4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/session.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
515 if (ldb_msg_find_element(msg, attr) != NULL) {
519 s = ldb_timestring(msg, t);
521 return LDB_ERR_OPERATIONS_ERROR;
524 if (ldb_msg_add_string(msg, attr, s) != LDB_SUCCESS) {
525 return LDB_ERR_OPERATIONS_ERROR;
528 el = ldb_msg_find_element(msg, attr);
529 /* always set as replace. This works because on add ops, the flag
531 el->flags = LDB_FLAG_MOD_REPLACE;
537 add a uint64_t element to a record
539 static int add_uint64_element(struct ldb_message *msg, const char *attr, uint64_t v)
541 struct ldb_message_element *el;
543 if (ldb_msg_find_element(msg, attr) != NULL) {
547 if (ldb_msg_add_fmt(msg, attr, "%llu", (unsigned long long)v) != LDB_SUCCESS) {
548 return LDB_ERR_OPERATIONS_ERROR;
551 el = ldb_msg_find_element(msg, attr);
552 /* always set as replace. This works because on add ops, the flag
554 el->flags = LDB_FLAG_MOD_REPLACE;
559 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
560 const struct replPropertyMetaData1 *m2,
561 const uint32_t *rdn_attid)
563 if (m1->attid == m2->attid) {
568 * the rdn attribute should be at the end!
569 * so we need to return a value greater than zero
570 * which means m1 is greater than m2
572 if (m1->attid == *rdn_attid) {
577 * the rdn attribute should be at the end!
578 * so we need to return a value less than zero
579 * which means m2 is greater than m1
581 if (m2->attid == *rdn_attid) {
585 return m1->attid > m2->attid ? 1 : -1;
588 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
589 const struct dsdb_schema *schema,
592 const char *rdn_name;
593 const struct dsdb_attribute *rdn_sa;
595 rdn_name = ldb_dn_get_rdn_name(dn);
597 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
598 return LDB_ERR_OPERATIONS_ERROR;
601 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
602 if (rdn_sa == NULL) {
603 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
604 return LDB_ERR_OPERATIONS_ERROR;
607 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
608 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
610 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
615 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
616 const struct ldb_message_element *e2,
617 const struct dsdb_schema *schema)
619 const struct dsdb_attribute *a1;
620 const struct dsdb_attribute *a2;
623 * TODO: make this faster by caching the dsdb_attribute pointer
624 * on the ldb_messag_element
627 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
628 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
631 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
635 return strcasecmp(e1->name, e2->name);
637 if (a1->attributeID_id == a2->attributeID_id) {
640 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
643 static void replmd_ldb_message_sort(struct ldb_message *msg,
644 const struct dsdb_schema *schema)
646 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
649 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
650 const struct GUID *invocation_id, uint64_t seq_num,
651 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
655 fix up linked attributes in replmd_add.
656 This involves setting up the right meta-data in extended DN
657 components, and creating backlinks to the object
659 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
660 uint64_t seq_num, const struct GUID *invocationId, time_t t,
661 struct GUID *guid, const struct dsdb_attribute *sa)
664 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
665 struct ldb_context *ldb = ldb_module_get_ctx(module);
667 /* We will take a reference to the schema in replmd_add_backlink */
668 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
671 unix_to_nt_time(&now, t);
673 for (i=0; i<el->num_values; i++) {
674 struct ldb_val *v = &el->values[i];
675 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
676 struct GUID target_guid;
680 /* note that the DN already has the extended
681 components from the extended_dn_store module */
682 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
683 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
684 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
685 if (ret != LDB_SUCCESS) {
686 talloc_free(tmp_ctx);
689 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
696 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
697 seq_num, seq_num, now, 0, false);
698 if (ret != LDB_SUCCESS) {
699 talloc_free(tmp_ctx);
703 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
704 if (ret != LDB_SUCCESS) {
705 talloc_free(tmp_ctx);
710 talloc_free(tmp_ctx);
716 intercept add requests
718 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
720 struct ldb_context *ldb;
721 struct ldb_control *control;
722 struct replmd_replicated_request *ac;
723 enum ndr_err_code ndr_err;
724 struct ldb_request *down_req;
725 struct ldb_message *msg;
726 const DATA_BLOB *guid_blob;
728 struct replPropertyMetaDataBlob nmd;
729 struct ldb_val nmd_value;
730 const struct GUID *our_invocation_id;
731 time_t t = time(NULL);
736 unsigned int functional_level;
738 bool allow_add_guid = false;
739 bool remove_current_guid = false;
740 bool is_urgent = false;
741 struct ldb_message_element *objectclass_el;
743 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
744 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
746 allow_add_guid = true;
749 /* do not manipulate our control entries */
750 if (ldb_dn_is_special(req->op.add.message->dn)) {
751 return ldb_next_request(module, req);
754 ldb = ldb_module_get_ctx(module);
756 functional_level = dsdb_functional_level(ldb);
758 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
760 ac = replmd_ctx_init(module, req);
762 return LDB_ERR_OPERATIONS_ERROR;
765 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
766 if ( guid_blob != NULL ) {
767 if( !allow_add_guid ) {
768 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
769 "replmd_add: it's not allowed to add an object with objectGUID\n");
771 return LDB_ERR_UNWILLING_TO_PERFORM;
773 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
774 if ( !NT_STATUS_IS_OK(status)) {
775 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
776 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
778 return LDB_ERR_UNWILLING_TO_PERFORM;
780 /* we remove this attribute as it can be a string and will not be treated
781 correctly and then we will readd it latter on in the good format*/
782 remove_current_guid = true;
786 guid = GUID_random();
789 /* Get a sequence number from the backend */
790 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
791 if (ret != LDB_SUCCESS) {
796 /* get our invocationId */
797 our_invocation_id = samdb_ntds_invocation_id(ldb);
798 if (!our_invocation_id) {
799 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
800 "replmd_add: unable to find invocationId\n");
802 return LDB_ERR_OPERATIONS_ERROR;
805 /* we have to copy the message as the caller might have it as a const */
806 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
810 return LDB_ERR_OPERATIONS_ERROR;
813 /* generated times */
814 unix_to_nt_time(&now, t);
815 time_str = ldb_timestring(msg, t);
819 return LDB_ERR_OPERATIONS_ERROR;
821 if (remove_current_guid) {
822 ldb_msg_remove_attr(msg,"objectGUID");
826 * remove autogenerated attributes
828 ldb_msg_remove_attr(msg, "whenCreated");
829 ldb_msg_remove_attr(msg, "whenChanged");
830 ldb_msg_remove_attr(msg, "uSNCreated");
831 ldb_msg_remove_attr(msg, "uSNChanged");
832 ldb_msg_remove_attr(msg, "replPropertyMetaData");
835 * readd replicated attributes
837 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
838 if (ret != LDB_SUCCESS) {
844 /* build the replication meta_data */
847 nmd.ctr.ctr1.count = msg->num_elements;
848 nmd.ctr.ctr1.array = talloc_array(msg,
849 struct replPropertyMetaData1,
851 if (!nmd.ctr.ctr1.array) {
854 return LDB_ERR_OPERATIONS_ERROR;
857 for (i=0; i < msg->num_elements; i++) {
858 struct ldb_message_element *e = &msg->elements[i];
859 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
860 const struct dsdb_attribute *sa;
862 if (e->name[0] == '@') continue;
864 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
866 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
867 "replmd_add: attribute '%s' not defined in schema\n",
870 return LDB_ERR_NO_SUCH_ATTRIBUTE;
873 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
874 /* if the attribute is not replicated (0x00000001)
875 * or constructed (0x00000004) it has no metadata
880 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
881 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
882 if (ret != LDB_SUCCESS) {
886 /* linked attributes are not stored in
887 replPropertyMetaData in FL above w2k */
891 m->attid = sa->attributeID_id;
893 m->originating_change_time = now;
894 m->originating_invocation_id = *our_invocation_id;
895 m->originating_usn = ac->seq_num;
896 m->local_usn = ac->seq_num;
900 /* fix meta data count */
901 nmd.ctr.ctr1.count = ni;
904 * sort meta data array, and move the rdn attribute entry to the end
906 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
907 if (ret != LDB_SUCCESS) {
912 /* generated NDR encoded values */
913 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
915 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
916 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
919 return LDB_ERR_OPERATIONS_ERROR;
923 * add the autogenerated values
925 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
926 if (ret != LDB_SUCCESS) {
931 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
932 if (ret != LDB_SUCCESS) {
937 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
938 if (ret != LDB_SUCCESS) {
943 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
944 if (ret != LDB_SUCCESS) {
949 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
950 if (ret != LDB_SUCCESS) {
957 * sort the attributes by attid before storing the object
959 replmd_ldb_message_sort(msg, ac->schema);
961 objectclass_el = ldb_msg_find_element(msg, "objectClass");
962 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
963 REPL_URGENT_ON_CREATE);
965 ac->is_urgent = is_urgent;
966 ret = ldb_build_add_req(&down_req, ldb, ac,
969 ac, replmd_op_callback,
972 LDB_REQ_SET_LOCATION(down_req);
973 if (ret != LDB_SUCCESS) {
978 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
979 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
980 if (ret != LDB_SUCCESS) {
986 /* mark the control done */
988 control->critical = 0;
991 /* go on with the call chain */
992 return ldb_next_request(module, down_req);
997 * update the replPropertyMetaData for one element
999 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1000 struct ldb_message *msg,
1001 struct ldb_message_element *el,
1002 struct ldb_message_element *old_el,
1003 struct replPropertyMetaDataBlob *omd,
1004 const struct dsdb_schema *schema,
1006 const struct GUID *our_invocation_id,
1010 const struct dsdb_attribute *a;
1011 struct replPropertyMetaData1 *md1;
1013 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1015 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1017 return LDB_ERR_OPERATIONS_ERROR;
1020 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1024 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1025 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1029 for (i=0; i<omd->ctr.ctr1.count; i++) {
1030 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1033 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1034 /* linked attributes are not stored in
1035 replPropertyMetaData in FL above w2k, but we do
