source4/dsdb/samdb/ldb_modules/repl_meta_data.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2004-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6    Copyright (C) Andrew Tridgell 2005
   7    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   8    Copyright (C) Matthieu Patou <mat@samba.org> 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 /*
  25  *  Name: ldb
  26  *
  27  *  Component: ldb repl_meta_data module
  28  *
  29  *  Description: - add a unique objectGUID onto every new record,
  30  *               - handle whenCreated, whenChanged timestamps
  31  *               - handle uSNCreated, uSNChanged numbers
  32  *               - handle replPropertyMetaData attribute
  33  *
  34  *  Author: Simo Sorce
  35  *  Author: Stefan Metzmacher
  36  */
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "dsdb/samdb/samdb.h"
  41 #include "dsdb/common/proto.h"
  42 #include "../libds/common/flags.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44 #include "librpc/gen_ndr/ndr_drsuapi.h"
  45 #include "librpc/gen_ndr/ndr_drsblobs.h"
  46 #include "param/param.h"
  47 #include "libcli/security/security.h"
  48 #include "lib/util/dlinklist.h"
  49 #include "dsdb/samdb/ldb_modules/util.h"
  50 #include "lib/util/binsearch.h"
  51 #include "lib/util/tsort.h"
  52
  53 struct replmd_private {
  54         TALLOC_CTX *la_ctx;
  55         struct la_entry *la_list;
  56         TALLOC_CTX *bl_ctx;
  57         struct la_backlink *la_backlinks;
  58         struct nc_entry {
  59                 struct nc_entry *prev, *next;
  60                 struct ldb_dn *dn;
  61                 uint64_t mod_usn;
  62                 uint64_t mod_usn_urgent;
  63         } *ncs;
  64 };
  65
  66 struct la_entry {
  67         struct la_entry *next, *prev;
  68         struct drsuapi_DsReplicaLinkedAttribute *la;
  69 };
  70
  71 struct replmd_replicated_request {
  72         struct ldb_module *module;
  73         struct ldb_request *req;
  74
  75         const struct dsdb_schema *schema;
  76
  77         /* the controls we pass down */
  78         struct ldb_control **controls;
  79
  80         /* details for the mode where we apply a bunch of inbound replication meessages */
  81         bool apply_mode;
  82         uint32_t index_current;
  83         struct dsdb_extended_replicated_objects *objs;
  84
  85         struct ldb_message *search_msg;
  86
  87         uint64_t seq_num;
  88         bool is_urgent;
  89 };
  90
  91 enum urgent_situation {
  92         REPL_URGENT_ON_CREATE = 1,
  93         REPL_URGENT_ON_UPDATE = 2,
  94         REPL_URGENT_ON_DELETE = 4
  95 };
  96
  97
  98 static const struct {
  99         const char *update_name;
 100         enum urgent_situation repl_situation;
 101 } urgent_objects[] = {
 102                 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
 103                 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
 104                 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 105                 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 106                 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 107                 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 108                 {NULL, 0}
 109 };
 110
 111 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
 112 static const char *urgent_attrs[] = {
 113                 "lockoutTime",
 114                 "pwdLastSet",
 115                 "userAccountControl",
 116                 NULL
 117 };
 118
 119
 120 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
 121                                         enum urgent_situation situation)
 122 {
 123         unsigned int i, j;
 124         for (i=0; urgent_objects[i].update_name; i++) {
 125
 126                 if ((situation & urgent_objects[i].repl_situation) == 0) {
 127                         continue;
 128                 }
 129
 130                 for (j=0; j<objectclass_el->num_values; j++) {
 131                         const struct ldb_val *v = &objectclass_el->values[j];
 132                         if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
 133                                 return true;
 134                         }
 135                 }
 136         }
 137         return false;
 138 }
 139
 140 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
 141 {
 142         if (ldb_attr_in_list(urgent_attrs, el->name)) {
 143                 return true;
 144         }
 145         return false;
 146 }
 147
 148
 149 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
 150
 151 /*
 152   initialise the module
 153   allocate the private structure and build the list
 154   of partition DNs for use by replmd_notify()
 155  */
 156 static int replmd_init(struct ldb_module *module)
 157 {
 158         struct replmd_private *replmd_private;
 159         struct ldb_context *ldb = ldb_module_get_ctx(module);
 160
 161         replmd_private = talloc_zero(module, struct replmd_private);
 162         if (replmd_private == NULL) {
 163                 ldb_oom(ldb);
 164                 return LDB_ERR_OPERATIONS_ERROR;
 165         }
 166         ldb_module_set_private(module, replmd_private);
 167
 168         return ldb_next_init(module);
 169 }
 170
 171 /*
 172   cleanup our per-transaction contexts
 173  */
 174 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
 175 {
 176         talloc_free(replmd_private->la_ctx);
 177         replmd_private->la_list = NULL;
 178         replmd_private->la_ctx = NULL;
 179
 180         talloc_free(replmd_private->bl_ctx);
 181         replmd_private->la_backlinks = NULL;
 182         replmd_private->bl_ctx = NULL;
 183 }
 184
 185
 186 struct la_backlink {
 187         struct la_backlink *next, *prev;
 188         const char *attr_name;
 189         struct GUID forward_guid, target_guid;
 190         bool active;
 191 };
 192
 193 /*
 194   process a backlinks we accumulated during a transaction, adding and
 195   deleting the backlinks from the target objects
 196  */
 197 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
 198 {
 199         struct ldb_dn *target_dn, *source_dn;
 200         int ret;
 201         struct ldb_context *ldb = ldb_module_get_ctx(module);
 202         struct ldb_message *msg;
 203         TALLOC_CTX *tmp_ctx = talloc_new(bl);
 204         char *dn_string;
 205
 206         /*
 207           - find DN of target
 208           - find DN of source
 209           - construct ldb_message
 210               - either an add or a delete
 211          */
 212         ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
 213         if (ret != LDB_SUCCESS) {
 214                 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
 215                          GUID_string(bl, &bl->target_guid)));
 216                 return LDB_SUCCESS;
 217         }
 218
 219         ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
 220         if (ret != LDB_SUCCESS) {
 221                 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
 222                                        GUID_string(bl, &bl->forward_guid));
 223                 talloc_free(tmp_ctx);
 224                 return ret;
 225         }
 226
 227         msg = ldb_msg_new(tmp_ctx);
 228         if (msg == NULL) {
 229                 ldb_module_oom(module);
 230                 talloc_free(tmp_ctx);
 231                 return LDB_ERR_OPERATIONS_ERROR;
 232         }
 233
 234         /* construct a ldb_message for adding/deleting the backlink */
 235         msg->dn = target_dn;
 236         dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
 237         if (!dn_string) {
 238                 ldb_module_oom(module);
 239                 talloc_free(tmp_ctx);
 240                 return LDB_ERR_OPERATIONS_ERROR;
 241         }
 242         ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
 243         if (ret != LDB_SUCCESS) {
 244                 talloc_free(tmp_ctx);
 245                 return ret;
 246         }
 247         msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
 248
 249         /* a backlink should never be single valued. Unfortunately the
 250            exchange schema has a attribute
 251            msExchBridgeheadedLocalConnectorsDNBL which is single
 252            valued and a backlink. We need to cope with that by
 253            ignoring the single value flag */
 254         msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
 255
 256         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
 257         if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
 258                 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
 259                    cope with possible corruption where the backlink has
 260                    already been removed */
 261                 DEBUG(0,("WARNING: backlink from %s already removed from %s - %s\n",
 262                          ldb_dn_get_linearized(target_dn),
 263                          ldb_dn_get_linearized(source_dn),
 264                          ldb_errstring(ldb)));
 265                 ret = LDB_SUCCESS;
 266         } else if (ret != LDB_SUCCESS) {
 267                 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
 268                                        bl->active?"add":"remove",
 269                                        ldb_dn_get_linearized(source_dn),
 270                                        ldb_dn_get_linearized(target_dn),
 271                                        ldb_errstring(ldb));
 272                 talloc_free(tmp_ctx);
 273                 return ret;
 274         }
 275         talloc_free(tmp_ctx);
 276         return ret;
 277 }
 278
 279 /*
 280   add a backlink to the list of backlinks to add/delete in the prepare
 281   commit
 282  */
 283 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
 284                                struct GUID *forward_guid, struct GUID *target_guid,
 285                                bool active, const struct dsdb_attribute *schema_attr, bool immediate)
 286 {
 287         const struct dsdb_attribute *target_attr;
 288         struct la_backlink *bl;
 289         struct replmd_private *replmd_private =
 290                 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
 291
 292         target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
 293         if (!target_attr) {
 294                 /*
 295                  * windows 2003 has a broken schema where the
 296                  * definition of msDS-IsDomainFor is missing (which is
 297                  * supposed to be the backlink of the
 298                  * msDS-HasDomainNCs attribute
 299                  */
 300                 return LDB_SUCCESS;
 301         }
 302
 303         /* see if its already in the list */
 304         for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
 305                 if (GUID_equal(forward_guid, &bl->forward_guid) &&
 306                     GUID_equal(target_guid, &bl->target_guid) &&
 307                     (target_attr->lDAPDisplayName == bl->attr_name ||
 308                      strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
 309                         break;
 310                 }
 311         }
 312
 313         if (bl) {
 314                 /* we found an existing one */
 315                 if (bl->active == active) {
 316                         return LDB_SUCCESS;
 317                 }
 318                 DLIST_REMOVE(replmd_private->la_backlinks, bl);
 319                 talloc_free(bl);
 320                 return LDB_SUCCESS;
 321         }
 322
 323         if (replmd_private->bl_ctx == NULL) {
 324                 replmd_private->bl_ctx = talloc_new(replmd_private);
 325                 if (replmd_private->bl_ctx == NULL) {
 326                         ldb_module_oom(module);
 327                         return LDB_ERR_OPERATIONS_ERROR;
 328                 }
 329         }
 330
 331         /* its a new one */
 332         bl = talloc(replmd_private->bl_ctx, struct la_backlink);
 333         if (bl == NULL) {
 334                 ldb_module_oom(module);
 335                 return LDB_ERR_OPERATIONS_ERROR;
 336         }
 337
 338         /* Ensure the schema does not go away before the bl->attr_name is used */
 339         if (!talloc_reference(bl, schema)) {
 340                 talloc_free(bl);
 341                 ldb_module_oom(module);
 342                 return LDB_ERR_OPERATIONS_ERROR;
 343         }
 344
 345         bl->attr_name = target_attr->lDAPDisplayName;
 346         bl->forward_guid = *forward_guid;
 347         bl->target_guid = *target_guid;
 348         bl->active = active;
 349
 350         /* the caller may ask for this backlink to be processed
 351            immediately */
 352         if (immediate) {
 353                 int ret = replmd_process_backlink(module, bl, NULL);
 354                 talloc_free(bl);
 355                 return ret;
 356         }
 357
 358         DLIST_ADD(replmd_private->la_backlinks, bl);
 359
 360         return LDB_SUCCESS;
 361 }
 362
 363
 364 /*
 365  * Callback for most write operations in this module:
 366  *
 367  * notify the repl task that a object has changed. The notifies are
 368  * gathered up in the replmd_private structure then written to the
 369  * @REPLCHANGED object in each partition during the prepare_commit
 370  */
 371 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 372 {
 373         int ret;
 374         struct replmd_replicated_request *ac =
 375                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
 376         struct replmd_private *replmd_private =
 377                 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
 378         struct nc_entry *modified_partition;
 379         struct ldb_control *partition_ctrl;
 380         const struct dsdb_control_current_partition *partition;
 381
 382         struct ldb_control **controls;
 383
 384         partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
 385
 386         controls = ares->controls;
 387         if (ldb_request_get_control(ac->req,
 388                                     DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
 389                 /*
 390                  * Remove the current partition control from what we pass up
 391                  * the chain if it hasn't been requested manually.
