4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "lib/util/tsort.h"
54 * It's 29/12/9999 at 23:59:59 UTC as specified in MS-ADTS 7.1.1.4.2
55 * Deleted Objects Container
57 static const NTTIME DELETED_OBJECT_CONTAINER_CHANGE_TIME = 2650466015990000000ULL;
59 struct replmd_private {
61 struct la_entry *la_list;
63 struct la_backlink *la_backlinks;
65 struct nc_entry *prev, *next;
68 uint64_t mod_usn_urgent;
73 struct la_entry *next, *prev;
74 struct drsuapi_DsReplicaLinkedAttribute *la;
77 struct replmd_replicated_request {
78 struct ldb_module *module;
79 struct ldb_request *req;
81 const struct dsdb_schema *schema;
83 /* the controls we pass down */
84 struct ldb_control **controls;
86 /* details for the mode where we apply a bunch of inbound replication meessages */
88 uint32_t index_current;
89 struct dsdb_extended_replicated_objects *objs;
91 struct ldb_message *search_msg;
97 enum urgent_situation {
98 REPL_URGENT_ON_CREATE = 1,
99 REPL_URGENT_ON_UPDATE = 2,
100 REPL_URGENT_ON_DELETE = 4
104 static const struct {
105 const char *update_name;
106 enum urgent_situation repl_situation;
107 } urgent_objects[] = {
108 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
109 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
110 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
111 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
113 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
117 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
118 static const char *urgent_attrs[] = {
121 "userAccountControl",
126 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
127 enum urgent_situation situation)
130 for (i=0; urgent_objects[i].update_name; i++) {
132 if ((situation & urgent_objects[i].repl_situation) == 0) {
136 for (j=0; j<objectclass_el->num_values; j++) {
137 const struct ldb_val *v = &objectclass_el->values[j];
138 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
146 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
148 if (ldb_attr_in_list(urgent_attrs, el->name)) {
155 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
158 initialise the module
159 allocate the private structure and build the list
160 of partition DNs for use by replmd_notify()
162 static int replmd_init(struct ldb_module *module)
164 struct replmd_private *replmd_private;
165 struct ldb_context *ldb = ldb_module_get_ctx(module);
167 replmd_private = talloc_zero(module, struct replmd_private);
168 if (replmd_private == NULL) {
170 return LDB_ERR_OPERATIONS_ERROR;
172 ldb_module_set_private(module, replmd_private);
174 return ldb_next_init(module);
178 cleanup our per-transaction contexts
180 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
182 talloc_free(replmd_private->la_ctx);
183 replmd_private->la_list = NULL;
184 replmd_private->la_ctx = NULL;
186 talloc_free(replmd_private->bl_ctx);
187 replmd_private->la_backlinks = NULL;
188 replmd_private->bl_ctx = NULL;
193 struct la_backlink *next, *prev;
194 const char *attr_name;
195 struct GUID forward_guid, target_guid;
200 process a backlinks we accumulated during a transaction, adding and
201 deleting the backlinks from the target objects
203 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
205 struct ldb_dn *target_dn, *source_dn;
207 struct ldb_context *ldb = ldb_module_get_ctx(module);
208 struct ldb_message *msg;
209 TALLOC_CTX *tmp_ctx = talloc_new(bl);
215 - construct ldb_message
216 - either an add or a delete
218 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
219 if (ret != LDB_SUCCESS) {
220 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
221 GUID_string(bl, &bl->target_guid)));
225 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
226 if (ret != LDB_SUCCESS) {
227 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
228 GUID_string(bl, &bl->forward_guid));
229 talloc_free(tmp_ctx);
233 msg = ldb_msg_new(tmp_ctx);
235 ldb_module_oom(module);
236 talloc_free(tmp_ctx);
237 return LDB_ERR_OPERATIONS_ERROR;
240 /* construct a ldb_message for adding/deleting the backlink */
242 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
244 ldb_module_oom(module);
245 talloc_free(tmp_ctx);
246 return LDB_ERR_OPERATIONS_ERROR;
248 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
249 if (ret != LDB_SUCCESS) {
250 talloc_free(tmp_ctx);
253 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
255 /* a backlink should never be single valued. Unfortunately the
256 exchange schema has a attribute
257 msExchBridgeheadedLocalConnectorsDNBL which is single
258 valued and a backlink. We need to cope with that by
259 ignoring the single value flag */
260 msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
262 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
263 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
264 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
265 cope with possible corruption where the backlink has
266 already been removed */
267 DEBUG(3,("WARNING: backlink from %s already removed from %s - %s\n",
268 ldb_dn_get_linearized(target_dn),
269 ldb_dn_get_linearized(source_dn),
270 ldb_errstring(ldb)));
272 } else if (ret != LDB_SUCCESS) {
273 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
274 bl->active?"add":"remove",
275 ldb_dn_get_linearized(source_dn),
276 ldb_dn_get_linearized(target_dn),
278 talloc_free(tmp_ctx);
281 talloc_free(tmp_ctx);
286 add a backlink to the list of backlinks to add/delete in the prepare
289 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
290 struct GUID *forward_guid, struct GUID *target_guid,
291 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
293 const struct dsdb_attribute *target_attr;
294 struct la_backlink *bl;
295 struct replmd_private *replmd_private =
296 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
298 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
301 * windows 2003 has a broken schema where the
302 * definition of msDS-IsDomainFor is missing (which is
303 * supposed to be the backlink of the
304 * msDS-HasDomainNCs attribute
309 /* see if its already in the list */
310 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
311 if (GUID_equal(forward_guid, &bl->forward_guid) &&
312 GUID_equal(target_guid, &bl->target_guid) &&
313 (target_attr->lDAPDisplayName == bl->attr_name ||
314 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
320 /* we found an existing one */
321 if (bl->active == active) {
324 DLIST_REMOVE(replmd_private->la_backlinks, bl);
329 if (replmd_private->bl_ctx == NULL) {
330 replmd_private->bl_ctx = talloc_new(replmd_private);
331 if (replmd_private->bl_ctx == NULL) {
332 ldb_module_oom(module);
333 return LDB_ERR_OPERATIONS_ERROR;
338 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
340 ldb_module_oom(module);
341 return LDB_ERR_OPERATIONS_ERROR;
344 /* Ensure the schema does not go away before the bl->attr_name is used */
345 if (!talloc_reference(bl, schema)) {
347 ldb_module_oom(module);
348 return LDB_ERR_OPERATIONS_ERROR;
351 bl->attr_name = target_attr->lDAPDisplayName;
352 bl->forward_guid = *forward_guid;
353 bl->target_guid = *target_guid;
356 /* the caller may ask for this backlink to be processed
359 int ret = replmd_process_backlink(module, bl, NULL);
364 DLIST_ADD(replmd_private->la_backlinks, bl);
371 * Callback for most write operations in this module:
373 * notify the repl task that a object has changed. The notifies are
374 * gathered up in the replmd_private structure then written to the
375 * @REPLCHANGED object in each partition during the prepare_commit
377 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
380 struct replmd_replicated_request *ac =
381 talloc_get_type_abort(req->context, struct replmd_replicated_request);
382 struct replmd_private *replmd_private =
383 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
384 struct nc_entry *modified_partition;
385 struct ldb_control *partition_ctrl;
386 const struct dsdb_control_current_partition *partition;
388 struct ldb_control **controls;
390 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
392 controls = ares->controls;
393 if (ldb_request_get_control(ac->req,
394 DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
396 * Remove the current partition control from what we pass up
397 * the chain if it hasn't been requested manually.
399 controls = ldb_controls_except_specified(ares->controls, ares,
403 if (ares->error != LDB_SUCCESS) {
404 DEBUG(5,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
405 return ldb_module_done(ac->req, controls,
406 ares->response, ares->error);
409 if (ares->type != LDB_REPLY_DONE) {
410 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
411 return ldb_module_done(ac->req, NULL,
412 NULL, LDB_ERR_OPERATIONS_ERROR);
415 if (!partition_ctrl) {
416 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
417 return ldb_module_done(ac->req, NULL,
418 NULL, LDB_ERR_OPERATIONS_ERROR);
421 partition = talloc_get_type_abort(partition_ctrl->data,
422 struct dsdb_control_current_partition);
424 if (ac->seq_num > 0) {
425 for (modified_partition = replmd_private->ncs; modified_partition;
426 modified_partition = modified_partition->next) {
427 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
432 if (modified_partition == NULL) {
433 modified_partition = talloc_zero(replmd_private, struct nc_entry);
434 if (!modified_partition) {
435 ldb_oom(ldb_module_get_ctx(ac->module));
436 return ldb_module_done(ac->req, NULL,
437 NULL, LDB_ERR_OPERATIONS_ERROR);
439 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
440 if (!modified_partition->dn) {
441 ldb_oom(ldb_module_get_ctx(ac->module));
442 return ldb_module_done(ac->req, NULL,
443 NULL, LDB_ERR_OPERATIONS_ERROR);
445 DLIST_ADD(replmd_private->ncs, modified_partition);
448 if (ac->seq_num > modified_partition->mod_usn) {
449 modified_partition->mod_usn = ac->seq_num;
451 modified_partition->mod_usn_urgent = ac->seq_num;
456 if (ac->apply_mode) {
460 ret = replmd_replicated_apply_next(ac);
461 if (ret != LDB_SUCCESS) {
462 return ldb_module_done(ac->req, NULL, NULL, ret);
466 /* free the partition control container here, for the
467 * common path. Other cases will have it cleaned up
468 * eventually with the ares */
469 talloc_free(partition_ctrl);
470 return ldb_module_done(ac->req, controls,
471 ares->response, LDB_SUCCESS);
477 * update a @REPLCHANGED record in each partition if there have been
478 * any writes of replicated data in the partition
480 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
482 struct replmd_private *replmd_private =
483 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
485 while (replmd_private->ncs) {
487 struct nc_entry *modified_partition = replmd_private->ncs;
489 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
490 modified_partition->mod_usn,
491 modified_partition->mod_usn_urgent, parent);
492 if (ret != LDB_SUCCESS) {
493 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
494 ldb_dn_get_linearized(modified_partition->dn)));
497 DLIST_REMOVE(replmd_private->ncs, modified_partition);
498 talloc_free(modified_partition);
506 created a replmd_replicated_request context
508 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
509 struct ldb_request *req)
511 struct ldb_context *ldb;
512 struct replmd_replicated_request *ac;
514 ldb = ldb_module_get_ctx(module);
516 ac = talloc_zero(req, struct replmd_replicated_request);
525 ac->schema = dsdb_get_schema(ldb, ac);
527 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
528 "replmd_modify: no dsdb_schema loaded");
529 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
537 add a time element to a record
539 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
541 struct ldb_message_element *el;
545 if (ldb_msg_find_element(msg, attr) != NULL) {
549 s = ldb_timestring(msg, t);
551 return LDB_ERR_OPERATIONS_ERROR;
554 ret = ldb_msg_add_string(msg, attr, s);
555 if (ret != LDB_SUCCESS) {
559 el = ldb_msg_find_element(msg, attr);
560 /* always set as replace. This works because on add ops, the flag
562 el->flags = LDB_FLAG_MOD_REPLACE;
568 add a uint64_t element to a record
570 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
571 const char *attr, uint64_t v)
573 struct ldb_message_element *el;
576 if (ldb_msg_find_element(msg, attr) != NULL) {
580 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
581 if (ret != LDB_SUCCESS) {
585 el = ldb_msg_find_element(msg, attr);
586 /* always set as replace. This works because on add ops, the flag
588 el->flags = LDB_FLAG_MOD_REPLACE;
593 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
594 const struct replPropertyMetaData1 *m2,
595 const uint32_t *rdn_attid)
597 if (m1->attid == m2->attid) {
602 * the rdn attribute should be at the end!
603 * so we need to return a value greater than zero
604 * which means m1 is greater than m2
606 if (m1->attid == *rdn_attid) {
611 * the rdn attribute should be at the end!
612 * so we need to return a value less than zero
613 * which means m2 is greater than m1
615 if (m2->attid == *rdn_attid) {
619 return m1->attid > m2->attid ? 1 : -1;
622 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
623 const struct dsdb_schema *schema,
626 const char *rdn_name;
627 const struct dsdb_attribute *rdn_sa;
629 rdn_name = ldb_dn_get_rdn_name(dn);
631 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
632 return LDB_ERR_OPERATIONS_ERROR;
635 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
636 if (rdn_sa == NULL) {
637 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
638 return LDB_ERR_OPERATIONS_ERROR;
641 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
642 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
644 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
649 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
650 const struct ldb_message_element *e2,
651 const struct dsdb_schema *schema)
653 const struct dsdb_attribute *a1;
654 const struct dsdb_attribute *a2;
657 * TODO: make this faster by caching the dsdb_attribute pointer
658 * on the ldb_messag_element
661 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
662 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
665 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
669 return strcasecmp(e1->name, e2->name);
671 if (a1->attributeID_id == a2->attributeID_id) {
674 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
677 static void replmd_ldb_message_sort(struct ldb_message *msg,
678 const struct dsdb_schema *schema)
680 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
683 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
684 const struct GUID *invocation_id, uint64_t seq_num,
685 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
689 fix up linked attributes in replmd_add.