1036 raise the seqnum for the object */
1037 if (*seq_num == 0 &&
1038 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1039 return LDB_ERR_OPERATIONS_ERROR;
1044 if (i == omd->ctr.ctr1.count) {
1045 /* we need to add a new one */
1046 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1047 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1048 if (omd->ctr.ctr1.array == NULL) {
1050 return LDB_ERR_OPERATIONS_ERROR;
1052 omd->ctr.ctr1.count++;
1053 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1056 /* Get a new sequence number from the backend. We only do this
1057 * if we have a change that requires a new
1058 * replPropertyMetaData element
1060 if (*seq_num == 0) {
1061 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1062 if (ret != LDB_SUCCESS) {
1063 return LDB_ERR_OPERATIONS_ERROR;
1067 md1 = &omd->ctr.ctr1.array[i];
1069 md1->attid = a->attributeID_id;
1070 md1->originating_change_time = now;
1071 md1->originating_invocation_id = *our_invocation_id;
1072 md1->originating_usn = *seq_num;
1073 md1->local_usn = *seq_num;
1078 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1080 uint32_t count = omd.ctr.ctr1.count;
1083 for (i=0; i < count; i++) {
1084 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1085 if (max < m.local_usn) {
1093 * update the replPropertyMetaData object each time we modify an
1094 * object. This is needed for DRS replication, as the merge on the
1095 * client is based on this object
1097 static int replmd_update_rpmd(struct ldb_module *module,
1098 const struct dsdb_schema *schema,
1099 struct ldb_request *req,
1100 struct ldb_message *msg, uint64_t *seq_num,
1104 const struct ldb_val *omd_value;
1105 enum ndr_err_code ndr_err;
1106 struct replPropertyMetaDataBlob omd;
1109 const struct GUID *our_invocation_id;
1111 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1112 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1113 struct ldb_result *res;
1114 struct ldb_context *ldb;
1115 struct ldb_message_element *objectclass_el;
1116 enum urgent_situation situation;
1117 bool rodc, rmd_is_provided;
1119 ldb = ldb_module_get_ctx(module);
1121 our_invocation_id = samdb_ntds_invocation_id(ldb);
1122 if (!our_invocation_id) {
1123 /* this happens during an initial vampire while
1124 updating the schema */
1125 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1129 unix_to_nt_time(&now, t);
1131 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1132 rmd_is_provided = true;
1134 rmd_is_provided = false;
1137 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1138 * otherwise we consider we are updating */
1139 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1140 situation = REPL_URGENT_ON_DELETE;
1142 situation = REPL_URGENT_ON_UPDATE;
1145 if (rmd_is_provided) {
1146 /* In this case the change_replmetadata control was supplied */
1147 /* We check that it's the only attribute that is provided
1148 * (it's a rare case so it's better to keep the code simplier)
1149 * We also check that the highest local_usn is bigger than
1152 if( msg->num_elements != 1 ||
1153 strncmp(msg->elements[0].name,
1154 "replPropertyMetaData", 20) ) {
1155 DEBUG(0,(__location__ ": changereplmetada control called without "\
1156 "a specified replPropertyMetaData attribute or with others\n"));
1157 return LDB_ERR_OPERATIONS_ERROR;
1159 if (situation == REPL_URGENT_ON_DELETE) {
1160 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1161 return LDB_ERR_OPERATIONS_ERROR;
1163 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1165 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1166 ldb_dn_get_linearized(msg->dn)));
1167 return LDB_ERR_OPERATIONS_ERROR;
1169 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1170 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1171 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1172 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1173 ldb_dn_get_linearized(msg->dn)));
1174 return LDB_ERR_OPERATIONS_ERROR;
1176 *seq_num = find_max_local_usn(omd);
1178 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1179 DSDB_FLAG_NEXT_MODULE |
1180 DSDB_SEARCH_SHOW_RECYCLED |
1181 DSDB_SEARCH_SHOW_EXTENDED_DN |
1182 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1183 DSDB_SEARCH_REVEAL_INTERNALS);
1185 if (ret != LDB_SUCCESS || res->count != 1) {
1186 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1187 ldb_dn_get_linearized(msg->dn)));
1188 return LDB_ERR_OPERATIONS_ERROR;
1191 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1192 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1197 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1198 if (*seq_num <= db_seq) {
1199 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1200 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1201 (long long)*seq_num, (long long)db_seq));
1202 return LDB_ERR_OPERATIONS_ERROR;
1206 /* search for the existing replPropertyMetaDataBlob. We need
1207 * to use REVEAL and ask for DNs in storage format to support
1208 * the check for values being the same in
1209 * replmd_update_rpmd_element()
1211 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1212 DSDB_FLAG_NEXT_MODULE |
1213 DSDB_SEARCH_SHOW_RECYCLED |
1214 DSDB_SEARCH_SHOW_EXTENDED_DN |
1215 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1216 DSDB_SEARCH_REVEAL_INTERNALS);
1217 if (ret != LDB_SUCCESS || res->count != 1) {
1218 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1219 ldb_dn_get_linearized(msg->dn)));
1220 return LDB_ERR_OPERATIONS_ERROR;
1223 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1224 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1229 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1231 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1232 ldb_dn_get_linearized(msg->dn)));
1233 return LDB_ERR_OPERATIONS_ERROR;
1236 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1237 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1238 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1239 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1240 ldb_dn_get_linearized(msg->dn)));
1241 return LDB_ERR_OPERATIONS_ERROR;
1244 if (omd.version != 1) {
1245 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1246 omd.version, ldb_dn_get_linearized(msg->dn)));
1247 return LDB_ERR_OPERATIONS_ERROR;
1250 for (i=0; i<msg->num_elements; i++) {
1251 struct ldb_message_element *old_el;
1252 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1253 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1254 our_invocation_id, now);
1255 if (ret != LDB_SUCCESS) {
1259 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1260 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1266 * replmd_update_rpmd_element has done an update if the
1269 if (*seq_num != 0) {
1270 struct ldb_val *md_value;
1271 struct ldb_message_element *el;
1273 /*if we are RODC and this is a DRSR update then its ok*/
1274 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1275 ret = samdb_rodc(ldb, &rodc);
1276 if (ret != LDB_SUCCESS) {
1277 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1279 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1280 return LDB_ERR_REFERRAL;
1284 md_value = talloc(msg, struct ldb_val);
1285 if (md_value == NULL) {
1287 return LDB_ERR_OPERATIONS_ERROR;
1290 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1291 if (ret != LDB_SUCCESS) {
1295 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1296 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1297 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1298 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1299 ldb_dn_get_linearized(msg->dn)));
1300 return LDB_ERR_OPERATIONS_ERROR;
1303 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1304 if (ret != LDB_SUCCESS) {
1305 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1306 ldb_dn_get_linearized(msg->dn)));
1311 el->values = md_value;
1318 struct dsdb_dn *dsdb_dn;
1323 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1325 return GUID_compare(pdn1->guid, pdn2->guid);
1328 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1330 struct parsed_dn *ret;
1331 if (dn && GUID_all_zero(guid)) {
1332 /* when updating a link using DRS, we sometimes get a
1333 NULL GUID. We then need to try and match by DN */
1335 for (i=0; i<count; i++) {
1336 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1337 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1343 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1348 get a series of message element values as an array of DNs and GUIDs
1349 the result is sorted by GUID
1351 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1352 struct ldb_message_element *el, struct parsed_dn **pdn,
1353 const char *ldap_oid)
1356 struct ldb_context *ldb = ldb_module_get_ctx(module);
1363 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1365 ldb_module_oom(module);
1366 return LDB_ERR_OPERATIONS_ERROR;
1369 for (i=0; i<el->num_values; i++) {
1370 struct ldb_val *v = &el->values[i];
1373 struct parsed_dn *p;
1377 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1378 if (p->dsdb_dn == NULL) {
1379 return LDB_ERR_INVALID_DN_SYNTAX;
1382 dn = p->dsdb_dn->dn;
1384 p->guid = talloc(*pdn, struct GUID);
1385 if (p->guid == NULL) {
1386 ldb_module_oom(module);
1387 return LDB_ERR_OPERATIONS_ERROR;
1390 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1391 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1392 /* we got a DN without a GUID - go find the GUID */
1393 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1394 if (ret != LDB_SUCCESS) {
1395 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1396 ldb_dn_get_linearized(dn));
1399 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1400 if (ret != LDB_SUCCESS) {
1403 } else if (!NT_STATUS_IS_OK(status)) {
1404 return LDB_ERR_OPERATIONS_ERROR;
1407 /* keep a pointer to the original ldb_val */
1411 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1417 build a new extended DN, including all meta data fields
1419 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1420 RMD_ADDTIME = originating_add_time
1421 RMD_INVOCID = originating_invocation_id
1422 RMD_CHANGETIME = originating_change_time
1423 RMD_ORIGINATING_USN = originating_usn
1424 RMD_LOCAL_USN = local_usn
1425 RMD_VERSION = version
1427 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1428 const struct GUID *invocation_id, uint64_t seq_num,
1429 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1431 struct ldb_dn *dn = dsdb_dn->dn;
1432 const char *tstring, *usn_string, *flags_string;
1433 struct ldb_val tval;
1435 struct ldb_val usnv, local_usnv;
1436 struct ldb_val vers, flagsv;
1439 const char *dnstring;
1441 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1443 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1445 return LDB_ERR_OPERATIONS_ERROR;
1447 tval = data_blob_string_const(tstring);
1449 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1451 return LDB_ERR_OPERATIONS_ERROR;
1453 usnv = data_blob_string_const(usn_string);
1455 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1457 return LDB_ERR_OPERATIONS_ERROR;
1459 local_usnv = data_blob_string_const(usn_string);
1461 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1463 return LDB_ERR_OPERATIONS_ERROR;
1465 vers = data_blob_string_const(vstring);
1467 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1468 if (!NT_STATUS_IS_OK(status)) {
1469 return LDB_ERR_OPERATIONS_ERROR;
1472 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1473 if (!flags_string) {
1474 return LDB_ERR_OPERATIONS_ERROR;
1476 flagsv = data_blob_string_const(flags_string);