 392                  */
 393                 controls = ldb_controls_except_specified(ares->controls, ares,
 394                                                          partition_ctrl);
 395         }
 396
 397         if (ares->error != LDB_SUCCESS) {
 398                 DEBUG(0,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
 399                 return ldb_module_done(ac->req, controls,
 400                                         ares->response, ares->error);
 401         }
 402
 403         if (ares->type != LDB_REPLY_DONE) {
 404                 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
 405                 return ldb_module_done(ac->req, NULL,
 406                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 407         }
 408
 409         if (!partition_ctrl) {
 410                 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
 411                 return ldb_module_done(ac->req, NULL,
 412                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 413         }
 414
 415         partition = talloc_get_type_abort(partition_ctrl->data,
 416                                     struct dsdb_control_current_partition);
 417
 418         if (ac->seq_num > 0) {
 419                 for (modified_partition = replmd_private->ncs; modified_partition;
 420                      modified_partition = modified_partition->next) {
 421                         if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
 422                                 break;
 423                         }
 424                 }
 425
 426                 if (modified_partition == NULL) {
 427                         modified_partition = talloc_zero(replmd_private, struct nc_entry);
 428                         if (!modified_partition) {
 429                                 ldb_oom(ldb_module_get_ctx(ac->module));
 430                                 return ldb_module_done(ac->req, NULL,
 431                                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 432                         }
 433                         modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
 434                         if (!modified_partition->dn) {
 435                                 ldb_oom(ldb_module_get_ctx(ac->module));
 436                                 return ldb_module_done(ac->req, NULL,
 437                                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 438                         }
 439                         DLIST_ADD(replmd_private->ncs, modified_partition);
 440                 }
 441
 442                 if (ac->seq_num > modified_partition->mod_usn) {
 443                         modified_partition->mod_usn = ac->seq_num;
 444                         if (ac->is_urgent) {
 445                                 modified_partition->mod_usn_urgent = ac->seq_num;
 446                         }
 447                 }
 448         }
 449
 450         if (ac->apply_mode) {
 451                 talloc_free(ares);
 452                 ac->index_current++;
 453
 454                 ret = replmd_replicated_apply_next(ac);
 455                 if (ret != LDB_SUCCESS) {
 456                         return ldb_module_done(ac->req, NULL, NULL, ret);
 457                 }
 458                 return ret;
 459         } else {
 460                 /* free the partition control container here, for the
 461                  * common path.  Other cases will have it cleaned up
 462                  * eventually with the ares */
 463                 talloc_free(partition_ctrl);
 464                 return ldb_module_done(ac->req, controls,
 465                                        ares->response, LDB_SUCCESS);
 466         }
 467 }
 468
 469
 470 /*
 471  * update a @REPLCHANGED record in each partition if there have been
 472  * any writes of replicated data in the partition
 473  */
 474 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
 475 {
 476         struct replmd_private *replmd_private =
 477                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
 478
 479         while (replmd_private->ncs) {
 480                 int ret;
 481                 struct nc_entry *modified_partition = replmd_private->ncs;
 482
 483                 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
 484                                                      modified_partition->mod_usn,
 485                                                      modified_partition->mod_usn_urgent, parent);
 486                 if (ret != LDB_SUCCESS) {
 487                         DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
 488                                  ldb_dn_get_linearized(modified_partition->dn)));
 489                         return ret;
 490                 }
 491                 DLIST_REMOVE(replmd_private->ncs, modified_partition);
 492                 talloc_free(modified_partition);
 493         }
 494
 495         return LDB_SUCCESS;
 496 }
 497
 498
 499 /*
 500   created a replmd_replicated_request context
 501  */
 502 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
 503                                                          struct ldb_request *req)
 504 {
 505         struct ldb_context *ldb;
 506         struct replmd_replicated_request *ac;
 507
 508         ldb = ldb_module_get_ctx(module);
 509
 510         ac = talloc_zero(req, struct replmd_replicated_request);
 511         if (ac == NULL) {
 512                 ldb_oom(ldb);
 513                 return NULL;
 514         }
 515
 516         ac->module = module;
 517         ac->req = req;
 518
 519         ac->schema = dsdb_get_schema(ldb, ac);
 520         if (!ac->schema) {
 521                 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
 522                               "replmd_modify: no dsdb_schema loaded");
 523                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
 524                 return NULL;
 525         }
 526
 527         return ac;
 528 }
 529
 530 /*
 531   add a time element to a record
 532 */
 533 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
 534 {
 535         struct ldb_message_element *el;
 536         char *s;
 537         int ret;
 538
 539         if (ldb_msg_find_element(msg, attr) != NULL) {
 540                 return LDB_SUCCESS;
 541         }
 542
 543         s = ldb_timestring(msg, t);
 544         if (s == NULL) {
 545                 return LDB_ERR_OPERATIONS_ERROR;
 546         }
 547
 548         ret = ldb_msg_add_string(msg, attr, s);
 549         if (ret != LDB_SUCCESS) {
 550                 return ret;
 551         }
 552
 553         el = ldb_msg_find_element(msg, attr);
 554         /* always set as replace. This works because on add ops, the flag
 555            is ignored */
 556         el->flags = LDB_FLAG_MOD_REPLACE;
 557
 558         return LDB_SUCCESS;
 559 }
 560
 561 /*
 562   add a uint64_t element to a record
 563 */
 564 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
 565                               const char *attr, uint64_t v)
 566 {
 567         struct ldb_message_element *el;
 568         int ret;
 569
 570         if (ldb_msg_find_element(msg, attr) != NULL) {
 571                 return LDB_SUCCESS;
 572         }
 573
 574         ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
 575         if (ret != LDB_SUCCESS) {
 576                 return ret;
 577         }
 578
 579         el = ldb_msg_find_element(msg, attr);
 580         /* always set as replace. This works because on add ops, the flag
 581            is ignored */
 582         el->flags = LDB_FLAG_MOD_REPLACE;
 583
 584         return LDB_SUCCESS;
 585 }
 586
 587 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
 588                                                    const struct replPropertyMetaData1 *m2,
 589                                                    const uint32_t *rdn_attid)
 590 {
 591         if (m1->attid == m2->attid) {
 592                 return 0;
 593         }
 594
 595         /*
 596          * the rdn attribute should be at the end!
 597          * so we need to return a value greater than zero
 598          * which means m1 is greater than m2
 599          */
 600         if (m1->attid == *rdn_attid) {
 601                 return 1;
 602         }
 603
 604         /*
 605          * the rdn attribute should be at the end!
 606          * so we need to return a value less than zero
 607          * which means m2 is greater than m1
 608          */
 609         if (m2->attid == *rdn_attid) {
 610                 return -1;
 611         }
 612
 613         return m1->attid > m2->attid ? 1 : -1;
 614 }
 615
 616 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
 617                                                 const struct dsdb_schema *schema,
 618                                                 struct ldb_dn *dn)
 619 {
 620         const char *rdn_name;
 621         const struct dsdb_attribute *rdn_sa;
 622
 623         rdn_name = ldb_dn_get_rdn_name(dn);
 624         if (!rdn_name) {
 625                 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
 626                 return LDB_ERR_OPERATIONS_ERROR;
 627         }
 628
 629         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
 630         if (rdn_sa == NULL) {
 631                 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
 632                 return LDB_ERR_OPERATIONS_ERROR;
 633         }
 634
 635         DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
 636                  rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
 637
 638         LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
 639
 640         return LDB_SUCCESS;
 641 }
 642
 643 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
 644                                                  const struct ldb_message_element *e2,
 645                                                  const struct dsdb_schema *schema)
 646 {
 647         const struct dsdb_attribute *a1;
 648         const struct dsdb_attribute *a2;
 649
 650         /*
 651          * TODO: make this faster by caching the dsdb_attribute pointer
 652          *       on the ldb_messag_element
 653          */
 654
 655         a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
 656         a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
 657
 658         /*
 659          * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
 660          *       in the schema
 661          */
 662         if (!a1 || !a2) {
 663                 return strcasecmp(e1->name, e2->name);
 664         }
 665         if (a1->attributeID_id == a2->attributeID_id) {
 666                 return 0;
 667         }
 668         return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
 669 }
 670
 671 static void replmd_ldb_message_sort(struct ldb_message *msg,
 672                                     const struct dsdb_schema *schema)
 673 {
 674         LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
 675 }
 676
 677 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
 678                                const struct GUID *invocation_id, uint64_t seq_num,
 679                                uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
 680
 681
 682 /*
 683   fix up linked attributes in replmd_add.
