4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/session.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
516 if (ldb_msg_find_element(msg, attr) != NULL) {
520 s = ldb_timestring(msg, t);
522 return LDB_ERR_OPERATIONS_ERROR;
525 ret = ldb_msg_add_string(msg, attr, s);
526 if (ret != LDB_SUCCESS) {
530 el = ldb_msg_find_element(msg, attr);
531 /* always set as replace. This works because on add ops, the flag
533 el->flags = LDB_FLAG_MOD_REPLACE;
539 add a uint64_t element to a record
541 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
542 const char *attr, uint64_t v)
544 struct ldb_message_element *el;
547 if (ldb_msg_find_element(msg, attr) != NULL) {
551 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
552 if (ret != LDB_SUCCESS) {
556 el = ldb_msg_find_element(msg, attr);
557 /* always set as replace. This works because on add ops, the flag
559 el->flags = LDB_FLAG_MOD_REPLACE;
564 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
565 const struct replPropertyMetaData1 *m2,
566 const uint32_t *rdn_attid)
568 if (m1->attid == m2->attid) {
573 * the rdn attribute should be at the end!
574 * so we need to return a value greater than zero
575 * which means m1 is greater than m2
577 if (m1->attid == *rdn_attid) {
582 * the rdn attribute should be at the end!
583 * so we need to return a value less than zero
584 * which means m2 is greater than m1
586 if (m2->attid == *rdn_attid) {
590 return m1->attid > m2->attid ? 1 : -1;
593 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
594 const struct dsdb_schema *schema,
597 const char *rdn_name;
598 const struct dsdb_attribute *rdn_sa;
600 rdn_name = ldb_dn_get_rdn_name(dn);
602 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
603 return LDB_ERR_OPERATIONS_ERROR;
606 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
607 if (rdn_sa == NULL) {
608 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
609 return LDB_ERR_OPERATIONS_ERROR;
612 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
613 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
615 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
620 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
621 const struct ldb_message_element *e2,
622 const struct dsdb_schema *schema)
624 const struct dsdb_attribute *a1;
625 const struct dsdb_attribute *a2;
628 * TODO: make this faster by caching the dsdb_attribute pointer
629 * on the ldb_messag_element
632 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
633 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
636 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
640 return strcasecmp(e1->name, e2->name);
642 if (a1->attributeID_id == a2->attributeID_id) {
645 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
648 static void replmd_ldb_message_sort(struct ldb_message *msg,
649 const struct dsdb_schema *schema)
651 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
654 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
655 const struct GUID *invocation_id, uint64_t seq_num,
656 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
660 fix up linked attributes in replmd_add.
661 This involves setting up the right meta-data in extended DN
662 components, and creating backlinks to the object
664 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
665 uint64_t seq_num, const struct GUID *invocationId, time_t t,
666 struct GUID *guid, const struct dsdb_attribute *sa)
669 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
670 struct ldb_context *ldb = ldb_module_get_ctx(module);
672 /* We will take a reference to the schema in replmd_add_backlink */
673 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
676 unix_to_nt_time(&now, t);
678 for (i=0; i<el->num_values; i++) {
679 struct ldb_val *v = &el->values[i];
680 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
681 struct GUID target_guid;
685 /* note that the DN already has the extended
686 components from the extended_dn_store module */
687 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
688 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
689 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
694 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
695 if (ret != LDB_SUCCESS) {
696 talloc_free(tmp_ctx);
701 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
702 seq_num, seq_num, now, 0, false);
703 if (ret != LDB_SUCCESS) {
704 talloc_free(tmp_ctx);
708 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
709 if (ret != LDB_SUCCESS) {
710 talloc_free(tmp_ctx);
715 talloc_free(tmp_ctx);
721 intercept add requests
723 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
725 struct ldb_context *ldb;
726 struct ldb_control *control;
727 struct replmd_replicated_request *ac;
728 enum ndr_err_code ndr_err;
729 struct ldb_request *down_req;
730 struct ldb_message *msg;
731 const DATA_BLOB *guid_blob;
733 struct replPropertyMetaDataBlob nmd;
734 struct ldb_val nmd_value;
735 const struct GUID *our_invocation_id;
736 time_t t = time(NULL);
741 unsigned int functional_level;
743 bool allow_add_guid = false;
744 bool remove_current_guid = false;
745 bool is_urgent = false;
746 struct ldb_message_element *objectclass_el;
748 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
749 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
751 allow_add_guid = true;
754 /* do not manipulate our control entries */
755 if (ldb_dn_is_special(req->op.add.message->dn)) {
756 return ldb_next_request(module, req);
759 ldb = ldb_module_get_ctx(module);
761 functional_level = dsdb_functional_level(ldb);
763 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
765 ac = replmd_ctx_init(module, req);
767 return LDB_ERR_OPERATIONS_ERROR;
770 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
771 if ( guid_blob != NULL ) {
772 if( !allow_add_guid ) {
773 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
774 "replmd_add: it's not allowed to add an object with objectGUID\n");
776 return LDB_ERR_UNWILLING_TO_PERFORM;
778 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
779 if ( !NT_STATUS_IS_OK(status)) {
780 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
781 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
783 return LDB_ERR_UNWILLING_TO_PERFORM;
785 /* we remove this attribute as it can be a string and will not be treated
786 correctly and then we will readd it latter on in the good format*/
787 remove_current_guid = true;
791 guid = GUID_random();
794 /* Get a sequence number from the backend */
795 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
796 if (ret != LDB_SUCCESS) {
801 /* get our invocationId */
802 our_invocation_id = samdb_ntds_invocation_id(ldb);
803 if (!our_invocation_id) {
804 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
805 "replmd_add: unable to find invocationId\n");
807 return LDB_ERR_OPERATIONS_ERROR;
810 /* we have to copy the message as the caller might have it as a const */
811 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
815 return LDB_ERR_OPERATIONS_ERROR;
818 /* generated times */
819 unix_to_nt_time(&now, t);
820 time_str = ldb_timestring(msg, t);
824 return LDB_ERR_OPERATIONS_ERROR;
826 if (remove_current_guid) {
827 ldb_msg_remove_attr(msg,"objectGUID");
831 * remove autogenerated attributes
833 ldb_msg_remove_attr(msg, "whenCreated");
834 ldb_msg_remove_attr(msg, "whenChanged");
835 ldb_msg_remove_attr(msg, "uSNCreated");
836 ldb_msg_remove_attr(msg, "uSNChanged");
837 ldb_msg_remove_attr(msg, "replPropertyMetaData");
840 * readd replicated attributes
842 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
843 if (ret != LDB_SUCCESS) {
849 /* build the replication meta_data */
852 nmd.ctr.ctr1.count = msg->num_elements;
853 nmd.ctr.ctr1.array = talloc_array(msg,
854 struct replPropertyMetaData1,
856 if (!nmd.ctr.ctr1.array) {
859 return LDB_ERR_OPERATIONS_ERROR;
862 for (i=0; i < msg->num_elements; i++) {
863 struct ldb_message_element *e = &msg->elements[i];
864 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
865 const struct dsdb_attribute *sa;
867 if (e->name[0] == '@') continue;
869 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
871 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
872 "replmd_add: attribute '%s' not defined in schema\n",
875 return LDB_ERR_NO_SUCH_ATTRIBUTE;
878 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
879 /* if the attribute is not replicated (0x00000001)
880 * or constructed (0x00000004) it has no metadata
885 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
886 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
887 if (ret != LDB_SUCCESS) {
891 /* linked attributes are not stored in
892 replPropertyMetaData in FL above w2k */
896 m->attid = sa->attributeID_id;
898 m->originating_change_time = now;
899 m->originating_invocation_id = *our_invocation_id;
900 m->originating_usn = ac->seq_num;
901 m->local_usn = ac->seq_num;
905 /* fix meta data count */
906 nmd.ctr.ctr1.count = ni;
909 * sort meta data array, and move the rdn attribute entry to the end
911 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
912 if (ret != LDB_SUCCESS) {
917 /* generated NDR encoded values */
918 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
920 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
921 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
924 return LDB_ERR_OPERATIONS_ERROR;
928 * add the autogenerated values
930 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
931 if (ret != LDB_SUCCESS) {
936 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
937 if (ret != LDB_SUCCESS) {
942 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
943 if (ret != LDB_SUCCESS) {
948 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
949 if (ret != LDB_SUCCESS) {
954 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
955 if (ret != LDB_SUCCESS) {
962 * sort the attributes by attid before storing the object
964 replmd_ldb_message_sort(msg, ac->schema);
966 objectclass_el = ldb_msg_find_element(msg, "objectClass");
967 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
968 REPL_URGENT_ON_CREATE);
970 ac->is_urgent = is_urgent;
971 ret = ldb_build_add_req(&down_req, ldb, ac,
974 ac, replmd_op_callback,
977 LDB_REQ_SET_LOCATION(down_req);
978 if (ret != LDB_SUCCESS) {
983 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
984 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
985 if (ret != LDB_SUCCESS) {
991 /* mark the control done */
993 control->critical = 0;
996 /* go on with the call chain */
997 return ldb_next_request(module, down_req);
1002 * update the replPropertyMetaData for one element
1004 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1005 struct ldb_message *msg,
1006 struct ldb_message_element *el,
1007 struct ldb_message_element *old_el,
1008 struct replPropertyMetaDataBlob *omd,
1009 const struct dsdb_schema *schema,
1011 const struct GUID *our_invocation_id,
1015 const struct dsdb_attribute *a;
1016 struct replPropertyMetaData1 *md1;
1018 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1020 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1022 return LDB_ERR_OPERATIONS_ERROR;
1025 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1029 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1030 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1034 for (i=0; i<omd->ctr.ctr1.count; i++) {
1035 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1038 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1039 /* linked attributes are not stored in
1040 replPropertyMetaData in FL above w2k, but we do
1041 raise the seqnum for the object */
1042 if (*seq_num == 0 &&
1043 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1044 return LDB_ERR_OPERATIONS_ERROR;