690 This involves setting up the right meta-data in extended DN
691 components, and creating backlinks to the object
693 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
694 uint64_t seq_num, const struct GUID *invocationId, time_t t,
695 struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
698 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
699 struct ldb_context *ldb = ldb_module_get_ctx(module);
701 /* We will take a reference to the schema in replmd_add_backlink */
702 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
705 unix_to_nt_time(&now, t);
707 for (i=0; i<el->num_values; i++) {
708 struct ldb_val *v = &el->values[i];
709 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
710 struct GUID target_guid;
714 /* note that the DN already has the extended
715 components from the extended_dn_store module */
716 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
717 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
718 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
719 if (ret != LDB_SUCCESS) {
720 talloc_free(tmp_ctx);
723 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
724 if (ret != LDB_SUCCESS) {
725 talloc_free(tmp_ctx);
730 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
731 seq_num, seq_num, now, 0, false);
732 if (ret != LDB_SUCCESS) {
733 talloc_free(tmp_ctx);
737 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
738 if (ret != LDB_SUCCESS) {
739 talloc_free(tmp_ctx);
744 talloc_free(tmp_ctx);
750 intercept add requests
752 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
754 struct samldb_msds_intid_persistant *msds_intid_struct;
755 struct ldb_context *ldb;
756 struct ldb_control *control;
757 struct replmd_replicated_request *ac;
758 enum ndr_err_code ndr_err;
759 struct ldb_request *down_req;
760 struct ldb_message *msg;
761 const DATA_BLOB *guid_blob;
763 struct replPropertyMetaDataBlob nmd;
764 struct ldb_val nmd_value;
765 const struct GUID *our_invocation_id;
766 time_t t = time(NULL);
771 unsigned int functional_level;
773 bool allow_add_guid = false;
774 bool remove_current_guid = false;
775 bool is_urgent = false;
776 struct ldb_message_element *objectclass_el;
778 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
779 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
781 allow_add_guid = true;
784 /* do not manipulate our control entries */
785 if (ldb_dn_is_special(req->op.add.message->dn)) {
786 return ldb_next_request(module, req);
789 ldb = ldb_module_get_ctx(module);
791 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
793 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
794 if (guid_blob != NULL) {
795 if (!allow_add_guid) {
796 ldb_set_errstring(ldb,
797 "replmd_add: it's not allowed to add an object with objectGUID!");
798 return LDB_ERR_UNWILLING_TO_PERFORM;
800 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
801 if (!NT_STATUS_IS_OK(status)) {
802 ldb_set_errstring(ldb,
803 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
804 return LDB_ERR_UNWILLING_TO_PERFORM;
806 /* we remove this attribute as it can be a string and
807 * will not be treated correctly and then we will re-add
808 * it later on in the good format */
809 remove_current_guid = true;
813 guid = GUID_random();
816 ac = replmd_ctx_init(module, req);
818 return ldb_module_oom(module);
821 functional_level = dsdb_functional_level(ldb);
823 /* Get a sequence number from the backend */
824 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
825 if (ret != LDB_SUCCESS) {
830 /* get our invocationId */
831 our_invocation_id = samdb_ntds_invocation_id(ldb);
832 if (!our_invocation_id) {
833 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
834 "replmd_add: unable to find invocationId\n");
836 return LDB_ERR_OPERATIONS_ERROR;
839 /* we have to copy the message as the caller might have it as a const */
840 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
844 return LDB_ERR_OPERATIONS_ERROR;
847 /* generated times */
848 unix_to_nt_time(&now, t);
849 time_str = ldb_timestring(msg, t);
853 return LDB_ERR_OPERATIONS_ERROR;
855 if (remove_current_guid) {
856 ldb_msg_remove_attr(msg,"objectGUID");
860 * remove autogenerated attributes
862 ldb_msg_remove_attr(msg, "whenCreated");
863 ldb_msg_remove_attr(msg, "whenChanged");
864 ldb_msg_remove_attr(msg, "uSNCreated");
865 ldb_msg_remove_attr(msg, "uSNChanged");
866 ldb_msg_remove_attr(msg, "replPropertyMetaData");
869 * readd replicated attributes
871 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
872 if (ret != LDB_SUCCESS) {
878 /* build the replication meta_data */
881 nmd.ctr.ctr1.count = msg->num_elements;
882 nmd.ctr.ctr1.array = talloc_array(msg,
883 struct replPropertyMetaData1,
885 if (!nmd.ctr.ctr1.array) {
888 return LDB_ERR_OPERATIONS_ERROR;
891 for (i=0; i < msg->num_elements; i++) {
892 struct ldb_message_element *e = &msg->elements[i];
893 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
894 const struct dsdb_attribute *sa;
896 if (e->name[0] == '@') continue;
898 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
900 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
901 "replmd_add: attribute '%s' not defined in schema\n",
904 return LDB_ERR_NO_SUCH_ATTRIBUTE;
907 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
908 /* if the attribute is not replicated (0x00000001)
909 * or constructed (0x00000004) it has no metadata
914 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
915 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
916 if (ret != LDB_SUCCESS) {
920 /* linked attributes are not stored in
921 replPropertyMetaData in FL above w2k */
925 m->attid = sa->attributeID_id;
927 if (m->attid == 0x20030) {
928 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
931 if (rdn_val == NULL) {
934 return LDB_ERR_OPERATIONS_ERROR;
937 rdn = (const char*)rdn_val->data;
938 if (strcmp(rdn, "Deleted Objects") == 0) {
940 * Set the originating_change_time to 29/12/9999 at 23:59:59
941 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
943 m->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
945 m->originating_change_time = now;
948 m->originating_change_time = now;
950 m->originating_invocation_id = *our_invocation_id;
951 m->originating_usn = ac->seq_num;
952 m->local_usn = ac->seq_num;
956 /* fix meta data count */
957 nmd.ctr.ctr1.count = ni;
960 * sort meta data array, and move the rdn attribute entry to the end
962 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
963 if (ret != LDB_SUCCESS) {
968 /* generated NDR encoded values */
969 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
971 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
972 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
975 return LDB_ERR_OPERATIONS_ERROR;
979 * add the autogenerated values
981 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
982 if (ret != LDB_SUCCESS) {
987 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
988 if (ret != LDB_SUCCESS) {
993 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
994 if (ret != LDB_SUCCESS) {
999 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
1000 if (ret != LDB_SUCCESS) {
1005 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
1006 if (ret != LDB_SUCCESS) {
1013 * sort the attributes by attid before storing the object
1015 replmd_ldb_message_sort(msg, ac->schema);
1017 objectclass_el = ldb_msg_find_element(msg, "objectClass");
1018 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
1019 REPL_URGENT_ON_CREATE);
1021 ac->is_urgent = is_urgent;
1022 ret = ldb_build_add_req(&down_req, ldb, ac,
1025 ac, replmd_op_callback,
1028 LDB_REQ_SET_LOCATION(down_req);
1029 if (ret != LDB_SUCCESS) {
1034 /* current partition control is needed by "replmd_op_callback" */
1035 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1036 ret = ldb_request_add_control(down_req,
1037 DSDB_CONTROL_CURRENT_PARTITION_OID,
1039 if (ret != LDB_SUCCESS) {
1045 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1046 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1047 if (ret != LDB_SUCCESS) {
1053 /* mark the control done */
1055 control->critical = 0;
1057 if (ldb_dn_compare_base(ac->schema->base_dn, req->op.add.message->dn) != 0) {
1059 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
1060 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1061 if (msds_intid_struct) {
1062 msds_intid_struct->usn = ac->seq_num;
1065 /* go on with the call chain */
1066 return ldb_next_request(module, down_req);
1071 * update the replPropertyMetaData for one element
1073 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1074 struct ldb_message *msg,
1075 struct ldb_message_element *el,
1076 struct ldb_message_element *old_el,
1077 struct replPropertyMetaDataBlob *omd,
1078 const struct dsdb_schema *schema,
1080 const struct GUID *our_invocation_id,
1082 struct ldb_request *req)
1085 const struct dsdb_attribute *a;
1086 struct replPropertyMetaData1 *md1;
1088 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1090 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1091 /* allow this to make it possible for dbcheck
1092 to remove bad attributes */
1096 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1098 return LDB_ERR_OPERATIONS_ERROR;
1101 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1105 /* if the attribute's value haven't changed then return LDB_SUCCESS
1106 * Unless we have the provision control or if the attribute is
1107 * interSiteTopologyGenerator as this page explain: http://support.microsoft.com/kb/224815
1108 * this attribute is periodicaly written by the DC responsible for the intersite generation
1111 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1112 if (strcmp(el->name, "interSiteTopologyGenerator") != 0 &&
1113 !ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1115 * allow this to make it possible for dbcheck
1116 * to rebuild broken metadata
1122 for (i=0; i<omd->ctr.ctr1.count; i++) {
1123 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1126 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1127 /* linked attributes are not stored in
1128 replPropertyMetaData in FL above w2k, but we do
1129 raise the seqnum for the object */
1130 if (*seq_num == 0 &&
1131 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1132 return LDB_ERR_OPERATIONS_ERROR;
1137 if (i == omd->ctr.ctr1.count) {
1138 /* we need to add a new one */
1139 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1140 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1141 if (omd->ctr.ctr1.array == NULL) {
1143 return LDB_ERR_OPERATIONS_ERROR;
1145 omd->ctr.ctr1.count++;
1146 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1149 /* Get a new sequence number from the backend. We only do this
1150 * if we have a change that requires a new
1151 * replPropertyMetaData element
1153 if (*seq_num == 0) {
1154 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1155 if (ret != LDB_SUCCESS) {
1156 return LDB_ERR_OPERATIONS_ERROR;
1160 md1 = &omd->ctr.ctr1.array[i];
1162 md1->attid = a->attributeID_id;
1163 if (md1->attid == 0x20030) {
1164 const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
1167 if (rdn_val == NULL) {
1169 return LDB_ERR_OPERATIONS_ERROR;
1172 rdn = (const char*)rdn_val->data;
1173 if (strcmp(rdn, "Deleted Objects") == 0) {
1175 * Set the originating_change_time to 29/12/9999 at 23:59:59
1176 * as specified in MS-ADTS 7.1.1.4.2 Deleted Objects Container
1178 md1->originating_change_time = DELETED_OBJECT_CONTAINER_CHANGE_TIME;
1180 md1->originating_change_time = now;
1183 md1->originating_change_time = now;
1185 md1->originating_invocation_id = *our_invocation_id;
1186 md1->originating_usn = *seq_num;
1187 md1->local_usn = *seq_num;
1192 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1194 uint32_t count = omd.ctr.ctr1.count;
1197 for (i=0; i < count; i++) {
1198 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1199 if (max < m.local_usn) {
1207 * update the replPropertyMetaData object each time we modify an
1208 * object. This is needed for DRS replication, as the merge on the
1209 * client is based on this object
1211 static int replmd_update_rpmd(struct ldb_module *module,
1212 const struct dsdb_schema *schema,
1213 struct ldb_request *req,
1214 const char * const *rename_attrs,
1215 struct ldb_message *msg, uint64_t *seq_num,
1217 bool *is_urgent, bool *rodc)
1219 const struct ldb_val *omd_value;
1220 enum ndr_err_code ndr_err;
1221 struct replPropertyMetaDataBlob omd;
1224 const struct GUID *our_invocation_id;
1226 const char * const *attrs = NULL;
1227 const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1228 const char * const attrs2[] = { "uSNChanged", "objectClass", "instanceType", NULL };
1229 struct ldb_result *res;
1230 struct ldb_context *ldb;
1231 struct ldb_message_element *objectclass_el;
1232 enum urgent_situation situation;
1233 bool rmd_is_provided;
1236 attrs = rename_attrs;
1241 ldb = ldb_module_get_ctx(module);
1243 our_invocation_id = samdb_ntds_invocation_id(ldb);
1244 if (!our_invocation_id) {
1245 /* this happens during an initial vampire while
1246 updating the schema */
1247 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1251 unix_to_nt_time(&now, t);
1253 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1254 rmd_is_provided = true;
1256 rmd_is_provided = false;
1259 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1260 * otherwise we consider we are updating */
1261 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1262 situation = REPL_URGENT_ON_DELETE;
1263 } else if (rename_attrs) {
1264 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1266 situation = REPL_URGENT_ON_UPDATE;
1269 if (rmd_is_provided) {
1270 /* In this case the change_replmetadata control was supplied */
1271 /* We check that it's the only attribute that is provided
1272 * (it's a rare case so it's better to keep the code simplier)
1273 * We also check that the highest local_usn is bigger than
1276 if( msg->num_elements != 1 ||
1277 strncmp(msg->elements[0].name,
1278 "replPropertyMetaData", 20) ) {
1279 DEBUG(0,(__location__ ": changereplmetada control called without "\
1280 "a specified replPropertyMetaData attribute or with others\n"));
1281 return LDB_ERR_OPERATIONS_ERROR;
1283 if (situation != REPL_URGENT_ON_UPDATE) {
1284 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1285 return LDB_ERR_OPERATIONS_ERROR;
1287 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1289 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1290 ldb_dn_get_linearized(msg->dn)));
1291 return LDB_ERR_OPERATIONS_ERROR;
1293 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1294 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1295 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1296 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1297 ldb_dn_get_linearized(msg->dn)));
1298 return LDB_ERR_OPERATIONS_ERROR;
1300 *seq_num = find_max_local_usn(omd);
1302 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1303 DSDB_FLAG_NEXT_MODULE |
1304 DSDB_SEARCH_SHOW_RECYCLED |
1305 DSDB_SEARCH_SHOW_EXTENDED_DN |
1306 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1307 DSDB_SEARCH_REVEAL_INTERNALS, req);
1309 if (ret != LDB_SUCCESS) {
1313 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1314 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1319 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1320 if (*seq_num <= db_seq) {
1321 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1322 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1323 (long long)*seq_num, (long long)db_seq));
1324 return LDB_ERR_OPERATIONS_ERROR;
1328 /* search for the existing replPropertyMetaDataBlob. We need