1478 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1479 if (ret != LDB_SUCCESS) return ret;
1480 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1481 if (ret != LDB_SUCCESS) return ret;
1482 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1483 if (ret != LDB_SUCCESS) return ret;
1484 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1485 if (ret != LDB_SUCCESS) return ret;
1486 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1487 if (ret != LDB_SUCCESS) return ret;
1488 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1489 if (ret != LDB_SUCCESS) return ret;
1490 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1491 if (ret != LDB_SUCCESS) return ret;
1493 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1494 if (dnstring == NULL) {
1495 return LDB_ERR_OPERATIONS_ERROR;
1497 *v = data_blob_string_const(dnstring);
1502 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1503 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1504 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1505 uint32_t version, bool deleted);
1508 check if any links need upgrading from w2k format
1510 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1512 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1515 for (i=0; i<count; i++) {
1520 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1521 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1525 /* it's an old one that needs upgrading */
1526 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1528 if (ret != LDB_SUCCESS) {
1536 update an extended DN, including all meta data fields
1538 see replmd_build_la_val for value names
1540 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1541 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1542 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1543 uint32_t version, bool deleted)
1545 struct ldb_dn *dn = dsdb_dn->dn;
1546 const char *tstring, *usn_string, *flags_string;
1547 struct ldb_val tval;
1549 struct ldb_val usnv, local_usnv;
1550 struct ldb_val vers, flagsv;
1551 const struct ldb_val *old_addtime;
1552 uint32_t old_version;
1555 const char *dnstring;
1557 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1559 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1561 return LDB_ERR_OPERATIONS_ERROR;
1563 tval = data_blob_string_const(tstring);
1565 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1567 return LDB_ERR_OPERATIONS_ERROR;
1569 usnv = data_blob_string_const(usn_string);
1571 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1573 return LDB_ERR_OPERATIONS_ERROR;
1575 local_usnv = data_blob_string_const(usn_string);
1577 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1578 if (!NT_STATUS_IS_OK(status)) {
1579 return LDB_ERR_OPERATIONS_ERROR;
1582 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1583 if (!flags_string) {
1584 return LDB_ERR_OPERATIONS_ERROR;
1586 flagsv = data_blob_string_const(flags_string);
1588 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1589 if (ret != LDB_SUCCESS) return ret;
1591 /* get the ADDTIME from the original */
1592 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1593 if (old_addtime == NULL) {
1594 old_addtime = &tval;
1596 if (dsdb_dn != old_dsdb_dn) {
1597 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1598 if (ret != LDB_SUCCESS) return ret;
1601 /* use our invocation id */
1602 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1603 if (ret != LDB_SUCCESS) return ret;
1605 /* changetime is the current time */
1606 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1607 if (ret != LDB_SUCCESS) return ret;
1609 /* update the USN */
1610 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1611 if (ret != LDB_SUCCESS) return ret;
1613 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1614 if (ret != LDB_SUCCESS) return ret;
1616 /* increase the version by 1 */
1617 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1618 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1619 version = old_version+1;
1621 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1622 vers = data_blob_string_const(vstring);
1623 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1624 if (ret != LDB_SUCCESS) return ret;
1626 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1627 if (dnstring == NULL) {
1628 return LDB_ERR_OPERATIONS_ERROR;
1630 *v = data_blob_string_const(dnstring);
1636 handle adding a linked attribute
1638 static int replmd_modify_la_add(struct ldb_module *module,
1639 const struct dsdb_schema *schema,
1640 struct ldb_message *msg,
1641 struct ldb_message_element *el,
1642 struct ldb_message_element *old_el,
1643 const struct dsdb_attribute *schema_attr,
1646 struct GUID *msg_guid)
1649 struct parsed_dn *dns, *old_dns;
1650 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1652 struct ldb_val *new_values = NULL;
1653 unsigned int num_new_values = 0;
1654 unsigned old_num_values = old_el?old_el->num_values:0;
1655 const struct GUID *invocation_id;
1656 struct ldb_context *ldb = ldb_module_get_ctx(module);
1659 unix_to_nt_time(&now, t);
1661 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1662 if (ret != LDB_SUCCESS) {
1663 talloc_free(tmp_ctx);
1667 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1668 if (ret != LDB_SUCCESS) {
1669 talloc_free(tmp_ctx);
1673 invocation_id = samdb_ntds_invocation_id(ldb);
1674 if (!invocation_id) {
1675 talloc_free(tmp_ctx);
1676 return LDB_ERR_OPERATIONS_ERROR;
1679 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1680 if (ret != LDB_SUCCESS) {
1681 talloc_free(tmp_ctx);
1685 /* for each new value, see if it exists already with the same GUID */
1686 for (i=0; i<el->num_values; i++) {
1687 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1689 /* this is a new linked attribute value */
1690 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1691 if (new_values == NULL) {
1692 ldb_module_oom(module);
1693 talloc_free(tmp_ctx);
1694 return LDB_ERR_OPERATIONS_ERROR;
1696 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1697 invocation_id, seq_num, seq_num, now, 0, false);
1698 if (ret != LDB_SUCCESS) {
1699 talloc_free(tmp_ctx);
1704 /* this is only allowed if the GUID was
1705 previously deleted. */
1706 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1708 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1709 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1710 el->name, GUID_string(tmp_ctx, p->guid));
1711 talloc_free(tmp_ctx);
1712 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1714 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1715 invocation_id, seq_num, seq_num, now, 0, false);
1716 if (ret != LDB_SUCCESS) {
1717 talloc_free(tmp_ctx);
1722 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1723 if (ret != LDB_SUCCESS) {
1724 talloc_free(tmp_ctx);
1729 /* add the new ones on to the end of the old values, constructing a new el->values */
1730 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1732 old_num_values+num_new_values);
1733 if (el->values == NULL) {
1734 ldb_module_oom(module);
1735 return LDB_ERR_OPERATIONS_ERROR;
1738 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1739 el->num_values = old_num_values + num_new_values;
1741 talloc_steal(msg->elements, el->values);
1742 talloc_steal(el->values, new_values);
1744 talloc_free(tmp_ctx);
1746 /* we now tell the backend to replace all existing values
1747 with the one we have constructed */
1748 el->flags = LDB_FLAG_MOD_REPLACE;
1755 handle deleting all active linked attributes
1757 static int replmd_modify_la_delete(struct ldb_module *module,
1758 const struct dsdb_schema *schema,
1759 struct ldb_message *msg,
1760 struct ldb_message_element *el,
1761 struct ldb_message_element *old_el,
1762 const struct dsdb_attribute *schema_attr,
1765 struct GUID *msg_guid)
1768 struct parsed_dn *dns, *old_dns;
1769 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1771 const struct GUID *invocation_id;
1772 struct ldb_context *ldb = ldb_module_get_ctx(module);
1775 unix_to_nt_time(&now, t);
1777 /* check if there is nothing to delete */
1778 if ((!old_el || old_el->num_values == 0) &&
1779 el->num_values == 0) {
1783 if (!old_el || old_el->num_values == 0) {
1784 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1787 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1788 if (ret != LDB_SUCCESS) {
1789 talloc_free(tmp_ctx);
1793 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1794 if (ret != LDB_SUCCESS) {
1795 talloc_free(tmp_ctx);
1799 invocation_id = samdb_ntds_invocation_id(ldb);
1800 if (!invocation_id) {
1801 return LDB_ERR_OPERATIONS_ERROR;
1804 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1805 if (ret != LDB_SUCCESS) {
1806 talloc_free(tmp_ctx);
1812 /* see if we are being asked to delete any links that
1813 don't exist or are already deleted */
1814 for (i=0; i<el->num_values; i++) {
1815 struct parsed_dn *p = &dns[i];
1816 struct parsed_dn *p2;
1819 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1821 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1822 el->name, GUID_string(tmp_ctx, p->guid));
1823 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1825 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1826 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1827 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1828 el->name, GUID_string(tmp_ctx, p->guid));
1829 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1833 /* for each new value, see if it exists already with the same GUID
1834 if it is not already deleted and matches the delete list then delete it
1836 for (i=0; i<old_el->num_values; i++) {
1837 struct parsed_dn *p = &old_dns[i];
1840 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1844 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1845 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1847 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1848 invocation_id, seq_num, seq_num, now, 0, true);
1849 if (ret != LDB_SUCCESS) {
1850 talloc_free(tmp_ctx);
1854 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1855 if (ret != LDB_SUCCESS) {
1856 talloc_free(tmp_ctx);
1861 el->values = talloc_steal(msg->elements, old_el->values);
1862 el->num_values = old_el->num_values;
1864 talloc_free(tmp_ctx);
1866 /* we now tell the backend to replace all existing values
1867 with the one we have constructed */
1868 el->flags = LDB_FLAG_MOD_REPLACE;
1874 handle replacing a linked attribute
1876 static int replmd_modify_la_replace(struct ldb_module *module,
1877 const struct dsdb_schema *schema,
1878 struct ldb_message *msg,
1879 struct ldb_message_element *el,
1880 struct ldb_message_element *old_el,
1881 const struct dsdb_attribute *schema_attr,
1884 struct GUID *msg_guid)
1887 struct parsed_dn *dns, *old_dns;
1888 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1890 const struct GUID *invocation_id;
1891 struct ldb_context *ldb = ldb_module_get_ctx(module);
1892 struct ldb_val *new_values = NULL;
1893 unsigned int num_new_values = 0;
1894 unsigned int old_num_values = old_el?old_el->num_values:0;
1897 unix_to_nt_time(&now, t);
1899 /* check if there is nothing to replace */
1900 if ((!old_el || old_el->num_values == 0) &&
1901 el->num_values == 0) {
1905 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1906 if (ret != LDB_SUCCESS) {
1907 talloc_free(tmp_ctx);
1911 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1912 if (ret != LDB_SUCCESS) {
1913 talloc_free(tmp_ctx);
1917 invocation_id = samdb_ntds_invocation_id(ldb);
1918 if (!invocation_id) {
1919 return LDB_ERR_OPERATIONS_ERROR;
1922 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1923 if (ret != LDB_SUCCESS) {