1049 if (i == omd->ctr.ctr1.count) {
1050 /* we need to add a new one */
1051 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1052 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1053 if (omd->ctr.ctr1.array == NULL) {
1055 return LDB_ERR_OPERATIONS_ERROR;
1057 omd->ctr.ctr1.count++;
1058 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1061 /* Get a new sequence number from the backend. We only do this
1062 * if we have a change that requires a new
1063 * replPropertyMetaData element
1065 if (*seq_num == 0) {
1066 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1067 if (ret != LDB_SUCCESS) {
1068 return LDB_ERR_OPERATIONS_ERROR;
1072 md1 = &omd->ctr.ctr1.array[i];
1074 md1->attid = a->attributeID_id;
1075 md1->originating_change_time = now;
1076 md1->originating_invocation_id = *our_invocation_id;
1077 md1->originating_usn = *seq_num;
1078 md1->local_usn = *seq_num;
1083 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1085 uint32_t count = omd.ctr.ctr1.count;
1088 for (i=0; i < count; i++) {
1089 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1090 if (max < m.local_usn) {
1098 * update the replPropertyMetaData object each time we modify an
1099 * object. This is needed for DRS replication, as the merge on the
1100 * client is based on this object
1102 static int replmd_update_rpmd(struct ldb_module *module,
1103 const struct dsdb_schema *schema,
1104 struct ldb_request *req,
1105 struct ldb_message *msg, uint64_t *seq_num,
1109 const struct ldb_val *omd_value;
1110 enum ndr_err_code ndr_err;
1111 struct replPropertyMetaDataBlob omd;
1114 const struct GUID *our_invocation_id;
1116 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1117 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1118 struct ldb_result *res;
1119 struct ldb_context *ldb;
1120 struct ldb_message_element *objectclass_el;
1121 enum urgent_situation situation;
1122 bool rodc, rmd_is_provided;
1124 ldb = ldb_module_get_ctx(module);
1126 our_invocation_id = samdb_ntds_invocation_id(ldb);
1127 if (!our_invocation_id) {
1128 /* this happens during an initial vampire while
1129 updating the schema */
1130 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1134 unix_to_nt_time(&now, t);
1136 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1137 rmd_is_provided = true;
1139 rmd_is_provided = false;
1142 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1143 * otherwise we consider we are updating */
1144 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1145 situation = REPL_URGENT_ON_DELETE;
1147 situation = REPL_URGENT_ON_UPDATE;
1150 if (rmd_is_provided) {
1151 /* In this case the change_replmetadata control was supplied */
1152 /* We check that it's the only attribute that is provided
1153 * (it's a rare case so it's better to keep the code simplier)
1154 * We also check that the highest local_usn is bigger than
1157 if( msg->num_elements != 1 ||
1158 strncmp(msg->elements[0].name,
1159 "replPropertyMetaData", 20) ) {
1160 DEBUG(0,(__location__ ": changereplmetada control called without "\
1161 "a specified replPropertyMetaData attribute or with others\n"));
1162 return LDB_ERR_OPERATIONS_ERROR;
1164 if (situation == REPL_URGENT_ON_DELETE) {
1165 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1166 return LDB_ERR_OPERATIONS_ERROR;
1168 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1170 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1171 ldb_dn_get_linearized(msg->dn)));
1172 return LDB_ERR_OPERATIONS_ERROR;
1174 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1175 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1176 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1177 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1178 ldb_dn_get_linearized(msg->dn)));
1179 return LDB_ERR_OPERATIONS_ERROR;
1181 *seq_num = find_max_local_usn(omd);
1183 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1184 DSDB_FLAG_NEXT_MODULE |
1185 DSDB_SEARCH_SHOW_RECYCLED |
1186 DSDB_SEARCH_SHOW_EXTENDED_DN |
1187 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1188 DSDB_SEARCH_REVEAL_INTERNALS);
1190 if (ret != LDB_SUCCESS || res->count != 1) {
1191 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1192 ldb_dn_get_linearized(msg->dn)));
1193 return LDB_ERR_OPERATIONS_ERROR;
1196 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1197 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1202 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1203 if (*seq_num <= db_seq) {
1204 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1205 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1206 (long long)*seq_num, (long long)db_seq));
1207 return LDB_ERR_OPERATIONS_ERROR;
1211 /* search for the existing replPropertyMetaDataBlob. We need
1212 * to use REVEAL and ask for DNs in storage format to support
1213 * the check for values being the same in
1214 * replmd_update_rpmd_element()
1216 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1217 DSDB_FLAG_NEXT_MODULE |
1218 DSDB_SEARCH_SHOW_RECYCLED |
1219 DSDB_SEARCH_SHOW_EXTENDED_DN |
1220 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1221 DSDB_SEARCH_REVEAL_INTERNALS);
1222 if (ret != LDB_SUCCESS || res->count != 1) {
1223 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1224 ldb_dn_get_linearized(msg->dn)));
1225 return LDB_ERR_OPERATIONS_ERROR;
1228 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1229 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1234 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1236 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1237 ldb_dn_get_linearized(msg->dn)));
1238 return LDB_ERR_OPERATIONS_ERROR;
1241 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1242 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1243 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1244 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1245 ldb_dn_get_linearized(msg->dn)));
1246 return LDB_ERR_OPERATIONS_ERROR;
1249 if (omd.version != 1) {
1250 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1251 omd.version, ldb_dn_get_linearized(msg->dn)));
1252 return LDB_ERR_OPERATIONS_ERROR;
1255 for (i=0; i<msg->num_elements; i++) {
1256 struct ldb_message_element *old_el;
1257 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1258 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1259 our_invocation_id, now);
1260 if (ret != LDB_SUCCESS) {
1264 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1265 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1271 * replmd_update_rpmd_element has done an update if the
1274 if (*seq_num != 0) {
1275 struct ldb_val *md_value;
1276 struct ldb_message_element *el;
1278 /*if we are RODC and this is a DRSR update then its ok*/
1279 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1280 ret = samdb_rodc(ldb, &rodc);
1281 if (ret != LDB_SUCCESS) {
1282 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1284 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1285 return LDB_ERR_REFERRAL;
1289 md_value = talloc(msg, struct ldb_val);
1290 if (md_value == NULL) {
1292 return LDB_ERR_OPERATIONS_ERROR;
1295 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1296 if (ret != LDB_SUCCESS) {
1300 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1301 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1302 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1303 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1304 ldb_dn_get_linearized(msg->dn)));
1305 return LDB_ERR_OPERATIONS_ERROR;
1308 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1309 if (ret != LDB_SUCCESS) {
1310 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1311 ldb_dn_get_linearized(msg->dn)));
1316 el->values = md_value;
1323 struct dsdb_dn *dsdb_dn;
1328 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1330 return GUID_compare(pdn1->guid, pdn2->guid);
1333 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1335 struct parsed_dn *ret;
1336 if (dn && GUID_all_zero(guid)) {
1337 /* when updating a link using DRS, we sometimes get a
1338 NULL GUID. We then need to try and match by DN */
1340 for (i=0; i<count; i++) {
1341 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1342 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1348 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1353 get a series of message element values as an array of DNs and GUIDs
1354 the result is sorted by GUID
1356 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1357 struct ldb_message_element *el, struct parsed_dn **pdn,
1358 const char *ldap_oid)
1361 struct ldb_context *ldb = ldb_module_get_ctx(module);
1368 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1370 ldb_module_oom(module);
1371 return LDB_ERR_OPERATIONS_ERROR;
1374 for (i=0; i<el->num_values; i++) {
1375 struct ldb_val *v = &el->values[i];
1378 struct parsed_dn *p;
1382 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1383 if (p->dsdb_dn == NULL) {
1384 return LDB_ERR_INVALID_DN_SYNTAX;
1387 dn = p->dsdb_dn->dn;
1389 p->guid = talloc(*pdn, struct GUID);
1390 if (p->guid == NULL) {
1391 ldb_module_oom(module);
1392 return LDB_ERR_OPERATIONS_ERROR;
1395 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1396 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1397 /* we got a DN without a GUID - go find the GUID */
1398 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1399 if (ret != LDB_SUCCESS) {
1400 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1401 ldb_dn_get_linearized(dn));
1404 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1405 if (ret != LDB_SUCCESS) {
1408 } else if (!NT_STATUS_IS_OK(status)) {
1409 return LDB_ERR_OPERATIONS_ERROR;
1412 /* keep a pointer to the original ldb_val */
1416 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1422 build a new extended DN, including all meta data fields
1424 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1425 RMD_ADDTIME = originating_add_time
1426 RMD_INVOCID = originating_invocation_id
1427 RMD_CHANGETIME = originating_change_time
1428 RMD_ORIGINATING_USN = originating_usn
1429 RMD_LOCAL_USN = local_usn
1430 RMD_VERSION = version
1432 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1433 const struct GUID *invocation_id, uint64_t seq_num,
1434 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1436 struct ldb_dn *dn = dsdb_dn->dn;
1437 const char *tstring, *usn_string, *flags_string;
1438 struct ldb_val tval;
1440 struct ldb_val usnv, local_usnv;
1441 struct ldb_val vers, flagsv;
1444 const char *dnstring;
1446 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1448 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1450 return LDB_ERR_OPERATIONS_ERROR;
1452 tval = data_blob_string_const(tstring);
1454 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1456 return LDB_ERR_OPERATIONS_ERROR;
1458 usnv = data_blob_string_const(usn_string);
1460 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1462 return LDB_ERR_OPERATIONS_ERROR;
1464 local_usnv = data_blob_string_const(usn_string);
1466 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1468 return LDB_ERR_OPERATIONS_ERROR;
1470 vers = data_blob_string_const(vstring);
1472 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1473 if (!NT_STATUS_IS_OK(status)) {
1474 return LDB_ERR_OPERATIONS_ERROR;
1477 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1478 if (!flags_string) {
1479 return LDB_ERR_OPERATIONS_ERROR;
1481 flagsv = data_blob_string_const(flags_string);
1483 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1484 if (ret != LDB_SUCCESS) return ret;
1485 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1486 if (ret != LDB_SUCCESS) return ret;