1329 * to use REVEAL and ask for DNs in storage format to support
1330 * the check for values being the same in
1331 * replmd_update_rpmd_element()
1333 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1334 DSDB_FLAG_NEXT_MODULE |
1335 DSDB_SEARCH_SHOW_RECYCLED |
1336 DSDB_SEARCH_SHOW_EXTENDED_DN |
1337 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1338 DSDB_SEARCH_REVEAL_INTERNALS, req);
1339 if (ret != LDB_SUCCESS) {
1343 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1344 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1349 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1351 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1352 ldb_dn_get_linearized(msg->dn)));
1353 return LDB_ERR_OPERATIONS_ERROR;
1356 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1357 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1358 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1359 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1360 ldb_dn_get_linearized(msg->dn)));
1361 return LDB_ERR_OPERATIONS_ERROR;
1364 if (omd.version != 1) {
1365 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1366 omd.version, ldb_dn_get_linearized(msg->dn)));
1367 return LDB_ERR_OPERATIONS_ERROR;
1370 for (i=0; i<msg->num_elements; i++) {
1371 struct ldb_message_element *old_el;
1372 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1373 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1374 our_invocation_id, now, req);
1375 if (ret != LDB_SUCCESS) {
1379 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1380 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1386 * replmd_update_rpmd_element has done an update if the
1389 if (*seq_num != 0) {
1390 struct ldb_val *md_value;
1391 struct ldb_message_element *el;
1393 /*if we are RODC and this is a DRSR update then its ok*/
1394 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
1395 && !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
1396 unsigned instanceType;
1398 ret = samdb_rodc(ldb, rodc);
1399 if (ret != LDB_SUCCESS) {
1400 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1402 ldb_set_errstring(ldb, "RODC modify is forbidden!");
1403 return LDB_ERR_REFERRAL;
1406 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0], "instanceType", INSTANCE_TYPE_WRITE);
1407 if (!(instanceType & INSTANCE_TYPE_WRITE)) {
1408 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
1409 "cannot change replicated attribute on partial replica");
1413 md_value = talloc(msg, struct ldb_val);
1414 if (md_value == NULL) {
1416 return LDB_ERR_OPERATIONS_ERROR;
1419 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1420 if (ret != LDB_SUCCESS) {
1424 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1425 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1426 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1427 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1428 ldb_dn_get_linearized(msg->dn)));
1429 return LDB_ERR_OPERATIONS_ERROR;
1432 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1433 if (ret != LDB_SUCCESS) {
1434 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1435 ldb_dn_get_linearized(msg->dn)));
1440 el->values = md_value;
1447 struct dsdb_dn *dsdb_dn;
1452 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1454 return GUID_compare(pdn1->guid, pdn2->guid);
1457 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1458 unsigned int count, struct GUID *guid,
1461 struct parsed_dn *ret;
1463 if (dn && GUID_all_zero(guid)) {
1464 /* when updating a link using DRS, we sometimes get a
1465 NULL GUID. We then need to try and match by DN */
1466 for (i=0; i<count; i++) {
1467 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1468 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1474 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1479 get a series of message element values as an array of DNs and GUIDs
1480 the result is sorted by GUID
1482 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1483 struct ldb_message_element *el, struct parsed_dn **pdn,
1484 const char *ldap_oid, struct ldb_request *parent)
1487 struct ldb_context *ldb = ldb_module_get_ctx(module);
1494 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1496 ldb_module_oom(module);
1497 return LDB_ERR_OPERATIONS_ERROR;
1500 for (i=0; i<el->num_values; i++) {
1501 struct ldb_val *v = &el->values[i];
1504 struct parsed_dn *p;
1508 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1509 if (p->dsdb_dn == NULL) {
1510 return LDB_ERR_INVALID_DN_SYNTAX;
1513 dn = p->dsdb_dn->dn;
1515 p->guid = talloc(*pdn, struct GUID);
1516 if (p->guid == NULL) {
1517 ldb_module_oom(module);
1518 return LDB_ERR_OPERATIONS_ERROR;
1521 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1522 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1523 /* we got a DN without a GUID - go find the GUID */
1524 int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1525 if (ret != LDB_SUCCESS) {
1526 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1527 ldb_dn_get_linearized(dn));
1528 if (ret == LDB_ERR_NO_SUCH_OBJECT &&
1529 LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE &&
1530 ldb_attr_cmp(el->name, "member") == 0) {
1531 return LDB_ERR_UNWILLING_TO_PERFORM;
1535 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1536 if (ret != LDB_SUCCESS) {
1539 } else if (!NT_STATUS_IS_OK(status)) {
1540 return LDB_ERR_OPERATIONS_ERROR;
1543 /* keep a pointer to the original ldb_val */
1547 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1553 build a new extended DN, including all meta data fields
1555 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1556 RMD_ADDTIME = originating_add_time
1557 RMD_INVOCID = originating_invocation_id
1558 RMD_CHANGETIME = originating_change_time
1559 RMD_ORIGINATING_USN = originating_usn
1560 RMD_LOCAL_USN = local_usn
1561 RMD_VERSION = version
1563 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1564 const struct GUID *invocation_id, uint64_t seq_num,
1565 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1567 struct ldb_dn *dn = dsdb_dn->dn;
1568 const char *tstring, *usn_string, *flags_string;
1569 struct ldb_val tval;
1571 struct ldb_val usnv, local_usnv;
1572 struct ldb_val vers, flagsv;
1575 const char *dnstring;
1577 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1579 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1581 return LDB_ERR_OPERATIONS_ERROR;
1583 tval = data_blob_string_const(tstring);
1585 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1587 return LDB_ERR_OPERATIONS_ERROR;
1589 usnv = data_blob_string_const(usn_string);
1591 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1593 return LDB_ERR_OPERATIONS_ERROR;
1595 local_usnv = data_blob_string_const(usn_string);
1597 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1599 return LDB_ERR_OPERATIONS_ERROR;
1601 vers = data_blob_string_const(vstring);
1603 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1604 if (!NT_STATUS_IS_OK(status)) {
1605 return LDB_ERR_OPERATIONS_ERROR;
1608 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1609 if (!flags_string) {
1610 return LDB_ERR_OPERATIONS_ERROR;
1612 flagsv = data_blob_string_const(flags_string);
1614 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1615 if (ret != LDB_SUCCESS) return ret;
1616 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1617 if (ret != LDB_SUCCESS) return ret;
1618 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1619 if (ret != LDB_SUCCESS) return ret;
1620 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1621 if (ret != LDB_SUCCESS) return ret;
1622 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1623 if (ret != LDB_SUCCESS) return ret;
1624 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1625 if (ret != LDB_SUCCESS) return ret;
1626 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1627 if (ret != LDB_SUCCESS) return ret;
1629 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1630 if (dnstring == NULL) {
1631 return LDB_ERR_OPERATIONS_ERROR;
1633 *v = data_blob_string_const(dnstring);
1638 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1639 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1640 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1641 uint32_t version, bool deleted);
1644 check if any links need upgrading from w2k format
1646 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1648 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1651 for (i=0; i<count; i++) {
1656 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1657 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1661 /* it's an old one that needs upgrading */
1662 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1664 if (ret != LDB_SUCCESS) {
1672 update an extended DN, including all meta data fields
1674 see replmd_build_la_val for value names
1676 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1677 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1678 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1679 uint32_t version, bool deleted)
1681 struct ldb_dn *dn = dsdb_dn->dn;
1682 const char *tstring, *usn_string, *flags_string;
1683 struct ldb_val tval;
1685 struct ldb_val usnv, local_usnv;
1686 struct ldb_val vers, flagsv;
1687 const struct ldb_val *old_addtime;
1688 uint32_t old_version;
1691 const char *dnstring;
1693 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1695 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1697 return LDB_ERR_OPERATIONS_ERROR;
1699 tval = data_blob_string_const(tstring);
1701 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1703 return LDB_ERR_OPERATIONS_ERROR;
1705 usnv = data_blob_string_const(usn_string);
1707 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1709 return LDB_ERR_OPERATIONS_ERROR;
1711 local_usnv = data_blob_string_const(usn_string);
1713 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1714 if (!NT_STATUS_IS_OK(status)) {
1715 return LDB_ERR_OPERATIONS_ERROR;
1718 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1719 if (!flags_string) {
1720 return LDB_ERR_OPERATIONS_ERROR;
1722 flagsv = data_blob_string_const(flags_string);
1724 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1725 if (ret != LDB_SUCCESS) return ret;
1727 /* get the ADDTIME from the original */
1728 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1729 if (old_addtime == NULL) {
1730 old_addtime = &tval;
1732 if (dsdb_dn != old_dsdb_dn ||
1733 ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1734 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1735 if (ret != LDB_SUCCESS) return ret;
1738 /* use our invocation id */
1739 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1740 if (ret != LDB_SUCCESS) return ret;
1742 /* changetime is the current time */
1743 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1744 if (ret != LDB_SUCCESS) return ret;
1746 /* update the USN */
1747 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1748 if (ret != LDB_SUCCESS) return ret;
1750 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1751 if (ret != LDB_SUCCESS) return ret;
1753 /* increase the version by 1 */
1754 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1755 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1756 version = old_version+1;
1758 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1759 vers = data_blob_string_const(vstring);
1760 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1761 if (ret != LDB_SUCCESS) return ret;
1763 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1764 if (dnstring == NULL) {
1765 return LDB_ERR_OPERATIONS_ERROR;
1767 *v = data_blob_string_const(dnstring);
1773 handle adding a linked attribute
1775 static int replmd_modify_la_add(struct ldb_module *module,
1776 const struct dsdb_schema *schema,
1777 struct ldb_message *msg,
1778 struct ldb_message_element *el,
1779 struct ldb_message_element *old_el,
1780 const struct dsdb_attribute *schema_attr,
1783 struct GUID *msg_guid,
1784 struct ldb_request *parent)
1787 struct parsed_dn *dns, *old_dns;
1788 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1790 struct ldb_val *new_values = NULL;
1791 unsigned int num_new_values = 0;
1792 unsigned old_num_values = old_el?old_el->num_values:0;
1793 const struct GUID *invocation_id;
1794 struct ldb_context *ldb = ldb_module_get_ctx(module);
1797 unix_to_nt_time(&now, t);
1799 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1800 if (ret != LDB_SUCCESS) {
1801 talloc_free(tmp_ctx);
1805 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1806 if (ret != LDB_SUCCESS) {
1807 talloc_free(tmp_ctx);
1811 invocation_id = samdb_ntds_invocation_id(ldb);
1812 if (!invocation_id) {
1813 talloc_free(tmp_ctx);
1814 return LDB_ERR_OPERATIONS_ERROR;
1817 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1818 if (ret != LDB_SUCCESS) {
1819 talloc_free(tmp_ctx);
1823 /* for each new value, see if it exists already with the same GUID */
1824 for (i=0; i<el->num_values; i++) {
1825 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1827 /* this is a new linked attribute value */
1828 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1829 if (new_values == NULL) {
1830 ldb_module_oom(module);
1831 talloc_free(tmp_ctx);
1832 return LDB_ERR_OPERATIONS_ERROR;
1834 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1835 invocation_id, seq_num, seq_num, now, 0, false);
1836 if (ret != LDB_SUCCESS) {
1837 talloc_free(tmp_ctx);
1842 /* this is only allowed if the GUID was
1843 previously deleted. */
1844 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1846 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1847 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1848 el->name, GUID_string(tmp_ctx, p->guid));
1849 talloc_free(tmp_ctx);
1850 /* error codes for 'member' need to be
1852 if (ldb_attr_cmp(el->name, "member") == 0) {
1853 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1855 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1858 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1859 invocation_id, seq_num, seq_num, now, 0, false);
1860 if (ret != LDB_SUCCESS) {
1861 talloc_free(tmp_ctx);
1866 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1867 if (ret != LDB_SUCCESS) {
1868 talloc_free(tmp_ctx);
1873 /* add the new ones on to the end of the old values, constructing a new el->values */
1874 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1876 old_num_values+num_new_values);
1877 if (el->values == NULL) {
1878 ldb_module_oom(module);
1879 return LDB_ERR_OPERATIONS_ERROR;
1882 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1883 el->num_values = old_num_values + num_new_values;
1885 talloc_steal(msg->elements, el->values);
1886 talloc_steal(el->values, new_values);
1888 talloc_free(tmp_ctx);
1890 /* we now tell the backend to replace all existing values
1891 with the one we have constructed */
1892 el->flags = LDB_FLAG_MOD_REPLACE;
1899 handle deleting all active linked attributes
1901 static int replmd_modify_la_delete(struct ldb_module *module,
1902 const struct dsdb_schema *schema,
1903 struct ldb_message *msg,
1904 struct ldb_message_element *el,
1905 struct ldb_message_element *old_el,
1906 const struct dsdb_attribute *schema_attr,
1909 struct GUID *msg_guid,
1910 struct ldb_request *parent)
1913 struct parsed_dn *dns, *old_dns;
1914 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1916 const struct GUID *invocation_id;
1917 struct ldb_context *ldb = ldb_module_get_ctx(module);
1920 unix_to_nt_time(&now, t);
1922 /* check if there is nothing to delete */
1923 if ((!old_el || old_el->num_values == 0) &&
1924 el->num_values == 0) {
1928 if (!old_el || old_el->num_values == 0) {