 684   This involves setting up the right meta-data in extended DN
 685   components, and creating backlinks to the object
 686  */
 687 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
 688                              uint64_t seq_num, const struct GUID *invocationId, time_t t,
 689                              struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
 690 {
 691         unsigned int i;
 692         TALLOC_CTX *tmp_ctx = talloc_new(el->values);
 693         struct ldb_context *ldb = ldb_module_get_ctx(module);
 694
 695         /* We will take a reference to the schema in replmd_add_backlink */
 696         const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
 697         NTTIME now;
 698
 699         unix_to_nt_time(&now, t);
 700
 701         for (i=0; i<el->num_values; i++) {
 702                 struct ldb_val *v = &el->values[i];
 703                 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
 704                 struct GUID target_guid;
 705                 NTSTATUS status;
 706                 int ret;
 707
 708                 /* note that the DN already has the extended
 709                    components from the extended_dn_store module */
 710                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
 711                 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
 712                         ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
 713                         if (ret != LDB_SUCCESS) {
 714                                 talloc_free(tmp_ctx);
 715                                 return ret;
 716                         }
 717                         ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
 718                         if (ret != LDB_SUCCESS) {
 719                                 talloc_free(tmp_ctx);
 720                                 return ret;
 721                         }
 722                 }
 723
 724                 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
 725                                           seq_num, seq_num, now, 0, false);
 726                 if (ret != LDB_SUCCESS) {
 727                         talloc_free(tmp_ctx);
 728                         return ret;
 729                 }
 730
 731                 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
 732                 if (ret != LDB_SUCCESS) {
 733                         talloc_free(tmp_ctx);
 734                         return ret;
 735                 }
 736         }
 737
 738         talloc_free(tmp_ctx);
 739         return LDB_SUCCESS;
 740 }
 741
 742
 743 /*
 744   intercept add requests
 745  */
 746 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
 747 {
 748         struct ldb_context *ldb;
 749         struct ldb_control *control;
 750         struct replmd_replicated_request *ac;
 751         enum ndr_err_code ndr_err;
 752         struct ldb_request *down_req;
 753         struct ldb_message *msg;
 754         const DATA_BLOB *guid_blob;
 755         struct GUID guid;
 756         struct replPropertyMetaDataBlob nmd;
 757         struct ldb_val nmd_value;
 758         const struct GUID *our_invocation_id;
 759         time_t t = time(NULL);
 760         NTTIME now;
 761         char *time_str;
 762         int ret;
 763         unsigned int i;
 764         unsigned int functional_level;
 765         uint32_t ni=0;
 766         bool allow_add_guid = false;
 767         bool remove_current_guid = false;
 768         bool is_urgent = false;
 769         struct ldb_message_element *objectclass_el;
 770
 771         /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
 772         control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
 773         if (control) {
 774                 allow_add_guid = true;
 775         }
 776
 777         /* do not manipulate our control entries */
 778         if (ldb_dn_is_special(req->op.add.message->dn)) {
 779                 return ldb_next_request(module, req);
 780         }
 781
 782         ldb = ldb_module_get_ctx(module);
 783
 784         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
 785
 786         guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
 787         if (guid_blob != NULL) {
 788                 if (!allow_add_guid) {
 789                         ldb_set_errstring(ldb,
 790                                           "replmd_add: it's not allowed to add an object with objectGUID!");
 791                         return LDB_ERR_UNWILLING_TO_PERFORM;
 792                 } else {
 793                         NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
 794                         if (!NT_STATUS_IS_OK(status)) {
 795                                 ldb_set_errstring(ldb,
 796                                                   "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
 797                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 798                         }
 799                         /* we remove this attribute as it can be a string and
 800                          * will not be treated correctly and then we will re-add
 801                          * it later on in the good format */
 802                         remove_current_guid = true;
 803                 }
 804         } else {
 805                 /* a new GUID */
 806                 guid = GUID_random();
 807         }
 808
 809         ac = replmd_ctx_init(module, req);
 810         if (ac == NULL) {
 811                 return ldb_module_oom(module);
 812         }
 813
 814         functional_level = dsdb_functional_level(ldb);
 815
 816         /* Get a sequence number from the backend */
 817         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
 818         if (ret != LDB_SUCCESS) {
 819                 talloc_free(ac);
 820                 return ret;
 821         }
 822
 823         /* get our invocationId */
 824         our_invocation_id = samdb_ntds_invocation_id(ldb);
 825         if (!our_invocation_id) {
 826                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 827                               "replmd_add: unable to find invocationId\n");
 828                 talloc_free(ac);
 829                 return LDB_ERR_OPERATIONS_ERROR;
 830         }
 831
 832         /* we have to copy the message as the caller might have it as a const */
 833         msg = ldb_msg_copy_shallow(ac, req->op.add.message);
 834         if (msg == NULL) {
 835                 ldb_oom(ldb);
 836                 talloc_free(ac);
 837                 return LDB_ERR_OPERATIONS_ERROR;
 838         }
 839
 840         /* generated times */
 841         unix_to_nt_time(&now, t);
 842         time_str = ldb_timestring(msg, t);
 843         if (!time_str) {
 844                 ldb_oom(ldb);
 845                 talloc_free(ac);
 846                 return LDB_ERR_OPERATIONS_ERROR;
 847         }
 848         if (remove_current_guid) {
 849                 ldb_msg_remove_attr(msg,"objectGUID");
 850         }
 851
 852         /*
 853          * remove autogenerated attributes
 854          */
 855         ldb_msg_remove_attr(msg, "whenCreated");
 856         ldb_msg_remove_attr(msg, "whenChanged");
 857         ldb_msg_remove_attr(msg, "uSNCreated");
 858         ldb_msg_remove_attr(msg, "uSNChanged");
 859         ldb_msg_remove_attr(msg, "replPropertyMetaData");
 860
 861         /*
 862          * readd replicated attributes
 863          */
 864         ret = ldb_msg_add_string(msg, "whenCreated", time_str);
 865         if (ret != LDB_SUCCESS) {
 866                 ldb_oom(ldb);
 867                 talloc_free(ac);
 868                 return ret;
 869         }
 870
 871         /* build the replication meta_data */
 872         ZERO_STRUCT(nmd);
 873         nmd.version             = 1;
 874         nmd.ctr.ctr1.count      = msg->num_elements;
 875         nmd.ctr.ctr1.array      = talloc_array(msg,
 876                                                struct replPropertyMetaData1,
 877                                                nmd.ctr.ctr1.count);
 878         if (!nmd.ctr.ctr1.array) {
 879                 ldb_oom(ldb);
 880                 talloc_free(ac);
 881                 return LDB_ERR_OPERATIONS_ERROR;
 882         }
 883
 884         for (i=0; i < msg->num_elements; i++) {
 885                 struct ldb_message_element *e = &msg->elements[i];
 886                 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
 887                 const struct dsdb_attribute *sa;
 888
 889                 if (e->name[0] == '@') continue;
 890
 891                 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
 892                 if (!sa) {
 893                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 894                                       "replmd_add: attribute '%s' not defined in schema\n",
 895                                       e->name);
 896                         talloc_free(ac);
 897                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 898                 }
 899
 900                 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
 901                         /* if the attribute is not replicated (0x00000001)
 902                          * or constructed (0x00000004) it has no metadata
 903                          */
 904                         continue;
 905                 }
 906
 907                 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
 908                         ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
 909                         if (ret != LDB_SUCCESS) {
 910                                 talloc_free(ac);
 911                                 return ret;
 912                         }
 913                         /* linked attributes are not stored in
 914                            replPropertyMetaData in FL above w2k */
 915                         continue;
 916                 }
 917
 918                 m->attid                        = sa->attributeID_id;
 919                 m->version                      = 1;
 920                 m->originating_change_time      = now;
 921                 m->originating_invocation_id    = *our_invocation_id;
 922                 m->originating_usn              = ac->seq_num;
 923                 m->local_usn                    = ac->seq_num;
 924                 ni++;
 925         }
 926
 927         /* fix meta data count */
 928         nmd.ctr.ctr1.count = ni;
 929
 930         /*
 931          * sort meta data array, and move the rdn attribute entry to the end
 932          */
 933         ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
 934         if (ret != LDB_SUCCESS) {
 935                 talloc_free(ac);
 936                 return ret;
 937         }
 938
 939         /* generated NDR encoded values */
 940         ndr_err = ndr_push_struct_blob(&nmd_value, msg,
 941                                        &nmd,
 942                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
 943         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 944                 ldb_oom(ldb);
 945                 talloc_free(ac);
 946                 return LDB_ERR_OPERATIONS_ERROR;
 947         }
 948
 949         /*
 950          * add the autogenerated values
 951          */
 952         ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
 953         if (ret != LDB_SUCCESS) {
 954                 ldb_oom(ldb);
 955                 talloc_free(ac);
 956                 return ret;
 957         }
 958         ret = ldb_msg_add_string(msg, "whenChanged", time_str);
 959         if (ret != LDB_SUCCESS) {
 960                 ldb_oom(ldb);
 961                 talloc_free(ac);
 962                 return ret;
 963         }
 964         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
 965         if (ret != LDB_SUCCESS) {
 966                 ldb_oom(ldb);
 967                 talloc_free(ac);
 968                 return ret;
 969         }
 970         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
 971         if (ret != LDB_SUCCESS) {
 972                 ldb_oom(ldb);
 973                 talloc_free(ac);
 974                 return ret;
 975         }
 976         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
 977         if (ret != LDB_SUCCESS) {
 978                 ldb_oom(ldb);
 979                 talloc_free(ac);
 980                 return ret;
 981         }
 982
 983         /*
 984          * sort the attributes by attid before storing the object
 985          */
 986         replmd_ldb_message_sort(msg, ac->schema);
 987
 988         objectclass_el = ldb_msg_find_element(msg, "objectClass");
 989         is_urgent = replmd_check_urgent_objectclass(objectclass_el,
 990                                                         REPL_URGENT_ON_CREATE);
 991
 992         ac->is_urgent = is_urgent;
 993         ret = ldb_build_add_req(&down_req, ldb, ac,
 994                                 msg,
 995                                 req->controls,
 996                                 ac, replmd_op_callback,
 997                                 req);
 998
 999         LDB_REQ_SET_LOCATION(down_req);
1000         if (ret != LDB_SUCCESS) {
1001                 talloc_free(ac);
1002                 return ret;
1003         }
1004
1005         /* current partition control is needed by "replmd_op_callback" */
1006         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1007                 ret = ldb_request_add_control(down_req,
1008                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
1009                                               false, NULL);
1010                 if (ret != LDB_SUCCESS) {
1011                         talloc_free(ac);
1012                         return ret;
1013                 }
1014         }
1015
1016         if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1017                 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1018                 if (ret != LDB_SUCCESS) {
1019                         talloc_free(ac);
1020                         return ret;
1021                 }
1022         }
1023
1024         /* mark the control done */
1025         if (control) {
1026                 control->critical = 0;
1027         }
1028
1029         /* go on with the call chain */
1030         return ldb_next_request(module, down_req);
1031 }
1032
1033
1034 /*
1035  * update the replPropertyMetaData for one element
1036  */
1037 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1038                                       struct ldb_message *msg,
1039                                       struct ldb_message_element *el,
1040                                       struct ldb_message_element *old_el,
1041                                       struct replPropertyMetaDataBlob *omd,
1042                                       const struct dsdb_schema *schema,
1043                                       uint64_t *seq_num,
1044                                       const struct GUID *our_invocation_id,
1045                                       NTTIME now,
1046                                       struct ldb_request *req)
1047 {
1048         uint32_t i;
1049         const struct dsdb_attribute *a;
1050         struct replPropertyMetaData1 *md1;
1051
1052         a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1053         if (a == NULL) {
1054                 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1055                         /* allow this to make it possible for dbcheck
1056                            to remove bad attributes */
1057                         return LDB_SUCCESS;
1058                 }
1059
1060                 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1061                          el->name));
1062                 return LDB_ERR_OPERATIONS_ERROR;
1063         }
1064
1065         if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1066                 return LDB_SUCCESS;
1067         }
1068
1069         /* if the attribute's value haven't changed then return LDB_SUCCESS     */
1070         if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1071                 return LDB_SUCCESS;
1072         }
1073
1074         for (i=0; i<omd->ctr.ctr1.count; i++) {
1075                 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1076         }
1077
1078         if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1079                 /* linked attributes are not stored in
1080                    replPropertyMetaData in FL above w2k, but we do
1081                    raise the seqnum for the object  */
1082                 if (*seq_num == 0 &&
1083                     ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1084                         return LDB_ERR_OPERATIONS_ERROR;
1085                 }
1086                 return LDB_SUCCESS;
1087         }
1088
1089         if (i == omd->ctr.ctr1.count) {
1090                 /* we need to add a new one */
1091                 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1092                                                      struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1093                 if (omd->ctr.ctr1.array == NULL) {
1094                         ldb_oom(ldb);
1095                         return LDB_ERR_OPERATIONS_ERROR;
1096                 }
1097                 omd->ctr.ctr1.count++;
1098                 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1099         }
1100
1101         /* Get a new sequence number from the backend. We only do this
1102          * if we have a change that requires a new
1103          * replPropertyMetaData element
1104          */
1105         if (*seq_num == 0) {
1106                 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1107                 if (ret != LDB_SUCCESS) {
1108                         return LDB_ERR_OPERATIONS_ERROR;
1109                 }
1110         }
1111