1487 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1488 if (ret != LDB_SUCCESS) return ret;
1489 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1490 if (ret != LDB_SUCCESS) return ret;
1491 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1492 if (ret != LDB_SUCCESS) return ret;
1493 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1494 if (ret != LDB_SUCCESS) return ret;
1495 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1496 if (ret != LDB_SUCCESS) return ret;
1498 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1499 if (dnstring == NULL) {
1500 return LDB_ERR_OPERATIONS_ERROR;
1502 *v = data_blob_string_const(dnstring);
1507 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1508 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1509 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1510 uint32_t version, bool deleted);
1513 check if any links need upgrading from w2k format
1515 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1517 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1520 for (i=0; i<count; i++) {
1525 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1526 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1530 /* it's an old one that needs upgrading */
1531 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1533 if (ret != LDB_SUCCESS) {
1541 update an extended DN, including all meta data fields
1543 see replmd_build_la_val for value names
1545 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1546 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1547 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1548 uint32_t version, bool deleted)
1550 struct ldb_dn *dn = dsdb_dn->dn;
1551 const char *tstring, *usn_string, *flags_string;
1552 struct ldb_val tval;
1554 struct ldb_val usnv, local_usnv;
1555 struct ldb_val vers, flagsv;
1556 const struct ldb_val *old_addtime;
1557 uint32_t old_version;
1560 const char *dnstring;
1562 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1564 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1566 return LDB_ERR_OPERATIONS_ERROR;
1568 tval = data_blob_string_const(tstring);
1570 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1572 return LDB_ERR_OPERATIONS_ERROR;
1574 usnv = data_blob_string_const(usn_string);
1576 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1578 return LDB_ERR_OPERATIONS_ERROR;
1580 local_usnv = data_blob_string_const(usn_string);
1582 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1583 if (!NT_STATUS_IS_OK(status)) {
1584 return LDB_ERR_OPERATIONS_ERROR;
1587 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1588 if (!flags_string) {
1589 return LDB_ERR_OPERATIONS_ERROR;
1591 flagsv = data_blob_string_const(flags_string);
1593 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1594 if (ret != LDB_SUCCESS) return ret;
1596 /* get the ADDTIME from the original */
1597 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1598 if (old_addtime == NULL) {
1599 old_addtime = &tval;
1601 if (dsdb_dn != old_dsdb_dn) {
1602 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1603 if (ret != LDB_SUCCESS) return ret;
1606 /* use our invocation id */
1607 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1608 if (ret != LDB_SUCCESS) return ret;
1610 /* changetime is the current time */
1611 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1612 if (ret != LDB_SUCCESS) return ret;
1614 /* update the USN */
1615 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1616 if (ret != LDB_SUCCESS) return ret;
1618 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1619 if (ret != LDB_SUCCESS) return ret;
1621 /* increase the version by 1 */
1622 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1623 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1624 version = old_version+1;
1626 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1627 vers = data_blob_string_const(vstring);
1628 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1629 if (ret != LDB_SUCCESS) return ret;
1631 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1632 if (dnstring == NULL) {
1633 return LDB_ERR_OPERATIONS_ERROR;
1635 *v = data_blob_string_const(dnstring);
1641 handle adding a linked attribute
1643 static int replmd_modify_la_add(struct ldb_module *module,
1644 const struct dsdb_schema *schema,
1645 struct ldb_message *msg,
1646 struct ldb_message_element *el,
1647 struct ldb_message_element *old_el,
1648 const struct dsdb_attribute *schema_attr,
1651 struct GUID *msg_guid)
1654 struct parsed_dn *dns, *old_dns;
1655 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1657 struct ldb_val *new_values = NULL;
1658 unsigned int num_new_values = 0;
1659 unsigned old_num_values = old_el?old_el->num_values:0;
1660 const struct GUID *invocation_id;
1661 struct ldb_context *ldb = ldb_module_get_ctx(module);
1664 unix_to_nt_time(&now, t);
1666 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1667 if (ret != LDB_SUCCESS) {
1668 talloc_free(tmp_ctx);
1672 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1673 if (ret != LDB_SUCCESS) {
1674 talloc_free(tmp_ctx);
1678 invocation_id = samdb_ntds_invocation_id(ldb);
1679 if (!invocation_id) {
1680 talloc_free(tmp_ctx);
1681 return LDB_ERR_OPERATIONS_ERROR;
1684 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1685 if (ret != LDB_SUCCESS) {
1686 talloc_free(tmp_ctx);
1690 /* for each new value, see if it exists already with the same GUID */
1691 for (i=0; i<el->num_values; i++) {
1692 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1694 /* this is a new linked attribute value */
1695 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1696 if (new_values == NULL) {
1697 ldb_module_oom(module);
1698 talloc_free(tmp_ctx);
1699 return LDB_ERR_OPERATIONS_ERROR;
1701 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1702 invocation_id, seq_num, seq_num, now, 0, false);
1703 if (ret != LDB_SUCCESS) {
1704 talloc_free(tmp_ctx);
1709 /* this is only allowed if the GUID was
1710 previously deleted. */
1711 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1713 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1714 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1715 el->name, GUID_string(tmp_ctx, p->guid));
1716 talloc_free(tmp_ctx);
1717 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1719 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1720 invocation_id, seq_num, seq_num, now, 0, false);
1721 if (ret != LDB_SUCCESS) {
1722 talloc_free(tmp_ctx);
1727 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1728 if (ret != LDB_SUCCESS) {
1729 talloc_free(tmp_ctx);
1734 /* add the new ones on to the end of the old values, constructing a new el->values */
1735 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1737 old_num_values+num_new_values);
1738 if (el->values == NULL) {
1739 ldb_module_oom(module);
1740 return LDB_ERR_OPERATIONS_ERROR;
1743 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1744 el->num_values = old_num_values + num_new_values;
1746 talloc_steal(msg->elements, el->values);
1747 talloc_steal(el->values, new_values);
1749 talloc_free(tmp_ctx);
1751 /* we now tell the backend to replace all existing values
1752 with the one we have constructed */
1753 el->flags = LDB_FLAG_MOD_REPLACE;
1760 handle deleting all active linked attributes
1762 static int replmd_modify_la_delete(struct ldb_module *module,
1763 const struct dsdb_schema *schema,
1764 struct ldb_message *msg,
1765 struct ldb_message_element *el,
1766 struct ldb_message_element *old_el,
1767 const struct dsdb_attribute *schema_attr,
1770 struct GUID *msg_guid)
1773 struct parsed_dn *dns, *old_dns;
1774 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1776 const struct GUID *invocation_id;
1777 struct ldb_context *ldb = ldb_module_get_ctx(module);
1780 unix_to_nt_time(&now, t);
1782 /* check if there is nothing to delete */
1783 if ((!old_el || old_el->num_values == 0) &&
1784 el->num_values == 0) {
1788 if (!old_el || old_el->num_values == 0) {
1789 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1792 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1793 if (ret != LDB_SUCCESS) {
1794 talloc_free(tmp_ctx);
1798 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1799 if (ret != LDB_SUCCESS) {
1800 talloc_free(tmp_ctx);
1804 invocation_id = samdb_ntds_invocation_id(ldb);
1805 if (!invocation_id) {
1806 return LDB_ERR_OPERATIONS_ERROR;
1809 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1810 if (ret != LDB_SUCCESS) {
1811 talloc_free(tmp_ctx);
1817 /* see if we are being asked to delete any links that
1818 don't exist or are already deleted */
1819 for (i=0; i<el->num_values; i++) {
1820 struct parsed_dn *p = &dns[i];
1821 struct parsed_dn *p2;
1824 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1826 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1827 el->name, GUID_string(tmp_ctx, p->guid));
1828 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1830 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1831 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1832 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1833 el->name, GUID_string(tmp_ctx, p->guid));
1834 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1838 /* for each new value, see if it exists already with the same GUID
1839 if it is not already deleted and matches the delete list then delete it
1841 for (i=0; i<old_el->num_values; i++) {
1842 struct parsed_dn *p = &old_dns[i];
1845 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1849 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1850 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1852 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1853 invocation_id, seq_num, seq_num, now, 0, true);
1854 if (ret != LDB_SUCCESS) {
1855 talloc_free(tmp_ctx);
1859 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1860 if (ret != LDB_SUCCESS) {
1861 talloc_free(tmp_ctx);
1866 el->values = talloc_steal(msg->elements, old_el->values);
1867 el->num_values = old_el->num_values;
1869 talloc_free(tmp_ctx);
1871 /* we now tell the backend to replace all existing values
1872 with the one we have constructed */
1873 el->flags = LDB_FLAG_MOD_REPLACE;
1879 handle replacing a linked attribute
1881 static int replmd_modify_la_replace(struct ldb_module *module,
1882 const struct dsdb_schema *schema,
1883 struct ldb_message *msg,
1884 struct ldb_message_element *el,
1885 struct ldb_message_element *old_el,
1886 const struct dsdb_attribute *schema_attr,
1889 struct GUID *msg_guid)
1892 struct parsed_dn *dns, *old_dns;
1893 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1895 const struct GUID *invocation_id;
1896 struct ldb_context *ldb = ldb_module_get_ctx(module);
1897 struct ldb_val *new_values = NULL;
1898 unsigned int num_new_values = 0;
1899 unsigned int old_num_values = old_el?old_el->num_values:0;
1902 unix_to_nt_time(&now, t);
1904 /* check if there is nothing to replace */
1905 if ((!old_el || old_el->num_values == 0) &&
1906 el->num_values == 0) {
1910 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1911 if (ret != LDB_SUCCESS) {
1912 talloc_free(tmp_ctx);
1916 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1917 if (ret != LDB_SUCCESS) {
1918 talloc_free(tmp_ctx);
1922 invocation_id = samdb_ntds_invocation_id(ldb);
1923 if (!invocation_id) {
1924 return LDB_ERR_OPERATIONS_ERROR;
1927 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1928 if (ret != LDB_SUCCESS) {
1929 talloc_free(tmp_ctx);
1933 /* mark all the old ones as deleted */
1934 for (i=0; i<old_num_values; i++) {
1935 struct parsed_dn *old_p = &old_dns[i];
1936 struct parsed_dn *p;
1937 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1939 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1941 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1942 if (ret != LDB_SUCCESS) {