1929 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1932 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1933 if (ret != LDB_SUCCESS) {
1934 talloc_free(tmp_ctx);
1938 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1939 if (ret != LDB_SUCCESS) {
1940 talloc_free(tmp_ctx);
1944 invocation_id = samdb_ntds_invocation_id(ldb);
1945 if (!invocation_id) {
1946 return LDB_ERR_OPERATIONS_ERROR;
1949 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1950 if (ret != LDB_SUCCESS) {
1951 talloc_free(tmp_ctx);
1957 /* see if we are being asked to delete any links that
1958 don't exist or are already deleted */
1959 for (i=0; i<el->num_values; i++) {
1960 struct parsed_dn *p = &dns[i];
1961 struct parsed_dn *p2;
1964 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1966 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1967 el->name, GUID_string(tmp_ctx, p->guid));
1968 if (ldb_attr_cmp(el->name, "member") == 0) {
1969 return LDB_ERR_UNWILLING_TO_PERFORM;
1971 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1974 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1975 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1976 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1977 el->name, GUID_string(tmp_ctx, p->guid));
1978 if (ldb_attr_cmp(el->name, "member") == 0) {
1979 return LDB_ERR_UNWILLING_TO_PERFORM;
1981 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1986 /* for each new value, see if it exists already with the same GUID
1987 if it is not already deleted and matches the delete list then delete it
1989 for (i=0; i<old_el->num_values; i++) {
1990 struct parsed_dn *p = &old_dns[i];
1993 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1997 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1998 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2000 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
2001 invocation_id, seq_num, seq_num, now, 0, true);
2002 if (ret != LDB_SUCCESS) {
2003 talloc_free(tmp_ctx);
2007 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
2008 if (ret != LDB_SUCCESS) {
2009 talloc_free(tmp_ctx);
2014 el->values = talloc_steal(msg->elements, old_el->values);
2015 el->num_values = old_el->num_values;
2017 talloc_free(tmp_ctx);
2019 /* we now tell the backend to replace all existing values
2020 with the one we have constructed */
2021 el->flags = LDB_FLAG_MOD_REPLACE;
2027 handle replacing a linked attribute
2029 static int replmd_modify_la_replace(struct ldb_module *module,
2030 const struct dsdb_schema *schema,
2031 struct ldb_message *msg,
2032 struct ldb_message_element *el,
2033 struct ldb_message_element *old_el,
2034 const struct dsdb_attribute *schema_attr,
2037 struct GUID *msg_guid,
2038 struct ldb_request *parent)
2041 struct parsed_dn *dns, *old_dns;
2042 TALLOC_CTX *tmp_ctx = talloc_new(msg);
2044 const struct GUID *invocation_id;
2045 struct ldb_context *ldb = ldb_module_get_ctx(module);
2046 struct ldb_val *new_values = NULL;
2047 unsigned int num_new_values = 0;
2048 unsigned int old_num_values = old_el?old_el->num_values:0;
2051 unix_to_nt_time(&now, t);
2053 /* check if there is nothing to replace */
2054 if ((!old_el || old_el->num_values == 0) &&
2055 el->num_values == 0) {
2059 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
2060 if (ret != LDB_SUCCESS) {
2061 talloc_free(tmp_ctx);
2065 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
2066 if (ret != LDB_SUCCESS) {
2067 talloc_free(tmp_ctx);
2071 invocation_id = samdb_ntds_invocation_id(ldb);
2072 if (!invocation_id) {
2073 return LDB_ERR_OPERATIONS_ERROR;
2076 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
2077 if (ret != LDB_SUCCESS) {
2078 talloc_free(tmp_ctx);
2082 /* mark all the old ones as deleted */
2083 for (i=0; i<old_num_values; i++) {
2084 struct parsed_dn *old_p = &old_dns[i];
2085 struct parsed_dn *p;
2086 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2088 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2090 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2091 if (ret != LDB_SUCCESS) {
2092 talloc_free(tmp_ctx);
2096 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2098 /* we don't delete it if we are re-adding it */
2102 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2103 invocation_id, seq_num, seq_num, now, 0, true);
2104 if (ret != LDB_SUCCESS) {
2105 talloc_free(tmp_ctx);
2110 /* for each new value, either update its meta-data, or add it
2113 for (i=0; i<el->num_values; i++) {
2114 struct parsed_dn *p = &dns[i], *old_p;
2117 (old_p = parsed_dn_find(old_dns,
2118 old_num_values, p->guid, NULL)) != NULL) {
2119 /* update in place */
2120 ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2121 old_p->dsdb_dn, invocation_id,
2122 seq_num, seq_num, now, 0, false);
2123 if (ret != LDB_SUCCESS) {
2124 talloc_free(tmp_ctx);
2129 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2131 if (new_values == NULL) {
2132 ldb_module_oom(module);
2133 talloc_free(tmp_ctx);
2134 return LDB_ERR_OPERATIONS_ERROR;
2136 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2137 invocation_id, seq_num, seq_num, now, 0, false);
2138 if (ret != LDB_SUCCESS) {
2139 talloc_free(tmp_ctx);
2145 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2146 if (ret != LDB_SUCCESS) {
2147 talloc_free(tmp_ctx);
2152 /* add the new values to the end of old_el */
2153 if (num_new_values != 0) {
2154 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2155 struct ldb_val, old_num_values+num_new_values);
2156 if (el->values == NULL) {
2157 ldb_module_oom(module);
2158 return LDB_ERR_OPERATIONS_ERROR;
2160 memcpy(&el->values[old_num_values], &new_values[0],
2161 sizeof(struct ldb_val)*num_new_values);
2162 el->num_values = old_num_values + num_new_values;
2163 talloc_steal(msg->elements, new_values);
2165 el->values = old_el->values;
2166 el->num_values = old_el->num_values;
2167 talloc_steal(msg->elements, el->values);
2170 talloc_free(tmp_ctx);
2172 /* we now tell the backend to replace all existing values
2173 with the one we have constructed */
2174 el->flags = LDB_FLAG_MOD_REPLACE;
2181 handle linked attributes in modify requests
2183 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2184 struct ldb_message *msg,
2185 uint64_t seq_num, time_t t,
2186 struct ldb_request *parent)
2188 struct ldb_result *res;
2191 struct ldb_context *ldb = ldb_module_get_ctx(module);
2192 struct ldb_message *old_msg;
2194 const struct dsdb_schema *schema;
2195 struct GUID old_guid;
2198 /* there the replmd_update_rpmd code has already
2199 * checked and saw that there are no linked
2204 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2205 /* don't do anything special for linked attributes */
2209 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2210 DSDB_FLAG_NEXT_MODULE |
2211 DSDB_SEARCH_SHOW_RECYCLED |
2212 DSDB_SEARCH_REVEAL_INTERNALS |
2213 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2215 if (ret != LDB_SUCCESS) {
2218 schema = dsdb_get_schema(ldb, res);
2220 return LDB_ERR_OPERATIONS_ERROR;
2223 old_msg = res->msgs[0];
2225 old_guid = samdb_result_guid(old_msg, "objectGUID");
2227 for (i=0; i<msg->num_elements; i++) {
2228 struct ldb_message_element *el = &msg->elements[i];
2229 struct ldb_message_element *old_el, *new_el;
2230 const struct dsdb_attribute *schema_attr
2231 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2233 ldb_asprintf_errstring(ldb,
2234 "%s: attribute %s is not a valid attribute in schema",
2235 __FUNCTION__, el->name);
2236 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2238 if (schema_attr->linkID == 0) {
2241 if ((schema_attr->linkID & 1) == 1) {
2242 if (parent && ldb_request_get_control(parent, DSDB_CONTROL_DBCHECK)) {
2245 /* Odd is for the target. Illegal to modify */
2246 ldb_asprintf_errstring(ldb,
2247 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2248 return LDB_ERR_UNWILLING_TO_PERFORM;
2250 old_el = ldb_msg_find_element(old_msg, el->name);
2251 switch (el->flags & LDB_FLAG_MOD_MASK) {
2252 case LDB_FLAG_MOD_REPLACE:
2253 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2255 case LDB_FLAG_MOD_DELETE:
2256 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2258 case LDB_FLAG_MOD_ADD:
2259 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2262 ldb_asprintf_errstring(ldb,
2263 "invalid flags 0x%x for %s linked attribute",
2264 el->flags, el->name);
2265 return LDB_ERR_UNWILLING_TO_PERFORM;
2267 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2268 ldb_asprintf_errstring(ldb,
2269 "Attribute %s is single valued but more than one value has been supplied",
2271 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2273 el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2278 if (ret != LDB_SUCCESS) {
2282 ldb_msg_remove_attr(old_msg, el->name);
2284 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2285 new_el->num_values = el->num_values;
2286 new_el->values = talloc_steal(msg->elements, el->values);
2288 /* TODO: this relises a bit too heavily on the exact
2289 behaviour of ldb_msg_find_element and
2290 ldb_msg_remove_element */
2291 old_el = ldb_msg_find_element(msg, el->name);
2293 ldb_msg_remove_element(msg, old_el);
2304 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2306 struct samldb_msds_intid_persistant *msds_intid_struct;
2307 struct ldb_context *ldb;
2308 struct replmd_replicated_request *ac;
2309 struct ldb_request *down_req;
2310 struct ldb_message *msg;
2311 time_t t = time(NULL);
2313 bool is_urgent = false, rodc = false;
2314 unsigned int functional_level;
2315 const DATA_BLOB *guid_blob;
2317 /* do not manipulate our control entries */
2318 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2319 return ldb_next_request(module, req);
2322 ldb = ldb_module_get_ctx(module);
2324 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2326 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2327 if ( guid_blob != NULL ) {
2328 ldb_set_errstring(ldb,
2329 "replmd_modify: it's not allowed to change the objectGUID!");
2330 return LDB_ERR_CONSTRAINT_VIOLATION;
2333 ac = replmd_ctx_init(module, req);
2335 return ldb_module_oom(module);
2338 functional_level = dsdb_functional_level(ldb);
2340 /* we have to copy the message as the caller might have it as a const */
2341 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2345 return LDB_ERR_OPERATIONS_ERROR;
2348 ldb_msg_remove_attr(msg, "whenChanged");
2349 ldb_msg_remove_attr(msg, "uSNChanged");
2351 ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2352 msg, &ac->seq_num, t, &is_urgent, &rodc);
2353 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2354 struct loadparm_context *lp_ctx;
2357 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2358 struct loadparm_context);
2360 referral = talloc_asprintf(req,
2362 lpcfg_dnsdomain(lp_ctx),
2363 ldb_dn_get_linearized(msg->dn));
2364 ret = ldb_module_send_referral(req, referral);
2369 if (ret != LDB_SUCCESS) {
2374 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2375 if (ret != LDB_SUCCESS) {
2381 * - replace the old object with the newly constructed one
2384 ac->is_urgent = is_urgent;
2386 ret = ldb_build_mod_req(&down_req, ldb, ac,
2389 ac, replmd_op_callback,
2391 LDB_REQ_SET_LOCATION(down_req);
2392 if (ret != LDB_SUCCESS) {
2397 /* current partition control is needed by "replmd_op_callback" */
2398 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2399 ret = ldb_request_add_control(down_req,
2400 DSDB_CONTROL_CURRENT_PARTITION_OID,
2402 if (ret != LDB_SUCCESS) {
2408 /* If we are in functional level 2000, then
2409 * replmd_modify_handle_linked_attribs will have done
2411 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2412 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2413 if (ret != LDB_SUCCESS) {
2419 talloc_steal(down_req, msg);
2421 /* we only change whenChanged and uSNChanged if the seq_num
2423 if (ac->seq_num != 0) {
2424 ret = add_time_element(msg, "whenChanged", t);
2425 if (ret != LDB_SUCCESS) {
2431 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2432 if (ret != LDB_SUCCESS) {
2439 if (!ldb_dn_compare_base(ac->schema->base_dn, msg->dn)) {
2440 /* Update the usn in the SAMLDB_MSDS_INTID_OPAQUE opaque */
2441 msds_intid_struct = (struct samldb_msds_intid_persistant *) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
2442 if (msds_intid_struct) {
2443 msds_intid_struct->usn = ac->seq_num;
2447 /* go on with the call chain */
2448 return ldb_next_request(module, down_req);
2451 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2454 handle a rename request
2456 On a rename we need to do an extra ldb_modify which sets the
2457 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2459 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2461 struct ldb_context *ldb;
2462 struct replmd_replicated_request *ac;
2464 struct ldb_request *down_req;
2466 /* do not manipulate our control entries */
2467 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2468 return ldb_next_request(module, req);
2471 ldb = ldb_module_get_ctx(module);
2473 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2475 ac = replmd_ctx_init(module, req);
2477 return ldb_module_oom(module);
2480 ret = ldb_build_rename_req(&down_req, ldb, ac,
2481 ac->req->op.rename.olddn,
2482 ac->req->op.rename.newdn,
2484 ac, replmd_rename_callback,
2486 LDB_REQ_SET_LOCATION(down_req);
2487 if (ret != LDB_SUCCESS) {
2492 /* go on with the call chain */
2493 return ldb_next_request(module, down_req);
2496 /* After the rename is compleated, update the whenchanged etc */
2497 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2499 struct ldb_context *ldb;
2500 struct replmd_replicated_request *ac;
2501 struct ldb_request *down_req;
2502 struct ldb_message *msg;
2503 const struct dsdb_attribute *rdn_attr;
2504 const char *rdn_name;
2505 const struct ldb_val *rdn_val;
2506 const char *attrs[5] = { NULL, };
2507 time_t t = time(NULL);
2509 bool is_urgent = false, rodc = false;
2511 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2512 ldb = ldb_module_get_ctx(ac->module);
2514 if (ares->error != LDB_SUCCESS) {
2515 return ldb_module_done(ac->req, ares->controls,
2516 ares->response, ares->error);
2519 if (ares->type != LDB_REPLY_DONE) {
2520 ldb_set_errstring(ldb,
2521 "invalid ldb_reply_type in callback");
2523 return ldb_module_done(ac->req, NULL, NULL,
2524 LDB_ERR_OPERATIONS_ERROR);
2528 * - replace the old object with the newly constructed one
2531 msg = ldb_msg_new(ac);
2534 return LDB_ERR_OPERATIONS_ERROR;
2537 msg->dn = ac->req->op.rename.newdn;
2539 rdn_name = ldb_dn_get_rdn_name(msg->dn);
2540 if (rdn_name == NULL) {
2542 return ldb_module_done(ac->req, NULL, NULL,
2546 /* normalize the rdn attribute name */
2547 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2548 if (rdn_attr == NULL) {
2550 return ldb_module_done(ac->req, NULL, NULL,
2553 rdn_name = rdn_attr->lDAPDisplayName;
2555 rdn_val = ldb_dn_get_rdn_val(msg->dn);
2556 if (rdn_val == NULL) {
2558 return ldb_module_done(ac->req, NULL, NULL,
2562 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2564 return ldb_module_done(ac->req, NULL, NULL,
2567 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2569 return ldb_module_done(ac->req, NULL, NULL,
2572 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2574 return ldb_module_done(ac->req, NULL, NULL,
2577 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2579 return ldb_module_done(ac->req, NULL, NULL,
2584 * here we let replmd_update_rpmd() only search for
2585 * the existing "replPropertyMetaData" and rdn_name attributes.
2587 * We do not want the existing "name" attribute as
2588 * the "name" attribute needs to get the version
2589 * updated on rename even if the rdn value hasn't changed.