1924 talloc_free(tmp_ctx);
1928 /* mark all the old ones as deleted */
1929 for (i=0; i<old_num_values; i++) {
1930 struct parsed_dn *old_p = &old_dns[i];
1931 struct parsed_dn *p;
1932 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1934 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1936 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1937 if (ret != LDB_SUCCESS) {
1938 talloc_free(tmp_ctx);
1942 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1944 /* we don't delete it if we are re-adding it */
1948 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1949 invocation_id, seq_num, seq_num, now, 0, true);
1950 if (ret != LDB_SUCCESS) {
1951 talloc_free(tmp_ctx);
1956 /* for each new value, either update its meta-data, or add it
1959 for (i=0; i<el->num_values; i++) {
1960 struct parsed_dn *p = &dns[i], *old_p;
1963 (old_p = parsed_dn_find(old_dns,
1964 old_num_values, p->guid, NULL)) != NULL) {
1965 /* update in place */
1966 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1967 old_p->dsdb_dn, invocation_id,
1968 seq_num, seq_num, now, 0, false);
1969 if (ret != LDB_SUCCESS) {
1970 talloc_free(tmp_ctx);
1975 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1977 if (new_values == NULL) {
1978 ldb_module_oom(module);
1979 talloc_free(tmp_ctx);
1980 return LDB_ERR_OPERATIONS_ERROR;
1982 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1983 invocation_id, seq_num, seq_num, now, 0, false);
1984 if (ret != LDB_SUCCESS) {
1985 talloc_free(tmp_ctx);
1991 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1992 if (ret != LDB_SUCCESS) {
1993 talloc_free(tmp_ctx);
1998 /* add the new values to the end of old_el */
1999 if (num_new_values != 0) {
2000 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2001 struct ldb_val, old_num_values+num_new_values);
2002 if (el->values == NULL) {
2003 ldb_module_oom(module);
2004 return LDB_ERR_OPERATIONS_ERROR;
2006 memcpy(&el->values[old_num_values], &new_values[0],
2007 sizeof(struct ldb_val)*num_new_values);
2008 el->num_values = old_num_values + num_new_values;
2009 talloc_steal(msg->elements, new_values);
2011 el->values = old_el->values;
2012 el->num_values = old_el->num_values;
2013 talloc_steal(msg->elements, el->values);
2016 talloc_free(tmp_ctx);
2018 /* we now tell the backend to replace all existing values
2019 with the one we have constructed */
2020 el->flags = LDB_FLAG_MOD_REPLACE;
2027 handle linked attributes in modify requests
2029 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2030 struct ldb_message *msg,
2031 uint64_t seq_num, time_t t)
2033 struct ldb_result *res;
2036 struct ldb_context *ldb = ldb_module_get_ctx(module);
2037 struct ldb_message *old_msg;
2039 const struct dsdb_schema *schema;
2040 struct GUID old_guid;
2043 /* there the replmd_update_rpmd code has already
2044 * checked and saw that there are no linked
2049 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2050 /* don't do anything special for linked attributes */
2054 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2055 DSDB_FLAG_NEXT_MODULE |
2056 DSDB_SEARCH_SHOW_RECYCLED |
2057 DSDB_SEARCH_REVEAL_INTERNALS |
2058 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2059 if (ret != LDB_SUCCESS) {
2062 schema = dsdb_get_schema(ldb, res);
2064 return LDB_ERR_OPERATIONS_ERROR;
2067 old_msg = res->msgs[0];
2069 old_guid = samdb_result_guid(old_msg, "objectGUID");
2071 for (i=0; i<msg->num_elements; i++) {
2072 struct ldb_message_element *el = &msg->elements[i];
2073 struct ldb_message_element *old_el, *new_el;
2074 const struct dsdb_attribute *schema_attr
2075 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2077 ldb_asprintf_errstring(ldb,
2078 "attribute %s is not a valid attribute in schema", el->name);
2079 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2081 if (schema_attr->linkID == 0) {
2084 if ((schema_attr->linkID & 1) == 1) {
2085 /* Odd is for the target. Illegal to modify */
2086 ldb_asprintf_errstring(ldb,
2087 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2088 return LDB_ERR_UNWILLING_TO_PERFORM;
2090 old_el = ldb_msg_find_element(old_msg, el->name);
2091 switch (el->flags & LDB_FLAG_MOD_MASK) {
2092 case LDB_FLAG_MOD_REPLACE:
2093 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2095 case LDB_FLAG_MOD_DELETE:
2096 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2098 case LDB_FLAG_MOD_ADD:
2099 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2102 ldb_asprintf_errstring(ldb,
2103 "invalid flags 0x%x for %s linked attribute",
2104 el->flags, el->name);
2105 return LDB_ERR_UNWILLING_TO_PERFORM;
2107 if (ret != LDB_SUCCESS) {
2111 ldb_msg_remove_attr(old_msg, el->name);
2113 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2114 new_el->num_values = el->num_values;
2115 new_el->values = talloc_steal(msg->elements, el->values);
2117 /* TODO: this relises a bit too heavily on the exact
2118 behaviour of ldb_msg_find_element and
2119 ldb_msg_remove_element */
2120 old_el = ldb_msg_find_element(msg, el->name);
2122 ldb_msg_remove_element(msg, old_el);
2133 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2135 struct ldb_context *ldb;
2136 struct replmd_replicated_request *ac;
2137 struct ldb_request *down_req;
2138 struct ldb_message *msg;
2139 time_t t = time(NULL);
2141 bool is_urgent = false;
2142 struct loadparm_context *lp_ctx;
2144 unsigned int functional_level;
2146 /* do not manipulate our control entries */
2147 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2148 return ldb_next_request(module, req);
2151 ldb = ldb_module_get_ctx(module);
2152 functional_level = dsdb_functional_level(ldb);
2154 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2155 struct loadparm_context);
2157 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2159 ac = replmd_ctx_init(module, req);
2161 return LDB_ERR_OPERATIONS_ERROR;
2164 /* we have to copy the message as the caller might have it as a const */
2165 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2169 return LDB_ERR_OPERATIONS_ERROR;
2172 ldb_msg_remove_attr(msg, "whenChanged");
2173 ldb_msg_remove_attr(msg, "uSNChanged");
2175 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2176 if (ret == LDB_ERR_REFERRAL) {
2177 referral = talloc_asprintf(req,
2179 lpcfg_dnsdomain(lp_ctx),
2180 ldb_dn_get_linearized(msg->dn));
2181 ret = ldb_module_send_referral(req, referral);
2183 return ldb_module_done(req, NULL, NULL, ret);
2186 if (ret != LDB_SUCCESS) {
2191 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2192 if (ret != LDB_SUCCESS) {
2198 * - replace the old object with the newly constructed one
2201 ac->is_urgent = is_urgent;
2203 ret = ldb_build_mod_req(&down_req, ldb, ac,
2206 ac, replmd_op_callback,
2208 LDB_REQ_SET_LOCATION(down_req);
2209 if (ret != LDB_SUCCESS) {
2214 /* If we are in functional level 2000, then
2215 * replmd_modify_handle_linked_attribs will have done
2217 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2218 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2219 if (ret != LDB_SUCCESS) {
2225 talloc_steal(down_req, msg);
2227 /* we only change whenChanged and uSNChanged if the seq_num
2229 if (ac->seq_num != 0) {
2230 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2235 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2241 /* go on with the call chain */
2242 return ldb_next_request(module, down_req);
2245 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2248 handle a rename request
2250 On a rename we need to do an extra ldb_modify which sets the
2251 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2253 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2255 struct ldb_context *ldb;
2256 struct replmd_replicated_request *ac;
2258 struct ldb_request *down_req;
2260 /* do not manipulate our control entries */
2261 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2262 return ldb_next_request(module, req);
2265 ldb = ldb_module_get_ctx(module);
2267 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2269 ac = replmd_ctx_init(module, req);
2271 return LDB_ERR_OPERATIONS_ERROR;
2273 ret = ldb_build_rename_req(&down_req, ldb, ac,
2274 ac->req->op.rename.olddn,
2275 ac->req->op.rename.newdn,
2277 ac, replmd_rename_callback,
2279 LDB_REQ_SET_LOCATION(down_req);
2280 if (ret != LDB_SUCCESS) {
2285 /* go on with the call chain */
2286 return ldb_next_request(module, down_req);
2289 /* After the rename is compleated, update the whenchanged etc */
2290 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2292 struct ldb_context *ldb;
2293 struct replmd_replicated_request *ac;
2294 struct ldb_request *down_req;
2295 struct ldb_message *msg;
2296 time_t t = time(NULL);
2299 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2300 ldb = ldb_module_get_ctx(ac->module);
2302 if (ares->error != LDB_SUCCESS) {
2303 return ldb_module_done(ac->req, ares->controls,
2304 ares->response, ares->error);
2307 if (ares->type != LDB_REPLY_DONE) {
2308 ldb_set_errstring(ldb,
2309 "invalid ldb_reply_type in callback");
2311 return ldb_module_done(ac->req, NULL, NULL,
2312 LDB_ERR_OPERATIONS_ERROR);
2315 /* Get a sequence number from the backend */
2316 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2317 if (ret != LDB_SUCCESS) {
2322 * - replace the old object with the newly constructed one
2325 msg = ldb_msg_new(ac);
2328 return LDB_ERR_OPERATIONS_ERROR;
2331 msg->dn = ac->req->op.rename.newdn;
2333 ret = ldb_build_mod_req(&down_req, ldb, ac,
2336 ac, replmd_op_callback,
2338 LDB_REQ_SET_LOCATION(down_req);
2339 if (ret != LDB_SUCCESS) {
2343 talloc_steal(down_req, msg);
2345 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2350 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2355 /* go on with the call chain - do the modify after the rename */
2356 return ldb_next_request(ac->module, down_req);
2360 remove links from objects that point at this object when an object
2363 static int replmd_delete_remove_link(struct ldb_module *module,
2364 const struct dsdb_schema *schema,
2366 struct ldb_message_element *el,
2367 const struct dsdb_attribute *sa)
2370 TALLOC_CTX *tmp_ctx = talloc_new(module);
2371 struct ldb_context *ldb = ldb_module_get_ctx(module);
2373 for (i=0; i<el->num_values; i++) {
2374 struct dsdb_dn *dsdb_dn;
2378 struct ldb_message *msg;
2379 const struct dsdb_attribute *target_attr;
2380 struct ldb_message_element *el2;
2381 struct ldb_val dn_val;
2383 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2387 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2389 talloc_free(tmp_ctx);
2390 return LDB_ERR_OPERATIONS_ERROR;
2393 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2394 if (!NT_STATUS_IS_OK(status)) {
2395 talloc_free(tmp_ctx);
2396 return LDB_ERR_OPERATIONS_ERROR;
2399 /* remove the link */
2400 msg = ldb_msg_new(tmp_ctx);
2402 ldb_module_oom(module);
2403 talloc_free(tmp_ctx);
2404 return LDB_ERR_OPERATIONS_ERROR;
2408 msg->dn = dsdb_dn->dn;
2410 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2411 if (target_attr == NULL) {
2415 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2416 if (ret != LDB_SUCCESS) {
2417 ldb_module_oom(module);
2418 talloc_free(tmp_ctx);
2419 return LDB_ERR_OPERATIONS_ERROR;
2421 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2422 el2->values = &dn_val;
2423 el2->num_values = 1;
2425 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2426 if (ret != LDB_SUCCESS) {
2427 talloc_free(tmp_ctx);
2431 talloc_free(tmp_ctx);
2437 handle update of replication meta data for deletion of objects
2439 This also handles the mapping of delete to a rename operation
2440 to allow deletes to be replicated.