1943 talloc_free(tmp_ctx);
1947 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1949 /* we don't delete it if we are re-adding it */
1953 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1954 invocation_id, seq_num, seq_num, now, 0, true);
1955 if (ret != LDB_SUCCESS) {
1956 talloc_free(tmp_ctx);
1961 /* for each new value, either update its meta-data, or add it
1964 for (i=0; i<el->num_values; i++) {
1965 struct parsed_dn *p = &dns[i], *old_p;
1968 (old_p = parsed_dn_find(old_dns,
1969 old_num_values, p->guid, NULL)) != NULL) {
1970 /* update in place */
1971 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1972 old_p->dsdb_dn, invocation_id,
1973 seq_num, seq_num, now, 0, false);
1974 if (ret != LDB_SUCCESS) {
1975 talloc_free(tmp_ctx);
1980 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1982 if (new_values == NULL) {
1983 ldb_module_oom(module);
1984 talloc_free(tmp_ctx);
1985 return LDB_ERR_OPERATIONS_ERROR;
1987 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1988 invocation_id, seq_num, seq_num, now, 0, false);
1989 if (ret != LDB_SUCCESS) {
1990 talloc_free(tmp_ctx);
1996 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1997 if (ret != LDB_SUCCESS) {
1998 talloc_free(tmp_ctx);
2003 /* add the new values to the end of old_el */
2004 if (num_new_values != 0) {
2005 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2006 struct ldb_val, old_num_values+num_new_values);
2007 if (el->values == NULL) {
2008 ldb_module_oom(module);
2009 return LDB_ERR_OPERATIONS_ERROR;
2011 memcpy(&el->values[old_num_values], &new_values[0],
2012 sizeof(struct ldb_val)*num_new_values);
2013 el->num_values = old_num_values + num_new_values;
2014 talloc_steal(msg->elements, new_values);
2016 el->values = old_el->values;
2017 el->num_values = old_el->num_values;
2018 talloc_steal(msg->elements, el->values);
2021 talloc_free(tmp_ctx);
2023 /* we now tell the backend to replace all existing values
2024 with the one we have constructed */
2025 el->flags = LDB_FLAG_MOD_REPLACE;
2032 handle linked attributes in modify requests
2034 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2035 struct ldb_message *msg,
2036 uint64_t seq_num, time_t t)
2038 struct ldb_result *res;
2041 struct ldb_context *ldb = ldb_module_get_ctx(module);
2042 struct ldb_message *old_msg;
2044 const struct dsdb_schema *schema;
2045 struct GUID old_guid;
2048 /* there the replmd_update_rpmd code has already
2049 * checked and saw that there are no linked
2054 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2055 /* don't do anything special for linked attributes */
2059 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2060 DSDB_FLAG_NEXT_MODULE |
2061 DSDB_SEARCH_SHOW_RECYCLED |
2062 DSDB_SEARCH_REVEAL_INTERNALS |
2063 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2064 if (ret != LDB_SUCCESS) {
2067 schema = dsdb_get_schema(ldb, res);
2069 return LDB_ERR_OPERATIONS_ERROR;
2072 old_msg = res->msgs[0];
2074 old_guid = samdb_result_guid(old_msg, "objectGUID");
2076 for (i=0; i<msg->num_elements; i++) {
2077 struct ldb_message_element *el = &msg->elements[i];
2078 struct ldb_message_element *old_el, *new_el;
2079 const struct dsdb_attribute *schema_attr
2080 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2082 ldb_asprintf_errstring(ldb,
2083 "attribute %s is not a valid attribute in schema", el->name);
2084 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2086 if (schema_attr->linkID == 0) {
2089 if ((schema_attr->linkID & 1) == 1) {
2090 /* Odd is for the target. Illegal to modify */
2091 ldb_asprintf_errstring(ldb,
2092 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2093 return LDB_ERR_UNWILLING_TO_PERFORM;
2095 old_el = ldb_msg_find_element(old_msg, el->name);
2096 switch (el->flags & LDB_FLAG_MOD_MASK) {
2097 case LDB_FLAG_MOD_REPLACE:
2098 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2100 case LDB_FLAG_MOD_DELETE:
2101 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2103 case LDB_FLAG_MOD_ADD:
2104 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2107 ldb_asprintf_errstring(ldb,
2108 "invalid flags 0x%x for %s linked attribute",
2109 el->flags, el->name);
2110 return LDB_ERR_UNWILLING_TO_PERFORM;
2112 if (ret != LDB_SUCCESS) {
2116 ldb_msg_remove_attr(old_msg, el->name);
2118 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2119 new_el->num_values = el->num_values;
2120 new_el->values = talloc_steal(msg->elements, el->values);
2122 /* TODO: this relises a bit too heavily on the exact
2123 behaviour of ldb_msg_find_element and
2124 ldb_msg_remove_element */
2125 old_el = ldb_msg_find_element(msg, el->name);
2127 ldb_msg_remove_element(msg, old_el);
2138 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2140 struct ldb_context *ldb;
2141 struct replmd_replicated_request *ac;
2142 struct ldb_request *down_req;
2143 struct ldb_message *msg;
2144 time_t t = time(NULL);
2146 bool is_urgent = false;
2147 struct loadparm_context *lp_ctx;
2149 unsigned int functional_level;
2150 const DATA_BLOB *guid_blob;
2152 /* do not manipulate our control entries */
2153 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2154 return ldb_next_request(module, req);
2157 ldb = ldb_module_get_ctx(module);
2158 functional_level = dsdb_functional_level(ldb);
2160 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2161 struct loadparm_context);
2163 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2165 ac = replmd_ctx_init(module, req);
2167 return LDB_ERR_OPERATIONS_ERROR;
2170 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2171 if ( guid_blob != NULL ) {
2172 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
2173 "replmd_modify: it's not allowed to change the objectGUID\n");
2175 return LDB_ERR_CONSTRAINT_VIOLATION;
2178 /* we have to copy the message as the caller might have it as a const */
2179 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2183 return LDB_ERR_OPERATIONS_ERROR;
2186 ldb_msg_remove_attr(msg, "whenChanged");
2187 ldb_msg_remove_attr(msg, "uSNChanged");
2189 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2190 if (ret == LDB_ERR_REFERRAL) {
2191 referral = talloc_asprintf(req,
2193 lpcfg_dnsdomain(lp_ctx),
2194 ldb_dn_get_linearized(msg->dn));
2195 ret = ldb_module_send_referral(req, referral);
2197 return ldb_module_done(req, NULL, NULL, ret);
2200 if (ret != LDB_SUCCESS) {
2205 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2206 if (ret != LDB_SUCCESS) {
2212 * - replace the old object with the newly constructed one
2215 ac->is_urgent = is_urgent;
2217 ret = ldb_build_mod_req(&down_req, ldb, ac,
2220 ac, replmd_op_callback,
2222 LDB_REQ_SET_LOCATION(down_req);
2223 if (ret != LDB_SUCCESS) {
2228 /* If we are in functional level 2000, then
2229 * replmd_modify_handle_linked_attribs will have done
2231 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2232 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2233 if (ret != LDB_SUCCESS) {
2239 talloc_steal(down_req, msg);
2241 /* we only change whenChanged and uSNChanged if the seq_num
2243 if (ac->seq_num != 0) {
2244 ret = add_time_element(msg, "whenChanged", t);
2245 if (ret != LDB_SUCCESS) {
2250 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2251 if (ret != LDB_SUCCESS) {
2257 /* go on with the call chain */
2258 return ldb_next_request(module, down_req);
2261 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2264 handle a rename request
2266 On a rename we need to do an extra ldb_modify which sets the
2267 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2269 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2271 struct ldb_context *ldb;
2272 struct replmd_replicated_request *ac;
2274 struct ldb_request *down_req;
2276 /* do not manipulate our control entries */
2277 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2278 return ldb_next_request(module, req);
2281 ldb = ldb_module_get_ctx(module);
2283 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2285 ac = replmd_ctx_init(module, req);
2287 return LDB_ERR_OPERATIONS_ERROR;
2289 ret = ldb_build_rename_req(&down_req, ldb, ac,
2290 ac->req->op.rename.olddn,
2291 ac->req->op.rename.newdn,
2293 ac, replmd_rename_callback,
2295 LDB_REQ_SET_LOCATION(down_req);
2296 if (ret != LDB_SUCCESS) {
2301 /* go on with the call chain */
2302 return ldb_next_request(module, down_req);
2305 /* After the rename is compleated, update the whenchanged etc */
2306 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2308 struct ldb_context *ldb;
2309 struct replmd_replicated_request *ac;
2310 struct ldb_request *down_req;
2311 struct ldb_message *msg;
2312 time_t t = time(NULL);
2315 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2316 ldb = ldb_module_get_ctx(ac->module);
2318 if (ares->error != LDB_SUCCESS) {
2319 return ldb_module_done(ac->req, ares->controls,
2320 ares->response, ares->error);
2323 if (ares->type != LDB_REPLY_DONE) {
2324 ldb_set_errstring(ldb,
2325 "invalid ldb_reply_type in callback");
2327 return ldb_module_done(ac->req, NULL, NULL,
2328 LDB_ERR_OPERATIONS_ERROR);
2331 /* Get a sequence number from the backend */
2332 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2333 if (ret != LDB_SUCCESS) {
2338 * - replace the old object with the newly constructed one
2341 msg = ldb_msg_new(ac);
2344 return LDB_ERR_OPERATIONS_ERROR;
2347 msg->dn = ac->req->op.rename.newdn;
2349 ret = ldb_build_mod_req(&down_req, ldb, ac,
2352 ac, replmd_op_callback,
2354 LDB_REQ_SET_LOCATION(down_req);
2355 if (ret != LDB_SUCCESS) {
2359 talloc_steal(down_req, msg);
2361 ret = add_time_element(msg, "whenChanged", t);
2362 if (ret != LDB_SUCCESS) {
2367 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2368 if (ret != LDB_SUCCESS) {
2373 /* go on with the call chain - do the modify after the rename */
2374 return ldb_next_request(ac->module, down_req);
2378 remove links from objects that point at this object when an object
2381 static int replmd_delete_remove_link(struct ldb_module *module,
2382 const struct dsdb_schema *schema,
2384 struct ldb_message_element *el,
2385 const struct dsdb_attribute *sa)
2388 TALLOC_CTX *tmp_ctx = talloc_new(module);
2389 struct ldb_context *ldb = ldb_module_get_ctx(module);
2391 for (i=0; i<el->num_values; i++) {
2392 struct dsdb_dn *dsdb_dn;
2396 struct ldb_message *msg;
2397 const struct dsdb_attribute *target_attr;
2398 struct ldb_message_element *el2;
2399 struct ldb_val dn_val;
2401 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2405 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2407 talloc_free(tmp_ctx);
2408 return LDB_ERR_OPERATIONS_ERROR;
2411 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2412 if (!NT_STATUS_IS_OK(status)) {
2413 talloc_free(tmp_ctx);
2414 return LDB_ERR_OPERATIONS_ERROR;
2417 /* remove the link */
2418 msg = ldb_msg_new(tmp_ctx);
2420 ldb_module_oom(module);
2421 talloc_free(tmp_ctx);
2422 return LDB_ERR_OPERATIONS_ERROR;
2426 msg->dn = dsdb_dn->dn;
2428 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2429 if (target_attr == NULL) {
2433 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2434 if (ret != LDB_SUCCESS) {
2435 ldb_module_oom(module);
2436 talloc_free(tmp_ctx);
2437 return LDB_ERR_OPERATIONS_ERROR;
2439 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2440 el2->values = &dn_val;
2441 el2->num_values = 1;
2443 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2444 if (ret != LDB_SUCCESS) {
2445 talloc_free(tmp_ctx);
2449 talloc_free(tmp_ctx);
2455 handle update of replication meta data for deletion of objects
2457 This also handles the mapping of delete to a rename operation
2458 to allow deletes to be replicated.