2591 * This is the diff of the meta data, for a moved user
2592 * on a w2k8r2 server:
2595 * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2596 * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2597 * replPropertyMetaData: NDR: struct replPropertyMetaDataBlob
2598 * version : 0x00000001 (1)
2599 * reserved : 0x00000000 (0)
2600 * @@ -66,11 +66,11 @@ replPropertyMetaData: NDR: struct re
2601 * local_usn : 0x00000000000037a5 (14245)
2602 * array: struct replPropertyMetaData1
2603 * attid : DRSUAPI_ATTID_name (0x90001)
2604 * - version : 0x00000001 (1)
2605 * - originating_change_time : Wed Feb 9 17:20:49 2011 CET
2606 * + version : 0x00000002 (2)
2607 * + originating_change_time : Wed Apr 6 15:21:01 2011 CEST
2608 * originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2609 * - originating_usn : 0x00000000000037a5 (14245)
2610 * - local_usn : 0x00000000000037a5 (14245)
2611 * + originating_usn : 0x0000000000003834 (14388)
2612 * + local_usn : 0x0000000000003834 (14388)
2613 * array: struct replPropertyMetaData1
2614 * attid : DRSUAPI_ATTID_userAccountControl (0x90008)
2615 * version : 0x00000004 (4)
2617 attrs[0] = "replPropertyMetaData";
2618 attrs[1] = "objectClass";
2619 attrs[2] = "instanceType";
2620 attrs[3] = rdn_name;
2623 ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2624 msg, &ac->seq_num, t, &is_urgent, &rodc);
2625 if (rodc && (ret == LDB_ERR_REFERRAL)) {
2626 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2627 struct loadparm_context *lp_ctx;
2630 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2631 struct loadparm_context);
2633 referral = talloc_asprintf(req,
2635 lpcfg_dnsdomain(lp_ctx),
2636 ldb_dn_get_linearized(olddn));
2637 ret = ldb_module_send_referral(req, referral);
2639 return ldb_module_done(req, NULL, NULL, ret);
2642 if (ret != LDB_SUCCESS) {
2644 return ldb_module_done(ac->req, NULL, NULL, ret);
2647 if (ac->seq_num == 0) {
2649 return ldb_module_done(ac->req, NULL, NULL,
2651 "internal error seq_num == 0"));
2653 ac->is_urgent = is_urgent;
2655 ret = ldb_build_mod_req(&down_req, ldb, ac,
2658 ac, replmd_op_callback,
2660 LDB_REQ_SET_LOCATION(down_req);
2661 if (ret != LDB_SUCCESS) {
2666 /* current partition control is needed by "replmd_op_callback" */
2667 if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2668 ret = ldb_request_add_control(down_req,
2669 DSDB_CONTROL_CURRENT_PARTITION_OID,
2671 if (ret != LDB_SUCCESS) {
2677 talloc_steal(down_req, msg);
2679 ret = add_time_element(msg, "whenChanged", t);
2680 if (ret != LDB_SUCCESS) {
2686 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2687 if (ret != LDB_SUCCESS) {
2693 /* go on with the call chain - do the modify after the rename */
2694 return ldb_next_request(ac->module, down_req);
2698 remove links from objects that point at this object when an object
2701 static int replmd_delete_remove_link(struct ldb_module *module,
2702 const struct dsdb_schema *schema,
2704 struct ldb_message_element *el,
2705 const struct dsdb_attribute *sa,
2706 struct ldb_request *parent)
2709 TALLOC_CTX *tmp_ctx = talloc_new(module);
2710 struct ldb_context *ldb = ldb_module_get_ctx(module);
2712 for (i=0; i<el->num_values; i++) {
2713 struct dsdb_dn *dsdb_dn;
2717 struct ldb_message *msg;
2718 const struct dsdb_attribute *target_attr;
2719 struct ldb_message_element *el2;
2720 struct ldb_val dn_val;
2722 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2726 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2728 talloc_free(tmp_ctx);
2729 return LDB_ERR_OPERATIONS_ERROR;
2732 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2733 if (!NT_STATUS_IS_OK(status)) {
2734 talloc_free(tmp_ctx);
2735 return LDB_ERR_OPERATIONS_ERROR;
2738 /* remove the link */
2739 msg = ldb_msg_new(tmp_ctx);
2741 ldb_module_oom(module);
2742 talloc_free(tmp_ctx);
2743 return LDB_ERR_OPERATIONS_ERROR;
2747 msg->dn = dsdb_dn->dn;
2749 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2750 if (target_attr == NULL) {
2754 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2755 if (ret != LDB_SUCCESS) {
2756 ldb_module_oom(module);
2757 talloc_free(tmp_ctx);
2758 return LDB_ERR_OPERATIONS_ERROR;
2760 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2761 el2->values = &dn_val;
2762 el2->num_values = 1;
2764 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2765 if (ret != LDB_SUCCESS) {
2766 talloc_free(tmp_ctx);
2770 talloc_free(tmp_ctx);
2776 handle update of replication meta data for deletion of objects
2778 This also handles the mapping of delete to a rename operation
2779 to allow deletes to be replicated.
2781 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2783 int ret = LDB_ERR_OTHER;
2784 bool retb, disallow_move_on_delete;
2785 struct ldb_dn *old_dn, *new_dn;
2786 const char *rdn_name;
2787 const struct ldb_val *rdn_value, *new_rdn_value;
2789 struct ldb_context *ldb = ldb_module_get_ctx(module);
2790 const struct dsdb_schema *schema;
2791 struct ldb_message *msg, *old_msg;
2792 struct ldb_message_element *el;
2793 TALLOC_CTX *tmp_ctx;
2794 struct ldb_result *res, *parent_res;
2795 const char *preserved_attrs[] = {
2796 /* yes, this really is a hard coded list. See MS-ADTS
2797 section 3.1.1.5.5.1.1 */
2798 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2799 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2800 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2801 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2802 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2803 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2804 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2805 "whenChanged", NULL};
2806 unsigned int i, el_count = 0;
2807 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2808 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2809 enum deletion_state deletion_state, next_deletion_state;
2812 if (ldb_dn_is_special(req->op.del.dn)) {
2813 return ldb_next_request(module, req);
2816 tmp_ctx = talloc_new(ldb);
2819 return LDB_ERR_OPERATIONS_ERROR;
2822 schema = dsdb_get_schema(ldb, tmp_ctx);
2824 return LDB_ERR_OPERATIONS_ERROR;
2827 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2829 /* we need the complete msg off disk, so we can work out which
2830 attributes need to be removed */
2831 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2832 DSDB_FLAG_NEXT_MODULE |
2833 DSDB_SEARCH_SHOW_RECYCLED |
2834 DSDB_SEARCH_REVEAL_INTERNALS |
2835 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2836 if (ret != LDB_SUCCESS) {
2837 talloc_free(tmp_ctx);
2840 old_msg = res->msgs[0];
2843 ret = dsdb_recyclebin_enabled(module, &enabled);
2844 if (ret != LDB_SUCCESS) {
2845 talloc_free(tmp_ctx);
2849 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2851 deletion_state = OBJECT_TOMBSTONE;
2852 next_deletion_state = OBJECT_REMOVED;
2853 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2854 deletion_state = OBJECT_RECYCLED;
2855 next_deletion_state = OBJECT_REMOVED;
2857 deletion_state = OBJECT_DELETED;
2858 next_deletion_state = OBJECT_RECYCLED;
2861 deletion_state = OBJECT_NOT_DELETED;
2863 next_deletion_state = OBJECT_DELETED;
2865 next_deletion_state = OBJECT_TOMBSTONE;
2869 if (next_deletion_state == OBJECT_REMOVED) {
2870 struct auth_session_info *session_info =
2871 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2872 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2873 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2874 ldb_dn_get_linearized(old_msg->dn));
2875 return LDB_ERR_UNWILLING_TO_PERFORM;
2878 /* it is already deleted - really remove it this time */
2879 talloc_free(tmp_ctx);
2880 return ldb_next_request(module, req);
2883 rdn_name = ldb_dn_get_rdn_name(old_dn);
2884 rdn_value = ldb_dn_get_rdn_val(old_dn);
2885 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2886 talloc_free(tmp_ctx);
2887 return ldb_operr(ldb);
2890 msg = ldb_msg_new(tmp_ctx);
2892 ldb_module_oom(module);
2893 talloc_free(tmp_ctx);
2894 return LDB_ERR_OPERATIONS_ERROR;
2899 if (deletion_state == OBJECT_NOT_DELETED){
2900 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2901 disallow_move_on_delete =
2902 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2903 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2905 /* work out where we will be renaming this object to */
2906 if (!disallow_move_on_delete) {
2907 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2909 if (ret != LDB_SUCCESS) {
2910 /* this is probably an attempted delete on a partition
2911 * that doesn't allow delete operations, such as the
2912 * schema partition */
2913 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2914 ldb_dn_get_linearized(old_dn));
2915 talloc_free(tmp_ctx);
2916 return LDB_ERR_UNWILLING_TO_PERFORM;
2919 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2920 if (new_dn == NULL) {
2921 ldb_module_oom(module);
2922 talloc_free(tmp_ctx);
2923 return LDB_ERR_OPERATIONS_ERROR;
2927 /* get the objects GUID from the search we just did */
2928 guid = samdb_result_guid(old_msg, "objectGUID");
2930 /* Add a formatted child */
2931 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2933 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2934 GUID_string(tmp_ctx, &guid));
2936 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2937 ldb_dn_get_linearized(new_dn)));
2938 talloc_free(tmp_ctx);
2939 return LDB_ERR_OPERATIONS_ERROR;
2942 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2943 if (ret != LDB_SUCCESS) {
2944 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2945 ldb_module_oom(module);
2946 talloc_free(tmp_ctx);
2949 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2953 now we need to modify the object in the following ways:
2955 - add isDeleted=TRUE
2956 - update rDN and name, with new rDN
2957 - remove linked attributes
2958 - remove objectCategory and sAMAccountType
2959 - remove attribs not on the preserved list
2960 - preserved if in above list, or is rDN
2961 - remove all linked attribs from this object
2962 - remove all links from other objects to this object
2963 - add lastKnownParent
2964 - update replPropertyMetaData?
2966 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2969 /* we need the storage form of the parent GUID */
2970 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2971 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2972 DSDB_FLAG_NEXT_MODULE |
2973 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2974 DSDB_SEARCH_REVEAL_INTERNALS|
2975 DSDB_SEARCH_SHOW_RECYCLED, req);
2976 if (ret != LDB_SUCCESS) {
2977 talloc_free(tmp_ctx);
2981 if (deletion_state == OBJECT_NOT_DELETED){
2982 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2983 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2984 if (ret != LDB_SUCCESS) {
2985 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2986 ldb_module_oom(module);
2987 talloc_free(tmp_ctx);
2990 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2993 switch (next_deletion_state){
2995 case OBJECT_DELETED:
2997 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2998 if (ret != LDB_SUCCESS) {
2999 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
3000 ldb_module_oom(module);
3001 talloc_free(tmp_ctx);
3004 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3006 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_REPLACE, NULL);
3007 if (ret != LDB_SUCCESS) {
3008 talloc_free(tmp_ctx);
3009 ldb_module_oom(module);
3013 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_REPLACE, NULL);
3014 if (ret != LDB_SUCCESS) {
3015 talloc_free(tmp_ctx);
3016 ldb_module_oom(module);
3022 case OBJECT_RECYCLED:
3023 case OBJECT_TOMBSTONE:
3026 * we also mark it as recycled, meaning this object can't be
3027 * recovered (we are stripping its attributes).
3028 * This is done only if we have this schema object of course ...
3029 * This behavior is identical to the one of Windows 2008R2 which
3030 * always set the isRecycled attribute, even if the recycle-bin is
3031 * not activated and what ever the forest level is.
3033 if (dsdb_attribute_by_lDAPDisplayName(schema, "isRecycled") != NULL) {
3034 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
3035 if (ret != LDB_SUCCESS) {
3036 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
3037 ldb_module_oom(module);
3038 talloc_free(tmp_ctx);
3041 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
3044 /* work out which of the old attributes we will be removing */
3045 for (i=0; i<old_msg->num_elements; i++) {
3046 const struct dsdb_attribute *sa;
3047 el = &old_msg->elements[i];
3048 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
3050 talloc_free(tmp_ctx);
3051 return LDB_ERR_OPERATIONS_ERROR;
3053 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
3054 /* don't remove the rDN */
3057 if (sa->linkID && (sa->linkID & 1)) {
3059 we have a backlink in this object
3060 that needs to be removed. We're not
3061 allowed to remove it directly
3062 however, so we instead setup a
3063 modify to delete the corresponding
3066 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
3067 if (ret != LDB_SUCCESS) {
3068 talloc_free(tmp_ctx);
3069 return LDB_ERR_OPERATIONS_ERROR;
3071 /* now we continue, which means we
3072 won't remove this backlink
3077 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
3080 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
3081 if (ret != LDB_SUCCESS) {
3082 talloc_free(tmp_ctx);
3083 ldb_module_oom(module);
3093 if (deletion_state == OBJECT_NOT_DELETED) {
3094 const struct dsdb_attribute *sa;
3096 /* work out what the new rdn value is, for updating the
3097 rDN and name fields */
3098 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
3099 if (new_rdn_value == NULL) {
3100 talloc_free(tmp_ctx);
3101 return ldb_operr(ldb);
3104 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
3106 talloc_free(tmp_ctx);
3107 return LDB_ERR_OPERATIONS_ERROR;
3110 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
3112 if (ret != LDB_SUCCESS) {
3113 talloc_free(tmp_ctx);
3116 el->flags = LDB_FLAG_MOD_REPLACE;
3118 el = ldb_msg_find_element(old_msg, "name");
3120 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3121 if (ret != LDB_SUCCESS) {
3122 talloc_free(tmp_ctx);
3125 el->flags = LDB_FLAG_MOD_REPLACE;
3129 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3130 if (ret != LDB_SUCCESS) {
3131 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3132 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3133 talloc_free(tmp_ctx);
3137 if (deletion_state == OBJECT_NOT_DELETED) {
3138 /* now rename onto the new DN */
3139 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3140 if (ret != LDB_SUCCESS){
3141 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3142 ldb_dn_get_linearized(old_dn),
3143 ldb_dn_get_linearized(new_dn),
3144 ldb_errstring(ldb)));
3145 talloc_free(tmp_ctx);
3150 talloc_free(tmp_ctx);
3152 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3157 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3162 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3164 int ret = LDB_ERR_OTHER;
3165 /* TODO: do some error mapping */
3170 static struct replPropertyMetaData1 *
3171 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3172 enum drsuapi_DsAttributeId attid)
3175 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3177 for (i = 0; i < rpmd_ctr->count; i++) {
3178 if (rpmd_ctr->array[i].attid == attid) {
3179 return &rpmd_ctr->array[i];
3187 return true if an update is newer than an existing entry
3188 see section 5.11 of MS-ADTS
3190 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3191 const struct GUID *update_invocation_id,
3192 uint32_t current_version,
3193 uint32_t update_version,
3194 NTTIME current_change_time,
3195 NTTIME update_change_time)
3197 if (update_version != current_version) {
3198 return update_version > current_version;
3200 if (update_change_time != current_change_time) {
3201 return update_change_time > current_change_time;
3203 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3206 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3207 struct replPropertyMetaData1 *new_m)
3209 return replmd_update_is_newer(&cur_m->originating_invocation_id,
3210 &new_m->originating_invocation_id,
3213 cur_m->originating_change_time,
3214 new_m->originating_change_time);
3221 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3223 const struct ldb_val *rdn_val;
3224 const char *rdn_name;
3225 struct ldb_dn *new_dn;
3227 rdn_val = ldb_dn_get_rdn_val(dn);
3228 rdn_name = ldb_dn_get_rdn_name(dn);
3229 if (!rdn_val || !rdn_name) {
3233 new_dn = ldb_dn_copy(mem_ctx, dn);
3238 if (!ldb_dn_remove_child_components(new_dn, 1)) {
3242 if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3244 ldb_dn_escape_value(new_dn, *rdn_val),
3245 GUID_string(new_dn, guid))) {
3254 perform a modify operation which sets the rDN and name attributes to
3255 their current values. This has the effect of changing these
3256 attributes to have been last updated by the current DC. This is
3257 needed to ensure that renames performed as part of conflict
3258 resolution are propogated to other DCs
3260 static int replmd_name_modify(struct replmd_replicated_request *ar,
3261 struct ldb_request *req, struct ldb_dn *dn)
3263 struct ldb_message *msg;
3264 const char *rdn_name;
3265 const struct ldb_val *rdn_val;
3266 const struct dsdb_attribute *rdn_attr;
3269 msg = ldb_msg_new(req);
3275 rdn_name = ldb_dn_get_rdn_name(dn);
3276 if (rdn_name == NULL) {
3280 /* normalize the rdn attribute name */
3281 rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3282 if (rdn_attr == NULL) {
3285 rdn_name = rdn_attr->lDAPDisplayName;
3287 rdn_val = ldb_dn_get_rdn_val(dn);
3288 if (rdn_val == NULL) {
3292 if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3295 if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3298 if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3301 if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3305 ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3306 if (ret != LDB_SUCCESS) {
3307 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3308 ldb_dn_get_linearized(dn),
3309 ldb_errstring(ldb_module_get_ctx(ar->module))));
3319 DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3320 ldb_dn_get_linearized(dn)));
3321 return LDB_ERR_OPERATIONS_ERROR;
3326 callback for conflict DN handling where we have renamed the incoming
3327 record. After renaming it, we need to ensure the change of name and
3328 rDN for the incoming record is seen as an originating update by this DC.