1112         md1 = &omd->ctr.ctr1.array[i];
1113         md1->version++;
1114         md1->attid                     = a->attributeID_id;
1115         md1->originating_change_time   = now;
1116         md1->originating_invocation_id = *our_invocation_id;
1117         md1->originating_usn           = *seq_num;
1118         md1->local_usn                 = *seq_num;
1119
1120         return LDB_SUCCESS;
1121 }
1122
1123 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1124 {
1125         uint32_t count = omd.ctr.ctr1.count;
1126         uint64_t max = 0;
1127         uint32_t i;
1128         for (i=0; i < count; i++) {
1129                 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1130                 if (max < m.local_usn) {
1131                         max = m.local_usn;
1132                 }
1133         }
1134         return max;
1135 }
1136
1137 /*
1138  * update the replPropertyMetaData object each time we modify an
1139  * object. This is needed for DRS replication, as the merge on the
1140  * client is based on this object
1141  */
1142 static int replmd_update_rpmd(struct ldb_module *module,
1143                               const struct dsdb_schema *schema,
1144                               struct ldb_request *req,
1145                               const char * const *rename_attrs,
1146                               struct ldb_message *msg, uint64_t *seq_num,
1147                               time_t t,
1148                               bool *is_urgent)
1149 {
1150         const struct ldb_val *omd_value;
1151         enum ndr_err_code ndr_err;
1152         struct replPropertyMetaDataBlob omd;
1153         unsigned int i;
1154         NTTIME now;
1155         const struct GUID *our_invocation_id;
1156         int ret;
1157         const char * const *attrs = NULL;
1158         const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1159         const char * const attrs2[] = { "uSNChanged", "objectClass", NULL };
1160         struct ldb_result *res;
1161         struct ldb_context *ldb;
1162         struct ldb_message_element *objectclass_el;
1163         enum urgent_situation situation;
1164         bool rodc, rmd_is_provided;
1165
1166         if (rename_attrs) {
1167                 attrs = rename_attrs;
1168         } else {
1169                 attrs = attrs1;
1170         }
1171
1172         ldb = ldb_module_get_ctx(module);
1173
1174         our_invocation_id = samdb_ntds_invocation_id(ldb);
1175         if (!our_invocation_id) {
1176                 /* this happens during an initial vampire while
1177                    updating the schema */
1178                 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1179                 return LDB_SUCCESS;
1180         }
1181
1182         unix_to_nt_time(&now, t);
1183
1184         if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1185                 rmd_is_provided = true;
1186         } else {
1187                 rmd_is_provided = false;
1188         }
1189
1190         /* if isDeleted is present and is TRUE, then we consider we are deleting,
1191          * otherwise we consider we are updating */
1192         if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1193                 situation = REPL_URGENT_ON_DELETE;
1194         } else if (rename_attrs) {
1195                 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1196         } else {
1197                 situation = REPL_URGENT_ON_UPDATE;
1198         }
1199
1200         if (rmd_is_provided) {
1201                 /* In this case the change_replmetadata control was supplied */
1202                 /* We check that it's the only attribute that is provided
1203                  * (it's a rare case so it's better to keep the code simplier)
1204                  * We also check that the highest local_usn is bigger than
1205                  * uSNChanged. */
1206                 uint64_t db_seq;
1207                 if( msg->num_elements != 1 ||
1208                         strncmp(msg->elements[0].name,
1209                                 "replPropertyMetaData", 20) ) {
1210                         DEBUG(0,(__location__ ": changereplmetada control called without "\
1211                                 "a specified replPropertyMetaData attribute or with others\n"));
1212                         return LDB_ERR_OPERATIONS_ERROR;
1213                 }
1214                 if (situation != REPL_URGENT_ON_UPDATE) {
1215                         DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1216                         return LDB_ERR_OPERATIONS_ERROR;
1217                 }
1218                 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1219                 if (!omd_value) {
1220                         DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1221                                  ldb_dn_get_linearized(msg->dn)));
1222                         return LDB_ERR_OPERATIONS_ERROR;
1223                 }
1224                 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1225                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1226                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1227                         DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1228                                  ldb_dn_get_linearized(msg->dn)));
1229                         return LDB_ERR_OPERATIONS_ERROR;
1230                 }
1231                 *seq_num = find_max_local_usn(omd);
1232
1233                 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1234                                             DSDB_FLAG_NEXT_MODULE |
1235                                             DSDB_SEARCH_SHOW_RECYCLED |
1236                                             DSDB_SEARCH_SHOW_EXTENDED_DN |
1237                                             DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1238                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
1239
1240                 if (ret != LDB_SUCCESS || res->count != 1) {
1241                         DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1242                                  ldb_dn_get_linearized(msg->dn)));
1243                         return LDB_ERR_OPERATIONS_ERROR;
1244                 }
1245
1246                 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1247                 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1248                                                                 situation)) {
1249                         *is_urgent = true;
1250                 }
1251
1252                 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1253                 if (*seq_num <= db_seq) {
1254                         DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1255                                               " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1256                                  (long long)*seq_num, (long long)db_seq));
1257                         return LDB_ERR_OPERATIONS_ERROR;
1258                 }
1259
1260         } else {
1261                 /* search for the existing replPropertyMetaDataBlob. We need
1262                  * to use REVEAL and ask for DNs in storage format to support
1263                  * the check for values being the same in
1264                  * replmd_update_rpmd_element()
1265                  */
1266                 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1267                                             DSDB_FLAG_NEXT_MODULE |
1268                                             DSDB_SEARCH_SHOW_RECYCLED |
1269                                             DSDB_SEARCH_SHOW_EXTENDED_DN |
1270                                             DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1271                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
1272                 if (ret != LDB_SUCCESS || res->count != 1) {
1273                         DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1274                                  ldb_dn_get_linearized(msg->dn)));
1275                         return LDB_ERR_OPERATIONS_ERROR;
1276                 }
1277
1278                 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1279                 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1280                                                                 situation)) {
1281                         *is_urgent = true;
1282                 }
1283
1284                 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1285                 if (!omd_value) {
1286                         DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1287                                  ldb_dn_get_linearized(msg->dn)));
1288                         return LDB_ERR_OPERATIONS_ERROR;
1289                 }
1290
1291                 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1292                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1293                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1294                         DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1295                                  ldb_dn_get_linearized(msg->dn)));
1296                         return LDB_ERR_OPERATIONS_ERROR;
1297                 }
1298
1299                 if (omd.version != 1) {
1300                         DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1301                                  omd.version, ldb_dn_get_linearized(msg->dn)));
1302                         return LDB_ERR_OPERATIONS_ERROR;
1303                 }
1304
1305                 for (i=0; i<msg->num_elements; i++) {
1306                         struct ldb_message_element *old_el;
1307                         old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1308                         ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1309                                                          our_invocation_id, now, req);
1310                         if (ret != LDB_SUCCESS) {
1311                                 return ret;
1312                         }
1313
1314                         if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1315                                 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1316                         }
1317
1318                 }
1319         }
1320         /*
1321          * replmd_update_rpmd_element has done an update if the
1322          * seq_num is set
1323          */
1324         if (*seq_num != 0) {
1325                 struct ldb_val *md_value;
1326                 struct ldb_message_element *el;
1327
1328                 /*if we are RODC and this is a DRSR update then its ok*/
1329                 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1330                         ret = samdb_rodc(ldb, &rodc);
1331                         if (ret != LDB_SUCCESS) {
1332                                 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1333                         } else if (rodc) {
1334                                 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1335                                 return LDB_ERR_REFERRAL;
1336                         }
1337                 }
1338
1339                 md_value = talloc(msg, struct ldb_val);
1340                 if (md_value == NULL) {
1341                         ldb_oom(ldb);
1342                         return LDB_ERR_OPERATIONS_ERROR;
1343                 }
1344
1345                 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1346                 if (ret != LDB_SUCCESS) {
1347                         return ret;
1348                 }
1349
1350                 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1351                                                (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1352                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1353                         DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1354                                  ldb_dn_get_linearized(msg->dn)));
1355                         return LDB_ERR_OPERATIONS_ERROR;
1356                 }
1357
1358                 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1359                 if (ret != LDB_SUCCESS) {
1360                         DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1361                                  ldb_dn_get_linearized(msg->dn)));
1362                         return ret;
1363                 }
1364
1365                 el->num_values = 1;
1366                 el->values = md_value;
1367         }
1368
1369         return LDB_SUCCESS;
1370 }
1371
1372 struct parsed_dn {
1373         struct dsdb_dn *dsdb_dn;
1374         struct GUID *guid;
1375         struct ldb_val *v;
1376 };
1377
1378 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1379 {
1380         return GUID_compare(pdn1->guid, pdn2->guid);
1381 }
1382
1383 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1384                                         unsigned int count, struct GUID *guid,
1385                                         struct ldb_dn *dn)
1386 {
1387         struct parsed_dn *ret;
1388         unsigned int i;
1389         if (dn && GUID_all_zero(guid)) {
1390                 /* when updating a link using DRS, we sometimes get a
1391                    NULL GUID. We then need to try and match by DN */
1392                 for (i=0; i<count; i++) {
1393                         if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1394                                 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1395                                 return &pdn[i];
1396                         }
1397                 }
1398                 return NULL;
1399         }
1400         BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1401         return ret;
1402 }
1403
1404 /*
1405   get a series of message element values as an array of DNs and GUIDs
1406   the result is sorted by GUID
1407  */
1408 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1409                           struct ldb_message_element *el, struct parsed_dn **pdn,
1410                           const char *ldap_oid, struct ldb_request *parent)
1411 {
1412         unsigned int i;
1413         struct ldb_context *ldb = ldb_module_get_ctx(module);
1414
1415         if (el == NULL) {
1416                 *pdn = NULL;
1417                 return LDB_SUCCESS;
1418         }
1419
1420         (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1421         if (!*pdn) {
1422                 ldb_module_oom(module);
1423                 return LDB_ERR_OPERATIONS_ERROR;
1424         }
1425
1426         for (i=0; i<el->num_values; i++) {
1427                 struct ldb_val *v = &el->values[i];
1428                 NTSTATUS status;
1429                 struct ldb_dn *dn;
1430                 struct parsed_dn *p;
1431
1432                 p = &(*pdn)[i];
1433
1434                 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1435                 if (p->dsdb_dn == NULL) {
1436                         return LDB_ERR_INVALID_DN_SYNTAX;
1437                 }
1438
1439                 dn = p->dsdb_dn->dn;
1440
1441                 p->guid = talloc(*pdn, struct GUID);
1442                 if (p->guid == NULL) {
1443                         ldb_module_oom(module);
1444                         return LDB_ERR_OPERATIONS_ERROR;
1445                 }
1446
1447                 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1448                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1449                         /* we got a DN without a GUID - go find the GUID */
1450                         int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1451                         if (ret != LDB_SUCCESS) {
1452                                 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1453                                                        ldb_dn_get_linearized(dn));
1454                                 return ret;
1455                         }
1456                         ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1457                         if (ret != LDB_SUCCESS) {
1458                                 return ret;
1459                         }
1460                 } else if (!NT_STATUS_IS_OK(status)) {
1461                         return LDB_ERR_OPERATIONS_ERROR;
1462                 }
1463
1464                 /* keep a pointer to the original ldb_val */
1465                 p->v = v;
1466         }
1467
1468         TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1469
1470         return LDB_SUCCESS;
1471 }
1472
1473 /*
1474   build a new extended DN, including all meta data fields
1475
1476   RMD_FLAGS           = DSDB_RMD_FLAG_* bits
1477   RMD_ADDTIME         = originating_add_time
1478   RMD_INVOCID         = originating_invocation_id
1479   RMD_CHANGETIME      = originating_change_time
1480   RMD_ORIGINATING_USN = originating_usn
1481   RMD_LOCAL_USN       = local_usn
1482   RMD_VERSION         = version
1483  */
1484 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1485                                const struct GUID *invocation_id, uint64_t seq_num,
1486                                uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1487 {
1488         struct ldb_dn *dn = dsdb_dn->dn;
1489         const char *tstring, *usn_string, *flags_string;
1490         struct ldb_val tval;
1491         struct ldb_val iid;
1492         struct ldb_val usnv, local_usnv;
1493         struct ldb_val vers, flagsv;
1494         NTSTATUS status;
1495         int ret;
1496         const char *dnstring;
1497         char *vstring;
1498         uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1499
1500         tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1501         if (!tstring) {
1502                 return LDB_ERR_OPERATIONS_ERROR;
1503         }