2442 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2444 int ret = LDB_ERR_OTHER;
2445 bool retb, disallow_move_on_delete;
2446 struct ldb_dn *old_dn, *new_dn;
2447 const char *rdn_name;
2448 const struct ldb_val *rdn_value, *new_rdn_value;
2450 struct ldb_context *ldb = ldb_module_get_ctx(module);
2451 const struct dsdb_schema *schema;
2452 struct ldb_message *msg, *old_msg;
2453 struct ldb_message_element *el;
2454 TALLOC_CTX *tmp_ctx;
2455 struct ldb_result *res, *parent_res;
2456 const char *preserved_attrs[] = {
2457 /* yes, this really is a hard coded list. See MS-ADTS
2458 section 3.1.1.5.5.1.1 */
2459 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2460 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2461 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2462 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2463 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2464 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2465 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2466 "whenChanged", NULL};
2467 unsigned int i, el_count = 0;
2468 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2469 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2470 enum deletion_state deletion_state, next_deletion_state;
2473 if (ldb_dn_is_special(req->op.del.dn)) {
2474 return ldb_next_request(module, req);
2477 tmp_ctx = talloc_new(ldb);
2480 return LDB_ERR_OPERATIONS_ERROR;
2483 schema = dsdb_get_schema(ldb, tmp_ctx);
2485 return LDB_ERR_OPERATIONS_ERROR;
2488 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2490 /* we need the complete msg off disk, so we can work out which
2491 attributes need to be removed */
2492 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2493 DSDB_FLAG_NEXT_MODULE |
2494 DSDB_SEARCH_SHOW_RECYCLED |
2495 DSDB_SEARCH_REVEAL_INTERNALS |
2496 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2497 if (ret != LDB_SUCCESS) {
2498 talloc_free(tmp_ctx);
2501 old_msg = res->msgs[0];
2504 ret = dsdb_recyclebin_enabled(module, &enabled);
2505 if (ret != LDB_SUCCESS) {
2506 talloc_free(tmp_ctx);
2510 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2512 deletion_state = OBJECT_TOMBSTONE;
2513 next_deletion_state = OBJECT_REMOVED;
2514 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2515 deletion_state = OBJECT_RECYCLED;
2516 next_deletion_state = OBJECT_REMOVED;
2518 deletion_state = OBJECT_DELETED;
2519 next_deletion_state = OBJECT_RECYCLED;
2522 deletion_state = OBJECT_NOT_DELETED;
2524 next_deletion_state = OBJECT_DELETED;
2526 next_deletion_state = OBJECT_TOMBSTONE;
2530 if (next_deletion_state == OBJECT_REMOVED) {
2531 struct auth_session_info *session_info =
2532 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2533 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2534 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2535 ldb_dn_get_linearized(old_msg->dn));
2536 return LDB_ERR_UNWILLING_TO_PERFORM;
2539 /* it is already deleted - really remove it this time */
2540 talloc_free(tmp_ctx);
2541 return ldb_next_request(module, req);
2544 rdn_name = ldb_dn_get_rdn_name(old_dn);
2545 rdn_value = ldb_dn_get_rdn_val(old_dn);
2547 msg = ldb_msg_new(tmp_ctx);
2549 ldb_module_oom(module);
2550 talloc_free(tmp_ctx);
2551 return LDB_ERR_OPERATIONS_ERROR;
2556 if (deletion_state == OBJECT_NOT_DELETED){
2557 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2558 disallow_move_on_delete =
2559 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2560 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2562 /* work out where we will be renaming this object to */
2563 if (!disallow_move_on_delete) {
2564 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2566 if (ret != LDB_SUCCESS) {
2567 /* this is probably an attempted delete on a partition
2568 * that doesn't allow delete operations, such as the
2569 * schema partition */
2570 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2571 ldb_dn_get_linearized(old_dn));
2572 talloc_free(tmp_ctx);
2573 return LDB_ERR_UNWILLING_TO_PERFORM;
2576 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2577 if (new_dn == NULL) {
2578 ldb_module_oom(module);
2579 talloc_free(tmp_ctx);
2580 return LDB_ERR_OPERATIONS_ERROR;
2584 /* get the objects GUID from the search we just did */
2585 guid = samdb_result_guid(old_msg, "objectGUID");
2587 /* Add a formatted child */
2588 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2591 GUID_string(tmp_ctx, &guid));
2593 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2594 ldb_dn_get_linearized(new_dn)));
2595 talloc_free(tmp_ctx);
2596 return LDB_ERR_OPERATIONS_ERROR;
2599 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2600 if (ret != LDB_SUCCESS) {
2601 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2602 ldb_module_oom(module);
2603 talloc_free(tmp_ctx);
2606 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2610 now we need to modify the object in the following ways:
2612 - add isDeleted=TRUE
2613 - update rDN and name, with new rDN
2614 - remove linked attributes
2615 - remove objectCategory and sAMAccountType
2616 - remove attribs not on the preserved list
2617 - preserved if in above list, or is rDN
2618 - remove all linked attribs from this object
2619 - remove all links from other objects to this object
2620 - add lastKnownParent
2621 - update replPropertyMetaData?
2623 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2626 /* we need the storage form of the parent GUID */
2627 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2628 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2629 DSDB_FLAG_NEXT_MODULE |
2630 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2631 DSDB_SEARCH_REVEAL_INTERNALS|
2632 DSDB_SEARCH_SHOW_RECYCLED);
2633 if (ret != LDB_SUCCESS) {
2634 talloc_free(tmp_ctx);
2638 if (deletion_state == OBJECT_NOT_DELETED){
2639 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2640 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2641 if (ret != LDB_SUCCESS) {
2642 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2643 ldb_module_oom(module);
2644 talloc_free(tmp_ctx);
2647 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2650 switch (next_deletion_state){
2652 case OBJECT_DELETED:
2654 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2655 if (ret != LDB_SUCCESS) {
2656 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2657 ldb_module_oom(module);
2658 talloc_free(tmp_ctx);
2661 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2663 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2664 if (ret != LDB_SUCCESS) {
2665 talloc_free(tmp_ctx);
2666 ldb_module_oom(module);
2670 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2671 if (ret != LDB_SUCCESS) {
2672 talloc_free(tmp_ctx);
2673 ldb_module_oom(module);
2679 case OBJECT_RECYCLED:
2680 case OBJECT_TOMBSTONE:
2682 /* we also mark it as recycled, meaning this object can't be
2683 recovered (we are stripping its attributes) */
2684 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2685 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2686 if (ret != LDB_SUCCESS) {
2687 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2688 ldb_module_oom(module);
2689 talloc_free(tmp_ctx);
2692 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2695 /* work out which of the old attributes we will be removing */
2696 for (i=0; i<old_msg->num_elements; i++) {
2697 const struct dsdb_attribute *sa;
2698 el = &old_msg->elements[i];
2699 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2701 talloc_free(tmp_ctx);
2702 return LDB_ERR_OPERATIONS_ERROR;
2704 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2705 /* don't remove the rDN */
2708 if (sa->linkID && sa->linkID & 1) {
2709 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2710 if (ret != LDB_SUCCESS) {
2711 talloc_free(tmp_ctx);
2712 return LDB_ERR_OPERATIONS_ERROR;
2716 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2719 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2720 if (ret != LDB_SUCCESS) {
2721 talloc_free(tmp_ctx);
2722 ldb_module_oom(module);
2732 if (deletion_state == OBJECT_NOT_DELETED) {
2733 const struct dsdb_attribute *sa;
2735 /* work out what the new rdn value is, for updating the
2736 rDN and name fields */
2737 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2739 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2741 talloc_free(tmp_ctx);
2742 return LDB_ERR_OPERATIONS_ERROR;
2745 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2747 if (ret != LDB_SUCCESS) {
2748 talloc_free(tmp_ctx);
2751 el->flags = LDB_FLAG_MOD_REPLACE;
2753 el = ldb_msg_find_element(old_msg, "name");
2755 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2756 if (ret != LDB_SUCCESS) {
2757 talloc_free(tmp_ctx);
2760 el->flags = LDB_FLAG_MOD_REPLACE;
2764 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2765 if (ret != LDB_SUCCESS) {
2766 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2767 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2768 talloc_free(tmp_ctx);
2772 if (deletion_state == OBJECT_NOT_DELETED) {
2773 /* now rename onto the new DN */
2774 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2775 if (ret != LDB_SUCCESS){
2776 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2777 ldb_dn_get_linearized(old_dn),
2778 ldb_dn_get_linearized(new_dn),
2779 ldb_errstring(ldb)));
2780 talloc_free(tmp_ctx);
2785 talloc_free(tmp_ctx);
2787 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2792 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2797 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2799 int ret = LDB_ERR_OTHER;
2800 /* TODO: do some error mapping */
2804 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2806 struct ldb_context *ldb;
2807 struct ldb_request *change_req;
2808 enum ndr_err_code ndr_err;
2809 struct ldb_message *msg;
2810 struct replPropertyMetaDataBlob *md;
2811 struct ldb_val md_value;
2816 * TODO: check if the parent object exist
2820 * TODO: handle the conflict case where an object with the
2824 ldb = ldb_module_get_ctx(ar->module);
2825 msg = ar->objs->objects[ar->index_current].msg;
2826 md = ar->objs->objects[ar->index_current].meta_data;
2828 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2829 if (ret != LDB_SUCCESS) {
2830 return replmd_replicated_request_error(ar, ret);
2833 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2834 if (ret != LDB_SUCCESS) {
2835 return replmd_replicated_request_error(ar, ret);
2838 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2839 if (ret != LDB_SUCCESS) {
2840 return replmd_replicated_request_error(ar, ret);
2843 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2844 if (ret != LDB_SUCCESS) {
2845 return replmd_replicated_request_error(ar, ret);
2848 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2849 if (ret != LDB_SUCCESS) {
2850 return replmd_replicated_request_error(ar, ret);
2853 /* remove any message elements that have zero values */
2854 for (i=0; i<msg->num_elements; i++) {
2855 struct ldb_message_element *el = &msg->elements[i];
2857 if (el->num_values == 0) {
2858 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2860 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2861 msg->num_elements--;
2868 * the meta data array is already sorted by the caller
2870 for (i=0; i < md->ctr.ctr1.count; i++) {
2871 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2873 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2874 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2875 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2876 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2877 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2879 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2880 if (ret != LDB_SUCCESS) {