3330 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3332 struct replmd_replicated_request *ar =
3333 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3336 if (ares->error != LDB_SUCCESS) {
3337 /* call the normal callback for everything except success */
3338 return replmd_op_callback(req, ares);
3341 /* perform a modify of the rDN and name of the record */
3342 ret = replmd_name_modify(ar, req, req->op.add.message->dn);
3343 if (ret != LDB_SUCCESS) {
3345 return replmd_op_callback(req, ares);
3348 return replmd_op_callback(req, ares);
3352 callback for replmd_replicated_apply_add() and replmd_replicated_handle_rename()
3353 This copes with the creation of conflict records in the case where
3354 the DN exists, but with a different objectGUID
3356 static int replmd_op_possible_conflict_callback(struct ldb_request *req, struct ldb_reply *ares, int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
3358 struct ldb_dn *conflict_dn;
3359 struct replmd_replicated_request *ar =
3360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3361 struct ldb_result *res;
3362 const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3364 const struct ldb_val *rmd_value, *omd_value;
3365 struct replPropertyMetaDataBlob omd, rmd;
3366 enum ndr_err_code ndr_err;
3367 bool rename_incoming_record, rodc;
3368 struct replPropertyMetaData1 *rmd_name, *omd_name;
3370 if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3371 /* call the normal callback for everything except
3373 return callback(req, ares);
3376 ret = samdb_rodc(ldb_module_get_ctx(ar->module), &rodc);
3377 if (ret != LDB_SUCCESS) {
3381 * we have a conflict, and need to decide if we will keep the
3382 * new record or the old record
3385 switch (req->operation) {
3387 conflict_dn = req->op.add.message->dn;
3390 conflict_dn = req->op.rename.newdn;
3393 return ldb_module_operr(ar->module);
3398 * We are on an RODC, or were a GC for this
3399 * partition, so we have to fail this until
3400 * someone who owns the partition sorts it
3403 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3404 "Conflict adding object '%s' from incoming replication as we are read only for the partition. \n"
3405 " - We must fail the operation until a master for this partition resolves the conflict",
3406 ldb_dn_get_linearized(conflict_dn));
3411 * first we need the replPropertyMetaData attribute from the
3414 ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3416 DSDB_FLAG_NEXT_MODULE |
3417 DSDB_SEARCH_SHOW_DELETED |
3418 DSDB_SEARCH_SHOW_RECYCLED, req);
3419 if (ret != LDB_SUCCESS) {
3420 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3421 ldb_dn_get_linearized(conflict_dn)));
3425 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3426 if (omd_value == NULL) {
3427 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3428 ldb_dn_get_linearized(conflict_dn)));
3432 ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3433 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3434 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3435 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3436 ldb_dn_get_linearized(conflict_dn)));
3441 * and the replPropertyMetaData attribute from the
3444 rmd_value = ldb_msg_find_ldb_val(req->op.add.message, "replPropertyMetaData");
3445 if (rmd_value == NULL) {
3446 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for new record '%s'\n",
3447 ldb_dn_get_linearized(conflict_dn)));
3451 ndr_err = ndr_pull_struct_blob(rmd_value, req, &rmd,
3452 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3453 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3454 DEBUG(0,(__location__ ": Failed to parse new replPropertyMetaData for %s\n",
3455 ldb_dn_get_linearized(conflict_dn)));
3459 /* we decide which is newer based on the RPMD on the name
3460 attribute. See [MS-DRSR] ResolveNameConflict */
3461 rmd_name = replmd_replPropertyMetaData1_find_attid(&rmd, DRSUAPI_ATTID_name);
3462 omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3463 if (!rmd_name || !omd_name) {
3464 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3465 ldb_dn_get_linearized(conflict_dn)));
3469 rename_incoming_record = !(ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) &&
3470 !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3472 if (rename_incoming_record) {
3474 struct ldb_dn *new_dn;
3475 struct ldb_message *new_msg;
3477 if (req->operation == LDB_RENAME) {
3478 DEBUG(0,(__location__ ": Unable to handle incoming renames where this would "
3479 "create a conflict. Incoming record is %s\n",
3480 ldb_dn_get_extended_linearized(req, conflict_dn, 1)));
3484 guid = samdb_result_guid(req->op.add.message, "objectGUID");
3485 if (GUID_all_zero(&guid)) {
3486 DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3487 ldb_dn_get_linearized(conflict_dn)));
3490 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3491 if (new_dn == NULL) {
3492 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3493 ldb_dn_get_linearized(conflict_dn)));
3497 DEBUG(1,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3498 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3500 switch (req->operation) {
3502 /* re-submit the request, but with a different
3503 callback, so we don't loop forever. */
3504 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
3507 DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3508 ldb_dn_get_linearized(conflict_dn)));
3510 new_msg->dn = new_dn;
3511 req->op.add.message = new_msg;
3512 req->callback = replmd_op_name_modify_callback;
3515 req->op.rename.newdn = new_dn;
3516 req->callback = callback;
3519 return ldb_module_operr(ar->module);
3522 return ldb_next_request(ar->module, req);
3524 /* we are renaming the existing record */
3526 struct ldb_dn *new_dn;
3528 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3529 if (GUID_all_zero(&guid)) {
3530 DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3531 ldb_dn_get_linearized(conflict_dn)));
3535 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3536 if (new_dn == NULL) {
3537 DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3538 ldb_dn_get_linearized(conflict_dn)));
3542 DEBUG(1,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3543 ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3545 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3546 DSDB_FLAG_OWN_MODULE, req);
3547 if (ret != LDB_SUCCESS) {
3548 DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3549 ldb_dn_get_linearized(conflict_dn),
3550 ldb_dn_get_linearized(new_dn),
3551 ldb_errstring(ldb_module_get_ctx(ar->module))));
3556 * now we need to ensure that the rename is seen as an
3557 * originating update. We do that with a modify.
3559 ret = replmd_name_modify(ar, req, new_dn);
3560 if (ret != LDB_SUCCESS) {
3564 req->callback = callback;
3566 return ldb_next_request(ar->module, req);
3570 /* on failure do the original callback. This means replication
3571 * will stop with an error, but there is not much else we can
3574 return callback(req, ares);
3578 callback for replmd_replicated_apply_add()
3579 This copes with the creation of conflict records in the case where
3580 the DN exists, but with a different objectGUID
3582 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3584 return replmd_op_possible_conflict_callback(req, ares, replmd_op_callback);
3588 callback for replmd_replicated_handle_rename()
3589 This copes with the creation of conflict records in the case where
3590 the DN exists, but with a different objectGUID
3592 static int replmd_op_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
3594 return replmd_op_possible_conflict_callback(req, ares, ldb_modify_default_callback);
3598 this is called when a new object comes in over DRS
3600 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3602 struct ldb_context *ldb;
3603 struct ldb_request *change_req;
3604 enum ndr_err_code ndr_err;
3605 struct ldb_message *msg;
3606 struct replPropertyMetaDataBlob *md;
3607 struct ldb_val md_value;
3612 * TODO: check if the parent object exist
3616 * TODO: handle the conflict case where an object with the
3620 ldb = ldb_module_get_ctx(ar->module);
3621 msg = ar->objs->objects[ar->index_current].msg;
3622 md = ar->objs->objects[ar->index_current].meta_data;
3624 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3625 if (ret != LDB_SUCCESS) {
3626 return replmd_replicated_request_error(ar, ret);
3629 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3630 if (ret != LDB_SUCCESS) {
3631 return replmd_replicated_request_error(ar, ret);
3634 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3635 if (ret != LDB_SUCCESS) {
3636 return replmd_replicated_request_error(ar, ret);
3639 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3640 if (ret != LDB_SUCCESS) {
3641 return replmd_replicated_request_error(ar, ret);
3644 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3645 if (ret != LDB_SUCCESS) {
3646 return replmd_replicated_request_error(ar, ret);
3649 /* remove any message elements that have zero values */
3650 for (i=0; i<msg->num_elements; i++) {
3651 struct ldb_message_element *el = &msg->elements[i];
3653 if (el->num_values == 0) {
3654 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3656 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3657 msg->num_elements--;
3664 * the meta data array is already sorted by the caller
3666 for (i=0; i < md->ctr.ctr1.count; i++) {
3667 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3669 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3670 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3671 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3672 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3673 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3675 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3676 if (ret != LDB_SUCCESS) {
3677 return replmd_replicated_request_error(ar, ret);
3680 replmd_ldb_message_sort(msg, ar->schema);
3683 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3684 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3688 ret = ldb_build_add_req(&change_req,
3694 replmd_op_add_callback,
3696 LDB_REQ_SET_LOCATION(change_req);
3697 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3699 /* current partition control needed by "repmd_op_callback" */
3700 ret = ldb_request_add_control(change_req,
3701 DSDB_CONTROL_CURRENT_PARTITION_OID,
3703 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3705 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PARTIAL_REPLICA) {
3706 /* this tells the partition module to make it a
3707 partial replica if creating an NC */
3708 ret = ldb_request_add_control(change_req,
3709 DSDB_CONTROL_PARTIAL_REPLICA,
3711 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3714 return ldb_next_request(ar->module, change_req);
3717 static int replmd_replicated_apply_search_for_parent_callback(struct ldb_request *req,
3718 struct ldb_reply *ares)
3720 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3721 struct replmd_replicated_request);
3725 return ldb_module_done(ar->req, NULL, NULL,
3726 LDB_ERR_OPERATIONS_ERROR);
3728 if (ares->error != LDB_SUCCESS &&
3729 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3730 return ldb_module_done(ar->req, ares->controls,
3731 ares->response, ares->error);
3734 switch (ares->type) {
3735 case LDB_REPLY_ENTRY:
3737 struct ldb_message *parent_msg = ares->message;
3738 struct ldb_message *msg = ar->objs->objects[ar->index_current].msg;
3739 struct ldb_dn *parent_dn;
3740 int comp_num = ldb_dn_get_comp_num(msg->dn);
3742 if (!ldb_dn_remove_base_components(msg->dn, comp_num - 1)) {
3744 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3747 if (!ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")
3748 && ldb_msg_check_string_attribute(parent_msg, "isDeleted", "TRUE")) {
3749 /* Per MS-DRSR 4.1.10.6.10
3750 * FindBestParentObject we need to move this
3751 * new object under a deleted object to
3753 struct ldb_dn *nc_root;
3755 ret = dsdb_find_nc_root(ldb_module_get_ctx(ar->module), msg, msg->dn, &nc_root);
3756 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
3757 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3758 "No suitable NC root found for %s. "
3759 "We need to move this object because parent object %s "
3760 "is deleted, but this object is not.",
3761 ldb_dn_get_linearized(msg->dn),
3762 ldb_dn_get_linearized(parent_msg->dn));
3763 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3764 } else if (ret != LDB_SUCCESS) {
3765 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3766 "Unable to find NC root for %s: %s. "
3767 "We need to move this object because parent object %s "
3768 "is deleted, but this object is not.",
3769 ldb_dn_get_linearized(msg->dn),
3770 ldb_errstring(ldb_module_get_ctx(ar->module)),
3771 ldb_dn_get_linearized(parent_msg->dn));
3772 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3775 ret = dsdb_wellknown_dn(ldb_module_get_ctx(ar->module), msg,
3777 DS_GUID_LOSTANDFOUND_CONTAINER,
3779 if (ret != LDB_SUCCESS) {
3780 ldb_asprintf_errstring(ldb_module_get_ctx(ar->module),
3781 "Unable to find LostAndFound Container for %s "
3782 "in partition %s: %s. "
3783 "We need to move this object because parent object %s "
3784 "is deleted, but this object is not.",
3785 ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(nc_root),
3786 ldb_errstring(ldb_module_get_ctx(ar->module)),
3787 ldb_dn_get_linearized(parent_msg->dn));
3788 return ldb_module_done(ar->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
3791 parent_dn = parent_msg->dn;
3793 if (!ldb_dn_add_base(msg->dn, parent_dn)) {
3795 return ldb_module_done(ar->req, NULL, NULL, ldb_module_operr(ar->module));
3799 case LDB_REPLY_REFERRAL:
3800 /* we ignore referrals */
3803 case LDB_REPLY_DONE:
3804 ret = replmd_replicated_apply_add(ar);
3805 if (ret != LDB_SUCCESS) {
3806 return ldb_module_done(ar->req, NULL, NULL, ret);
3815 * Look for the parent object, so we put the new object in the right place
3818 static int replmd_replicated_apply_search_for_parent(struct replmd_replicated_request *ar)
3820 struct ldb_context *ldb;
3824 struct ldb_request *search_req;
3825 static const char *attrs[] = {"isDeleted", NULL};
3827 ldb = ldb_module_get_ctx(ar->module);
3829 if (!ar->objs->objects[ar->index_current].parent_guid_value.data) {
3830 return replmd_replicated_apply_add(ar);
3833 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].parent_guid_value);
3834 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3836 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3837 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3838 talloc_free(tmp_str);
3840 ret = ldb_build_search_req(&search_req,
3843 ar->objs->partition_dn,
3849 replmd_replicated_apply_search_for_parent_callback,
3851 LDB_REQ_SET_LOCATION(search_req);
3853 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3855 if (ret != LDB_SUCCESS) {
3859 return ldb_next_request(ar->module, search_req);
3863 handle renames that come in over DRS replication
3865 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3866 struct ldb_message *msg,
3867 struct replPropertyMetaDataBlob *rmd,
3868 struct replPropertyMetaDataBlob *omd,
3869 struct ldb_request *parent)
3871 struct replPropertyMetaData1 *md_remote;
3872 struct replPropertyMetaData1 *md_local;
3874 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3879 /* now we need to check for double renames. We could have a
3880 * local rename pending which our replication partner hasn't
3881 * received yet. We choose which one wins by looking at the
3882 * attribute stamps on the two objects, the newer one wins
3884 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3885 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3886 /* if there is no name attribute then we have to assume the
3887 object we've received is in fact newer */
3888 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING ||
3889 !md_remote || !md_local ||
3890 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3891 struct ldb_request *req;
3893 TALLOC_CTX *tmp_ctx = talloc_new(msg);
3894 struct ldb_result *res;
3896 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3897 ldb_dn_get_linearized(ar->search_msg->dn),
3898 ldb_dn_get_linearized(msg->dn)));
3901 res = talloc_zero(tmp_ctx, struct ldb_result);
3903 talloc_free(tmp_ctx);
3904 return ldb_oom(ldb_module_get_ctx(ar->module));
3907 /* pass rename to the next module
3908 * so it doesn't appear as an originating update */
3909 ret = ldb_build_rename_req(&req, ldb_module_get_ctx(ar->module), tmp_ctx,