1504         tval = data_blob_string_const(tstring);
1505
1506         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1507         if (!usn_string) {
1508                 return LDB_ERR_OPERATIONS_ERROR;
1509         }
1510         usnv = data_blob_string_const(usn_string);
1511
1512         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1513         if (!usn_string) {
1514                 return LDB_ERR_OPERATIONS_ERROR;
1515         }
1516         local_usnv = data_blob_string_const(usn_string);
1517
1518         vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1519         if (!vstring) {
1520                 return LDB_ERR_OPERATIONS_ERROR;
1521         }
1522         vers = data_blob_string_const(vstring);
1523
1524         status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1525         if (!NT_STATUS_IS_OK(status)) {
1526                 return LDB_ERR_OPERATIONS_ERROR;
1527         }
1528
1529         flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1530         if (!flags_string) {
1531                 return LDB_ERR_OPERATIONS_ERROR;
1532         }
1533         flagsv = data_blob_string_const(flags_string);
1534
1535         ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1536         if (ret != LDB_SUCCESS) return ret;
1537         ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1538         if (ret != LDB_SUCCESS) return ret;
1539         ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1540         if (ret != LDB_SUCCESS) return ret;
1541         ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1542         if (ret != LDB_SUCCESS) return ret;
1543         ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1544         if (ret != LDB_SUCCESS) return ret;
1545         ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1546         if (ret != LDB_SUCCESS) return ret;
1547         ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1548         if (ret != LDB_SUCCESS) return ret;
1549
1550         dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1551         if (dnstring == NULL) {
1552                 return LDB_ERR_OPERATIONS_ERROR;
1553         }
1554         *v = data_blob_string_const(dnstring);
1555
1556         return LDB_SUCCESS;
1557 }
1558
1559 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1560                                 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1561                                 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1562                                 uint32_t version, bool deleted);
1563
1564 /*
1565   check if any links need upgrading from w2k format
1566
1567   The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1568  */
1569 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1570 {
1571         uint32_t i;
1572         for (i=0; i<count; i++) {
1573                 NTSTATUS status;
1574                 uint32_t version;
1575                 int ret;
1576
1577                 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1578                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1579                         continue;
1580                 }
1581
1582                 /* it's an old one that needs upgrading */
1583                 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1584                                            1, 1, 0, 0, false);
1585                 if (ret != LDB_SUCCESS) {
1586                         return ret;
1587                 }
1588         }
1589         return LDB_SUCCESS;
1590 }
1591
1592 /*
1593   update an extended DN, including all meta data fields
1594
1595   see replmd_build_la_val for value names
1596  */
1597 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1598                                 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1599                                 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1600                                 uint32_t version, bool deleted)
1601 {
1602         struct ldb_dn *dn = dsdb_dn->dn;
1603         const char *tstring, *usn_string, *flags_string;
1604         struct ldb_val tval;
1605         struct ldb_val iid;
1606         struct ldb_val usnv, local_usnv;
1607         struct ldb_val vers, flagsv;
1608         const struct ldb_val *old_addtime;
1609         uint32_t old_version;
1610         NTSTATUS status;
1611         int ret;
1612         const char *dnstring;
1613         char *vstring;
1614         uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1615
1616         tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1617         if (!tstring) {
1618                 return LDB_ERR_OPERATIONS_ERROR;
1619         }
1620         tval = data_blob_string_const(tstring);
1621
1622         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1623         if (!usn_string) {
1624                 return LDB_ERR_OPERATIONS_ERROR;
1625         }
1626         usnv = data_blob_string_const(usn_string);
1627
1628         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1629         if (!usn_string) {
1630                 return LDB_ERR_OPERATIONS_ERROR;
1631         }
1632         local_usnv = data_blob_string_const(usn_string);
1633
1634         status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1635         if (!NT_STATUS_IS_OK(status)) {
1636                 return LDB_ERR_OPERATIONS_ERROR;
1637         }
1638
1639         flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1640         if (!flags_string) {
1641                 return LDB_ERR_OPERATIONS_ERROR;
1642         }
1643         flagsv = data_blob_string_const(flags_string);
1644
1645         ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1646         if (ret != LDB_SUCCESS) return ret;
1647
1648         /* get the ADDTIME from the original */
1649         old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1650         if (old_addtime == NULL) {
1651                 old_addtime = &tval;
1652         }
1653         if (dsdb_dn != old_dsdb_dn ||
1654             ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1655                 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1656                 if (ret != LDB_SUCCESS) return ret;
1657         }
1658
1659         /* use our invocation id */
1660         ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1661         if (ret != LDB_SUCCESS) return ret;
1662
1663         /* changetime is the current time */
1664         ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1665         if (ret != LDB_SUCCESS) return ret;
1666
1667         /* update the USN */
1668         ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1669         if (ret != LDB_SUCCESS) return ret;
1670
1671         ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1672         if (ret != LDB_SUCCESS) return ret;
1673
1674         /* increase the version by 1 */
1675         status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1676         if (NT_STATUS_IS_OK(status) && old_version >= version) {
1677                 version = old_version+1;
1678         }
1679         vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1680         vers = data_blob_string_const(vstring);
1681         ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1682         if (ret != LDB_SUCCESS) return ret;
1683
1684         dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1685         if (dnstring == NULL) {
1686                 return LDB_ERR_OPERATIONS_ERROR;
1687         }
1688         *v = data_blob_string_const(dnstring);
1689
1690         return LDB_SUCCESS;
1691 }
1692
1693 /*
1694   handle adding a linked attribute
1695  */
1696 static int replmd_modify_la_add(struct ldb_module *module,
1697                                 const struct dsdb_schema *schema,
1698                                 struct ldb_message *msg,
1699                                 struct ldb_message_element *el,
1700                                 struct ldb_message_element *old_el,
1701                                 const struct dsdb_attribute *schema_attr,
1702                                 uint64_t seq_num,
1703                                 time_t t,
1704                                 struct GUID *msg_guid,
1705                                 struct ldb_request *parent)
1706 {
1707         unsigned int i;
1708         struct parsed_dn *dns, *old_dns;
1709         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1710         int ret;
1711         struct ldb_val *new_values = NULL;
1712         unsigned int num_new_values = 0;
1713         unsigned old_num_values = old_el?old_el->num_values:0;
1714         const struct GUID *invocation_id;
1715         struct ldb_context *ldb = ldb_module_get_ctx(module);
1716         NTTIME now;
1717
1718         unix_to_nt_time(&now, t);
1719
1720         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1721         if (ret != LDB_SUCCESS) {
1722                 talloc_free(tmp_ctx);
1723                 return ret;
1724         }
1725
1726         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1727         if (ret != LDB_SUCCESS) {
1728                 talloc_free(tmp_ctx);
1729                 return ret;
1730         }
1731
1732         invocation_id = samdb_ntds_invocation_id(ldb);
1733         if (!invocation_id) {
1734                 talloc_free(tmp_ctx);
1735                 return LDB_ERR_OPERATIONS_ERROR;
1736         }
1737
1738         ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1739         if (ret != LDB_SUCCESS) {
1740                 talloc_free(tmp_ctx);
1741                 return ret;
1742         }
1743
1744         /* for each new value, see if it exists already with the same GUID */
1745         for (i=0; i<el->num_values; i++) {
1746                 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1747                 if (p == NULL) {
1748                         /* this is a new linked attribute value */
1749                         new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1750                         if (new_values == NULL) {
1751                                 ldb_module_oom(module);
1752                                 talloc_free(tmp_ctx);
1753                                 return LDB_ERR_OPERATIONS_ERROR;
1754                         }
1755                         ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1756                                                   invocation_id, seq_num, seq_num, now, 0, false);
1757                         if (ret != LDB_SUCCESS) {
1758                                 talloc_free(tmp_ctx);
1759                                 return ret;
1760                         }
1761                         num_new_values++;
1762                 } else {
1763                         /* this is only allowed if the GUID was
1764                            previously deleted. */
1765                         uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1766
1767                         if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1768                                 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1769                                                        el->name, GUID_string(tmp_ctx, p->guid));
1770                                 talloc_free(tmp_ctx);
1771                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1772                         }
1773                         ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1774                                                    invocation_id, seq_num, seq_num, now, 0, false);
1775                         if (ret != LDB_SUCCESS) {
1776                                 talloc_free(tmp_ctx);
1777                                 return ret;
1778                         }
1779                 }
1780
1781                 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1782                 if (ret != LDB_SUCCESS) {
1783                         talloc_free(tmp_ctx);
1784                         return ret;
1785                 }
1786         }
1787
1788         /* add the new ones on to the end of the old values, constructing a new el->values */
1789         el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1790                                     struct ldb_val,
1791                                     old_num_values+num_new_values);
1792         if (el->values == NULL) {
1793                 ldb_module_oom(module);
1794                 return LDB_ERR_OPERATIONS_ERROR;
1795         }
1796
1797         memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1798         el->num_values = old_num_values + num_new_values;
1799
1800         talloc_steal(msg->elements, el->values);
1801         talloc_steal(el->values, new_values);
1802
1803         talloc_free(tmp_ctx);
1804
1805         /* we now tell the backend to replace all existing values
1806            with the one we have constructed */
1807         el->flags = LDB_FLAG_MOD_REPLACE;
1808
1809         return LDB_SUCCESS;
1810 }
1811
1812
1813 /*
1814   handle deleting all active linked attributes
1815  */
1816 static int replmd_modify_la_delete(struct ldb_module *module,
1817                                    const struct dsdb_schema *schema,
1818                                    struct ldb_message *msg,
1819                                    struct ldb_message_element *el,
1820                                    struct ldb_message_element *old_el,
1821                                    const struct dsdb_attribute *schema_attr,
1822                                    uint64_t seq_num,
1823                                    time_t t,
1824                                    struct GUID *msg_guid,
1825                                    struct ldb_request *parent)
1826 {
1827         unsigned int i;
1828         struct parsed_dn *dns, *old_dns;
1829         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1830         int ret;
1831         const struct GUID *invocation_id;
1832         struct ldb_context *ldb = ldb_module_get_ctx(module);
1833         NTTIME now;
1834
1835         unix_to_nt_time(&now, t);
1836
1837         /* check if there is nothing to delete */
1838         if ((!old_el || old_el->num_values == 0) &&
1839             el->num_values == 0) {
1840                 return LDB_SUCCESS;
1841         }
1842
1843         if (!old_el || old_el->num_values == 0) {
1844                 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1845         }
1846
1847         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1848         if (ret != LDB_SUCCESS) {
1849                 talloc_free(tmp_ctx);
1850                 return ret;
1851         }
1852
1853         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1854         if (ret != LDB_SUCCESS) {
1855                 talloc_free(tmp_ctx);
1856                 return ret;
1857         }
1858
1859         invocation_id = samdb_ntds_invocation_id(ldb);
1860         if (!invocation_id) {
1861                 return LDB_ERR_OPERATIONS_ERROR;
1862         }
1863
1864         ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1865         if (ret != LDB_SUCCESS) {
1866                 talloc_free(tmp_ctx);
1867                 return ret;
1868         }
1869
1870         el->values = NULL;
1871
1872         /* see if we are being asked to delete any links that
1873            don't exist or are already deleted */
1874         for (i=0; i<el->num_values; i++) {
1875                 struct parsed_dn *p = &dns[i];
1876                 struct parsed_dn *p2;
1877                 uint32_t rmd_flags;
1878
1879                 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1880                 if (!p2) {
1881                         ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1882                                                el->name, GUID_string(tmp_ctx, p->guid));
1883                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1884                 }
1885                 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1886                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1887                         ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1888                                                el->name, GUID_string(tmp_ctx, p->guid));
1889                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1890                 }
1891         }
1892
1893         /* for each new value, see if it exists already with the same GUID
1894            if it is not already deleted and matches the delete list then delete it
1895         */
1896         for (i=0; i<old_el->num_values; i++) {
1897                 struct parsed_dn *p = &old_dns[i];
1898                 uint32_t rmd_flags;
1899
1900                 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1901                         continue;
1902                 }
1903
1904                 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1905                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1906
1907                 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1908                                            invocation_id, seq_num, seq_num, now, 0, true);
1909                 if (ret != LDB_SUCCESS) {
1910                         talloc_free(tmp_ctx);
1911                         return ret;
1912                 }
1913
1914                 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1915                 if (ret != LDB_SUCCESS) {
1916                         talloc_free(tmp_ctx);
1917                         return ret;
1918                 }
1919         }
1920
1921         el->values = talloc_steal(msg->elements, old_el->values);
1922         el->num_values = old_el->num_values;
1923
1924         talloc_free(tmp_ctx);
1925
1926         /* we now tell the backend to replace all existing values
1927            with the one we have constructed */
1928         el->flags = LDB_FLAG_MOD_REPLACE;
1929
