element()
1212 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1213 DSDB_FLAG_NEXT_MODULE |
1214 DSDB_SEARCH_SHOW_RECYCLED |
1215 DSDB_SEARCH_SHOW_EXTENDED_DN |
1216 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1217 DSDB_SEARCH_REVEAL_INTERNALS);
1218 if (ret != LDB_SUCCESS || res->count != 1) {
1219 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1220 ldb_dn_get_linearized(msg->dn)));
1221 return LDB_ERR_OPERATIONS_ERROR;
1224 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1225 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1230 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1232 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1233 ldb_dn_get_linearized(msg->dn)));
1234 return LDB_ERR_OPERATIONS_ERROR;
1237 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1238 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1239 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1240 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1241 ldb_dn_get_linearized(msg->dn)));
1242 return LDB_ERR_OPERATIONS_ERROR;
1245 if (omd.version != 1) {
1246 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1247 omd.version, ldb_dn_get_linearized(msg->dn)));
1248 return LDB_ERR_OPERATIONS_ERROR;
1251 for (i=0; i<msg->num_elements; i++) {
1252 struct ldb_message_element *old_el;
1253 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1254 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1255 our_invocation_id, now);
1256 if (ret != LDB_SUCCESS) {
1260 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1261 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1267 * replmd_update_rpmd_element has done an update if the
1270 if (*seq_num != 0) {
1271 struct ldb_val *md_value;
1272 struct ldb_message_element *el;
1274 /*if we are RODC and this is a DRSR update then its ok*/
1275 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1276 ret = samdb_rodc(ldb, &rodc);
1277 if (ret != LDB_SUCCESS) {
1278 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1280 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1281 return LDB_ERR_REFERRAL;
1285 md_value = talloc(msg, struct ldb_val);
1286 if (md_value == NULL) {
1288 return LDB_ERR_OPERATIONS_ERROR;
1291 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1292 if (ret != LDB_SUCCESS) {
1296 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1297 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1298 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1299 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1300 ldb_dn_get_linearized(msg->dn)));
1301 return LDB_ERR_OPERATIONS_ERROR;
1304 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1305 if (ret != LDB_SUCCESS) {
1306 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1307 ldb_dn_get_linearized(msg->dn)));
1312 el->values = md_value;
1319 struct dsdb_dn *dsdb_dn;
1324 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1326 return GUID_compare(pdn1->guid, pdn2->guid);
1329 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1331 struct parsed_dn *ret;
1332 if (dn && GUID_all_zero(guid)) {
1333 /* when updating a link using DRS, we sometimes get a
1334 NULL GUID. We then need to try and match by DN */
1336 for (i=0; i<count; i++) {
1337 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1338 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1344 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1349 get a series of message element values as an array of DNs and GUIDs
1350 the result is sorted by GUID
1352 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1353 struct ldb_message_element *el, struct parsed_dn **pdn,
1354 const char *ldap_oid)
1357 struct ldb_context *ldb = ldb_module_get_ctx(module);
1364 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1366 ldb_module_oom(module);
1367 return LDB_ERR_OPERATIONS_ERROR;
1370 for (i=0; i<el->num_values; i++) {
1371 struct ldb_val *v = &el->values[i];
1374 struct parsed_dn *p;
1378 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1379 if (p->dsdb_dn == NULL) {
1380 return LDB_ERR_INVALID_DN_SYNTAX;
1383 dn = p->dsdb_dn->dn;
1385 p->guid = talloc(*pdn, struct GUID);
1386 if (p->guid == NULL) {
1387 ldb_module_oom(module);
1388 return LDB_ERR_OPERATIONS_ERROR;
1391 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1392 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1393 /* we got a DN without a GUID - go find the GUID */
1394 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1395 if (ret != LDB_SUCCESS) {
1396 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1397 ldb_dn_get_linearized(dn));
1400 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1401 if (ret != LDB_SUCCESS) {
1404 } else if (!NT_STATUS_IS_OK(status)) {
1405 return LDB_ERR_OPERATIONS_ERROR;
1408 /* keep a pointer to the original ldb_val */
1412 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1418 build a new extended DN, including all meta data fields
1420 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1421 RMD_ADDTIME = originating_add_time
1422 RMD_INVOCID = originating_invocation_id
1423 RMD_CHANGETIME = originating_change_time
1424 RMD_ORIGINATING_USN = originating_usn
1425 RMD_LOCAL_USN = local_usn
1426 RMD_VERSION = version
1428 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1429 const struct GUID *invocation_id, uint64_t seq_num,
1430 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1432 struct ldb_dn *dn = dsdb_dn->dn;
1433 const char *tstring, *usn_string, *flags_string;
1434 struct ldb_val tval;
1436 struct ldb_val usnv, local_usnv;
1437 struct ldb_val vers, flagsv;
1440 const char *dnstring;
1442 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1444 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1446 return LDB_ERR_OPERATIONS_ERROR;
1448 tval = data_blob_string_const(tstring);
1450 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1452 return LDB_ERR_OPERATIONS_ERROR;
1454 usnv = data_blob_string_const(usn_string);
1456 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1458 return LDB_ERR_OPERATIONS_ERROR;
1460 local_usnv = data_blob_string_const(usn_string);
1462 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1464 return LDB_ERR_OPERATIONS_ERROR;
1466 vers = data_blob_string_const(vstring);
1468 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1469 if (!NT_STATUS_IS_OK(status)) {
1470 return LDB_ERR_OPERATIONS_ERROR;
1473 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1474 if (!flags_string) {
1475 return LDB_ERR_OPERATIONS_ERROR;
1477 flagsv = data_blob_string_const(flags_string);
1479 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1480 if (ret != LDB_SUCCESS) return ret;
1481 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1482 if (ret != LDB_SUCCESS) return ret;
1483 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1484 if (ret != LDB_SUCCESS) return ret;
1485 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1486 if (ret != LDB_SUCCESS) return ret;
1487 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1488 if (ret != LDB_SUCCESS) return ret;
1489 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1490 if (ret != LDB_SUCCESS) return ret;
1491 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1492 if (ret != LDB_SUCCESS) return ret;
1494 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1495 if (dnstring == NULL) {
1496 return LDB_ERR_OPERATIONS_ERROR;
1498 *v = data_blob_string_const(dnstring);
1503 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1504 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1505 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1506 uint32_t version, bool deleted);
1509 check if any links need upgrading from w2k format
1511 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1513 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1516 for (i=0; i<count; i++) {
1521 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1522 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1526 /* it's an old one that needs upgrading */
1527 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1529 if (ret != LDB_SUCCESS) {
1537 update an extended DN, including all meta data fields
1539 see replmd_build_la_val for value names
1541 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1542 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1543 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1544 uint32_t version, bool deleted)
1546 struct ldb_dn *dn = dsdb_dn->dn;
1547 const char *tstring, *usn_string, *flags_string;
1548 struct ldb_val tval;
1550 struct ldb_val usnv, local_usnv;
1551 struct ldb_val vers, flagsv;
1552 const struct ldb_val *old_addtime;
1553 uint32_t old_version;
1556 const char *dnstring;
1558 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1560 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1562 return LDB_ERR_OPERATIONS_ERROR;