2460 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2462 int ret = LDB_ERR_OTHER;
2463 bool retb, disallow_move_on_delete;
2464 struct ldb_dn *old_dn, *new_dn;
2465 const char *rdn_name;
2466 const struct ldb_val *rdn_value, *new_rdn_value;
2468 struct ldb_context *ldb = ldb_module_get_ctx(module);
2469 const struct dsdb_schema *schema;
2470 struct ldb_message *msg, *old_msg;
2471 struct ldb_message_element *el;
2472 TALLOC_CTX *tmp_ctx;
2473 struct ldb_result *res, *parent_res;
2474 const char *preserved_attrs[] = {
2475 /* yes, this really is a hard coded list. See MS-ADTS
2476 section 3.1.1.5.5.1.1 */
2477 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2478 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2479 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2480 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2481 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2482 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2483 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2484 "whenChanged", NULL};
2485 unsigned int i, el_count = 0;
2486 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2487 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2488 enum deletion_state deletion_state, next_deletion_state;
2491 if (ldb_dn_is_special(req->op.del.dn)) {
2492 return ldb_next_request(module, req);
2495 tmp_ctx = talloc_new(ldb);
2498 return LDB_ERR_OPERATIONS_ERROR;
2501 schema = dsdb_get_schema(ldb, tmp_ctx);
2503 return LDB_ERR_OPERATIONS_ERROR;
2506 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2508 /* we need the complete msg off disk, so we can work out which
2509 attributes need to be removed */
2510 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2511 DSDB_FLAG_NEXT_MODULE |
2512 DSDB_SEARCH_SHOW_RECYCLED |
2513 DSDB_SEARCH_REVEAL_INTERNALS |
2514 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2515 if (ret != LDB_SUCCESS) {
2516 talloc_free(tmp_ctx);
2519 old_msg = res->msgs[0];
2522 ret = dsdb_recyclebin_enabled(module, &enabled);
2523 if (ret != LDB_SUCCESS) {
2524 talloc_free(tmp_ctx);
2528 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2530 deletion_state = OBJECT_TOMBSTONE;
2531 next_deletion_state = OBJECT_REMOVED;
2532 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2533 deletion_state = OBJECT_RECYCLED;
2534 next_deletion_state = OBJECT_REMOVED;
2536 deletion_state = OBJECT_DELETED;
2537 next_deletion_state = OBJECT_RECYCLED;
2540 deletion_state = OBJECT_NOT_DELETED;
2542 next_deletion_state = OBJECT_DELETED;
2544 next_deletion_state = OBJECT_TOMBSTONE;
2548 if (next_deletion_state == OBJECT_REMOVED) {
2549 struct auth_session_info *session_info =
2550 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2551 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2552 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2553 ldb_dn_get_linearized(old_msg->dn));
2554 return LDB_ERR_UNWILLING_TO_PERFORM;
2557 /* it is already deleted - really remove it this time */
2558 talloc_free(tmp_ctx);
2559 return ldb_next_request(module, req);
2562 rdn_name = ldb_dn_get_rdn_name(old_dn);
2563 rdn_value = ldb_dn_get_rdn_val(old_dn);
2565 msg = ldb_msg_new(tmp_ctx);
2567 ldb_module_oom(module);
2568 talloc_free(tmp_ctx);
2569 return LDB_ERR_OPERATIONS_ERROR;
2574 if (deletion_state == OBJECT_NOT_DELETED){
2575 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2576 disallow_move_on_delete =
2577 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2578 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2580 /* work out where we will be renaming this object to */
2581 if (!disallow_move_on_delete) {
2582 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2584 if (ret != LDB_SUCCESS) {
2585 /* this is probably an attempted delete on a partition
2586 * that doesn't allow delete operations, such as the
2587 * schema partition */
2588 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2589 ldb_dn_get_linearized(old_dn));
2590 talloc_free(tmp_ctx);
2591 return LDB_ERR_UNWILLING_TO_PERFORM;
2594 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2595 if (new_dn == NULL) {
2596 ldb_module_oom(module);
2597 talloc_free(tmp_ctx);
2598 return LDB_ERR_OPERATIONS_ERROR;
2602 /* get the objects GUID from the search we just did */
2603 guid = samdb_result_guid(old_msg, "objectGUID");
2605 /* Add a formatted child */
2606 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2609 GUID_string(tmp_ctx, &guid));
2611 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2612 ldb_dn_get_linearized(new_dn)));
2613 talloc_free(tmp_ctx);
2614 return LDB_ERR_OPERATIONS_ERROR;
2617 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2618 if (ret != LDB_SUCCESS) {
2619 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2620 ldb_module_oom(module);
2621 talloc_free(tmp_ctx);
2624 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2628 now we need to modify the object in the following ways:
2630 - add isDeleted=TRUE
2631 - update rDN and name, with new rDN
2632 - remove linked attributes
2633 - remove objectCategory and sAMAccountType
2634 - remove attribs not on the preserved list
2635 - preserved if in above list, or is rDN
2636 - remove all linked attribs from this object
2637 - remove all links from other objects to this object
2638 - add lastKnownParent
2639 - update replPropertyMetaData?
2641 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2644 /* we need the storage form of the parent GUID */
2645 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2646 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2647 DSDB_FLAG_NEXT_MODULE |
2648 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2649 DSDB_SEARCH_REVEAL_INTERNALS|
2650 DSDB_SEARCH_SHOW_RECYCLED);
2651 if (ret != LDB_SUCCESS) {
2652 talloc_free(tmp_ctx);
2656 if (deletion_state == OBJECT_NOT_DELETED){
2657 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2658 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2659 if (ret != LDB_SUCCESS) {
2660 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2661 ldb_module_oom(module);
2662 talloc_free(tmp_ctx);
2665 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2668 switch (next_deletion_state){
2670 case OBJECT_DELETED:
2672 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2673 if (ret != LDB_SUCCESS) {
2674 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2675 ldb_module_oom(module);
2676 talloc_free(tmp_ctx);
2679 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2681 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2682 if (ret != LDB_SUCCESS) {
2683 talloc_free(tmp_ctx);
2684 ldb_module_oom(module);
2688 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2689 if (ret != LDB_SUCCESS) {
2690 talloc_free(tmp_ctx);
2691 ldb_module_oom(module);
2697 case OBJECT_RECYCLED:
2698 case OBJECT_TOMBSTONE:
2700 /* we also mark it as recycled, meaning this object can't be
2701 recovered (we are stripping its attributes) */
2702 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2703 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2704 if (ret != LDB_SUCCESS) {
2705 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2706 ldb_module_oom(module);
2707 talloc_free(tmp_ctx);
2710 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2713 /* work out which of the old attributes we will be removing */
2714 for (i=0; i<old_msg->num_elements; i++) {
2715 const struct dsdb_attribute *sa;
2716 el = &old_msg->elements[i];
2717 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2719 talloc_free(tmp_ctx);
2720 return LDB_ERR_OPERATIONS_ERROR;
2722 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2723 /* don't remove the rDN */
2726 if (sa->linkID && sa->linkID & 1) {
2727 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2728 if (ret != LDB_SUCCESS) {
2729 talloc_free(tmp_ctx);
2730 return LDB_ERR_OPERATIONS_ERROR;
2734 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2737 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2738 if (ret != LDB_SUCCESS) {
2739 talloc_free(tmp_ctx);
2740 ldb_module_oom(module);
2750 if (deletion_state == OBJECT_NOT_DELETED) {
2751 const struct dsdb_attribute *sa;
2753 /* work out what the new rdn value is, for updating the
2754 rDN and name fields */
2755 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2757 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2759 talloc_free(tmp_ctx);
2760 return LDB_ERR_OPERATIONS_ERROR;
2763 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2765 if (ret != LDB_SUCCESS) {
2766 talloc_free(tmp_ctx);
2769 el->flags = LDB_FLAG_MOD_REPLACE;
2771 el = ldb_msg_find_element(old_msg, "name");
2773 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2774 if (ret != LDB_SUCCESS) {
2775 talloc_free(tmp_ctx);
2778 el->flags = LDB_FLAG_MOD_REPLACE;
2782 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2783 if (ret != LDB_SUCCESS) {
2784 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2785 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2786 talloc_free(tmp_ctx);
2790 if (deletion_state == OBJECT_NOT_DELETED) {
2791 /* now rename onto the new DN */
2792 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2793 if (ret != LDB_SUCCESS){
2794 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2795 ldb_dn_get_linearized(old_dn),
2796 ldb_dn_get_linearized(new_dn),
2797 ldb_errstring(ldb)));
2798 talloc_free(tmp_ctx);
2803 talloc_free(tmp_ctx);
2805 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2810 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2815 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2817 int ret = LDB_ERR_OTHER;
2818 /* TODO: do some error mapping */
2822 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2824 struct ldb_context *ldb;
2825 struct ldb_request *change_req;
2826 enum ndr_err_code ndr_err;
2827 struct ldb_message *msg;
2828 struct replPropertyMetaDataBlob *md;
2829 struct ldb_val md_value;
2834 * TODO: check if the parent object exist
2838 * TODO: handle the conflict case where an object with the
2842 ldb = ldb_module_get_ctx(ar->module);
2843 msg = ar->objs->objects[ar->index_current].msg;
2844 md = ar->objs->objects[ar->index_current].meta_data;
2846 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2847 if (ret != LDB_SUCCESS) {
2848 return replmd_replicated_request_error(ar, ret);
2851 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2852 if (ret != LDB_SUCCESS) {
2853 return replmd_replicated_request_error(ar, ret);
2856 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2857 if (ret != LDB_SUCCESS) {
2858 return replmd_replicated_request_error(ar, ret);
2861 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2862 if (ret != LDB_SUCCESS) {
2863 return replmd_replicated_request_error(ar, ret);
2866 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2867 if (ret != LDB_SUCCESS) {
2868 return replmd_replicated_request_error(ar, ret);
2871 /* remove any message elements that have zero values */
2872 for (i=0; i<msg->num_elements; i++) {
2873 struct ldb_message_element *el = &msg->elements[i];
2875 if (el->num_values == 0) {
2876 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2878 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2879 msg->num_elements--;
2886 * the meta data array is already sorted by the caller
2888 for (i=0; i < md->ctr.ctr1.count; i++) {
2889 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2891 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2892 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2893 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2894 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2895 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2897 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2898 if (ret != LDB_SUCCESS) {