1930         return LDB_SUCCESS;
1931 }
1932
1933 /*
1934   handle replacing a linked attribute
1935  */
1936 static int replmd_modify_la_replace(struct ldb_module *module,
1937                                     const struct dsdb_schema *schema,
1938                                     struct ldb_message *msg,
1939                                     struct ldb_message_element *el,
1940                                     struct ldb_message_element *old_el,
1941                                     const struct dsdb_attribute *schema_attr,
1942                                     uint64_t seq_num,
1943                                     time_t t,
1944                                     struct GUID *msg_guid,
1945                                     struct ldb_request *parent)
1946 {
1947         unsigned int i;
1948         struct parsed_dn *dns, *old_dns;
1949         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1950         int ret;
1951         const struct GUID *invocation_id;
1952         struct ldb_context *ldb = ldb_module_get_ctx(module);
1953         struct ldb_val *new_values = NULL;
1954         unsigned int num_new_values = 0;
1955         unsigned int old_num_values = old_el?old_el->num_values:0;
1956         NTTIME now;
1957
1958         unix_to_nt_time(&now, t);
1959
1960         /* check if there is nothing to replace */
1961         if ((!old_el || old_el->num_values == 0) &&
1962             el->num_values == 0) {
1963                 return LDB_SUCCESS;
1964         }
1965
1966         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1967         if (ret != LDB_SUCCESS) {
1968                 talloc_free(tmp_ctx);
1969                 return ret;
1970         }
1971
1972         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1973         if (ret != LDB_SUCCESS) {
1974                 talloc_free(tmp_ctx);
1975                 return ret;
1976         }
1977
1978         invocation_id = samdb_ntds_invocation_id(ldb);
1979         if (!invocation_id) {
1980                 return LDB_ERR_OPERATIONS_ERROR;
1981         }
1982
1983         ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1984         if (ret != LDB_SUCCESS) {
1985                 talloc_free(tmp_ctx);
1986                 return ret;
1987         }
1988
1989         /* mark all the old ones as deleted */
1990         for (i=0; i<old_num_values; i++) {
1991                 struct parsed_dn *old_p = &old_dns[i];
1992                 struct parsed_dn *p;
1993                 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1994
1995                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1996
1997                 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1998                 if (ret != LDB_SUCCESS) {
1999                         talloc_free(tmp_ctx);
2000                         return ret;
2001                 }
2002
2003                 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2004                 if (p) {
2005                         /* we don't delete it if we are re-adding it */
2006                         continue;
2007                 }
2008
2009                 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2010                                            invocation_id, seq_num, seq_num, now, 0, true);
2011                 if (ret != LDB_SUCCESS) {
2012                         talloc_free(tmp_ctx);
2013                         return ret;
2014                 }
2015         }
2016
2017         /* for each new value, either update its meta-data, or add it
2018          * to old_el
2019         */
2020         for (i=0; i<el->num_values; i++) {
2021                 struct parsed_dn *p = &dns[i], *old_p;
2022
2023                 if (old_dns &&
2024                     (old_p = parsed_dn_find(old_dns,
2025                                             old_num_values, p->guid, NULL)) != NULL) {
2026                         /* update in place */
2027                         ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2028                                                    old_p->dsdb_dn, invocation_id,
2029                                                    seq_num, seq_num, now, 0, false);
2030                         if (ret != LDB_SUCCESS) {
2031                                 talloc_free(tmp_ctx);
2032                                 return ret;
2033                         }
2034                 } else {
2035                         /* add a new one */
2036                         new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2037                                                     num_new_values+1);
2038                         if (new_values == NULL) {
2039                                 ldb_module_oom(module);
2040                                 talloc_free(tmp_ctx);
2041                                 return LDB_ERR_OPERATIONS_ERROR;
2042                         }
2043                         ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2044                                                   invocation_id, seq_num, seq_num, now, 0, false);
2045                         if (ret != LDB_SUCCESS) {
2046                                 talloc_free(tmp_ctx);
2047                                 return ret;
2048                         }
2049                         num_new_values++;
2050                 }
2051
2052                 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2053                 if (ret != LDB_SUCCESS) {
2054                         talloc_free(tmp_ctx);
2055                         return ret;
2056                 }
2057         }
2058
2059         /* add the new values to the end of old_el */
2060         if (num_new_values != 0) {
2061                 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2062                                             struct ldb_val, old_num_values+num_new_values);
2063                 if (el->values == NULL) {
2064                         ldb_module_oom(module);
2065                         return LDB_ERR_OPERATIONS_ERROR;
2066                 }
2067                 memcpy(&el->values[old_num_values], &new_values[0],
2068                        sizeof(struct ldb_val)*num_new_values);
2069                 el->num_values = old_num_values + num_new_values;
2070                 talloc_steal(msg->elements, new_values);
2071         } else {
2072                 el->values = old_el->values;
2073                 el->num_values = old_el->num_values;
2074                 talloc_steal(msg->elements, el->values);
2075         }
2076
2077         talloc_free(tmp_ctx);
2078
2079         /* we now tell the backend to replace all existing values
2080            with the one we have constructed */
2081         el->flags = LDB_FLAG_MOD_REPLACE;
2082
2083         return LDB_SUCCESS;
2084 }
2085
2086
2087 /*
2088   handle linked attributes in modify requests
2089  */
2090 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2091                                                struct ldb_message *msg,
2092                                                uint64_t seq_num, time_t t,
2093                                                struct ldb_request *parent)
2094 {
2095         struct ldb_result *res;
2096         unsigned int i;
2097         int ret;
2098         struct ldb_context *ldb = ldb_module_get_ctx(module);
2099         struct ldb_message *old_msg;
2100
2101         const struct dsdb_schema *schema;
2102         struct GUID old_guid;
2103
2104         if (seq_num == 0) {
2105                 /* there the replmd_update_rpmd code has already
2106                  * checked and saw that there are no linked
2107                  * attributes */
2108                 return LDB_SUCCESS;
2109         }
2110
2111         if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2112                 /* don't do anything special for linked attributes */
2113                 return LDB_SUCCESS;
2114         }
2115
2116         ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2117                                     DSDB_FLAG_NEXT_MODULE |
2118                                     DSDB_SEARCH_SHOW_RECYCLED |
2119                                     DSDB_SEARCH_REVEAL_INTERNALS |
2120                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2121                                     parent);
2122         if (ret != LDB_SUCCESS) {
2123                 return ret;
2124         }
2125         schema = dsdb_get_schema(ldb, res);
2126         if (!schema) {
2127                 return LDB_ERR_OPERATIONS_ERROR;
2128         }
2129
2130         old_msg = res->msgs[0];
2131
2132         old_guid = samdb_result_guid(old_msg, "objectGUID");
2133
2134         for (i=0; i<msg->num_elements; i++) {
2135                 struct ldb_message_element *el = &msg->elements[i];
2136                 struct ldb_message_element *old_el, *new_el;
2137                 const struct dsdb_attribute *schema_attr
2138                         = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2139                 if (!schema_attr) {
2140                         ldb_asprintf_errstring(ldb,
2141                                                "%s: attribute %s is not a valid attribute in schema",
2142                                                __FUNCTION__, el->name);
2143                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
2144                 }
2145                 if (schema_attr->linkID == 0) {
2146                         continue;
2147                 }
2148                 if ((schema_attr->linkID & 1) == 1) {
2149                         /* Odd is for the target.  Illegal to modify */
2150                         ldb_asprintf_errstring(ldb,
2151                                                "attribute %s must not be modified directly, it is a linked attribute", el->name);
2152                         return LDB_ERR_UNWILLING_TO_PERFORM;
2153                 }
2154                 old_el = ldb_msg_find_element(old_msg, el->name);
2155                 switch (el->flags & LDB_FLAG_MOD_MASK) {
2156                 case LDB_FLAG_MOD_REPLACE:
2157                         ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2158                         break;
2159                 case LDB_FLAG_MOD_DELETE:
2160                         ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2161                         break;
2162                 case LDB_FLAG_MOD_ADD:
2163                         ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2164                         break;
2165                 default:
2166                         ldb_asprintf_errstring(ldb,
2167                                                "invalid flags 0x%x for %s linked attribute",
2168                                                el->flags, el->name);
2169                         return LDB_ERR_UNWILLING_TO_PERFORM;
2170                 }
2171                 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2172                         ldb_asprintf_errstring(ldb,
2173                                                "Attribute %s is single valued but more than one value has been supplied",
2174                                                el->name);
2175                         return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2176                 } else {
2177                         el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2178                 }
2179
2180
2181
2182                 if (ret != LDB_SUCCESS) {
2183                         return ret;
2184                 }
2185                 if (old_el) {
2186                         ldb_msg_remove_attr(old_msg, el->name);
2187                 }
2188                 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2189                 new_el->num_values = el->num_values;
2190                 new_el->values = talloc_steal(msg->elements, el->values);
2191
2192                 /* TODO: this relises a bit too heavily on the exact
2193                    behaviour of ldb_msg_find_element and
2194                    ldb_msg_remove_element */
2195                 old_el = ldb_msg_find_element(msg, el->name);
2196                 if (old_el != el) {
2197                         ldb_msg_remove_element(msg, old_el);
2198                         i--;
2199                 }
2200         }
2201
2202         talloc_free(res);
2203         return ret;
2204 }
2205
2206
2207
2208 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2209 {
2210         struct ldb_context *ldb;
2211         struct replmd_replicated_request *ac;
2212         struct ldb_request *down_req;
2213         struct ldb_message *msg;
2214         time_t t = time(NULL);
2215         int ret;
2216         bool is_urgent = false;
2217         struct loadparm_context *lp_ctx;
2218         char *referral;
2219         unsigned int functional_level;
2220         const DATA_BLOB *guid_blob;
2221
2222         /* do not manipulate our control entries */
2223         if (ldb_dn_is_special(req->op.mod.message->dn)) {
2224                 return ldb_next_request(module, req);
2225         }
2226
2227         ldb = ldb_module_get_ctx(module);
2228
2229         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2230
2231         guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2232         if ( guid_blob != NULL ) {
2233                 ldb_set_errstring(ldb,
2234                                   "replmd_modify: it's not allowed to change the objectGUID!");
2235                 return LDB_ERR_CONSTRAINT_VIOLATION;
2236         }
2237
2238         ac = replmd_ctx_init(module, req);
2239         if (ac == NULL) {
2240                 return ldb_module_oom(module);
2241         }
2242
2243         functional_level = dsdb_functional_level(ldb);
2244
2245         lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2246                                  struct loadparm_context);
2247
2248         /* we have to copy the message as the caller might have it as a const */
2249         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2250         if (msg == NULL) {
2251                 ldb_oom(ldb);
2252                 talloc_free(ac);
2253                 return LDB_ERR_OPERATIONS_ERROR;
2254         }
2255
2256         ldb_msg_remove_attr(msg, "whenChanged");
2257         ldb_msg_remove_attr(msg, "uSNChanged");
2258
2259         ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2260                                  msg, &ac->seq_num, t, &is_urgent);
2261         if (ret == LDB_ERR_REFERRAL) {
2262                 referral = talloc_asprintf(req,
2263                                            "ldap://%s/%s",
2264                                            lpcfg_dnsdomain(lp_ctx),
2265                                            ldb_dn_get_linearized(msg->dn));
2266                 ret = ldb_module_send_referral(req, referral);
2267                 talloc_free(ac);
2268                 return ldb_module_done(req, NULL, NULL, ret);
2269         }
2270
2271         if (ret != LDB_SUCCESS) {
2272                 talloc_free(ac);
2273                 return ret;
2274         }
2275
2276         ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2277         if (ret != LDB_SUCCESS) {
2278                 talloc_free(ac);
2279                 return ret;
2280         }
2281
2282         /* TODO:
2283          * - replace the old object with the newly constructed one
2284          */
2285
2286         ac->is_urgent = is_urgent;
2287
2288         ret = ldb_build_mod_req(&down_req, ldb, ac,
2289                                 msg,
2290                                 req->controls,
2291                                 ac, replmd_op_callback,
2292                                 req);
2293         LDB_REQ_SET_LOCATION(down_req);
2294         if (ret != LDB_SUCCESS) {
2295                 talloc_free(ac);
2296                 return ret;
2297         }
2298
2299         /* current partition control is needed by "replmd_op_callback" */
2300         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2301                 ret = ldb_request_add_control(down_req,
2302                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
2303                                               false, NULL);
2304                 if (ret != LDB_SUCCESS) {
2305                         talloc_free(ac);
2306                         return ret;
2307                 }
2308         }
2309
2310         /* If we are in functional level 2000, then
2311          * replmd_modify_handle_linked_attribs will have done
2312          * nothing */
2313         if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2314                 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2315                 if (ret != LDB_SUCCESS) {
2316                         talloc_free(ac);
2317                         return ret;
2318                 }
2319         }
2320
2321         talloc_steal(down_req, msg);
2322
2323         /* we only change whenChanged and uSNChanged if the seq_num
2324            has changed */
2325         if (ac->seq_num != 0) {
2326                 ret = add_time_element(msg, "whenChanged", t);
2327                 if (ret != LDB_SUCCESS) {
2328                         talloc_free(ac);
2329                         return ret;
2330                 }
2331
2332                 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2333                 if (ret != LDB_SUCCESS) {
2334                         talloc_free(ac);
2335                         return ret;
2336                 }
2337         }
2338
2339         /* go on with the call chain */
2340         return ldb_next_request(module, down_req);
2341 }
2342
2343 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2344
2345 /*
2346   handle a rename request
2347
2348   On a rename we need to do an extra ldb_modify which sets the
2349   whenChanged and uSNChanged attributes.  We do this in a callback after the success.