1564 tval = data_blob_string_const(tstring);
1566 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1568 return LDB_ERR_OPERATIONS_ERROR;
1570 usnv = data_blob_string_const(usn_string);
1572 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1574 return LDB_ERR_OPERATIONS_ERROR;
1576 local_usnv = data_blob_string_const(usn_string);
1578 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1579 if (!NT_STATUS_IS_OK(status)) {
1580 return LDB_ERR_OPERATIONS_ERROR;
1583 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1584 if (!flags_string) {
1585 return LDB_ERR_OPERATIONS_ERROR;
1587 flagsv = data_blob_string_const(flags_string);
1589 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1590 if (ret != LDB_SUCCESS) return ret;
1592 /* get the ADDTIME from the original */
1593 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1594 if (old_addtime == NULL) {
1595 old_addtime = &tval;
1597 if (dsdb_dn != old_dsdb_dn) {
1598 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1599 if (ret != LDB_SUCCESS) return ret;
1602 /* use our invocation id */
1603 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1604 if (ret != LDB_SUCCESS) return ret;
1606 /* changetime is the current time */
1607 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1608 if (ret != LDB_SUCCESS) return ret;
1610 /* update the USN */
1611 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1612 if (ret != LDB_SUCCESS) return ret;
1614 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1615 if (ret != LDB_SUCCESS) return ret;
1617 /* increase the version by 1 */
1618 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1619 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1620 version = old_version+1;
1622 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1623 vers = data_blob_string_const(vstring);
1624 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1625 if (ret != LDB_SUCCESS) return ret;
1627 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1628 if (dnstring == NULL) {
1629 return LDB_ERR_OPERATIONS_ERROR;
1631 *v = data_blob_string_const(dnstring);
1637 handle adding a linked attribute
1639 static int replmd_modify_la_add(struct ldb_module *module,
1640 const struct dsdb_schema *schema,
1641 struct ldb_message *msg,
1642 struct ldb_message_element *el,
1643 struct ldb_message_element *old_el,
1644 const struct dsdb_attribute *schema_attr,
1647 struct GUID *msg_guid)
1650 struct parsed_dn *dns, *old_dns;
1651 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1653 struct ldb_val *new_values = NULL;
1654 unsigned int num_new_values = 0;
1655 unsigned old_num_values = old_el?old_el->num_values:0;
1656 const struct GUID *invocation_id;
1657 struct ldb_context *ldb = ldb_module_get_ctx(module);
1660 unix_to_nt_time(&now, t);
1662 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1663 if (ret != LDB_SUCCESS) {
1664 talloc_free(tmp_ctx);
1668 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1669 if (ret != LDB_SUCCESS) {
1670 talloc_free(tmp_ctx);
1674 invocation_id = samdb_ntds_invocation_id(ldb);
1675 if (!invocation_id) {
1676 talloc_free(tmp_ctx);
1677 return LDB_ERR_OPERATIONS_ERROR;
1680 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1681 if (ret != LDB_SUCCESS) {
1682 talloc_free(tmp_ctx);
1686 /* for each new value, see if it exists already with the same GUID */
1687 for (i=0; i<el->num_values; i++) {
1688 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1690 /* this is a new linked attribute value */
1691 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1692 if (new_values == NULL) {
1693 ldb_module_oom(module);
1694 talloc_free(tmp_ctx);
1695 return LDB_ERR_OPERATIONS_ERROR;
1697 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1698 invocation_id, seq_num, seq_num, now, 0, false);
1699 if (ret != LDB_SUCCESS) {
1700 talloc_free(tmp_ctx);
1705 /* this is only allowed if the GUID was
1706 previously deleted. */
1707 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1709 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1710 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1711 el->name, GUID_string(tmp_ctx, p->guid));
1712 talloc_free(tmp_ctx);
1713 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1715 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1716 invocation_id, seq_num, seq_num, now, 0, false);
1717 if (ret != LDB_SUCCESS) {
1718 talloc_free(tmp_ctx);
1723 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1724 if (ret != LDB_SUCCESS) {
1725 talloc_free(tmp_ctx);
1730 /* add the new ones on to the end of the old values, constructing a new el->values */
1731 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1733 old_num_values+num_new_values);
1734 if (el->values == NULL) {
1735 ldb_module_oom(module);
1736 return LDB_ERR_OPERATIONS_ERROR;
1739 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1740 el->num_values = old_num_values + num_new_values;
1742 talloc_steal(msg->elements, el->values);
1743 talloc_steal(el->values, new_values);
1745 talloc_free(tmp_ctx);
1747 /* we now tell the backend to replace all existing values
1748 with the one we have constructed */
1749 el->flags = LDB_FLAG_MOD_REPLACE;
1756 handle deleting all active linked attributes
1758 static int replmd_modify_la_delete(struct ldb_module *module,
1759 const struct dsdb_schema *schema,
1760 struct ldb_message *msg,
1761 struct ldb_message_element *el,
1762 struct ldb_message_element *old_el,
1763 const struct dsdb_attribute *schema_attr,
1766 struct GUID *msg_guid)
1769 struct parsed_dn *dns, *old_dns;
1770 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1772 const struct GUID *invocation_id;
1773 struct ldb_context *ldb = ldb_module_get_ctx(module);
1776 unix_to_nt_time(&now, t);
1778 /* check if there is nothing to delete */
1779 if ((!old_el || old_el->num_values == 0) &&
1780 el->num_values == 0) {
1784 if (!old_el || old_el->num_values == 0) {
1785 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1788 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1789 if (ret != LDB_SUCCESS) {
1790 talloc_free(tmp_ctx);
1794 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1795 if (ret != LDB_SUCCESS) {
1796 talloc_free(tmp_ctx);
1800 invocation_id = samdb_ntds_invocation_id(ldb);
1801 if (!invocation_id) {
1802 return LDB_ERR_OPERATIONS_ERROR;
1805 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1806 if (ret != LDB_SUCCESS) {
1807 talloc_free(tmp_ctx);
1813 /* see if we are being asked to delete any links that
1814 don't exist or are already deleted */
1815 for (i=0; i<el->num_values; i++) {
1816 struct parsed_dn *p = &dns[i];
1817 struct parsed_dn *p2;
1820 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1822 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1823 el->name, GUID_string(tmp_ctx, p->guid));
1824 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1826 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1827 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1828 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1829 el->name, GUID_string(tmp_ctx, p->guid));
1830 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1834 /* for each new value, see if it exists already with the same GUID
1835 if it is not already deleted and matches the delete list then delete it
1837 for (i=0; i<old_el->num_values; i++) {
1838 struct parsed_dn *p = &old_dns[i];
1841 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1845 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1846 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1848 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1849 invocation_id, seq_num, seq_num, now, 0, true);
1850 if (ret != LDB_SUCCESS) {
1851 talloc_free(tmp_ctx);
1855 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1856 if (ret != LDB_SUCCESS) {
1857 talloc_free(tmp_ctx);
1862 el->values = talloc_steal(msg->elements, old_el->values);
1863 el->num_values = old_el->num_values;
1865 talloc_free(tmp_ctx);
1867 /* we now tell the backend to replace all existing values
1868 with the one we have constructed */
1869 el->flags = LDB_FLAG_MOD_REPLACE;
1875 handle replacing a linked attribute
1877 static int replmd_modify_la_replace(struct ldb_module *module,
1878 const struct dsdb_schema *schema,
1879 struct ldb_message *msg,
1880 struct ldb_message_element *el,
1881 struct ldb_message_element *old_el,
1882 const struct dsdb_attribute *schema_attr,
1885 struct GUID *msg_guid)
1888 struct parsed_dn *dns, *old_dns;
1889 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1891 const struct GUID *invocation_id;
1892 struct ldb_context *ldb = ldb_module_get_ctx(module);
1893 struct ldb_val *new_values = NULL;
1894 unsigned int num_new_values = 0;