2899 return replmd_replicated_request_error(ar, ret);
2902 replmd_ldb_message_sort(msg, ar->schema);
2905 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2906 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2910 ret = ldb_build_add_req(&change_req,
2918 LDB_REQ_SET_LOCATION(change_req);
2919 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2921 return ldb_next_request(ar->module, change_req);
2925 return true if an update is newer than an existing entry
2926 see section 5.11 of MS-ADTS
2928 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2929 const struct GUID *update_invocation_id,
2930 uint32_t current_version,
2931 uint32_t update_version,
2932 uint32_t current_usn,
2933 uint32_t update_usn,
2934 NTTIME current_change_time,
2935 NTTIME update_change_time)
2937 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2938 if (update_usn != current_usn) {
2939 return update_usn >= current_usn;
2942 if (update_version != current_version) {
2943 return update_version >= current_version;
2945 if (update_change_time != current_change_time) {
2946 return update_change_time >= current_change_time;
2948 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2951 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2952 struct replPropertyMetaData1 *new_m)
2954 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2955 &new_m->originating_invocation_id,
2958 cur_m->originating_usn,
2959 new_m->originating_usn,
2960 cur_m->originating_change_time,
2961 new_m->originating_change_time);
2964 static struct replPropertyMetaData1 *
2965 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2966 enum drsuapi_DsAttributeId attid)
2969 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2971 for (i = 0; i < rpmd_ctr->count; i++) {
2972 if (rpmd_ctr->array[i].attid == attid) {
2973 return &rpmd_ctr->array[i];
2981 handle renames that come in over DRS replication
2983 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
2984 struct ldb_message *msg,
2985 struct replPropertyMetaDataBlob *rmd,
2986 struct replPropertyMetaDataBlob *omd)
2988 struct replPropertyMetaData1 *md_remote;
2989 struct replPropertyMetaData1 *md_local;
2991 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
2996 /* now we need to check for double renames. We could have a
2997 * local rename pending which our replication partner hasn't
2998 * received yet. We choose which one wins by looking at the
2999 * attribute stamps on the two objects, the newer one wins
3001 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3002 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3003 /* if there is no name attribute then we have to assume the
3004 object we've received is in fact newer */
3005 if (!md_remote || !md_local ||
3006 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3007 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3008 ldb_dn_get_linearized(ar->search_msg->dn),
3009 ldb_dn_get_linearized(msg->dn)));
3010 /* pass rename to the next module
3011 * so it doesn't appear as an originating update */
3012 return dsdb_module_rename(ar->module,
3013 ar->search_msg->dn, msg->dn,
3014 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
3017 /* we're going to keep our old object */
3018 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3019 ldb_dn_get_linearized(ar->search_msg->dn),
3020 ldb_dn_get_linearized(msg->dn)));
3025 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3027 struct ldb_context *ldb;
3028 struct ldb_request *change_req;
3029 enum ndr_err_code ndr_err;
3030 struct ldb_message *msg;
3031 struct replPropertyMetaDataBlob *rmd;
3032 struct replPropertyMetaDataBlob omd;
3033 const struct ldb_val *omd_value;
3034 struct replPropertyMetaDataBlob nmd;
3035 struct ldb_val nmd_value;
3038 unsigned int removed_attrs = 0;
3041 ldb = ldb_module_get_ctx(ar->module);
3042 msg = ar->objs->objects[ar->index_current].msg;
3043 rmd = ar->objs->objects[ar->index_current].meta_data;
3047 /* find existing meta data */
3048 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3050 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3051 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3052 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3053 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3054 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3057 if (omd.version != 1) {
3058 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3062 /* handle renames that come in over DRS */
3063 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd);
3064 if (ret != LDB_SUCCESS) {
3065 ldb_debug(ldb, LDB_DEBUG_FATAL,
3066 "replmd_replicated_request rename %s => %s failed - %s\n",
3067 ldb_dn_get_linearized(ar->search_msg->dn),
3068 ldb_dn_get_linearized(msg->dn),
3069 ldb_errstring(ldb));
3070 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3075 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3076 nmd.ctr.ctr1.array = talloc_array(ar,
3077 struct replPropertyMetaData1,
3078 nmd.ctr.ctr1.count);
3079 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3081 /* first copy the old meta data */
3082 for (i=0; i < omd.ctr.ctr1.count; i++) {
3083 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3087 /* now merge in the new meta data */
3088 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3091 for (j=0; j < ni; j++) {
3094 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3098 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3099 &rmd->ctr.ctr1.array[i]);
3101 /* replace the entry */
3102 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3107 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3108 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3109 msg->elements[i-removed_attrs].name,
3110 ldb_dn_get_linearized(msg->dn),
3111 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3114 /* we don't want to apply this change so remove the attribute */
3115 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3122 if (found) continue;
3124 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3129 * finally correct the size of the meta_data array
3131 nmd.ctr.ctr1.count = ni;
3134 * the rdn attribute (the alias for the name attribute),
3135 * 'cn' for most objects is the last entry in the meta data array
3138 * sort the new meta data array
3140 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3141 if (ret != LDB_SUCCESS) {
3146 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3148 if (msg->num_elements == 0) {
3149 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3152 ar->index_current++;
3153 return replmd_replicated_apply_next(ar);
3156 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3157 ar->index_current, msg->num_elements);
3159 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3160 if (ret != LDB_SUCCESS) {
3161 return replmd_replicated_request_error(ar, ret);
3164 for (i=0; i<ni; i++) {
3165 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3168 /* create the meta data value */
3169 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3170 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3171 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3172 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3173 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3177 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3178 * and replPopertyMetaData attributes
3180 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3181 if (ret != LDB_SUCCESS) {
3182 return replmd_replicated_request_error(ar, ret);
3184 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3185 if (ret != LDB_SUCCESS) {
3186 return replmd_replicated_request_error(ar, ret);
3188 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3189 if (ret != LDB_SUCCESS) {
3190 return replmd_replicated_request_error(ar, ret);
3193 replmd_ldb_message_sort(msg, ar->schema);
3195 /* we want to replace the old values */
3196 for (i=0; i < msg->num_elements; i++) {
3197 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3201 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3202 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3206 ret = ldb_build_mod_req(&change_req,
3214 LDB_REQ_SET_LOCATION(change_req);
3215 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3217 return ldb_next_request(ar->module, change_req);
3220 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3221 struct ldb_reply *ares)
3223 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3224 struct replmd_replicated_request);
3228 return ldb_module_done(ar->req, NULL, NULL,
3229 LDB_ERR_OPERATIONS_ERROR);
3231 if (ares->error != LDB_SUCCESS &&
3232 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3233 return ldb_module_done(ar->req, ares->controls,
3234 ares->response, ares->error);
3237 switch (ares->type) {
3238 case LDB_REPLY_ENTRY:
3239 ar->search_msg = talloc_steal(ar, ares->message);
3242 case LDB_REPLY_REFERRAL:
3243 /* we ignore referrals */
3246 case LDB_REPLY_DONE:
3247 if (ar->search_msg != NULL) {
3248 ret = replmd_replicated_apply_merge(ar);
3250 ret = replmd_replicated_apply_add(ar);
3252 if (ret != LDB_SUCCESS) {
3253 return ldb_module_done(ar->req, NULL, NULL, ret);
3261 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3263 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3265 struct ldb_context *ldb;
3269 struct ldb_request *search_req;
3270 struct ldb_search_options_control *options;
3272 if (ar->index_current >= ar->objs->num_objects) {
3273 /* done with it, go to next stage */
3274 return replmd_replicated_uptodate_vector(ar);
3277 ldb = ldb_module_get_ctx(ar->module);
3278 ar->search_msg = NULL;
3280 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3281 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3283 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3284 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3285 talloc_free(tmp_str);
3287 ret = ldb_build_search_req(&search_req,
3296 replmd_replicated_apply_search_callback,
3298 LDB_REQ_SET_LOCATION(search_req);
3300 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3302 if (ret != LDB_SUCCESS) {
3306 /* we need to cope with cross-partition links, so search for
3307 the GUID over all partitions */
3308 options = talloc(search_req, struct ldb_search_options_control);
3309 if (options == NULL) {
3310 DEBUG(0, (__location__ ": out of memory\n"));
3311 return LDB_ERR_OPERATIONS_ERROR;
3313 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3315 ret = ldb_request_add_control(search_req,
3316 LDB_CONTROL_SEARCH_OPTIONS_OID,
3318 if (ret != LDB_SUCCESS) {
3322 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3324 return ldb_next_request(ar->module, search_req);
3327 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3328 struct ldb_reply *ares)
3330 struct ldb_context *ldb;
3331 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3332 struct replmd_replicated_request);
3333 ldb = ldb_module_get_ctx(ar->module);
3336 return ldb_module_done(ar->req, NULL, NULL,
3337 LDB_ERR_OPERATIONS_ERROR);
3339 if (ares->error != LDB_SUCCESS) {
3340 return ldb_module_done(ar->req, ares->controls,
3341 ares->response, ares->error);
3344 if (ares->type != LDB_REPLY_DONE) {
3345 ldb_set_errstring(ldb, "Invalid reply type\n!");
3346 return ldb_module_done(ar->req, NULL, NULL,
3347 LDB_ERR_OPERATIONS_ERROR);
3352 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3355 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3357 struct ldb_context *ldb;