2881 return replmd_replicated_request_error(ar, ret);
2884 replmd_ldb_message_sort(msg, ar->schema);
2887 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2888 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2892 ret = ldb_build_add_req(&change_req,
2900 LDB_REQ_SET_LOCATION(change_req);
2901 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2903 return ldb_next_request(ar->module, change_req);
2907 return true if an update is newer than an existing entry
2908 see section 5.11 of MS-ADTS
2910 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2911 const struct GUID *update_invocation_id,
2912 uint32_t current_version,
2913 uint32_t update_version,
2914 uint32_t current_usn,
2915 uint32_t update_usn,
2916 NTTIME current_change_time,
2917 NTTIME update_change_time)
2919 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2920 if (update_usn != current_usn) {
2921 return update_usn >= current_usn;
2924 if (update_version != current_version) {
2925 return update_version >= current_version;
2927 if (update_change_time != current_change_time) {
2928 return update_change_time >= current_change_time;
2930 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2933 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2934 struct replPropertyMetaData1 *new_m)
2936 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2937 &new_m->originating_invocation_id,
2940 cur_m->originating_usn,
2941 new_m->originating_usn,
2942 cur_m->originating_change_time,
2943 new_m->originating_change_time);
2946 static struct replPropertyMetaData1 *
2947 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2948 enum drsuapi_DsAttributeId attid)
2951 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2953 for (i = 0; i < rpmd_ctr->count; i++) {
2954 if (rpmd_ctr->array[i].attid == attid) {
2955 return &rpmd_ctr->array[i];
2963 handle renames that come in over DRS replication
2965 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
2966 struct ldb_message *msg,
2967 struct replPropertyMetaDataBlob *rmd,
2968 struct replPropertyMetaDataBlob *omd)
2970 struct replPropertyMetaData1 *md_remote;
2971 struct replPropertyMetaData1 *md_local;
2973 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
2978 /* now we need to check for double renames. We could have a
2979 * local rename pending which our replication partner hasn't
2980 * received yet. We choose which one wins by looking at the
2981 * attribute stamps on the two objects, the newer one wins
2983 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTRIBUTE_name);
2984 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTRIBUTE_name);
2985 /* if there is no name attribute then we have to assume the
2986 object we've received is in fact newer */
2987 if (!md_remote || !md_local ||
2988 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
2989 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
2990 ldb_dn_get_linearized(ar->search_msg->dn),
2991 ldb_dn_get_linearized(msg->dn)));
2992 /* pass rename to the next module
2993 * so it doesn't appear as an originating update */
2994 return dsdb_module_rename(ar->module,
2995 ar->search_msg->dn, msg->dn,
2996 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
2999 /* we're going to keep our old object */
3000 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3001 ldb_dn_get_linearized(ar->search_msg->dn),
3002 ldb_dn_get_linearized(msg->dn)));
3007 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3009 struct ldb_context *ldb;
3010 struct ldb_request *change_req;
3011 enum ndr_err_code ndr_err;
3012 struct ldb_message *msg;
3013 struct replPropertyMetaDataBlob *rmd;
3014 struct replPropertyMetaDataBlob omd;
3015 const struct ldb_val *omd_value;
3016 struct replPropertyMetaDataBlob nmd;
3017 struct ldb_val nmd_value;
3020 unsigned int removed_attrs = 0;
3023 ldb = ldb_module_get_ctx(ar->module);
3024 msg = ar->objs->objects[ar->index_current].msg;
3025 rmd = ar->objs->objects[ar->index_current].meta_data;
3029 /* find existing meta data */
3030 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3032 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3033 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3034 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3035 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3036 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3039 if (omd.version != 1) {
3040 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3044 /* handle renames that come in over DRS */
3045 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd);
3046 if (ret != LDB_SUCCESS) {
3047 ldb_debug(ldb, LDB_DEBUG_FATAL,
3048 "replmd_replicated_request rename %s => %s failed - %s\n",
3049 ldb_dn_get_linearized(ar->search_msg->dn),
3050 ldb_dn_get_linearized(msg->dn),
3051 ldb_errstring(ldb));
3052 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3057 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3058 nmd.ctr.ctr1.array = talloc_array(ar,
3059 struct replPropertyMetaData1,
3060 nmd.ctr.ctr1.count);
3061 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3063 /* first copy the old meta data */
3064 for (i=0; i < omd.ctr.ctr1.count; i++) {
3065 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3069 /* now merge in the new meta data */
3070 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3073 for (j=0; j < ni; j++) {
3076 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3080 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3081 &rmd->ctr.ctr1.array[i]);
3083 /* replace the entry */
3084 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3089 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) {
3090 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3091 msg->elements[i-removed_attrs].name,
3092 ldb_dn_get_linearized(msg->dn),
3093 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3096 /* we don't want to apply this change so remove the attribute */
3097 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3104 if (found) continue;
3106 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3111 * finally correct the size of the meta_data array
3113 nmd.ctr.ctr1.count = ni;
3116 * the rdn attribute (the alias for the name attribute),
3117 * 'cn' for most objects is the last entry in the meta data array
3120 * sort the new meta data array
3122 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3123 if (ret != LDB_SUCCESS) {
3128 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3130 if (msg->num_elements == 0) {
3131 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3134 ar->index_current++;
3135 return replmd_replicated_apply_next(ar);
3138 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3139 ar->index_current, msg->num_elements);
3141 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3142 if (ret != LDB_SUCCESS) {
3143 return replmd_replicated_request_error(ar, ret);
3146 for (i=0; i<ni; i++) {
3147 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3150 /* create the meta data value */
3151 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3152 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3153 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3154 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3155 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3159 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3160 * and replPopertyMetaData attributes
3162 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3163 if (ret != LDB_SUCCESS) {
3164 return replmd_replicated_request_error(ar, ret);
3166 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3167 if (ret != LDB_SUCCESS) {
3168 return replmd_replicated_request_error(ar, ret);
3170 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3171 if (ret != LDB_SUCCESS) {
3172 return replmd_replicated_request_error(ar, ret);
3175 replmd_ldb_message_sort(msg, ar->schema);
3177 /* we want to replace the old values */
3178 for (i=0; i < msg->num_elements; i++) {
3179 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3183 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3184 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3188 ret = ldb_build_mod_req(&change_req,
3196 LDB_REQ_SET_LOCATION(change_req);
3197 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3199 return ldb_next_request(ar->module, change_req);
3202 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3203 struct ldb_reply *ares)
3205 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3206 struct replmd_replicated_request);
3210 return ldb_module_done(ar->req, NULL, NULL,
3211 LDB_ERR_OPERATIONS_ERROR);
3213 if (ares->error != LDB_SUCCESS &&
3214 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3215 return ldb_module_done(ar->req, ares->controls,
3216 ares->response, ares->error);
3219 switch (ares->type) {
3220 case LDB_REPLY_ENTRY:
3221 ar->search_msg = talloc_steal(ar, ares->message);
3224 case LDB_REPLY_REFERRAL:
3225 /* we ignore referrals */
3228 case LDB_REPLY_DONE:
3229 if (ar->search_msg != NULL) {
3230 ret = replmd_replicated_apply_merge(ar);
3232 ret = replmd_replicated_apply_add(ar);
3234 if (ret != LDB_SUCCESS) {
3235 return ldb_module_done(ar->req, NULL, NULL, ret);
3243 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3245 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3247 struct ldb_context *ldb;
3251 struct ldb_request *search_req;
3252 struct ldb_search_options_control *options;
3254 if (ar->index_current >= ar->objs->num_objects) {
3255 /* done with it, go to next stage */
3256 return replmd_replicated_uptodate_vector(ar);
3259 ldb = ldb_module_get_ctx(ar->module);
3260 ar->search_msg = NULL;
3262 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3263 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3265 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3266 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3267 talloc_free(tmp_str);
3269 ret = ldb_build_search_req(&search_req,
3278 replmd_replicated_apply_search_callback,
3280 LDB_REQ_SET_LOCATION(search_req);
3282 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3284 if (ret != LDB_SUCCESS) {
3288 /* we need to cope with cross-partition links, so search for
3289 the GUID over all partitions */
3290 options = talloc(search_req, struct ldb_search_options_control);
3291 if (options == NULL) {
3292 DEBUG(0, (__location__ ": out of memory\n"));
3293 return LDB_ERR_OPERATIONS_ERROR;
3295 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3297 ret = ldb_request_add_control(search_req,
3298 LDB_CONTROL_SEARCH_OPTIONS_OID,
3300 if (ret != LDB_SUCCESS) {
3304 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3306 return ldb_next_request(ar->module, search_req);
3309 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3310 struct ldb_reply *ares)
3312 struct ldb_context *ldb;
3313 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3314 struct replmd_replicated_request);
3315 ldb = ldb_module_get_ctx(ar->module);
3318 return ldb_module_done(ar->req, NULL, NULL,
3319 LDB_ERR_OPERATIONS_ERROR);
3321 if (ares->error != LDB_SUCCESS) {
3322 return ldb_module_done(ar->req, ares->controls,
3323 ares->response, ares->error);
3326 if (ares->type != LDB_REPLY_DONE) {
3327 ldb_set_errstring(ldb, "Invalid reply type\n!");
3328 return ldb_module_done(ar->req, NULL, NULL,
3329 LDB_ERR_OPERATIONS_ERROR);