1895 unsigned int old_num_values = old_el?old_el->num_values:0;
1898 unix_to_nt_time(&now, t);
1900 /* check if there is nothing to replace */
1901 if ((!old_el || old_el->num_values == 0) &&
1902 el->num_values == 0) {
1906 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1907 if (ret != LDB_SUCCESS) {
1908 talloc_free(tmp_ctx);
1912 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1913 if (ret != LDB_SUCCESS) {
1914 talloc_free(tmp_ctx);
1918 invocation_id = samdb_ntds_invocation_id(ldb);
1919 if (!invocation_id) {
1920 return LDB_ERR_OPERATIONS_ERROR;
1923 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1924 if (ret != LDB_SUCCESS) {
1925 talloc_free(tmp_ctx);
1929 /* mark all the old ones as deleted */
1930 for (i=0; i<old_num_values; i++) {
1931 struct parsed_dn *old_p = &old_dns[i];
1932 struct parsed_dn *p;
1933 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1935 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1937 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1938 if (ret != LDB_SUCCESS) {
1939 talloc_free(tmp_ctx);
1943 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1945 /* we don't delete it if we are re-adding it */
1949 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1950 invocation_id, seq_num, seq_num, now, 0, true);
1951 if (ret != LDB_SUCCESS) {
1952 talloc_free(tmp_ctx);
1957 /* for each new value, either update its meta-data, or add it
1960 for (i=0; i<el->num_values; i++) {
1961 struct parsed_dn *p = &dns[i], *old_p;
1964 (old_p = parsed_dn_find(old_dns,
1965 old_num_values, p->guid, NULL)) != NULL) {
1966 /* update in place */
1967 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1968 old_p->dsdb_dn, invocation_id,
1969 seq_num, seq_num, now, 0, false);
1970 if (ret != LDB_SUCCESS) {
1971 talloc_free(tmp_ctx);
1976 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1978 if (new_values == NULL) {
1979 ldb_module_oom(module);
1980 talloc_free(tmp_ctx);
1981 return LDB_ERR_OPERATIONS_ERROR;
1983 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1984 invocation_id, seq_num, seq_num, now, 0, false);
1985 if (ret != LDB_SUCCESS) {
1986 talloc_free(tmp_ctx);
1992 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1993 if (ret != LDB_SUCCESS) {
1994 talloc_free(tmp_ctx);
1999 /* add the new values to the end of old_el */
2000 if (num_new_values != 0) {
2001 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2002 struct ldb_val, old_num_values+num_new_values);
2003 if (el->values == NULL) {
2004 ldb_module_oom(module);
2005 return LDB_ERR_OPERATIONS_ERROR;
2007 memcpy(&el->values[old_num_values], &new_values[0],
2008 sizeof(struct ldb_val)*num_new_values);
2009 el->num_values = old_num_values + num_new_values;
2010 talloc_steal(msg->elements, new_values);
2012 el->values = old_el->values;
2013 el->num_values = old_el->num_values;
2014 talloc_steal(msg->elements, el->values);
2017 talloc_free(tmp_ctx);
2019 /* we now tell the backend to replace all existing values
2020 with the one we have constructed */
2021 el->flags = LDB_FLAG_MOD_REPLACE;
2028 handle linked attributes in modify requests
2030 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2031 struct ldb_message *msg,
2032 uint64_t seq_num, time_t t)
2034 struct ldb_result *res;
2037 struct ldb_context *ldb = ldb_module_get_ctx(module);
2038 struct ldb_message *old_msg;
2040 const struct dsdb_schema *schema;
2041 struct GUID old_guid;
2044 /* there the replmd_update_rpmd code has already
2045 * checked and saw that there are no linked
2050 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2051 /* don't do anything special for linked attributes */
2055 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2056 DSDB_FLAG_NEXT_MODULE |
2057 DSDB_SEARCH_SHOW_RECYCLED |
2058 DSDB_SEARCH_REVEAL_INTERNALS |
2059 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2060 if (ret != LDB_SUCCESS) {
2063 schema = dsdb_get_schema(ldb, res);
2065 return LDB_ERR_OPERATIONS_ERROR;
2068 old_msg = res->msgs[0];
2070 old_guid = samdb_result_guid(old_msg, "objectGUID");
2072 for (i=0; i<msg->num_elements; i++) {
2073 struct ldb_message_element *el = &msg->elements[i];
2074 struct ldb_message_element *old_el, *new_el;
2075 const struct dsdb_attribute *schema_attr
2076 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2078 ldb_asprintf_errstring(ldb,
2079 "attribute %s is not a valid attribute in schema", el->name);
2080 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2082 if (schema_attr->linkID == 0) {
2085 if ((schema_attr->linkID & 1) == 1) {
2086 /* Odd is for the target. Illegal to modify */
2087 ldb_asprintf_errstring(ldb,
2088 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2089 return LDB_ERR_UNWILLING_TO_PERFORM;
2091 old_el = ldb_msg_find_element(old_msg, el->name);
2092 switch (el->flags & LDB_FLAG_MOD_MASK) {
2093 case LDB_FLAG_MOD_REPLACE:
2094 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2096 case LDB_FLAG_MOD_DELETE:
2097 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2099 case LDB_FLAG_MOD_ADD:
2100 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2103 ldb_asprintf_errstring(ldb,
2104 "invalid flags 0x%x for %s linked attribute",
2105 el->flags, el->name);
2106 return LDB_ERR_UNWILLING_TO_PERFORM;
2108 if (ret != LDB_SUCCESS) {
2112 ldb_msg_remove_attr(old_msg, el->name);
2114 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2115 new_el->num_values = el->num_values;
2116 new_el->values = talloc_steal(msg->elements, el->values);
2118 /* TODO: this relises a bit too heavily on the exact
2119 behaviour of ldb_msg_find_element and
2120 ldb_msg_remove_element */
2121 old_el = ldb_msg_find_element(msg, el->name);
2123 ldb_msg_remove_element(msg, old_el);
2134 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2136 struct ldb_context *ldb;
2137 struct replmd_replicated_request *ac;
2138 struct ldb_request *down_req;
2139 struct ldb_message *msg;
2140 time_t t = time(NULL);
2142 bool is_urgent = false;
2143 struct loadparm_context *lp_ctx;
2145 unsigned int functional_level;
2147 /* do not manipulate our control entries */
2148 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2149 return ldb_next_request(module, req);
2152 ldb = ldb_module_get_ctx(module);
2153 functional_level = dsdb_functional_level(ldb);
2155 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2156 struct loadparm_context);
2158 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2160 ac = replmd_ctx_init(module, req);
2162 return LDB_ERR_OPERATIONS_ERROR;
2165 /* we have to copy the message as the caller might have it as a const */
2166 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2170 return LDB_ERR_OPERATIONS_ERROR;
2173 ldb_msg_remove_attr(msg, "whenChanged");
2174 ldb_msg_remove_attr(msg, "uSNChanged");
2176 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2177 if (ret == LDB_ERR_REFERRAL) {
2178 referral = talloc_asprintf(req,
2180 lpcfg_dnsdomain(lp_ctx),
2181 ldb_dn_get_linearized(msg->dn));
2182 ret = ldb_module_send_referral(req, referral);
2184 return ldb_module_done(req, NULL, NULL, ret);
2187 if (ret != LDB_SUCCESS) {
2192 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2193 if (ret != LDB_SUCCESS) {
2199 * - replace the old object with the newly constructed one
2202 ac->is_urgent = is_urgent;
2204 ret = ldb_build_mod_req(&down_req, ldb, ac,
2207 ac, replmd_op_callback,
2209 LDB_REQ_SET_LOCATION(down_req);
2210 if (ret != LDB_SUCCESS) {
2215 /* If we are in functional level 2000, then
2216 * replmd_modify_handle_linked_attribs will have done
2218 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2219 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2220 if (ret != LDB_SUCCESS) {
2226 talloc_steal(down_req, msg);
2228 /* we only change whenChanged and uSNChanged if the seq_num
2230 if (ac->seq_num != 0) {
2231 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2236 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2242 /* go on with the call chain */
2243 return ldb_next_request(module, down_req);
2246 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2249 handle a rename request
2251 On a rename we need to do an extra ldb_modify which sets the
2252 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2254 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2256 struct ldb_context *ldb;
2257 struct replmd_replicated_request *ac;
2259 struct ldb_request *down_req;
2261 /* do not manipulate our control entries */
2262 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2263 return ldb_next_request(module, req);
2266 ldb = ldb_module_get_ctx(module);
2268 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2270 ac = replmd_ctx_init(module, req);
2272 return LDB_ERR_OPERATIONS_ERROR;
2274 ret = ldb_build_rename_req(&down_req, ldb, ac,
2275 ac->req->op.rename.olddn,
2276 ac->req->op.rename.newdn,