3358 struct ldb_request *change_req;
3359 enum ndr_err_code ndr_err;
3360 struct ldb_message *msg;
3361 struct replUpToDateVectorBlob ouv;
3362 const struct ldb_val *ouv_value;
3363 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3364 struct replUpToDateVectorBlob nuv;
3365 struct ldb_val nuv_value;
3366 struct ldb_message_element *nuv_el = NULL;
3367 const struct GUID *our_invocation_id;
3368 struct ldb_message_element *orf_el = NULL;
3369 struct repsFromToBlob nrf;
3370 struct ldb_val *nrf_value = NULL;
3371 struct ldb_message_element *nrf_el = NULL;
3375 time_t t = time(NULL);
3378 uint32_t instanceType;
3380 ldb = ldb_module_get_ctx(ar->module);
3381 ruv = ar->objs->uptodateness_vector;
3387 unix_to_nt_time(&now, t);
3389 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3390 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3391 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3392 ldb_dn_get_linearized(ar->search_msg->dn)));
3393 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3397 * first create the new replUpToDateVector
3399 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3401 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3402 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3403 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3404 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3405 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3408 if (ouv.version != 2) {
3409 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3414 * the new uptodateness vector will at least
3415 * contain 1 entry, one for the source_dsa
3417 * plus optional values from our old vector and the one from the source_dsa
3419 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3420 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3421 nuv.ctr.ctr2.cursors = talloc_array(ar,
3422 struct drsuapi_DsReplicaCursor2,
3423 nuv.ctr.ctr2.count);
3424 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3426 /* first copy the old vector */
3427 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3428 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3432 /* get our invocation_id if we have one already attached to the ldb */
3433 our_invocation_id = samdb_ntds_invocation_id(ldb);
3435 /* merge in the source_dsa vector is available */
3436 for (i=0; (ruv && i < ruv->count); i++) {
3439 if (our_invocation_id &&
3440 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3441 our_invocation_id)) {
3445 for (j=0; j < ni; j++) {
3446 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3447 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3454 * we update only the highest_usn and not the latest_sync_success time,
3455 * because the last success stands for direct replication
3457 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3458 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3463 if (found) continue;
3465 /* if it's not there yet, add it */
3466 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3471 * merge in the current highwatermark for the source_dsa
3474 for (j=0; j < ni; j++) {
3475 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3476 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3483 * here we update the highest_usn and last_sync_success time
3484 * because we're directly replicating from the source_dsa
3486 * and use the tmp_highest_usn because this is what we have just applied
3489 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3490 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3495 * here we update the highest_usn and last_sync_success time
3496 * because we're directly replicating from the source_dsa
3498 * and use the tmp_highest_usn because this is what we have just applied
3501 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3502 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3503 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3508 * finally correct the size of the cursors array
3510 nuv.ctr.ctr2.count = ni;
3515 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3518 * create the change ldb_message
3520 msg = ldb_msg_new(ar);
3521 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3522 msg->dn = ar->search_msg->dn;
3524 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3525 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3526 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3527 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3528 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3530 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3531 if (ret != LDB_SUCCESS) {
3532 return replmd_replicated_request_error(ar, ret);
3534 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3537 * now create the new repsFrom value from the given repsFromTo1 structure
3541 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3542 /* and fix some values... */
3543 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3544 nrf.ctr.ctr1.last_success = now;
3545 nrf.ctr.ctr1.last_attempt = now;
3546 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3547 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3550 * first see if we already have a repsFrom value for the current source dsa
3551 * if so we'll later replace this value
3553 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3555 for (i=0; i < orf_el->num_values; i++) {
3556 struct repsFromToBlob *trf;
3558 trf = talloc(ar, struct repsFromToBlob);
3559 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3561 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3562 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3563 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3564 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3565 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3568 if (trf->version != 1) {
3569 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3573 * we compare the source dsa objectGUID not the invocation_id
3574 * because we want only one repsFrom value per source dsa
3575 * and when the invocation_id of the source dsa has changed we don't need
3576 * the old repsFrom with the old invocation_id
3578 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3579 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3585 nrf_value = &orf_el->values[i];
3590 * copy over all old values to the new ldb_message
3592 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3593 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3598 * if we haven't found an old repsFrom value for the current source dsa
3599 * we'll add a new value
3602 struct ldb_val zero_value;
3603 ZERO_STRUCT(zero_value);
3604 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3605 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3607 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3610 /* we now fill the value which is already attached to ldb_message */
3611 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3613 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3614 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3615 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3616 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3620 * the ldb_message_element for the attribute, has all the old values and the new one
3621 * so we'll replace the whole attribute with all values
3623 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3626 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3627 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3631 /* prepare the ldb_modify() request */
3632 ret = ldb_build_mod_req(&change_req,
3638 replmd_replicated_uptodate_modify_callback,
3640 LDB_REQ_SET_LOCATION(change_req);
3641 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3643 return ldb_next_request(ar->module, change_req);
3646 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3647 struct ldb_reply *ares)
3649 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3650 struct replmd_replicated_request);
3654 return ldb_module_done(ar->req, NULL, NULL,
3655 LDB_ERR_OPERATIONS_ERROR);
3657 if (ares->error != LDB_SUCCESS &&
3658 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3659 return ldb_module_done(ar->req, ares->controls,
3660 ares->response, ares->error);
3663 switch (ares->type) {
3664 case LDB_REPLY_ENTRY:
3665 ar->search_msg = talloc_steal(ar, ares->message);
3668 case LDB_REPLY_REFERRAL:
3669 /* we ignore referrals */
3672 case LDB_REPLY_DONE:
3673 if (ar->search_msg == NULL) {
3674 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3676 ret = replmd_replicated_uptodate_modify(ar);
3678 if (ret != LDB_SUCCESS) {
3679 return ldb_module_done(ar->req, NULL, NULL, ret);
3688 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3690 struct ldb_context *ldb;
3692 static const char *attrs[] = {
3693 "replUpToDateVector",
3698 struct ldb_request *search_req;
3700 ldb = ldb_module_get_ctx(ar->module);
3701 ar->search_msg = NULL;
3703 ret = ldb_build_search_req(&search_req,
3706 ar->objs->partition_dn,
3712 replmd_replicated_uptodate_search_callback,
3714 LDB_REQ_SET_LOCATION(search_req);
3715 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3717 return ldb_next_request(ar->module, search_req);
3722 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3724 struct ldb_context *ldb;
3725 struct dsdb_extended_replicated_objects *objs;
3726 struct replmd_replicated_request *ar;
3727 struct ldb_control **ctrls;
3730 struct replmd_private *replmd_private =
3731 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3733 ldb = ldb_module_get_ctx(module);
3735 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3737 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3739 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3740 return LDB_ERR_PROTOCOL_ERROR;
3743 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3744 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3745 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3746 return LDB_ERR_PROTOCOL_ERROR;
3749 ar = replmd_ctx_init(module, req);
3751 return LDB_ERR_OPERATIONS_ERROR;
3753 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3754 ar->apply_mode = true;
3756 ar->schema = dsdb_get_schema(ldb, ar);
3758 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3760 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3761 return LDB_ERR_CONSTRAINT_VIOLATION;
3764 ctrls = req->controls;
3766 if (req->controls) {
3767 req->controls = talloc_memdup(ar, req->controls,
3768 talloc_get_size(req->controls));
3769 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3772 /* This allows layers further down to know if a change came in over replication */
3773 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3774 if (ret != LDB_SUCCESS) {
3778 /* If this change contained linked attributes in the body
3779 * (rather than in the links section) we need to update
3780 * backlinks in linked_attributes */
3781 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3782 if (ret != LDB_SUCCESS) {
3786 ar->controls = req->controls;
3787 req->controls = ctrls;
3789 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3791 /* save away the linked attributes for the end of the
3793 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3794 struct la_entry *la_entry;
3796 if (replmd_private->la_ctx == NULL) {
3797 replmd_private->la_ctx = talloc_new(replmd_private);
3799 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3800 if (la_entry == NULL) {
3802 return LDB_ERR_OPERATIONS_ERROR;
3804 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3805 if (la_entry->la == NULL) {
3806 talloc_free(la_entry);
3808 return LDB_ERR_OPERATIONS_ERROR;