3334 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3337 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3339 struct ldb_context *ldb;
3340 struct ldb_request *change_req;
3341 enum ndr_err_code ndr_err;
3342 struct ldb_message *msg;
3343 struct replUpToDateVectorBlob ouv;
3344 const struct ldb_val *ouv_value;
3345 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3346 struct replUpToDateVectorBlob nuv;
3347 struct ldb_val nuv_value;
3348 struct ldb_message_element *nuv_el = NULL;
3349 const struct GUID *our_invocation_id;
3350 struct ldb_message_element *orf_el = NULL;
3351 struct repsFromToBlob nrf;
3352 struct ldb_val *nrf_value = NULL;
3353 struct ldb_message_element *nrf_el = NULL;
3357 time_t t = time(NULL);
3360 uint32_t instanceType;
3362 ldb = ldb_module_get_ctx(ar->module);
3363 ruv = ar->objs->uptodateness_vector;
3369 unix_to_nt_time(&now, t);
3371 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3372 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3373 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3374 ldb_dn_get_linearized(ar->search_msg->dn)));
3375 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3379 * first create the new replUpToDateVector
3381 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3383 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3384 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3385 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3386 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3387 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3390 if (ouv.version != 2) {
3391 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3396 * the new uptodateness vector will at least
3397 * contain 1 entry, one for the source_dsa
3399 * plus optional values from our old vector and the one from the source_dsa
3401 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3402 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3403 nuv.ctr.ctr2.cursors = talloc_array(ar,
3404 struct drsuapi_DsReplicaCursor2,
3405 nuv.ctr.ctr2.count);
3406 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3408 /* first copy the old vector */
3409 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3410 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3414 /* get our invocation_id if we have one already attached to the ldb */
3415 our_invocation_id = samdb_ntds_invocation_id(ldb);
3417 /* merge in the source_dsa vector is available */
3418 for (i=0; (ruv && i < ruv->count); i++) {
3421 if (our_invocation_id &&
3422 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3423 our_invocation_id)) {
3427 for (j=0; j < ni; j++) {
3428 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3429 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3436 * we update only the highest_usn and not the latest_sync_success time,
3437 * because the last success stands for direct replication
3439 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3440 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3445 if (found) continue;
3447 /* if it's not there yet, add it */
3448 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3453 * merge in the current highwatermark for the source_dsa
3456 for (j=0; j < ni; j++) {
3457 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3458 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3465 * here we update the highest_usn and last_sync_success time
3466 * because we're directly replicating from the source_dsa
3468 * and use the tmp_highest_usn because this is what we have just applied
3471 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3472 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3477 * here we update the highest_usn and last_sync_success time
3478 * because we're directly replicating from the source_dsa
3480 * and use the tmp_highest_usn because this is what we have just applied
3483 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3484 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3485 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3490 * finally correct the size of the cursors array
3492 nuv.ctr.ctr2.count = ni;
3497 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3500 * create the change ldb_message
3502 msg = ldb_msg_new(ar);
3503 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3504 msg->dn = ar->search_msg->dn;
3506 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3507 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3508 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3509 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3510 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3512 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3513 if (ret != LDB_SUCCESS) {
3514 return replmd_replicated_request_error(ar, ret);
3516 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3519 * now create the new repsFrom value from the given repsFromTo1 structure
3523 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3524 /* and fix some values... */
3525 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3526 nrf.ctr.ctr1.last_success = now;
3527 nrf.ctr.ctr1.last_attempt = now;
3528 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3529 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3532 * first see if we already have a repsFrom value for the current source dsa
3533 * if so we'll later replace this value
3535 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3537 for (i=0; i < orf_el->num_values; i++) {
3538 struct repsFromToBlob *trf;
3540 trf = talloc(ar, struct repsFromToBlob);
3541 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3543 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3544 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3545 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3546 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3547 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3550 if (trf->version != 1) {
3551 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3555 * we compare the source dsa objectGUID not the invocation_id
3556 * because we want only one repsFrom value per source dsa
3557 * and when the invocation_id of the source dsa has changed we don't need
3558 * the old repsFrom with the old invocation_id
3560 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3561 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3567 nrf_value = &orf_el->values[i];
3572 * copy over all old values to the new ldb_message
3574 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3575 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3580 * if we haven't found an old repsFrom value for the current source dsa
3581 * we'll add a new value
3584 struct ldb_val zero_value;
3585 ZERO_STRUCT(zero_value);
3586 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3587 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3589 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3592 /* we now fill the value which is already attached to ldb_message */
3593 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3595 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3596 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3597 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3598 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3602 * the ldb_message_element for the attribute, has all the old values and the new one
3603 * so we'll replace the whole attribute with all values
3605 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3608 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3609 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3613 /* prepare the ldb_modify() request */
3614 ret = ldb_build_mod_req(&change_req,
3620 replmd_replicated_uptodate_modify_callback,
3622 LDB_REQ_SET_LOCATION(change_req);
3623 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3625 return ldb_next_request(ar->module, change_req);
3628 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3629 struct ldb_reply *ares)
3631 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3632 struct replmd_replicated_request);
3636 return ldb_module_done(ar->req, NULL, NULL,
3637 LDB_ERR_OPERATIONS_ERROR);
3639 if (ares->error != LDB_SUCCESS &&
3640 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3641 return ldb_module_done(ar->req, ares->controls,
3642 ares->response, ares->error);
3645 switch (ares->type) {
3646 case LDB_REPLY_ENTRY:
3647 ar->search_msg = talloc_steal(ar, ares->message);
3650 case LDB_REPLY_REFERRAL:
3651 /* we ignore referrals */
3654 case LDB_REPLY_DONE:
3655 if (ar->search_msg == NULL) {
3656 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3658 ret = replmd_replicated_uptodate_modify(ar);
3660 if (ret != LDB_SUCCESS) {
3661 return ldb_module_done(ar->req, NULL, NULL, ret);
3670 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3672 struct ldb_context *ldb;
3674 static const char *attrs[] = {
3675 "replUpToDateVector",
3680 struct ldb_request *search_req;
3682 ldb = ldb_module_get_ctx(ar->module);
3683 ar->search_msg = NULL;
3685 ret = ldb_build_search_req(&search_req,
3688 ar->objs->partition_dn,
3694 replmd_replicated_uptodate_search_callback,
3696 LDB_REQ_SET_LOCATION(search_req);
3697 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3699 return ldb_next_request(ar->module, search_req);
3704 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3706 struct ldb_context *ldb;
3707 struct dsdb_extended_replicated_objects *objs;
3708 struct replmd_replicated_request *ar;
3709 struct ldb_control **ctrls;
3712 struct replmd_private *replmd_private =
3713 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3715 ldb = ldb_module_get_ctx(module);
3717 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3719 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3721 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3722 return LDB_ERR_PROTOCOL_ERROR;
3725 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3726 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3727 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3728 return LDB_ERR_PROTOCOL_ERROR;
3731 ar = replmd_ctx_init(module, req);
3733 return LDB_ERR_OPERATIONS_ERROR;
3735 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3736 ar->apply_mode = true;
3738 ar->schema = dsdb_get_schema(ldb, ar);
3740 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3742 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3743 return LDB_ERR_CONSTRAINT_VIOLATION;
3746 ctrls = req->controls;
3748 if (req->controls) {
3749 req->controls = talloc_memdup(ar, req->controls,
3750 talloc_get_size(req->controls));
3751 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3754 /* This allows layers further down to know if a change came in over replication */
3755 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3756 if (ret != LDB_SUCCESS) {
3760 /* If this change contained linked attributes in the body
3761 * (rather than in the links section) we need to update
3762 * backlinks in linked_attributes */
3763 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3764 if (ret != LDB_SUCCESS) {
3768 ar->controls = req->controls;
3769 req->controls = ctrls;
3771 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3773 /* save away the linked attributes for the end of the
3775 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3776 struct la_entry *la_entry;
3778 if (replmd_private->la_ctx == NULL) {
3779 replmd_private->la_ctx = talloc_new(replmd_private);
3781 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3782 if (la_entry == NULL) {
3784 return LDB_ERR_OPERATIONS_ERROR;