2278 ac, replmd_rename_callback,
2280 LDB_REQ_SET_LOCATION(down_req);
2281 if (ret != LDB_SUCCESS) {
2286 /* go on with the call chain */
2287 return ldb_next_request(module, down_req);
2290 /* After the rename is compleated, update the whenchanged etc */
2291 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2293 struct ldb_context *ldb;
2294 struct replmd_replicated_request *ac;
2295 struct ldb_request *down_req;
2296 struct ldb_message *msg;
2297 time_t t = time(NULL);
2300 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2301 ldb = ldb_module_get_ctx(ac->module);
2303 if (ares->error != LDB_SUCCESS) {
2304 return ldb_module_done(ac->req, ares->controls,
2305 ares->response, ares->error);
2308 if (ares->type != LDB_REPLY_DONE) {
2309 ldb_set_errstring(ldb,
2310 "invalid ldb_reply_type in callback");
2312 return ldb_module_done(ac->req, NULL, NULL,
2313 LDB_ERR_OPERATIONS_ERROR);
2316 /* Get a sequence number from the backend */
2317 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2318 if (ret != LDB_SUCCESS) {
2323 * - replace the old object with the newly constructed one
2326 msg = ldb_msg_new(ac);
2329 return LDB_ERR_OPERATIONS_ERROR;
2332 msg->dn = ac->req->op.rename.newdn;
2334 ret = ldb_build_mod_req(&down_req, ldb, ac,
2337 ac, replmd_op_callback,
2339 LDB_REQ_SET_LOCATION(down_req);
2340 if (ret != LDB_SUCCESS) {
2344 talloc_steal(down_req, msg);
2346 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2351 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2356 /* go on with the call chain - do the modify after the rename */
2357 return ldb_next_request(ac->module, down_req);
2361 remove links from objects that point at this object when an object
2364 static int replmd_delete_remove_link(struct ldb_module *module,
2365 const struct dsdb_schema *schema,
2367 struct ldb_message_element *el,
2368 const struct dsdb_attribute *sa)
2371 TALLOC_CTX *tmp_ctx = talloc_new(module);
2372 struct ldb_context *ldb = ldb_module_get_ctx(module);
2374 for (i=0; i<el->num_values; i++) {
2375 struct dsdb_dn *dsdb_dn;
2379 struct ldb_message *msg;
2380 const struct dsdb_attribute *target_attr;
2381 struct ldb_message_element *el2;
2382 struct ldb_val dn_val;
2384 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2388 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2390 talloc_free(tmp_ctx);
2391 return LDB_ERR_OPERATIONS_ERROR;
2394 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2395 if (!NT_STATUS_IS_OK(status)) {
2396 talloc_free(tmp_ctx);
2397 return LDB_ERR_OPERATIONS_ERROR;
2400 /* remove the link */
2401 msg = ldb_msg_new(tmp_ctx);
2403 ldb_module_oom(module);
2404 talloc_free(tmp_ctx);
2405 return LDB_ERR_OPERATIONS_ERROR;
2409 msg->dn = dsdb_dn->dn;
2411 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2412 if (target_attr == NULL) {
2416 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2417 if (ret != LDB_SUCCESS) {
2418 ldb_module_oom(module);
2419 talloc_free(tmp_ctx);
2420 return LDB_ERR_OPERATIONS_ERROR;
2422 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2423 el2->values = &dn_val;
2424 el2->num_values = 1;
2426 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2427 if (ret != LDB_SUCCESS) {
2428 talloc_free(tmp_ctx);
2432 talloc_free(tmp_ctx);
2438 handle update of replication meta data for deletion of objects
2440 This also handles the mapping of delete to a rename operation
2441 to allow deletes to be replicated.
2443 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2445 int ret = LDB_ERR_OTHER;
2446 bool retb, disallow_move_on_delete;
2447 struct ldb_dn *old_dn, *new_dn;
2448 const char *rdn_name;
2449 const struct ldb_val *rdn_value, *new_rdn_value;
2451 struct ldb_context *ldb = ldb_module_get_ctx(module);
2452 const struct dsdb_schema *schema;
2453 struct ldb_message *msg, *old_msg;
2454 struct ldb_message_element *el;
2455 TALLOC_CTX *tmp_ctx;
2456 struct ldb_result *res, *parent_res;
2457 const char *preserved_attrs[] = {
2458 /* yes, this really is a hard coded list. See MS-ADTS
2459 section 3.1.1.5.5.1.1 */
2460 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2461 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2462 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2463 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2464 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2465 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2466 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2467 "whenChanged", NULL};
2468 unsigned int i, el_count = 0;
2469 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2470 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2471 enum deletion_state deletion_state, next_deletion_state;
2474 if (ldb_dn_is_special(req->op.del.dn)) {
2475 return ldb_next_request(module, req);
2478 tmp_ctx = talloc_new(ldb);
2481 return LDB_ERR_OPERATIONS_ERROR;
2484 schema = dsdb_get_schema(ldb, tmp_ctx);
2486 return LDB_ERR_OPERATIONS_ERROR;
2489 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2491 /* we need the complete msg off disk, so we can work out which
2492 attributes need to be removed */
2493 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2494 DSDB_FLAG_NEXT_MODULE |
2495 DSDB_SEARCH_SHOW_RECYCLED |
2496 DSDB_SEARCH_REVEAL_INTERNALS |
2497 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2498 if (ret != LDB_SUCCESS) {
2499 talloc_free(tmp_ctx);
2502 old_msg = res->msgs[0];
2505 ret = dsdb_recyclebin_enabled(module, &enabled);
2506 if (ret != LDB_SUCCESS) {
2507 talloc_free(tmp_ctx);
2511 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2513 deletion_state = OBJECT_TOMBSTONE;
2514 next_deletion_state = OBJECT_REMOVED;
2515 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2516 deletion_state = OBJECT_RECYCLED;
2517 next_deletion_state = OBJECT_REMOVED;
2519 deletion_state = OBJECT_DELETED;
2520 next_deletion_state = OBJECT_RECYCLED;
2523 deletion_state = OBJECT_NOT_DELETED;
2525 next_deletion_state = OBJECT_DELETED;
2527 next_deletion_state = OBJECT_TOMBSTONE;
2531 if (next_deletion_state == OBJECT_REMOVED) {
2532 struct auth_session_info *session_info =
2533 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2534 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2535 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2536 ldb_dn_get_linearized(old_msg->dn));
2537 return LDB_ERR_UNWILLING_TO_PERFORM;
2540 /* it is already deleted - really remove it this time */
2541 talloc_free(tmp_ctx);
2542 return ldb_next_request(module, req);
2545 rdn_name = ldb_dn_get_rdn_name(old_dn);
2546 rdn_value = ldb_dn_get_rdn_val(old_dn);
2548 msg = ldb_msg_new(tmp_ctx);
2550 ldb_module_oom(module);
2551 talloc_free(tmp_ctx);
2552 return LDB_ERR_OPERATIONS_ERROR;
2557 if (deletion_state == OBJECT_NOT_DELETED){
2558 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2559 disallow_move_on_delete =
2560 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2561 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2563 /* work out where we will be renaming this object to */
2564 if (!disallow_move_on_delete) {
2565 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2567 if (ret != LDB_SUCCESS) {
2568 /* this is probably an attempted delete on a partition
2569 * that doesn't allow delete operations, such as the
2570 * schema partition */
2571 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2572 ldb_dn_get_linearized(old_dn));
2573 talloc_free(tmp_ctx);
2574 return LDB_ERR_UNWILLING_TO_PERFORM;
2577 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2578 if (new_dn == NULL) {
2579 ldb_module_oom(module);
2580 talloc_free(tmp_ctx);
2581 return LDB_ERR_OPERATIONS_ERROR;
2585 /* get the objects GUID from the search we just did */
2586 guid = samdb_result_guid(old_msg, "objectGUID");
2588 /* Add a formatted child */
2589 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2592 GUID_string(tmp_ctx, &guid));
2594 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2595 ldb_dn_get_linearized(new_dn)));
2596 talloc_free(tmp_ctx);
2597 return LDB_ERR_OPERATIONS_ERROR;
2600 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2601 if (ret != LDB_SUCCESS) {
2602 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2603 ldb_module_oom(module);
2604 talloc_free(tmp_ctx);
2607 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2611 now we need to modify the object in the following ways:
2613 - add isDeleted=TRUE
2614 - update rDN and name, with new rDN
2615 - remove linked attributes
2616 - remove objectCategory and sAMAccountType
2617 - remove attribs not on the preserved list
2618 - preserved if in above list, or is rDN
2619 - remove all linked attribs from this object
2620 - remove all links from other objects to this object
2621 - add lastKnownParent
2622 - update replPropertyMetaData?