3810 *la_entry->la = ar->objs->linked_attributes[i];
3812 /* we need to steal the non-scalars so they stay
3813 around until the end of the transaction */
3814 talloc_steal(la_entry->la, la_entry->la->identifier);
3815 talloc_steal(la_entry->la, la_entry->la->value.blob);
3817 DLIST_ADD(replmd_private->la_list, la_entry);
3820 return replmd_replicated_apply_next(ar);
3824 process one linked attribute structure
3826 static int replmd_process_linked_attribute(struct ldb_module *module,
3827 struct la_entry *la_entry)
3829 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3830 struct ldb_context *ldb = ldb_module_get_ctx(module);
3831 struct ldb_message *msg;
3832 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3833 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3835 const struct dsdb_attribute *attr;
3836 struct dsdb_dn *dsdb_dn;
3837 uint64_t seq_num = 0;
3838 struct ldb_message_element *old_el;
3840 time_t t = time(NULL);
3841 struct ldb_result *res;
3842 const char *attrs[2];
3843 struct parsed_dn *pdn_list, *pdn;
3844 struct GUID guid = GUID_zero();
3846 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3847 const struct GUID *our_invocation_id;
3850 linked_attributes[0]:
3851 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3853 identifier: struct drsuapi_DsReplicaObjectIdentifier
3854 __ndr_size : 0x0000003a (58)
3855 __ndr_size_sid : 0x00000000 (0)
3856 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3858 __ndr_size_dn : 0x00000000 (0)
3860 attid : DRSUAPI_ATTID_member (0x1F)
3861 value: struct drsuapi_DsAttributeValue
3862 __ndr_size : 0x0000007e (126)
3864 blob : DATA_BLOB length=126
3865 flags : 0x00000001 (1)
3866 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3867 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3868 meta_data: struct drsuapi_DsReplicaMetaData
3869 version : 0x00000015 (21)
3870 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3871 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3872 originating_usn : 0x000000000001e19c (123292)
3874 (for cases where the link is to a normal DN)
3875 &target: struct drsuapi_DsReplicaObjectIdentifier3
3876 __ndr_size : 0x0000007e (126)
3877 __ndr_size_sid : 0x0000001c (28)
3878 guid : 7639e594-db75-4086-b0d4-67890ae46031
3879 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3880 __ndr_size_dn : 0x00000022 (34)
3881 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3884 /* find the attribute being modified */
3885 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3887 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3888 talloc_free(tmp_ctx);
3889 return LDB_ERR_OPERATIONS_ERROR;
3892 attrs[0] = attr->lDAPDisplayName;
3895 /* get the existing message from the db for the object with
3896 this GUID, returning attribute being modified. We will then
3897 use this msg as the basis for a modify call */
3898 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3899 DSDB_FLAG_NEXT_MODULE |
3900 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3901 DSDB_SEARCH_SHOW_RECYCLED |
3902 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3903 DSDB_SEARCH_REVEAL_INTERNALS,
3904 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3905 if (ret != LDB_SUCCESS) {
3906 talloc_free(tmp_ctx);
3909 if (res->count != 1) {
3910 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3911 GUID_string(tmp_ctx, &la->identifier->guid));
3912 talloc_free(tmp_ctx);
3913 return LDB_ERR_NO_SUCH_OBJECT;
3917 if (msg->num_elements == 0) {
3918 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3919 if (ret != LDB_SUCCESS) {
3920 ldb_module_oom(module);
3921 talloc_free(tmp_ctx);
3922 return LDB_ERR_OPERATIONS_ERROR;
3925 old_el = &msg->elements[0];
3926 old_el->flags = LDB_FLAG_MOD_REPLACE;
3929 /* parse the existing links */
3930 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3931 if (ret != LDB_SUCCESS) {
3932 talloc_free(tmp_ctx);
3936 /* get our invocationId */
3937 our_invocation_id = samdb_ntds_invocation_id(ldb);
3938 if (!our_invocation_id) {
3939 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3940 talloc_free(tmp_ctx);
3941 return LDB_ERR_OPERATIONS_ERROR;
3944 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3945 if (ret != LDB_SUCCESS) {
3946 talloc_free(tmp_ctx);
3950 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3951 if (!W_ERROR_IS_OK(status)) {
3952 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3953 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3954 return LDB_ERR_OPERATIONS_ERROR;
3957 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3958 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3959 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3961 ldb_dn_get_linearized(dsdb_dn->dn),
3962 ldb_dn_get_linearized(msg->dn));
3963 return LDB_ERR_OPERATIONS_ERROR;
3966 /* re-resolve the DN by GUID, as the DRS server may give us an
3968 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3969 if (ret != LDB_SUCCESS) {
3970 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3971 GUID_string(tmp_ctx, &guid),
3972 ldb_dn_get_linearized(dsdb_dn->dn)));
3975 /* see if this link already exists */
3976 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3978 /* see if this update is newer than what we have already */
3979 struct GUID invocation_id = GUID_zero();
3980 uint32_t version = 0;
3981 uint32_t originating_usn = 0;
3982 NTTIME change_time = 0;
3983 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3985 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3986 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3987 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
3988 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3990 if (!replmd_update_is_newer(&invocation_id,
3991 &la->meta_data.originating_invocation_id,
3993 la->meta_data.version,
3995 la->meta_data.originating_usn,
3997 la->meta_data.originating_change_time)) {
3998 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3999 old_el->name, ldb_dn_get_linearized(msg->dn),
4000 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4001 talloc_free(tmp_ctx);
4005 /* get a seq_num for this change */
4006 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4007 if (ret != LDB_SUCCESS) {
4008 talloc_free(tmp_ctx);
4012 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4013 /* remove the existing backlink */
4014 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4015 if (ret != LDB_SUCCESS) {
4016 talloc_free(tmp_ctx);
4021 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4022 &la->meta_data.originating_invocation_id,
4023 la->meta_data.originating_usn, seq_num,
4024 la->meta_data.originating_change_time,
4025 la->meta_data.version,
4027 if (ret != LDB_SUCCESS) {
4028 talloc_free(tmp_ctx);
4033 /* add the new backlink */
4034 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4035 if (ret != LDB_SUCCESS) {
4036 talloc_free(tmp_ctx);
4041 /* get a seq_num for this change */
4042 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4043 if (ret != LDB_SUCCESS) {
4044 talloc_free(tmp_ctx);
4048 old_el->values = talloc_realloc(msg->elements, old_el->values,
4049 struct ldb_val, old_el->num_values+1);
4050 if (!old_el->values) {
4051 ldb_module_oom(module);
4052 return LDB_ERR_OPERATIONS_ERROR;
4054 old_el->num_values++;
4056 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4057 &la->meta_data.originating_invocation_id,
4058 la->meta_data.originating_usn, seq_num,
4059 la->meta_data.originating_change_time,
4060 la->meta_data.version,
4061 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4062 if (ret != LDB_SUCCESS) {
4063 talloc_free(tmp_ctx);
4068 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4070 if (ret != LDB_SUCCESS) {
4071 talloc_free(tmp_ctx);
4077 /* we only change whenChanged and uSNChanged if the seq_num
4079 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4080 talloc_free(tmp_ctx);
4081 return ldb_operr(ldb);
4084 if (add_uint64_element(ldb, msg, "uSNChanged",
4085 seq_num) != LDB_SUCCESS) {
4086 talloc_free(tmp_ctx);
4087 return ldb_operr(ldb);
4090 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4091 if (old_el == NULL) {
4092 talloc_free(tmp_ctx);
4093 return ldb_operr(ldb);
4096 ret = dsdb_check_single_valued_link(attr, old_el);
4097 if (ret != LDB_SUCCESS) {
4098 talloc_free(tmp_ctx);
4102 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4104 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
4105 if (ret != LDB_SUCCESS) {
4106 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4108 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4109 talloc_free(tmp_ctx);
4113 talloc_free(tmp_ctx);
4118 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4120 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4121 return replmd_extended_replicated_objects(module, req);
4124 return ldb_next_request(module, req);
4129 we hook into the transaction operations to allow us to
4130 perform the linked attribute updates at the end of the whole
4131 transaction. This allows a forward linked attribute to be created
4132 before the object is created. During a vampire, w2k8 sends us linked
4133 attributes before the objects they are part of.
4135 static int replmd_start_transaction(struct ldb_module *module)
4137 /* create our private structure for this transaction */
4138 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4139 struct replmd_private);
4140 replmd_txn_cleanup(replmd_private);
4142 /* free any leftover mod_usn records from cancelled
4144 while (replmd_private->ncs) {
4145 struct nc_entry *e = replmd_private->ncs;
4146 DLIST_REMOVE(replmd_private->ncs, e);
4150 return ldb_next_start_trans(module);
4154 on prepare commit we loop over our queued la_context structures and
4157 static int replmd_prepare_commit(struct ldb_module *module)
4159 struct replmd_private *replmd_private =
4160 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4161 struct la_entry *la, *prev;
4162 struct la_backlink *bl;
4165 /* walk the list backwards, to do the first entry first, as we
4166 * added the entries with DLIST_ADD() which puts them at the
4167 * start of the list */
4168 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4169 prev = DLIST_PREV(la);
4170 DLIST_REMOVE(replmd_private->la_list, la);
4171 ret = replmd_process_linked_attribute(module, la);
4172 if (ret != LDB_SUCCESS) {
4173 replmd_txn_cleanup(replmd_private);
4178 /* process our backlink list, creating and deleting backlinks
4180 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4181 ret = replmd_process_backlink(module, bl);
4182 if (ret != LDB_SUCCESS) {
4183 replmd_txn_cleanup(replmd_private);
4188 replmd_txn_cleanup(replmd_private);
4190 /* possibly change @REPLCHANGED */
4191 ret = replmd_notify_store(module);
4192 if (ret != LDB_SUCCESS) {
4196 return ldb_next_prepare_commit(module);
4199 static int replmd_del_transaction(struct ldb_module *module)
4201 struct replmd_private *replmd_private =
4202 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4203 replmd_txn_cleanup(replmd_private);
4205 return ldb_next_del_trans(module);
4209 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4210 .name = "repl_meta_data",
4211 .init_context = replmd_init,
4213 .modify = replmd_modify,
4214 .rename = replmd_rename,
4215 .del = replmd_delete,
4216 .extended = replmd_extended,
4217 .start_transaction = replmd_start_transaction,
4218 .prepare_commit = replmd_prepare_commit,
4219 .del_transaction = replmd_del_transaction,
4222 int ldb_repl_meta_data_module_init(const char *version)
4224 LDB_MODULE_CHECK_VERSION(version);
4225 return ldb_register_module(&ldb_repl_meta_data_module_ops);