3786 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3787 if (la_entry->la == NULL) {
3788 talloc_free(la_entry);
3790 return LDB_ERR_OPERATIONS_ERROR;
3792 *la_entry->la = ar->objs->linked_attributes[i];
3794 /* we need to steal the non-scalars so they stay
3795 around until the end of the transaction */
3796 talloc_steal(la_entry->la, la_entry->la->identifier);
3797 talloc_steal(la_entry->la, la_entry->la->value.blob);
3799 DLIST_ADD(replmd_private->la_list, la_entry);
3802 return replmd_replicated_apply_next(ar);
3806 process one linked attribute structure
3808 static int replmd_process_linked_attribute(struct ldb_module *module,
3809 struct la_entry *la_entry)
3811 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3812 struct ldb_context *ldb = ldb_module_get_ctx(module);
3813 struct ldb_message *msg;
3814 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3815 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3817 const struct dsdb_attribute *attr;
3818 struct dsdb_dn *dsdb_dn;
3819 uint64_t seq_num = 0;
3820 struct ldb_message_element *old_el;
3822 time_t t = time(NULL);
3823 struct ldb_result *res;
3824 const char *attrs[2];
3825 struct parsed_dn *pdn_list, *pdn;
3826 struct GUID guid = GUID_zero();
3828 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3829 const struct GUID *our_invocation_id;
3832 linked_attributes[0]:
3833 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3835 identifier: struct drsuapi_DsReplicaObjectIdentifier
3836 __ndr_size : 0x0000003a (58)
3837 __ndr_size_sid : 0x00000000 (0)
3838 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3840 __ndr_size_dn : 0x00000000 (0)
3842 attid : DRSUAPI_ATTRIBUTE_member (0x1F)
3843 value: struct drsuapi_DsAttributeValue
3844 __ndr_size : 0x0000007e (126)
3846 blob : DATA_BLOB length=126
3847 flags : 0x00000001 (1)
3848 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3849 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3850 meta_data: struct drsuapi_DsReplicaMetaData
3851 version : 0x00000015 (21)
3852 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3853 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3854 originating_usn : 0x000000000001e19c (123292)
3856 (for cases where the link is to a normal DN)
3857 &target: struct drsuapi_DsReplicaObjectIdentifier3
3858 __ndr_size : 0x0000007e (126)
3859 __ndr_size_sid : 0x0000001c (28)
3860 guid : 7639e594-db75-4086-b0d4-67890ae46031
3861 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3862 __ndr_size_dn : 0x00000022 (34)
3863 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3866 /* find the attribute being modified */
3867 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3869 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3870 talloc_free(tmp_ctx);
3871 return LDB_ERR_OPERATIONS_ERROR;
3874 attrs[0] = attr->lDAPDisplayName;
3877 /* get the existing message from the db for the object with
3878 this GUID, returning attribute being modified. We will then
3879 use this msg as the basis for a modify call */
3880 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3881 DSDB_FLAG_NEXT_MODULE |
3882 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3883 DSDB_SEARCH_SHOW_RECYCLED |
3884 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3885 DSDB_SEARCH_REVEAL_INTERNALS,
3886 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3887 if (ret != LDB_SUCCESS) {
3888 talloc_free(tmp_ctx);
3891 if (res->count != 1) {
3892 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3893 GUID_string(tmp_ctx, &la->identifier->guid));
3894 talloc_free(tmp_ctx);
3895 return LDB_ERR_NO_SUCH_OBJECT;
3899 if (msg->num_elements == 0) {
3900 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3901 if (ret != LDB_SUCCESS) {
3902 ldb_module_oom(module);
3903 talloc_free(tmp_ctx);
3904 return LDB_ERR_OPERATIONS_ERROR;
3907 old_el = &msg->elements[0];
3908 old_el->flags = LDB_FLAG_MOD_REPLACE;
3911 /* parse the existing links */
3912 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3913 if (ret != LDB_SUCCESS) {
3914 talloc_free(tmp_ctx);
3918 /* get our invocationId */
3919 our_invocation_id = samdb_ntds_invocation_id(ldb);
3920 if (!our_invocation_id) {
3921 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3922 talloc_free(tmp_ctx);
3923 return LDB_ERR_OPERATIONS_ERROR;
3926 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3927 if (ret != LDB_SUCCESS) {
3928 talloc_free(tmp_ctx);
3932 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3933 if (!W_ERROR_IS_OK(status)) {
3934 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3935 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3936 return LDB_ERR_OPERATIONS_ERROR;
3939 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3940 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3941 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3943 ldb_dn_get_linearized(dsdb_dn->dn),
3944 ldb_dn_get_linearized(msg->dn));
3945 return LDB_ERR_OPERATIONS_ERROR;
3948 /* re-resolve the DN by GUID, as the DRS server may give us an
3950 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3951 if (ret != LDB_SUCCESS) {
3952 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3953 GUID_string(tmp_ctx, &guid),
3954 ldb_dn_get_linearized(dsdb_dn->dn)));
3957 /* see if this link already exists */
3958 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3960 /* see if this update is newer than what we have already */
3961 struct GUID invocation_id = GUID_zero();
3962 uint32_t version = 0;
3963 uint32_t originating_usn = 0;
3964 NTTIME change_time = 0;
3965 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3967 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3968 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3969 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
3970 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3972 if (!replmd_update_is_newer(&invocation_id,
3973 &la->meta_data.originating_invocation_id,
3975 la->meta_data.version,
3977 la->meta_data.originating_usn,
3979 la->meta_data.originating_change_time)) {
3980 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3981 old_el->name, ldb_dn_get_linearized(msg->dn),
3982 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
3983 talloc_free(tmp_ctx);
3987 /* get a seq_num for this change */
3988 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3989 if (ret != LDB_SUCCESS) {
3990 talloc_free(tmp_ctx);
3994 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
3995 /* remove the existing backlink */
3996 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
3997 if (ret != LDB_SUCCESS) {
3998 talloc_free(tmp_ctx);
4003 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4004 &la->meta_data.originating_invocation_id,
4005 la->meta_data.originating_usn, seq_num,
4006 la->meta_data.originating_change_time,
4007 la->meta_data.version,
4009 if (ret != LDB_SUCCESS) {
4010 talloc_free(tmp_ctx);
4015 /* add the new backlink */
4016 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4017 if (ret != LDB_SUCCESS) {
4018 talloc_free(tmp_ctx);
4023 /* get a seq_num for this change */
4024 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4025 if (ret != LDB_SUCCESS) {
4026 talloc_free(tmp_ctx);
4030 old_el->values = talloc_realloc(msg->elements, old_el->values,
4031 struct ldb_val, old_el->num_values+1);
4032 if (!old_el->values) {
4033 ldb_module_oom(module);
4034 return LDB_ERR_OPERATIONS_ERROR;
4036 old_el->num_values++;
4038 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4039 &la->meta_data.originating_invocation_id,
4040 la->meta_data.originating_usn, seq_num,
4041 la->meta_data.originating_change_time,
4042 la->meta_data.version,
4043 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4044 if (ret != LDB_SUCCESS) {
4045 talloc_free(tmp_ctx);
4050 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4052 if (ret != LDB_SUCCESS) {
4053 talloc_free(tmp_ctx);
4059 /* we only change whenChanged and uSNChanged if the seq_num
4061 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4062 talloc_free(tmp_ctx);
4063 return ldb_operr(ldb);
4066 if (add_uint64_element(msg, "uSNChanged", seq_num) != LDB_SUCCESS) {
4067 talloc_free(tmp_ctx);
4068 return ldb_operr(ldb);
4071 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4072 if (old_el == NULL) {
4073 talloc_free(tmp_ctx);
4074 return ldb_operr(ldb);
4077 ret = dsdb_check_single_valued_link(attr, old_el);
4078 if (ret != LDB_SUCCESS) {
4079 talloc_free(tmp_ctx);
4083 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
4084 if (ret != LDB_SUCCESS) {
4085 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4087 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4088 talloc_free(tmp_ctx);
4092 talloc_free(tmp_ctx);
4097 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4099 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4100 return replmd_extended_replicated_objects(module, req);
4103 return ldb_next_request(module, req);
4108 we hook into the transaction operations to allow us to
4109 perform the linked attribute updates at the end of the whole
4110 transaction. This allows a forward linked attribute to be created
4111 before the object is created. During a vampire, w2k8 sends us linked
4112 attributes before the objects they are part of.
4114 static int replmd_start_transaction(struct ldb_module *module)
4116 /* create our private structure for this transaction */
4117 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4118 struct replmd_private);
4119 replmd_txn_cleanup(replmd_private);
4121 /* free any leftover mod_usn records from cancelled
4123 while (replmd_private->ncs) {
4124 struct nc_entry *e = replmd_private->ncs;
4125 DLIST_REMOVE(replmd_private->ncs, e);
4129 return ldb_next_start_trans(module);
4133 on prepare commit we loop over our queued la_context structures and
4136 static int replmd_prepare_commit(struct ldb_module *module)
4138 struct replmd_private *replmd_private =
4139 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4140 struct la_entry *la, *prev;
4141 struct la_backlink *bl;
4144 /* walk the list backwards, to do the first entry first, as we
4145 * added the entries with DLIST_ADD() which puts them at the
4146 * start of the list */
4147 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4148 prev = DLIST_PREV(la);
4149 DLIST_REMOVE(replmd_private->la_list, la);
4150 ret = replmd_process_linked_attribute(module, la);
4151 if (ret != LDB_SUCCESS) {
4152 replmd_txn_cleanup(replmd_private);
4157 /* process our backlink list, creating and deleting backlinks
4159 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4160 ret = replmd_process_backlink(module, bl);
4161 if (ret != LDB_SUCCESS) {
4162 replmd_txn_cleanup(replmd_private);
4167 replmd_txn_cleanup(replmd_private);
4169 /* possibly change @REPLCHANGED */
4170 ret = replmd_notify_store(module);
4171 if (ret != LDB_SUCCESS) {
4175 return ldb_next_prepare_commit(module);
4178 static int replmd_del_transaction(struct ldb_module *module)
4180 struct replmd_private *replmd_private =
4181 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4182 replmd_txn_cleanup(replmd_private);
4184 return ldb_next_del_trans(module);
4188 _PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4189 .name = "repl_meta_data",
4190 .init_context = replmd_init,
4192 .modify = replmd_modify,
4193 .rename = replmd_rename,
4194 .del = replmd_delete,
4195 .extended = replmd_extended,
4196 .start_transaction = replmd_start_transaction,
4197 .prepare_commit = replmd_prepare_commit,
4198 .del_transaction = replmd_del_transaction,