2624 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2627 /* we need the storage form of the parent GUID */
2628 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2629 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2630 DSDB_FLAG_NEXT_MODULE |
2631 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2632 DSDB_SEARCH_REVEAL_INTERNALS|
2633 DSDB_SEARCH_SHOW_RECYCLED);
2634 if (ret != LDB_SUCCESS) {
2635 talloc_free(tmp_ctx);
2639 if (deletion_state == OBJECT_NOT_DELETED){
2640 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2641 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2642 if (ret != LDB_SUCCESS) {
2643 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2644 ldb_module_oom(module);
2645 talloc_free(tmp_ctx);
2648 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2651 switch (next_deletion_state){
2653 case OBJECT_DELETED:
2655 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2656 if (ret != LDB_SUCCESS) {
2657 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2658 ldb_module_oom(module);
2659 talloc_free(tmp_ctx);
2662 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2664 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2665 if (ret != LDB_SUCCESS) {
2666 talloc_free(tmp_ctx);
2667 ldb_module_oom(module);
2671 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2672 if (ret != LDB_SUCCESS) {
2673 talloc_free(tmp_ctx);
2674 ldb_module_oom(module);
2680 case OBJECT_RECYCLED:
2681 case OBJECT_TOMBSTONE:
2683 /* we also mark it as recycled, meaning this object can't be
2684 recovered (we are stripping its attributes) */
2685 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2686 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2687 if (ret != LDB_SUCCESS) {
2688 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2689 ldb_module_oom(module);
2690 talloc_free(tmp_ctx);
2693 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2696 /* work out which of the old attributes we will be removing */
2697 for (i=0; i<old_msg->num_elements; i++) {
2698 const struct dsdb_attribute *sa;
2699 el = &old_msg->elements[i];
2700 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2702 talloc_free(tmp_ctx);
2703 return LDB_ERR_OPERATIONS_ERROR;
2705 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2706 /* don't remove the rDN */
2709 if (sa->linkID && sa->linkID & 1) {
2710 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2711 if (ret != LDB_SUCCESS) {
2712 talloc_free(tmp_ctx);
2713 return LDB_ERR_OPERATIONS_ERROR;
2717 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2720 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2721 if (ret != LDB_SUCCESS) {
2722 talloc_free(tmp_ctx);
2723 ldb_module_oom(module);
2733 if (deletion_state == OBJECT_NOT_DELETED) {
2734 const struct dsdb_attribute *sa;
2736 /* work out what the new rdn value is, for updating the
2737 rDN and name fields */
2738 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2740 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2742 talloc_free(tmp_ctx);
2743 return LDB_ERR_OPERATIONS_ERROR;
2746 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2748 if (ret != LDB_SUCCESS) {
2749 talloc_free(tmp_ctx);
2752 el->flags = LDB_FLAG_MOD_REPLACE;
2754 el = ldb_msg_find_element(old_msg, "name");
2756 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2757 if (ret != LDB_SUCCESS) {
2758 talloc_free(tmp_ctx);
2761 el->flags = LDB_FLAG_MOD_REPLACE;
2765 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2766 if (ret != LDB_SUCCESS) {
2767 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2768 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2769 talloc_free(tmp_ctx);
2773 if (deletion_state == OBJECT_NOT_DELETED) {
2774 /* now rename onto the new DN */
2775 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2776 if (ret != LDB_SUCCESS){
2777 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2778 ldb_dn_get_linearized(old_dn),
2779 ldb_dn_get_linearized(new_dn),
2780 ldb_errstring(ldb)));
2781 talloc_free(tmp_ctx);
2786 talloc_free(tmp_ctx);
2788 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2793 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2798 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2800 int ret = LDB_ERR_OTHER;
2801 /* TODO: do some error mapping */
2805 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2807 struct ldb_context *ldb;
2808 struct ldb_request *change_req;
2809 enum ndr_err_code ndr_err;
2810 struct ldb_message *msg;
2811 struct replPropertyMetaDataBlob *md;
2812 struct ldb_val md_value;
2817 * TODO: check if the parent object exist
2821 * TODO: handle the conflict case where an object with the
2825 ldb = ldb_module_get_ctx(ar->module);
2826 msg = ar->objs->objects[ar->index_current].msg;
2827 md = ar->objs->objects[ar->index_current].meta_data;
2829 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2830 if (ret != LDB_SUCCESS) {
2831 return replmd_replicated_request_error(ar, ret);
2834 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2835 if (ret != LDB_SUCCESS) {
2836 return replmd_replicated_request_error(ar, ret);
2839 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2840 if (ret != LDB_SUCCESS) {
2841 return replmd_replicated_request_error(ar, ret);
2844 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2845 if (ret != LDB_SUCCESS) {
2846 return replmd_replicated_request_error(ar, ret);
2849 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2850 if (ret != LDB_SUCCESS) {
2851 return replmd_replicated_request_error(ar, ret);
2854 /* remove any message elements that have zero values */
2855 for (i=0; i<msg->num_elements; i++) {
2856 struct ldb_message_element *el = &msg->elements[i];
2858 if (el->num_values == 0) {
2859 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2861 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2862 msg->num_elements--;
2869 * the meta data array is already sorted by the caller
2871 for (i=0; i < md->ctr.ctr1.count; i++) {
2872 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2874 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2875 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2876 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2877 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2878 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2880 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2881 if (ret != LDB_SUCCESS) {
2882 return replmd_replicated_request_error(ar, ret);
2885 replmd_ldb_message_sort(msg, ar->schema);
2888 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2889 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2893 ret = ldb_build_add_req(&change_req,
2901 LDB_REQ_SET_LOCATION(change_req);
2902 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2904 return ldb_next_request(ar->module, change_req);
2908 return true if an update is newer than an existing entry
2909 see section 5.11 of MS-ADTS
2911 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2912 const struct GUID *update_invocation_id,
2913 uint32_t current_version,
2914 uint32_t update_version,
2915 uint32_t current_usn,
2916 uint32_t update_usn,
2917 NTTIME current_change_time,
2918 NTTIME update_change_time)
2920 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2921 if (update_usn != current_usn) {
2922 return update_usn >= current_usn;
2925 if (update_version != current_version) {
2926 return update_version >= current_version;
2928 if (update_change_time != current_change_time) {
2929 return update_change_time >= current_change_time;
2931 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2934 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2935 struct replPropertyMetaData1 *new_m)
2937 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2938 &new_m->originating_invocation_id,
2941 cur_m->originating_usn,
2942 new_m->originating_usn,
2943 cur_m->originating_change_time,
2944 new_m->originating_change_time);
2947 static struct replPropertyMetaData1 *
2948 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2949 enum drsuapi_DsAttributeId attid)
2952 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2954 for (i = 0; i < rpmd_ctr->count; i++) {
2955 if (rpmd_ctr->array[i].attid == attid) {
2956 return &rpmd_ctr->array[i];
2964 handle renames that come in over DRS replication
2966 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
2967 struct ldb_message *msg,
2968 struct replPropertyMetaDataBlob *rmd,
2969 struct replPropertyMetaDataBlob *omd)
2971 struct replPropertyMetaData1 *md_remote;
2972 struct replPropertyMetaData1 *md_local;
2974 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
2979 /* now we need to check for double renames. We could have a
2980 * local rename pending which our replication partner hasn't
2981 * received yet. We choose which one wins by looking at the
2982 * attribute stamps on the two objects, the newer one wins
2984 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTRIBUTE_name);
2985 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTRIBUTE_name);
2986 /* if there is no name attribute then we have to assume the
2987 object we've received is in fact newer */
2988 if (!md_remote || !md_local ||
2989 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
2990 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
2991 ldb_dn_get_linearized(ar->search_msg->dn),
2992 ldb_dn_get_linearized(msg->dn)));
2993 /* pass rename to the next module
2994 * so it doesn't appear as an originating update */
2995 return dsdb_module_rename(ar->module,
2996 ar->search_msg->dn, msg->dn,
2997 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
3000 /* we're going to keep our old object */
3001 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3002 ldb_dn_get_linearized(ar->search_msg->dn),
3003 ldb_dn_get_linearized(msg->dn)));
3008 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3010 struct ldb_context *ldb;
3011 struct ldb_request *change_req;
3012 enum ndr_err_code ndr_err;
3013 struct ldb_message *msg;
3014 struct replPropertyMetaDataBlob *rmd;
3015 struct replPropertyMetaDataBlob omd;
3016 const struct ldb_val *omd_value;
3017 struct replPropertyMetaDataBlob nmd;
3018 struct ldb_val nmd_value;
3021 unsigned int removed_attrs = 0;