3910 ar->search_msg->dn, msg->dn,
3913 replmd_op_rename_callback,
3915 LDB_REQ_SET_LOCATION(req);
3916 if (ret != LDB_SUCCESS) {
3917 talloc_free(tmp_ctx);
3921 ret = dsdb_request_add_controls(req, DSDB_MODIFY_RELAX);
3922 if (ret != LDB_SUCCESS) {
3923 talloc_free(tmp_ctx);
3927 ret = ldb_next_request(ar->module, req);
3929 if (ret == LDB_SUCCESS) {
3930 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
3933 talloc_free(tmp_ctx);
3937 /* we're going to keep our old object */
3938 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3939 ldb_dn_get_linearized(ar->search_msg->dn),
3940 ldb_dn_get_linearized(msg->dn)));
3945 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3947 struct ldb_context *ldb;
3948 struct ldb_request *change_req;
3949 enum ndr_err_code ndr_err;
3950 struct ldb_message *msg;
3951 struct replPropertyMetaDataBlob *rmd;
3952 struct replPropertyMetaDataBlob omd;
3953 const struct ldb_val *omd_value;
3954 struct replPropertyMetaDataBlob nmd;
3955 struct ldb_val nmd_value;
3958 unsigned int removed_attrs = 0;
3961 ldb = ldb_module_get_ctx(ar->module);
3962 msg = ar->objs->objects[ar->index_current].msg;
3963 rmd = ar->objs->objects[ar->index_current].meta_data;
3967 /* find existing meta data */
3968 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3970 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3971 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3972 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3973 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3974 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3977 if (omd.version != 1) {
3978 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3982 /* handle renames that come in over DRS */
3983 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
3984 if (ret != LDB_SUCCESS) {
3985 ldb_debug(ldb, LDB_DEBUG_FATAL,
3986 "replmd_replicated_request rename %s => %s failed - %s\n",
3987 ldb_dn_get_linearized(ar->search_msg->dn),
3988 ldb_dn_get_linearized(msg->dn),
3989 ldb_errstring(ldb));
3990 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3995 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3996 nmd.ctr.ctr1.array = talloc_array(ar,
3997 struct replPropertyMetaData1,
3998 nmd.ctr.ctr1.count);
3999 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4001 /* first copy the old meta data */
4002 for (i=0; i < omd.ctr.ctr1.count; i++) {
4003 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
4008 /* now merge in the new meta data */
4009 for (i=0; i < rmd->ctr.ctr1.count; i++) {
4012 for (j=0; j < ni; j++) {
4015 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
4019 if (ar->objs->dsdb_repl_flags & DSDB_REPL_FLAG_PRIORITISE_INCOMING) {
4020 /* if we compare equal then do an
4021 update. This is used when a client
4022 asks for a FULL_SYNC, and can be
4023 used to recover a corrupt
4025 cmp = !replmd_replPropertyMetaData1_is_newer(&rmd->ctr.ctr1.array[i],
4026 &nmd.ctr.ctr1.array[j]);
4028 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
4029 &rmd->ctr.ctr1.array[i]);
4032 /* replace the entry */
4033 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
4034 if (ar->seq_num == 0) {
4035 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4036 if (ret != LDB_SUCCESS) {
4037 return replmd_replicated_request_error(ar, ret);
4040 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
4045 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
4046 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
4047 msg->elements[i-removed_attrs].name,
4048 ldb_dn_get_linearized(msg->dn),
4049 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
4052 /* we don't want to apply this change so remove the attribute */
4053 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
4060 if (found) continue;
4062 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
4063 if (ar->seq_num == 0) {
4064 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
4065 if (ret != LDB_SUCCESS) {
4066 return replmd_replicated_request_error(ar, ret);
4069 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
4074 * finally correct the size of the meta_data array
4076 nmd.ctr.ctr1.count = ni;
4079 * the rdn attribute (the alias for the name attribute),
4080 * 'cn' for most objects is the last entry in the meta data array
4083 * sort the new meta data array
4085 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
4086 if (ret != LDB_SUCCESS) {
4091 * check if some replicated attributes left, otherwise skip the ldb_modify() call
4093 if (msg->num_elements == 0) {
4094 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
4097 ar->index_current++;
4098 return replmd_replicated_apply_next(ar);
4101 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
4102 ar->index_current, msg->num_elements);
4104 /* create the meta data value */
4105 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
4106 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
4107 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4108 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4109 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4113 * when we know that we'll modify the record, add the whenChanged, uSNChanged
4114 * and replPopertyMetaData attributes
4116 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
4117 if (ret != LDB_SUCCESS) {
4118 return replmd_replicated_request_error(ar, ret);
4120 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
4121 if (ret != LDB_SUCCESS) {
4122 return replmd_replicated_request_error(ar, ret);
4124 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
4125 if (ret != LDB_SUCCESS) {
4126 return replmd_replicated_request_error(ar, ret);
4129 replmd_ldb_message_sort(msg, ar->schema);
4131 /* we want to replace the old values */
4132 for (i=0; i < msg->num_elements; i++) {
4133 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
4137 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4138 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
4142 ret = ldb_build_mod_req(&change_req,
4150 LDB_REQ_SET_LOCATION(change_req);
4151 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4153 /* current partition control needed by "repmd_op_callback" */
4154 ret = ldb_request_add_control(change_req,
4155 DSDB_CONTROL_CURRENT_PARTITION_OID,
4157 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4159 return ldb_next_request(ar->module, change_req);
4162 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
4163 struct ldb_reply *ares)
4165 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4166 struct replmd_replicated_request);
4170 return ldb_module_done(ar->req, NULL, NULL,
4171 LDB_ERR_OPERATIONS_ERROR);
4173 if (ares->error != LDB_SUCCESS &&
4174 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4175 return ldb_module_done(ar->req, ares->controls,
4176 ares->response, ares->error);
4179 switch (ares->type) {
4180 case LDB_REPLY_ENTRY:
4181 ar->search_msg = talloc_steal(ar, ares->message);
4184 case LDB_REPLY_REFERRAL:
4185 /* we ignore referrals */
4188 case LDB_REPLY_DONE:
4189 if (ar->search_msg != NULL) {
4190 ret = replmd_replicated_apply_merge(ar);
4192 ret = replmd_replicated_apply_search_for_parent(ar);
4194 if (ret != LDB_SUCCESS) {
4195 return ldb_module_done(ar->req, NULL, NULL, ret);
4203 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
4205 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
4207 struct ldb_context *ldb;
4211 struct ldb_request *search_req;
4212 struct ldb_search_options_control *options;
4214 if (ar->index_current >= ar->objs->num_objects) {
4215 /* done with it, go to next stage */
4216 return replmd_replicated_uptodate_vector(ar);
4219 ldb = ldb_module_get_ctx(ar->module);
4220 ar->search_msg = NULL;
4222 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
4223 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4225 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
4226 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4227 talloc_free(tmp_str);
4229 ret = ldb_build_search_req(&search_req,
4238 replmd_replicated_apply_search_callback,
4240 LDB_REQ_SET_LOCATION(search_req);
4242 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
4244 if (ret != LDB_SUCCESS) {
4248 /* we need to cope with cross-partition links, so search for
4249 the GUID over all partitions */
4250 options = talloc(search_req, struct ldb_search_options_control);
4251 if (options == NULL) {
4252 DEBUG(0, (__location__ ": out of memory\n"));
4253 return LDB_ERR_OPERATIONS_ERROR;
4255 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
4257 ret = ldb_request_add_control(search_req,
4258 LDB_CONTROL_SEARCH_OPTIONS_OID,
4260 if (ret != LDB_SUCCESS) {
4264 return ldb_next_request(ar->module, search_req);
4267 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
4268 struct ldb_reply *ares)
4270 struct ldb_context *ldb;
4271 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4272 struct replmd_replicated_request);
4273 ldb = ldb_module_get_ctx(ar->module);
4276 return ldb_module_done(ar->req, NULL, NULL,
4277 LDB_ERR_OPERATIONS_ERROR);
4279 if (ares->error != LDB_SUCCESS) {
4280 return ldb_module_done(ar->req, ares->controls,
4281 ares->response, ares->error);
4284 if (ares->type != LDB_REPLY_DONE) {
4285 ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
4286 return ldb_module_done(ar->req, NULL, NULL,
4287 LDB_ERR_OPERATIONS_ERROR);
4292 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4295 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
4297 struct ldb_context *ldb;
4298 struct ldb_request *change_req;
4299 enum ndr_err_code ndr_err;
4300 struct ldb_message *msg;
4301 struct replUpToDateVectorBlob ouv;
4302 const struct ldb_val *ouv_value;
4303 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
4304 struct replUpToDateVectorBlob nuv;
4305 struct ldb_val nuv_value;
4306 struct ldb_message_element *nuv_el = NULL;
4307 const struct GUID *our_invocation_id;
4308 struct ldb_message_element *orf_el = NULL;
4309 struct repsFromToBlob nrf;
4310 struct ldb_val *nrf_value = NULL;
4311 struct ldb_message_element *nrf_el = NULL;
4315 time_t t = time(NULL);
4318 uint32_t instanceType;
4320 ldb = ldb_module_get_ctx(ar->module);
4321 ruv = ar->objs->uptodateness_vector;
4327 unix_to_nt_time(&now, t);
4329 if (ar->search_msg == NULL) {
4330 /* this happens for a REPL_OBJ call where we are
4331 creating the target object by replicating it. The
4332 subdomain join code does this for the partition DN
4334 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as no target DN\n"));
4335 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4338 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
4339 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
4340 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
4341 ldb_dn_get_linearized(ar->search_msg->dn)));
4342 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
4346 * first create the new replUpToDateVector
4348 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
4350 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
4351 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
4352 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4353 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4354 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4357 if (ouv.version != 2) {
4358 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4363 * the new uptodateness vector will at least
4364 * contain 1 entry, one for the source_dsa
4366 * plus optional values from our old vector and the one from the source_dsa
4368 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
4369 if (ruv) nuv.ctr.ctr2.count += ruv->count;
4370 nuv.ctr.ctr2.cursors = talloc_array(ar,
4371 struct drsuapi_DsReplicaCursor2,
4372 nuv.ctr.ctr2.count);
4373 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4375 /* first copy the old vector */
4376 for (i=0; i < ouv.ctr.ctr2.count; i++) {
4377 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
4381 /* get our invocation_id if we have one already attached to the ldb */
4382 our_invocation_id = samdb_ntds_invocation_id(ldb);
4384 /* merge in the source_dsa vector is available */
4385 for (i=0; (ruv && i < ruv->count); i++) {
4388 if (our_invocation_id &&
4389 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4390 our_invocation_id)) {
4394 for (j=0; j < ni; j++) {
4395 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
4396 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4403 * we update only the highest_usn and not the latest_sync_success time,
4404 * because the last success stands for direct replication
4406 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4407 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
4412 if (found) continue;
4414 /* if it's not there yet, add it */
4415 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4420 * merge in the current highwatermark for the source_dsa
4423 for (j=0; j < ni; j++) {
4424 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
4425 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4432 * here we update the highest_usn and last_sync_success time
4433 * because we're directly replicating from the source_dsa
4435 * and use the tmp_highest_usn because this is what we have just applied
4438 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4439 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
4444 * here we update the highest_usn and last_sync_success time
4445 * because we're directly replicating from the source_dsa
4447 * and use the tmp_highest_usn because this is what we have just applied
4450 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
4451 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4452 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
4457 * finally correct the size of the cursors array
4459 nuv.ctr.ctr2.count = ni;
4464 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4467 * create the change ldb_message
4469 msg = ldb_msg_new(ar);
4470 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4471 msg->dn = ar->search_msg->dn;
4473 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4474 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4475 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4476 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4477 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4479 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4480 if (ret != LDB_SUCCESS) {
4481 return replmd_replicated_request_error(ar, ret);
4483 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4486 * now create the new repsFrom value from the given repsFromTo1 structure
4490 nrf.ctr.ctr1 = *ar->objs->source_dsa;
4491 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
4494 * first see if we already have a repsFrom value for the current source dsa
4495 * if so we'll later replace this value
4497 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4499 for (i=0; i < orf_el->num_values; i++) {
4500 struct repsFromToBlob *trf;
4502 trf = talloc(ar, struct repsFromToBlob);
4503 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4505 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4506 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4507 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4508 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4509 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4512 if (trf->version != 1) {
4513 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4517 * we compare the source dsa objectGUID not the invocation_id
4518 * because we want only one repsFrom value per source dsa
4519 * and when the invocation_id of the source dsa has changed we don't need
4520 * the old repsFrom with the old invocation_id
4522 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4523 &ar->objs->source_dsa->source_dsa_obj_guid)) {
4529 nrf_value = &orf_el->values[i];
4534 * copy over all old values to the new ldb_message
4536 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4537 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4542 * if we haven't found an old repsFrom value for the current source dsa
4543 * we'll add a new value
4546 struct ldb_val zero_value;
4547 ZERO_STRUCT(zero_value);
4548 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4549 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4551 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4554 /* we now fill the value which is already attached to ldb_message */
4555 ndr_err = ndr_push_struct_blob(nrf_value, msg,