2350  */
2351 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2352 {
2353         struct ldb_context *ldb;
2354         struct replmd_replicated_request *ac;
2355         int ret;
2356         struct ldb_request *down_req;
2357
2358         /* do not manipulate our control entries */
2359         if (ldb_dn_is_special(req->op.mod.message->dn)) {
2360                 return ldb_next_request(module, req);
2361         }
2362
2363         ldb = ldb_module_get_ctx(module);
2364
2365         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2366
2367         ac = replmd_ctx_init(module, req);
2368         if (ac == NULL) {
2369                 return ldb_module_oom(module);
2370         }
2371
2372         ret = ldb_build_rename_req(&down_req, ldb, ac,
2373                                    ac->req->op.rename.olddn,
2374                                    ac->req->op.rename.newdn,
2375                                    ac->req->controls,
2376                                    ac, replmd_rename_callback,
2377                                    ac->req);
2378         LDB_REQ_SET_LOCATION(down_req);
2379         if (ret != LDB_SUCCESS) {
2380                 talloc_free(ac);
2381                 return ret;
2382         }
2383
2384         /* go on with the call chain */
2385         return ldb_next_request(module, down_req);
2386 }
2387
2388 /* After the rename is compleated, update the whenchanged etc */
2389 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2390 {
2391         struct ldb_context *ldb;
2392         struct replmd_replicated_request *ac;
2393         struct ldb_request *down_req;
2394         struct ldb_message *msg;
2395         const struct dsdb_attribute *rdn_attr;
2396         const char *rdn_name;
2397         const struct ldb_val *rdn_val;
2398         const char *attrs[4] = { NULL, };
2399         time_t t = time(NULL);
2400         int ret;
2401         bool is_urgent = false;
2402
2403         ac = talloc_get_type(req->context, struct replmd_replicated_request);
2404         ldb = ldb_module_get_ctx(ac->module);
2405
2406         if (ares->error != LDB_SUCCESS) {
2407                 return ldb_module_done(ac->req, ares->controls,
2408                                         ares->response, ares->error);
2409         }
2410
2411         if (ares->type != LDB_REPLY_DONE) {
2412                 ldb_set_errstring(ldb,
2413                                   "invalid ldb_reply_type in callback");
2414                 talloc_free(ares);
2415                 return ldb_module_done(ac->req, NULL, NULL,
2416                                         LDB_ERR_OPERATIONS_ERROR);
2417         }
2418
2419         /* TODO:
2420          * - replace the old object with the newly constructed one
2421          */
2422
2423         msg = ldb_msg_new(ac);
2424         if (msg == NULL) {
2425                 ldb_oom(ldb);
2426                 return LDB_ERR_OPERATIONS_ERROR;
2427         }
2428
2429         msg->dn = ac->req->op.rename.newdn;
2430
2431         rdn_name = ldb_dn_get_rdn_name(msg->dn);
2432         if (rdn_name == NULL) {
2433                 talloc_free(ares);
2434                 return ldb_module_done(ac->req, NULL, NULL,
2435                                        ldb_operr(ldb));
2436         }
2437
2438         /* normalize the rdn attribute name */
2439         rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2440         if (rdn_attr == NULL) {
2441                 talloc_free(ares);
2442                 return ldb_module_done(ac->req, NULL, NULL,
2443                                        ldb_operr(ldb));
2444         }
2445         rdn_name = rdn_attr->lDAPDisplayName;
2446
2447         rdn_val = ldb_dn_get_rdn_val(msg->dn);
2448         if (rdn_val == NULL) {
2449                 talloc_free(ares);
2450                 return ldb_module_done(ac->req, NULL, NULL,
2451                                        ldb_operr(ldb));
2452         }
2453
2454         if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2455                 talloc_free(ares);
2456                 return ldb_module_done(ac->req, NULL, NULL,
2457                                        ldb_oom(ldb));
2458         }
2459         if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2460                 talloc_free(ares);
2461                 return ldb_module_done(ac->req, NULL, NULL,
2462                                        ldb_oom(ldb));
2463         }
2464         if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2465                 talloc_free(ares);
2466                 return ldb_module_done(ac->req, NULL, NULL,
2467                                        ldb_oom(ldb));
2468         }
2469         if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2470                 talloc_free(ares);
2471                 return ldb_module_done(ac->req, NULL, NULL,
2472                                        ldb_oom(ldb));
2473         }
2474
2475         /*
2476          * here we let replmd_update_rpmd() only search for
2477          * the existing "replPropertyMetaData" and rdn_name attributes.
2478          *
2479          * We do not want the existing "name" attribute as
2480          * the "name" attribute needs to get the version
2481          * updated on rename even if the rdn value hasn't changed.
2482          *
2483          * This is the diff of the meta data, for a moved user
2484          * on a w2k8r2 server:
2485          *
2486          * # record 1
2487          * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2488          * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2489          *  replPropertyMetaData:     NDR: struct replPropertyMetaDataBlob
2490          *         version                  : 0x00000001 (1)
2491          *         reserved                 : 0x00000000 (0)
2492          * @@ -66,11 +66,11 @@ replPropertyMetaData:     NDR: struct re
2493          *                      local_usn                : 0x00000000000037a5 (14245)
2494          *                 array: struct replPropertyMetaData1
2495          *                      attid                    : DRSUAPI_ATTID_name (0x90001)
2496          * -                    version                  : 0x00000001 (1)
2497          * -                    originating_change_time  : Wed Feb  9 17:20:49 2011 CET
2498          * +                    version                  : 0x00000002 (2)
2499          * +                    originating_change_time  : Wed Apr  6 15:21:01 2011 CEST
2500          *                      originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2501          * -                    originating_usn          : 0x00000000000037a5 (14245)
2502          * -                    local_usn                : 0x00000000000037a5 (14245)
2503          * +                    originating_usn          : 0x0000000000003834 (14388)
2504          * +                    local_usn                : 0x0000000000003834 (14388)
2505          *                 array: struct replPropertyMetaData1
2506          *                      attid                    : DRSUAPI_ATTID_userAccountControl (0x90008)
2507          *                      version                  : 0x00000004 (4)
2508          */
2509         attrs[0] = "replPropertyMetaData";
2510         attrs[1] = "objectClass";
2511         attrs[2] = rdn_name;
2512         attrs[3] = NULL;
2513
2514         ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2515                                  msg, &ac->seq_num, t, &is_urgent);
2516         if (ret == LDB_ERR_REFERRAL) {
2517                 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2518                 struct loadparm_context *lp_ctx;
2519                 char *referral;
2520
2521                 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2522                                          struct loadparm_context);
2523
2524                 referral = talloc_asprintf(req,
2525                                            "ldap://%s/%s",
2526                                            lpcfg_dnsdomain(lp_ctx),
2527                                            ldb_dn_get_linearized(olddn));
2528                 ret = ldb_module_send_referral(req, referral);
2529                 talloc_free(ac);
2530                 return ldb_module_done(req, NULL, NULL, ret);
2531         }
2532
2533         if (ret != LDB_SUCCESS) {
2534                 talloc_free(ares);
2535                 return ldb_module_done(ac->req, NULL, NULL,
2536                                        ldb_error(ldb, ret,
2537                                         "failed to call replmd_update_rpmd()"));
2538         }
2539
2540         if (ac->seq_num == 0) {
2541                 talloc_free(ares);
2542                 return ldb_module_done(ac->req, NULL, NULL,
2543                                        ldb_error(ldb, ret,
2544                                         "internal error seq_num == 0"));
2545         }
2546         ac->is_urgent = is_urgent;
2547
2548         ret = ldb_build_mod_req(&down_req, ldb, ac,
2549                                 msg,
2550                                 req->controls,
2551                                 ac, replmd_op_callback,
2552                                 req);
2553         LDB_REQ_SET_LOCATION(down_req);
2554         if (ret != LDB_SUCCESS) {
2555                 talloc_free(ac);
2556                 return ret;
2557         }
2558
2559         /* current partition control is needed by "replmd_op_callback" */
2560         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2561                 ret = ldb_request_add_control(down_req,
2562                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
2563                                               false, NULL);
2564                 if (ret != LDB_SUCCESS) {
2565                         talloc_free(ac);
2566                         return ret;
2567                 }
2568         }
2569
2570         talloc_steal(down_req, msg);
2571
2572         ret = add_time_element(msg, "whenChanged", t);
2573         if (ret != LDB_SUCCESS) {
2574                 talloc_free(ac);
2575                 return ret;
2576         }
2577
2578         ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2579         if (ret != LDB_SUCCESS) {
2580                 talloc_free(ac);
2581                 return ret;
2582         }
2583
2584         /* go on with the call chain - do the modify after the rename */
2585         return ldb_next_request(ac->module, down_req);
2586 }
2587
2588 /*
2589    remove links from objects that point at this object when an object
2590    is deleted
2591  */
2592 static int replmd_delete_remove_link(struct ldb_module *module,
2593                                      const struct dsdb_schema *schema,
2594                                      struct ldb_dn *dn,
2595                                      struct ldb_message_element *el,
2596                                      const struct dsdb_attribute *sa,
2597                                      struct ldb_request *parent)
2598 {
2599         unsigned int i;
2600         TALLOC_CTX *tmp_ctx = talloc_new(module);
2601         struct ldb_context *ldb = ldb_module_get_ctx(module);
2602
2603         for (i=0; i<el->num_values; i++) {
2604                 struct dsdb_dn *dsdb_dn;
2605                 NTSTATUS status;
2606                 int ret;
2607                 struct GUID guid2;
2608                 struct ldb_message *msg;
2609                 const struct dsdb_attribute *target_attr;
2610                 struct ldb_message_element *el2;
2611                 struct ldb_val dn_val;
2612
2613                 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2614                         continue;
2615                 }
2616
2617                 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2618                 if (!dsdb_dn) {
2619                         talloc_free(tmp_ctx);
2620                         return LDB_ERR_OPERATIONS_ERROR;
2621                 }
2622
2623                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2624                 if (!NT_STATUS_IS_OK(status)) {
2625                         talloc_free(tmp_ctx);
2626                         return LDB_ERR_OPERATIONS_ERROR;
2627                 }
2628
2629                 /* remove the link */
2630                 msg = ldb_msg_new(tmp_ctx);
2631                 if (!msg) {
2632                         ldb_module_oom(module);
2633                         talloc_free(tmp_ctx);
2634                         return LDB_ERR_OPERATIONS_ERROR;
2635                 }
2636
2637
2638                 msg->dn = dsdb_dn->dn;
2639
2640                 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2641                 if (target_attr == NULL) {
2642                         continue;
2643                 }
2644
2645                 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2646                 if (ret != LDB_SUCCESS) {
2647                         ldb_module_oom(module);
2648                         talloc_free(tmp_ctx);
2649                         return LDB_ERR_OPERATIONS_ERROR;
2650                 }
2651                 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2652                 el2->values = &dn_val;
2653                 el2->num_values = 1;
2654
2655                 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2656                 if (ret != LDB_SUCCESS) {
2657                         talloc_free(tmp_ctx);
2658                         return ret;
2659                 }
2660         }
2661         talloc_free(tmp_ctx);
2662         return LDB_SUCCESS;
2663 }
2664
2665
2666 /*
2667   handle update of replication meta data for deletion of objects
2668
2669   This also handles the mapping of delete to a rename operation
2670   to allow deletes to be replicated.