3024 ldb = ldb_module_get_ctx(ar->module);
3025 msg = ar->objs->objects[ar->index_current].msg;
3026 rmd = ar->objs->objects[ar->index_current].meta_data;
3030 /* find existing meta data */
3031 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3033 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3034 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3035 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3036 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3037 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3040 if (omd.version != 1) {
3041 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3045 /* handle renames that come in over DRS */
3046 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd);
3047 if (ret != LDB_SUCCESS) {
3048 ldb_debug(ldb, LDB_DEBUG_FATAL,
3049 "replmd_replicated_request rename %s => %s failed - %s\n",
3050 ldb_dn_get_linearized(ar->search_msg->dn),
3051 ldb_dn_get_linearized(msg->dn),
3052 ldb_errstring(ldb));
3053 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3058 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3059 nmd.ctr.ctr1.array = talloc_array(ar,
3060 struct replPropertyMetaData1,
3061 nmd.ctr.ctr1.count);
3062 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3064 /* first copy the old meta data */
3065 for (i=0; i < omd.ctr.ctr1.count; i++) {
3066 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3070 /* now merge in the new meta data */
3071 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3074 for (j=0; j < ni; j++) {
3077 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3081 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3082 &rmd->ctr.ctr1.array[i]);
3084 /* replace the entry */
3085 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3090 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) {
3091 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3092 msg->elements[i-removed_attrs].name,
3093 ldb_dn_get_linearized(msg->dn),
3094 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3097 /* we don't want to apply this change so remove the attribute */
3098 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3105 if (found) continue;
3107 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3112 * finally correct the size of the meta_data array
3114 nmd.ctr.ctr1.count = ni;
3117 * the rdn attribute (the alias for the name attribute),
3118 * 'cn' for most objects is the last entry in the meta data array
3121 * sort the new meta data array
3123 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3124 if (ret != LDB_SUCCESS) {
3129 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3131 if (msg->num_elements == 0) {
3132 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3135 ar->index_current++;
3136 return replmd_replicated_apply_next(ar);
3139 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3140 ar->index_current, msg->num_elements);
3142 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3143 if (ret != LDB_SUCCESS) {
3144 return replmd_replicated_request_error(ar, ret);
3147 for (i=0; i<ni; i++) {
3148 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3151 /* create the meta data value */
3152 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3153 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3154 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3155 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3156 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3160 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3161 * and replPopertyMetaData attributes
3163 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3164 if (ret != LDB_SUCCESS) {
3165 return replmd_replicated_request_error(ar, ret);
3167 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3168 if (ret != LDB_SUCCESS) {
3169 return replmd_replicated_request_error(ar, ret);
3171 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3172 if (ret != LDB_SUCCESS) {
3173 return replmd_replicated_request_error(ar, ret);
3176 replmd_ldb_message_sort(msg, ar->schema);
3178 /* we want to replace the old values */
3179 for (i=0; i < msg->num_elements; i++) {
3180 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3184 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3185 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3189 ret = ldb_build_mod_req(&change_req,
3197 LDB_REQ_SET_LOCATION(change_req);
3198 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3200 return ldb_next_request(ar->module, change_req);
3203 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3204 struct ldb_reply *ares)
3206 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3207 struct replmd_replicated_request);
3211 return ldb_module_done(ar->req, NULL, NULL,
3212 LDB_ERR_OPERATIONS_ERROR);
3214 if (ares->error != LDB_SUCCESS &&
3215 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3216 return ldb_module_done(ar->req, ares->controls,
3217 ares->response, ares->error);
3220 switch (ares->type) {
3221 case LDB_REPLY_ENTRY:
3222 ar->search_msg = talloc_steal(ar, ares->message);
3225 case LDB_REPLY_REFERRAL:
3226 /* we ignore referrals */
3229 case LDB_REPLY_DONE:
3230 if (ar->search_msg != NULL) {
3231 ret = replmd_replicated_apply_merge(ar);
3233 ret = replmd_replicated_apply_add(ar);
3235 if (ret != LDB_SUCCESS) {
3236 return ldb_module_done(ar->req, NULL, NULL, ret);
3244 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3246 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3248 struct ldb_context *ldb;
3252 struct ldb_request *search_req;
3253 struct ldb_search_options_control *options;
3255 if (ar->index_current >= ar->objs->num_objects) {
3256 /* done with it, go to next stage */
3257 return replmd_replicated_uptodate_vector(ar);
3260 ldb = ldb_module_get_ctx(ar->module);
3261 ar->search_msg = NULL;
3263 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3264 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3266 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3267 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3268 talloc_free(tmp_str);
3270 ret = ldb_build_search_req(&search_req,
3279 replmd_replicated_apply_search_callback,
3281 LDB_REQ_SET_LOCATION(search_req);
3283 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3285 if (ret != LDB_SUCCESS) {
3289 /* we need to cope with cross-partition links, so search for
3290 the GUID over all partitions */
3291 options = talloc(search_req, struct ldb_search_options_control);
3292 if (options == NULL) {
3293 DEBUG(0, (__location__ ": out of memory\n"));
3294 return LDB_ERR_OPERATIONS_ERROR;
3296 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3298 ret = ldb_request_add_control(search_req,
3299 LDB_CONTROL_SEARCH_OPTIONS_OID,
3301 if (ret != LDB_SUCCESS) {
3305 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3307 return ldb_next_request(ar->module, search_req);
3310 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3311 struct ldb_reply *ares)
3313 struct ldb_context *ldb;
3314 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3315 struct replmd_replicated_request);
3316 ldb = ldb_module_get_ctx(ar->module);
3319 return ldb_module_done(ar->req, NULL, NULL,
3320 LDB_ERR_OPERATIONS_ERROR);
3322 if (ares->error != LDB_SUCCESS) {
3323 return ldb_module_done(ar->req, ares->controls,
3324 ares->response, ares->error);
3327 if (ares->type != LDB_REPLY_DONE) {
3328 ldb_set_errstring(ldb, "Invalid reply type\n!");
3329 return ldb_module_done(ar->req, NULL, NULL,
3330 LDB_ERR_OPERATIONS_ERROR);
3335 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3338 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3340 struct ldb_context *ldb;
3341 struct ldb_request *change_req;
3342 enum ndr_err_code ndr_err;
3343 struct ldb_message *msg;
3344 struct replUpToDateVectorBlob ouv;
3345 const struct ldb_val *ouv_value;
3346 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3347 struct replUpToDateVectorBlob nuv;
3348 struct ldb_val nuv_value;
3349 struct ldb_message_element *nuv_el = NULL;
3350 const struct GUID *our_invocation_id;
3351 struct ldb_message_element *orf_el = NULL;
3352 struct repsFromToBlob nrf;
3353 struct ldb_val *nrf_value = NULL;
3354 struct ldb_message_element *nrf_el = NULL;
3358 time_t t = time(NULL);
3361 uint32_t instanceType;
3363 ldb = ldb_module_get_ctx(ar->module);
3364 ruv = ar->objs->uptodateness_vector;
3370 unix_to_nt_time(&now, t);
3372 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3373 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3374 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3375 ldb_dn_get_linearized(ar->search_msg->dn)));
3376 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3380 * first create the new replUpToDateVector
3382 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3384 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3385 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3386 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3387 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3388 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3391 if (ouv.version != 2) {
3392 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3397 * the new uptodateness vector will at least
3398 * contain 1 entry, one for the source_dsa
3400 * plus optional values from our old vector and the one from the source_dsa
3402 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3403 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3404 nuv.ctr.ctr2.cursors = talloc_array(ar,
3405 struct drsuapi_DsReplicaCursor2,
3406 nuv.ctr.ctr2.count);
3407 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3409 /* first copy the old vector */
3410 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3411 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3415 /* get our invocation_id if we have one already attached to the ldb */
3416 our_invocation_id = samdb_ntds_invocation_id(ldb);
3418 /* merge in the source_dsa vector is available */
3419 for (i=0; (ruv && i < ruv->count); i++) {
3422 if (our_invocation_id &&
3423 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3424 our_invocation_id)) {
3428 for (j=0; j < ni; j++) {