4557 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4558 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4559 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4560 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4564 * the ldb_message_element for the attribute, has all the old values and the new one
4565 * so we'll replace the whole attribute with all values
4567 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4569 if (CHECK_DEBUGLVL(4)) {
4570 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4571 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4575 /* prepare the ldb_modify() request */
4576 ret = ldb_build_mod_req(&change_req,
4582 replmd_replicated_uptodate_modify_callback,
4584 LDB_REQ_SET_LOCATION(change_req);
4585 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4587 return ldb_next_request(ar->module, change_req);
4590 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4591 struct ldb_reply *ares)
4593 struct replmd_replicated_request *ar = talloc_get_type(req->context,
4594 struct replmd_replicated_request);
4598 return ldb_module_done(ar->req, NULL, NULL,
4599 LDB_ERR_OPERATIONS_ERROR);
4601 if (ares->error != LDB_SUCCESS &&
4602 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4603 return ldb_module_done(ar->req, ares->controls,
4604 ares->response, ares->error);
4607 switch (ares->type) {
4608 case LDB_REPLY_ENTRY:
4609 ar->search_msg = talloc_steal(ar, ares->message);
4612 case LDB_REPLY_REFERRAL:
4613 /* we ignore referrals */
4616 case LDB_REPLY_DONE:
4617 ret = replmd_replicated_uptodate_modify(ar);
4618 if (ret != LDB_SUCCESS) {
4619 return ldb_module_done(ar->req, NULL, NULL, ret);
4628 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4630 struct ldb_context *ldb;
4632 static const char *attrs[] = {
4633 "replUpToDateVector",
4638 struct ldb_request *search_req;
4640 ldb = ldb_module_get_ctx(ar->module);
4641 ar->search_msg = NULL;
4643 ret = ldb_build_search_req(&search_req,
4646 ar->objs->partition_dn,
4652 replmd_replicated_uptodate_search_callback,
4654 LDB_REQ_SET_LOCATION(search_req);
4655 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4657 return ldb_next_request(ar->module, search_req);
4662 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4664 struct ldb_context *ldb;
4665 struct dsdb_extended_replicated_objects *objs;
4666 struct replmd_replicated_request *ar;
4667 struct ldb_control **ctrls;
4670 struct replmd_private *replmd_private =
4671 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4672 struct dsdb_control_replicated_update *rep_update;
4674 ldb = ldb_module_get_ctx(module);
4676 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4678 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4680 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4681 return LDB_ERR_PROTOCOL_ERROR;
4684 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4685 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4686 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4687 return LDB_ERR_PROTOCOL_ERROR;
4690 ar = replmd_ctx_init(module, req);
4692 return LDB_ERR_OPERATIONS_ERROR;
4694 /* Set the flags to have the replmd_op_callback run over the full set of objects */
4695 ar->apply_mode = true;
4697 ar->schema = dsdb_get_schema(ldb, ar);
4699 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4701 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4702 return LDB_ERR_CONSTRAINT_VIOLATION;
4705 ctrls = req->controls;
4707 if (req->controls) {
4708 req->controls = talloc_memdup(ar, req->controls,
4709 talloc_get_size(req->controls));
4710 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4713 /* This allows layers further down to know if a change came in
4714 over replication and what the replication flags were */
4715 rep_update = talloc_zero(ar, struct dsdb_control_replicated_update);
4716 if (rep_update == NULL) {
4717 return ldb_module_oom(module);
4719 rep_update->dsdb_repl_flags = objs->dsdb_repl_flags;
4721 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, rep_update);
4722 if (ret != LDB_SUCCESS) {
4726 /* If this change contained linked attributes in the body
4727 * (rather than in the links section) we need to update
4728 * backlinks in linked_attributes */
4729 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4730 if (ret != LDB_SUCCESS) {
4734 ar->controls = req->controls;
4735 req->controls = ctrls;
4737 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4739 /* save away the linked attributes for the end of the
4741 for (i=0; i<ar->objs->linked_attributes_count; i++) {
4742 struct la_entry *la_entry;
4744 if (replmd_private->la_ctx == NULL) {
4745 replmd_private->la_ctx = talloc_new(replmd_private);
4747 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4748 if (la_entry == NULL) {
4750 return LDB_ERR_OPERATIONS_ERROR;
4752 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4753 if (la_entry->la == NULL) {
4754 talloc_free(la_entry);
4756 return LDB_ERR_OPERATIONS_ERROR;
4758 *la_entry->la = ar->objs->linked_attributes[i];
4760 /* we need to steal the non-scalars so they stay
4761 around until the end of the transaction */
4762 talloc_steal(la_entry->la, la_entry->la->identifier);
4763 talloc_steal(la_entry->la, la_entry->la->value.blob);
4765 DLIST_ADD(replmd_private->la_list, la_entry);
4768 return replmd_replicated_apply_next(ar);
4772 process one linked attribute structure
4774 static int replmd_process_linked_attribute(struct ldb_module *module,
4775 struct la_entry *la_entry,
4776 struct ldb_request *parent)
4778 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4779 struct ldb_context *ldb = ldb_module_get_ctx(module);
4780 struct ldb_message *msg;
4781 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4782 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4784 const struct dsdb_attribute *attr;
4785 struct dsdb_dn *dsdb_dn;
4786 uint64_t seq_num = 0;
4787 struct ldb_message_element *old_el;
4789 time_t t = time(NULL);
4790 struct ldb_result *res;
4791 const char *attrs[2];
4792 struct parsed_dn *pdn_list, *pdn;
4793 struct GUID guid = GUID_zero();
4795 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
4796 const struct GUID *our_invocation_id;
4799 linked_attributes[0]:
4800 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
4802 identifier: struct drsuapi_DsReplicaObjectIdentifier
4803 __ndr_size : 0x0000003a (58)
4804 __ndr_size_sid : 0x00000000 (0)
4805 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
4807 __ndr_size_dn : 0x00000000 (0)
4809 attid : DRSUAPI_ATTID_member (0x1F)
4810 value: struct drsuapi_DsAttributeValue
4811 __ndr_size : 0x0000007e (126)
4813 blob : DATA_BLOB length=126
4814 flags : 0x00000001 (1)
4815 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
4816 originating_add_time : Wed Sep 2 22:20:01 2009 EST
4817 meta_data: struct drsuapi_DsReplicaMetaData
4818 version : 0x00000015 (21)
4819 originating_change_time : Wed Sep 2 23:39:07 2009 EST
4820 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
4821 originating_usn : 0x000000000001e19c (123292)
4823 (for cases where the link is to a normal DN)
4824 &target: struct drsuapi_DsReplicaObjectIdentifier3
4825 __ndr_size : 0x0000007e (126)
4826 __ndr_size_sid : 0x0000001c (28)
4827 guid : 7639e594-db75-4086-b0d4-67890ae46031
4828 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
4829 __ndr_size_dn : 0x00000022 (34)
4830 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
4833 /* find the attribute being modified */
4834 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
4836 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
4837 talloc_free(tmp_ctx);
4838 return LDB_ERR_OPERATIONS_ERROR;
4841 attrs[0] = attr->lDAPDisplayName;
4844 /* get the existing message from the db for the object with
4845 this GUID, returning attribute being modified. We will then
4846 use this msg as the basis for a modify call */
4847 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
4848 DSDB_FLAG_NEXT_MODULE |
4849 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
4850 DSDB_SEARCH_SHOW_RECYCLED |
4851 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
4852 DSDB_SEARCH_REVEAL_INTERNALS,
4854 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
4855 if (ret != LDB_SUCCESS) {
4856 talloc_free(tmp_ctx);
4859 if (res->count != 1) {
4860 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
4861 GUID_string(tmp_ctx, &la->identifier->guid));
4862 talloc_free(tmp_ctx);
4863 return LDB_ERR_NO_SUCH_OBJECT;
4867 if (msg->num_elements == 0) {
4868 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
4869 if (ret != LDB_SUCCESS) {
4870 ldb_module_oom(module);
4871 talloc_free(tmp_ctx);
4872 return LDB_ERR_OPERATIONS_ERROR;
4875 old_el = &msg->elements[0];
4876 old_el->flags = LDB_FLAG_MOD_REPLACE;
4879 /* parse the existing links */
4880 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
4881 if (ret != LDB_SUCCESS) {
4882 talloc_free(tmp_ctx);
4886 /* get our invocationId */
4887 our_invocation_id = samdb_ntds_invocation_id(ldb);
4888 if (!our_invocation_id) {
4889 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
4890 talloc_free(tmp_ctx);
4891 return LDB_ERR_OPERATIONS_ERROR;
4894 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
4895 if (ret != LDB_SUCCESS) {
4896 talloc_free(tmp_ctx);
4900 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
4901 if (!W_ERROR_IS_OK(status)) {
4902 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
4903 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
4904 return LDB_ERR_OPERATIONS_ERROR;
4907 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
4908 if (!NT_STATUS_IS_OK(ntstatus) && active) {
4909 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
4911 ldb_dn_get_linearized(dsdb_dn->dn),
4912 ldb_dn_get_linearized(msg->dn));
4913 return LDB_ERR_OPERATIONS_ERROR;
4916 /* re-resolve the DN by GUID, as the DRS server may give us an
4918 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
4919 if (ret != LDB_SUCCESS) {
4920 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s\n",
4921 GUID_string(tmp_ctx, &guid),
4922 ldb_dn_get_linearized(dsdb_dn->dn)));
4925 /* see if this link already exists */
4926 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
4928 /* see if this update is newer than what we have already */
4929 struct GUID invocation_id = GUID_zero();
4930 uint32_t version = 0;
4931 uint32_t originating_usn = 0;
4932 NTTIME change_time = 0;
4933 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
4935 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
4936 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
4937 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
4938 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
4940 if (!replmd_update_is_newer(&invocation_id,
4941 &la->meta_data.originating_invocation_id,
4943 la->meta_data.version,
4945 la->meta_data.originating_change_time)) {
4946 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4947 old_el->name, ldb_dn_get_linearized(msg->dn),
4948 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4949 talloc_free(tmp_ctx);
4953 /* get a seq_num for this change */
4954 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4955 if (ret != LDB_SUCCESS) {
4956 talloc_free(tmp_ctx);
4960 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4961 /* remove the existing backlink */
4962 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4963 if (ret != LDB_SUCCESS) {
4964 talloc_free(tmp_ctx);
4969 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4970 &la->meta_data.originating_invocation_id,
4971 la->meta_data.originating_usn, seq_num,
4972 la->meta_data.originating_change_time,
4973 la->meta_data.version,
4975 if (ret != LDB_SUCCESS) {
4976 talloc_free(tmp_ctx);
4981 /* add the new backlink */
4982 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4983 if (ret != LDB_SUCCESS) {
4984 talloc_free(tmp_ctx);
4989 /* get a seq_num for this change */
4990 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4991 if (ret != LDB_SUCCESS) {
4992 talloc_free(tmp_ctx);
4996 old_el->values = talloc_realloc(msg->elements, old_el->values,
4997 struct ldb_val, old_el->num_values+1);
4998 if (!old_el->values) {
4999 ldb_module_oom(module);
5000 return LDB_ERR_OPERATIONS_ERROR;
5002 old_el->num_values++;
5004 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
5005 &la->meta_data.originating_invocation_id,
5006 la->meta_data.originating_usn, seq_num,
5007 la->meta_data.originating_change_time,
5008 la->meta_data.version,
5009 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
5010 if (ret != LDB_SUCCESS) {
5011 talloc_free(tmp_ctx);
5016 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
5018 if (ret != LDB_SUCCESS) {
5019 talloc_free(tmp_ctx);
5025 /* we only change whenChanged and uSNChanged if the seq_num
5027 ret = add_time_element(msg, "whenChanged", t);
5028 if (ret != LDB_SUCCESS) {
5029 talloc_free(tmp_ctx);
5034 ret = add_uint64_element(ldb, msg, "uSNChanged", seq_num);
5035 if (ret != LDB_SUCCESS) {
5036 talloc_free(tmp_ctx);
5041 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
5042 if (old_el == NULL) {
5043 talloc_free(tmp_ctx);
5044 return ldb_operr(ldb);
5047 ret = dsdb_check_single_valued_link(attr, old_el);
5048 if (ret != LDB_SUCCESS) {
5049 talloc_free(tmp_ctx);
5053 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
5055 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
5056 if (ret != LDB_SUCCESS) {
5057 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
5059 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
5060 talloc_free(tmp_ctx);
5064 talloc_free(tmp_ctx);
5069 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
5071 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
5072 return replmd_extended_replicated_objects(module, req);
5075 return ldb_next_request(module, req);
5080 we hook into the transaction operations to allow us to
5081 perform the linked attribute updates at the end of the whole
5082 transaction. This allows a forward linked attribute to be created
5083 before the object is created. During a vampire, w2k8 sends us linked
5084 attributes before the objects they are part of.
5086 static int replmd_start_transaction(struct ldb_module *module)
5088 /* create our private structure for this transaction */
5089 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
5090 struct replmd_private);
5091 replmd_txn_cleanup(replmd_private);
5093 /* free any leftover mod_usn records from cancelled
5095 while (replmd_private->ncs) {
5096 struct nc_entry *e = replmd_private->ncs;
5097 DLIST_REMOVE(replmd_private->ncs, e);
5101 return ldb_next_start_trans(module);
5105 on prepare commit we loop over our queued la_context structures and
5108 static int replmd_prepare_commit(struct ldb_module *module)
5110 struct replmd_private *replmd_private =
5111 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5112 struct la_entry *la, *prev;
5113 struct la_backlink *bl;
5116 /* walk the list backwards, to do the first entry first, as we
5117 * added the entries with DLIST_ADD() which puts them at the
5118 * start of the list */
5119 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
5120 prev = DLIST_PREV(la);
5121 DLIST_REMOVE(replmd_private->la_list, la);
5122 ret = replmd_process_linked_attribute(module, la, NULL);
5123 if (ret != LDB_SUCCESS) {
5124 replmd_txn_cleanup(replmd_private);
5129 /* process our backlink list, creating and deleting backlinks
5131 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
5132 ret = replmd_process_backlink(module, bl, NULL);
5133 if (ret != LDB_SUCCESS) {
5134 replmd_txn_cleanup(replmd_private);
5139 replmd_txn_cleanup(replmd_private);
5141 /* possibly change @REPLCHANGED */
5142 ret = replmd_notify_store(module, NULL);
5143 if (ret != LDB_SUCCESS) {
5147 return ldb_next_prepare_commit(module);
5150 static int replmd_del_transaction(struct ldb_module *module)
5152 struct replmd_private *replmd_private =
5153 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
5154 replmd_txn_cleanup(replmd_private);
5156 return ldb_next_del_trans(module);
5160 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
5161 .name = "repl_meta_data",
5162 .init_context = replmd_init,
5164 .modify = replmd_modify,
5165 .rename = replmd_rename,
5166 .del = replmd_delete,
5167 .extended = replmd_extended,
5168 .start_transaction = replmd_start_transaction,
5169 .prepare_commit = replmd_prepare_commit,
5170 .del_transaction = replmd_del_transaction,
5173 int ldb_repl_meta_data_module_init(const char *version)
5175 LDB_MODULE_CHECK_VERSION(version);
5176 return ldb_register_module(&ldb_repl_meta_data_module_ops);