3429 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3430 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3437 * we update only the highest_usn and not the latest_sync_success time,
3438 * because the last success stands for direct replication
3440 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3441 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3446 if (found) continue;
3448 /* if it's not there yet, add it */
3449 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3454 * merge in the current highwatermark for the source_dsa
3457 for (j=0; j < ni; j++) {
3458 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3459 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3466 * here we update the highest_usn and last_sync_success time
3467 * because we're directly replicating from the source_dsa
3469 * and use the tmp_highest_usn because this is what we have just applied
3472 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3473 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3478 * here we update the highest_usn and last_sync_success time
3479 * because we're directly replicating from the source_dsa
3481 * and use the tmp_highest_usn because this is what we have just applied
3484 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3485 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3486 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3491 * finally correct the size of the cursors array
3493 nuv.ctr.ctr2.count = ni;
3498 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3501 * create the change ldb_message
3503 msg = ldb_msg_new(ar);
3504 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3505 msg->dn = ar->search_msg->dn;
3507 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3508 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3509 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3510 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3511 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3513 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3514 if (ret != LDB_SUCCESS) {
3515 return replmd_replicated_request_error(ar, ret);
3517 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3520 * now create the new repsFrom value from the given repsFromTo1 structure
3524 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3525 /* and fix some values... */
3526 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3527 nrf.ctr.ctr1.last_success = now;
3528 nrf.ctr.ctr1.last_attempt = now;
3529 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3530 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3533 * first see if we already have a repsFrom value for the current source dsa
3534 * if so we'll later replace this value
3536 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3538 for (i=0; i < orf_el->num_values; i++) {
3539 struct repsFromToBlob *trf;
3541 trf = talloc(ar, struct repsFromToBlob);
3542 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3544 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3545 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3546 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3547 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3548 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3551 if (trf->version != 1) {
3552 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3556 * we compare the source dsa objectGUID not the invocation_id
3557 * because we want only one repsFrom value per source dsa
3558 * and when the invocation_id of the source dsa has changed we don't need
3559 * the old repsFrom with the old invocation_id
3561 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3562 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3568 nrf_value = &orf_el->values[i];
3573 * copy over all old values to the new ldb_message
3575 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3576 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3581 * if we haven't found an old repsFrom value for the current source dsa
3582 * we'll add a new value
3585 struct ldb_val zero_value;
3586 ZERO_STRUCT(zero_value);
3587 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3588 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3590 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3593 /* we now fill the value which is already attached to ldb_message */
3594 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3596 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3597 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3598 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3599 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3603 * the ldb_message_element for the attribute, has all the old values and the new one
3604 * so we'll replace the whole attribute with all values
3606 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3609 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3610 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3614 /* prepare the ldb_modify() request */
3615 ret = ldb_build_mod_req(&change_req,
3621 replmd_replicated_uptodate_modify_callback,
3623 LDB_REQ_SET_LOCATION(change_req);
3624 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3626 return ldb_next_request(ar->module, change_req);
3629 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3630 struct ldb_reply *ares)
3632 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3633 struct replmd_replicated_request);
3637 return ldb_module_done(ar->req, NULL, NULL,
3638 LDB_ERR_OPERATIONS_ERROR);
3640 if (ares->error != LDB_SUCCESS &&
3641 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3642 return ldb_module_done(ar->req, ares->controls,
3643 ares->response, ares->error);
3646 switch (ares->type) {
3647 case LDB_REPLY_ENTRY:
3648 ar->search_msg = talloc_steal(ar, ares->message);
3651 case LDB_REPLY_REFERRAL:
3652 /* we ignore referrals */
3655 case LDB_REPLY_DONE:
3656 if (ar->search_msg == NULL) {
3657 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3659 ret = replmd_replicated_uptodate_modify(ar);
3661 if (ret != LDB_SUCCESS) {
3662 return ldb_module_done(ar->req, NULL, NULL, ret);
3671 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3673 struct ldb_context *ldb;
3675 static const char *attrs[] = {
3676 "replUpToDateVector",
3681 struct ldb_request *search_req;
3683 ldb = ldb_module_get_ctx(ar->module);
3684 ar->search_msg = NULL;
3686 ret = ldb_build_search_req(&search_req,
3689 ar->objs->partition_dn,
3695 replmd_replicated_uptodate_search_callback,
3697 LDB_REQ_SET_LOCATION(search_req);
3698 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3700 return ldb_next_request(ar->module, search_req);
3705 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3707 struct ldb_context *ldb;
3708 struct dsdb_extended_replicated_objects *objs;
3709 struct replmd_replicated_request *ar;
3710 struct ldb_control **ctrls;
3713 struct replmd_private *replmd_private =
3714 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3716 ldb = ldb_module_get_ctx(module);
3718 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3720 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3722 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3723 return LDB_ERR_PROTOCOL_ERROR;
3726 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3727 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3728 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3729 return LDB_ERR_PROTOCOL_ERROR;
3732 ar = replmd_ctx_init(module, req);
3734 return LDB_ERR_OPERATIONS_ERROR;
3736 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3737 ar->apply_mode = true;
3739 ar->schema = dsdb_get_schema(ldb, ar);
3741 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3743 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3744 return LDB_ERR_CONSTRAINT_VIOLATION;
3747 ctrls = req->controls;
3749 if (req->controls) {
3750 req->controls = talloc_memdup(ar, req->controls,
3751 talloc_get_size(req->controls));
3752 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3755 /* This allows layers further down to know if a change came in over replication */
3756 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3757 if (ret != LDB_SUCCESS) {
3761 /* If this change contained linked attributes in the body
3762 * (rather than in the links section) we need to update
3763 * backlinks in linked_attributes */
3764 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3765 if (ret != LDB_SUCCESS) {
3769 ar->controls = req->controls;
3770 req->controls = ctrls;
3772 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3774 /* save away the linked attributes for the end of the
3776 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3777 struct la_entry *la_entry;
3779 if (replmd_private->la_ctx == NULL) {
3780 replmd_private->la_ctx = talloc_new(replmd_private);
3782 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3783 if (la_entry == NULL) {
3785 return LDB_ERR_OPERATIONS_ERROR;
3787 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3788 if (la_entry->la == NULL) {
3789 talloc_free(la_entry);
3791 return LDB_ERR_OPERATIONS_ERROR;
3793 *la_entry->la = ar->objs->linked_attributes[i];
3795 /* we need to steal the non-scalars so they stay
3796 around until the end of the transaction */
3797 talloc_steal(la_entry->la, la_entry->la->identifier);
3798 talloc_steal(la_entry->la, la_entry->la->value.blob);
3800 DLIST_ADD(replmd_private->la_list, la_entry);
3803 return replmd_replicated_apply_next(ar);
3807 process one linked attribute structure
3809 static int replmd_process_linked_attribute(struct ldb_module *module,
3810 struct la_entry *la_entry)
3812 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3813 struct ldb_context *ldb = ldb_module_get_ctx(module);
3814 struct ldb_message *msg;
3815 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3816 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3818 const struct dsdb_attribute *attr;
3819 struct dsdb_dn *dsdb_dn;
3820 uint64_t seq_num = 0;
3821 struct ldb_message_element *old_el;
3823 time_t t = time(NULL);
3824 struct ldb_result *res;
3825 const char *attrs[2];
3826 struct parsed_dn *pdn_list, *pdn;
3827 struct GUID guid = GUID_zero();
3829 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3830 const struct GUID *our_invocation_id;
3833 linked_attributes[0]:
3834 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3836 identifier: struct drsuapi_DsReplicaObjectIdentifier
3837 __ndr_size : 0x0000003a (58)
3838 __ndr_size_sid : 0x00000000 (0)
3839 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3841 __ndr_size_dn : 0x00000000 (0)
3843 attid : DRSUAPI_ATTRIBUTE_member (0x1F)
3844 value: struct drsuapi_DsAttributeValue
3845 __ndr_size : 0x0000007e (126)
3847 blob : DATA_BLOB length=126
3848 flags : 0x00000001 (1)
3849 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3850 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3851 meta_data: struct drsuapi_DsReplicaMetaData
3852 version : 0x00000015 (21)
3853 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3854 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3855 originating_usn : 0x000000000001e19c (123292)
3857 (for cases where the link is to a normal DN)
3858 &target: struct drsuapi_DsReplicaObjectIdentifier3
3859 __ndr_size : 0x0000007e (126)
3860 __ndr_size_sid : 0x0000001c (28)
3861 guid : 7639e594-db75-4086-b0d4-67890ae46031
3862 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3863 __ndr_size_dn : 0x00000022 (34)
3864 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3867 /* find the attribute being modified */
3868 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3870 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3871 talloc_free(tmp_ctx);
3872 return LDB_ERR_OPERATIONS_ERROR;
3875 attrs[0] = attr->lDAPDisplayName;
3878 /* get the existing message from the db for the object with
3879 this GUID, returning attribute being modified. We will then
3880 use this msg as the basis for a modify call */
3881 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3882 DSDB_FLAG_NEXT_MODULE |
3883 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3884 DSDB_SEARCH_SHOW_RECYCLED |
3885 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3886 DSDB_SEARCH_REVEAL_INTERNALS,
3887 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3888 if (ret != LDB_SUCCESS) {
3889 talloc_free(tmp_ctx);
3892 if (res->count != 1) {
3893 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3894 GUID_string(tmp_ctx, &la->identifier->guid));
3895 talloc_free(tmp_ctx);
3896 return LDB_ERR_NO_SUCH_OBJECT;
3900 if (msg->num_elements == 0) {
3901 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3902 if (ret != LDB_SUCCESS) {
3903 ldb_module_oom(module);
3904 talloc_free(tmp_ctx);
3905 return LDB_ERR_OPERATIONS_ERROR;
3908 old_el = &msg->elements[0];
3909 old_el->flags = LDB_FLAG_MOD_REPLACE;
3912 /* parse the existing links */
3913 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3914 if (ret != LDB_SUCCESS) {
3915 talloc_free(tmp_ctx);
3919 /* get our invocationId */
3920 our_invocation_id = samdb_ntds_invocation_id(ldb);
3921 if (!our_invocation_id) {
3922 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3923 talloc_free(tmp_ctx);
3924 return LDB_ERR_OPERATIONS_ERROR;
3927 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3928 if (ret != LDB_SUCCESS) {
3929 talloc_free(tmp_ctx);
3933 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3934 if (!W_ERROR_IS_OK(status)) {
3935 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3936 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3937 return LDB_ERR_OPERATIONS_ERROR;
3940 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3941 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3942 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3944 ldb_dn_get_linearized(dsdb_dn->dn),
3945 ldb_dn_get_linearized(msg->dn));
3946 return LDB_ERR_OPERATIONS_ERROR;
3949 /* re-resolve the DN by GUID, as the DRS server may give us an
3951 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3952 if (ret != LDB_SUCCESS) {
3953 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3954 GUID_string(tmp_ctx, &guid),
3955 ldb_dn_get_linearized(dsdb_dn->dn)));
3958 /* see if this link already exists */
3959 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3961 /* see if this update is newer than what we have already */
3962 struct GUID invocation_id = GUID_zero();
3963 uint32_t version = 0;
3964 uint32_t originating_usn = 0;
3965 NTTIME change_time = 0;
3966 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3968 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3969 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3970 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
3971 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3973 if (!replmd_update_is_newer(&invocation_id,
3974 &la->meta_data.originating_invocation_id,
3976 la->meta_data.version,
3978 la->meta_data.originating_usn,
3980 la->meta_data.originating_change_time)) {
3981 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3982 old_el->name, ldb_dn_get_linearized(msg->dn),
3983 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
3984 talloc_free(tmp_ctx);
3988 /* get a seq_num for this change */
3989 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3990 if (ret != LDB_SUCCESS) {
3991 talloc_free(tmp_ctx);
3995 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
3996 /* remove the existing backlink */
3997 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
3998 if (ret != LDB_SUCCESS) {
3999 talloc_free(tmp_ctx);
4004 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4005 &la->meta_data.originating_invocation_id,
4006 la->meta_data.originating_usn, seq_num,
4007 la->meta_data.originating_change_time,
4008 la->meta_data.version,
4010 if (ret != LDB_SUCCESS) {
4011 talloc_free(tmp_ctx);
4016 /* add the new backlink */
4017 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4018 if (ret != LDB_SUCCESS) {
4019 talloc_free(tmp_ctx);
4024 /* get a seq_num for this change */
4025 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4026 if (ret != LDB_SUCCESS) {
4027 talloc_free(tmp_ctx);
4031 old_el->values = talloc_realloc(msg->elements, old_el->values,
4032 struct ldb_val, old_el->num_values+1);
4033 if (!old_el->values) {
4034 ldb_module_oom(module);
4035 return LDB_ERR_OPERATIONS_ERROR;
4037 old_el->num_values++;
4039 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4040 &la->meta_data.originating_invocation_id,
4041 la->meta_data.originating_usn, seq_num,
4042 la->meta_data.originating_change_time,
4043 la->meta_data.version,
4044 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4045 if (ret != LDB_SUCCESS) {
4046 talloc_free(tmp_ctx);
4051 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4053 if (ret != LDB_SUCCESS) {
4054 talloc_free(tmp_ctx);
4060 /* we only change whenChanged and uSNChanged if the seq_num
4062 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4063 talloc_free(tmp_ctx);
4064 return ldb_operr(ldb);
4067 if (add_uint64_element(msg, "uSNChanged", seq_num) != LDB_SUCCESS) {
4068 talloc_free(tmp_ctx);
4069 return ldb_operr(ldb);
4072 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4073 if (old_el == NULL) {
4074 talloc_free(tmp_ctx);
4075 return ldb_operr(ldb);
4078 ret = dsdb_check_single_valued_link(attr, old_el);
4079 if (ret != LDB_SUCCESS) {
4080 talloc_free(tmp_ctx);
4084 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
4085 if (ret != LDB_SUCCESS) {
4086 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4088 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4089 talloc_free(tmp_ctx);
4093 talloc_free(tmp_ctx);
4098 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4100 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4101 return replmd_extended_replicated_objects(module, req);
4104 return ldb_next_request(module, req);
4109 we hook into the transaction operations to allow us to
4110 perform the linked attribute updates at the end of the whole
4111 transaction. This allows a forward linked attribute to be created
4112 before the object is created. During a vampire, w2k8 sends us linked
4113 attributes before the objects they are part of.
4115 static int replmd_start_transaction(struct ldb_module *module)
4117 /* create our private structure for this transaction */
4118 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4119 struct replmd_private);
4120 replmd_txn_cleanup(replmd_private);
4122 /* free any leftover mod_usn records from cancelled
4124 while (replmd_private->ncs) {
4125 struct nc_entry *e = replmd_private->ncs;
4126 DLIST_REMOVE(replmd_private->ncs, e);
4130 return ldb_next_start_trans(module);
4134 on prepare commit we loop over our queued la_context structures and
4137 static int replmd_prepare_commit(struct ldb_module *module)
4139 struct replmd_private *replmd_private =
4140 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4141 struct la_entry *la, *prev;
4142 struct la_backlink *bl;
4145 /* walk the list backwards, to do the first entry first, as we
4146 * added the entries with DLIST_ADD() which puts them at the
4147 * start of the list */
4148 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4149 prev = DLIST_PREV(la);
4150 DLIST_REMOVE(replmd_private->la_list, la);
4151 ret = replmd_process_linked_attribute(module, la);
4152 if (ret != LDB_SUCCESS) {
4153 replmd_txn_cleanup(replmd_private);
4158 /* process our backlink list, creating and deleting backlinks
4160 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4161 ret = replmd_process_backlink(module, bl);
4162 if (ret != LDB_SUCCESS) {
4163 replmd_txn_cleanup(replmd_private);
4168 replmd_txn_cleanup(replmd_private);
4170 /* possibly change @REPLCHANGED */
4171 ret = replmd_notify_store(module);
4172 if (ret != LDB_SUCCESS) {
4176 return ldb_next_prepare_commit(module);
4179 static int replmd_del_transaction(struct ldb_module *module)
4181 struct replmd_private *replmd_private =
4182 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4183 replmd_txn_cleanup(replmd_private);
4185 return ldb_next_del_trans(module);
4189 _PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4190 .name = "repl_meta_data",
4191 .init_context = replmd_init,
4193 .modify = replmd_modify,
4194 .rename = replmd_rename,
4195 .del = replmd_delete,
4196 .extended = replmd_extended,
4197 .start_transaction = replmd_start_transaction,
4198 .prepare_commit = replmd_prepare_commit,
4199 .del_transaction = replmd_del_transaction,