2671  */
2672 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2673 {
2674         int ret = LDB_ERR_OTHER;
2675         bool retb, disallow_move_on_delete;
2676         struct ldb_dn *old_dn, *new_dn;
2677         const char *rdn_name;
2678         const struct ldb_val *rdn_value, *new_rdn_value;
2679         struct GUID guid;
2680         struct ldb_context *ldb = ldb_module_get_ctx(module);
2681         const struct dsdb_schema *schema;
2682         struct ldb_message *msg, *old_msg;
2683         struct ldb_message_element *el;
2684         TALLOC_CTX *tmp_ctx;
2685         struct ldb_result *res, *parent_res;
2686         const char *preserved_attrs[] = {
2687                 /* yes, this really is a hard coded list. See MS-ADTS
2688                    section 3.1.1.5.5.1.1 */
2689                 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2690                 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2691                 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2692                 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2693                 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2694                 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2695                 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2696                 "whenChanged", NULL};
2697         unsigned int i, el_count = 0;
2698         enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2699                                                 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2700         enum deletion_state deletion_state, next_deletion_state;
2701         bool enabled;
2702
2703         if (ldb_dn_is_special(req->op.del.dn)) {
2704                 return ldb_next_request(module, req);
2705         }
2706
2707         tmp_ctx = talloc_new(ldb);
2708         if (!tmp_ctx) {
2709                 ldb_oom(ldb);
2710                 return LDB_ERR_OPERATIONS_ERROR;
2711         }
2712
2713         schema = dsdb_get_schema(ldb, tmp_ctx);
2714         if (!schema) {
2715                 return LDB_ERR_OPERATIONS_ERROR;
2716         }
2717
2718         old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2719
2720         /* we need the complete msg off disk, so we can work out which
2721            attributes need to be removed */
2722         ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2723                                     DSDB_FLAG_NEXT_MODULE |
2724                                     DSDB_SEARCH_SHOW_RECYCLED |
2725                                     DSDB_SEARCH_REVEAL_INTERNALS |
2726                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2727         if (ret != LDB_SUCCESS) {
2728                 talloc_free(tmp_ctx);
2729                 return ret;
2730         }
2731         old_msg = res->msgs[0];
2732
2733
2734         ret = dsdb_recyclebin_enabled(module, &enabled);
2735         if (ret != LDB_SUCCESS) {
2736                 talloc_free(tmp_ctx);
2737                 return ret;
2738         }
2739
2740         if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2741                 if (!enabled) {
2742                         deletion_state = OBJECT_TOMBSTONE;
2743                         next_deletion_state = OBJECT_REMOVED;
2744                 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2745                         deletion_state = OBJECT_RECYCLED;
2746                         next_deletion_state = OBJECT_REMOVED;
2747                 } else {
2748                         deletion_state = OBJECT_DELETED;
2749                         next_deletion_state = OBJECT_RECYCLED;
2750                 }
2751         } else {
2752                 deletion_state = OBJECT_NOT_DELETED;
2753                 if (enabled) {
2754                         next_deletion_state = OBJECT_DELETED;
2755                 } else {
2756                         next_deletion_state = OBJECT_TOMBSTONE;
2757                 }
2758         }
2759
2760         if (next_deletion_state == OBJECT_REMOVED) {
2761                 struct auth_session_info *session_info =
2762                                 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2763                 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2764                         ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2765                                         ldb_dn_get_linearized(old_msg->dn));
2766                         return LDB_ERR_UNWILLING_TO_PERFORM;
2767                 }
2768
2769                 /* it is already deleted - really remove it this time */
2770                 talloc_free(tmp_ctx);
2771                 return ldb_next_request(module, req);
2772         }
2773
2774         rdn_name = ldb_dn_get_rdn_name(old_dn);
2775         rdn_value = ldb_dn_get_rdn_val(old_dn);
2776         if ((rdn_name == NULL) || (rdn_value == NULL)) {
2777                 talloc_free(tmp_ctx);
2778                 return ldb_operr(ldb);
2779         }
2780
2781         msg = ldb_msg_new(tmp_ctx);
2782         if (msg == NULL) {
2783                 ldb_module_oom(module);
2784                 talloc_free(tmp_ctx);
2785                 return LDB_ERR_OPERATIONS_ERROR;
2786         }
2787
2788         msg->dn = old_dn;
2789
2790         if (deletion_state == OBJECT_NOT_DELETED){
2791                 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2792                 disallow_move_on_delete =
2793                         (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2794                                 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2795
2796                 /* work out where we will be renaming this object to */
2797                 if (!disallow_move_on_delete) {
2798                         ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2799                                                           &new_dn);
2800                         if (ret != LDB_SUCCESS) {
2801                                 /* this is probably an attempted delete on a partition
2802                                  * that doesn't allow delete operations, such as the
2803                                  * schema partition */
2804                                 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2805                                                            ldb_dn_get_linearized(old_dn));
2806                                 talloc_free(tmp_ctx);
2807                                 return LDB_ERR_UNWILLING_TO_PERFORM;
2808                         }
2809                 } else {
2810                         new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2811                         if (new_dn == NULL) {
2812                                 ldb_module_oom(module);
2813                                 talloc_free(tmp_ctx);
2814                                 return LDB_ERR_OPERATIONS_ERROR;
2815                         }
2816                 }
2817
2818                 /* get the objects GUID from the search we just did */
2819                 guid = samdb_result_guid(old_msg, "objectGUID");
2820
2821                 /* Add a formatted child */
2822                 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2823                                                 rdn_name,
2824                                                 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2825                                                 GUID_string(tmp_ctx, &guid));
2826                 if (!retb) {
2827                         DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2828                                         ldb_dn_get_linearized(new_dn)));
2829                         talloc_free(tmp_ctx);
2830                         return LDB_ERR_OPERATIONS_ERROR;
2831                 }
2832
2833                 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2834                 if (ret != LDB_SUCCESS) {
2835                         DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2836                         ldb_module_oom(module);
2837                         talloc_free(tmp_ctx);
2838                         return ret;
2839                 }
2840                 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2841         }
2842
2843         /*
2844           now we need to modify the object in the following ways:
2845
2846           - add isDeleted=TRUE
2847           - update rDN and name, with new rDN
2848           - remove linked attributes
2849           - remove objectCategory and sAMAccountType
2850           - remove attribs not on the preserved list
2851              - preserved if in above list, or is rDN
2852           - remove all linked attribs from this object
2853           - remove all links from other objects to this object
2854           - add lastKnownParent
2855           - update replPropertyMetaData?
2856
2857           see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2858          */
2859
2860         /* we need the storage form of the parent GUID */
2861         ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2862                                     ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2863                                     DSDB_FLAG_NEXT_MODULE |
2864                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2865                                     DSDB_SEARCH_REVEAL_INTERNALS|
2866                                     DSDB_SEARCH_SHOW_RECYCLED, req);
2867         if (ret != LDB_SUCCESS) {
2868                 talloc_free(tmp_ctx);
2869                 return ret;
2870         }
2871
2872         if (deletion_state == OBJECT_NOT_DELETED){
2873                 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2874                                                    ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2875                 if (ret != LDB_SUCCESS) {
2876                         DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2877                         ldb_module_oom(module);
2878                         talloc_free(tmp_ctx);
2879                         return ret;
2880                 }
2881                 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2882         }
2883
2884         switch (next_deletion_state){
2885
2886         case OBJECT_DELETED:
2887
2888                 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2889                 if (ret != LDB_SUCCESS) {
2890                         DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2891                         ldb_module_oom(module);
2892                         talloc_free(tmp_ctx);
2893                         return ret;
2894                 }
2895                 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2896
2897                 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2898                 if (ret != LDB_SUCCESS) {
2899                         talloc_free(tmp_ctx);
2900                         ldb_module_oom(module);
2901                         return ret;
2902                 }
2903
2904                 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2905                 if (ret != LDB_SUCCESS) {
2906                         talloc_free(tmp_ctx);
2907                         ldb_module_oom(module);
2908                         return ret;
2909                 }
2910
2911                 break;
2912
2913         case OBJECT_RECYCLED:
2914         case OBJECT_TOMBSTONE:
2915
2916                 /* we also mark it as recycled, meaning this object can't be
2917                    recovered (we are stripping its attributes) */
2918                 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2919                         ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2920                         if (ret != LDB_SUCCESS) {
2921                                 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2922                                 ldb_module_oom(module);
2923                                 talloc_free(tmp_ctx);
2924                                 return ret;
2925                         }
2926                         msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2927                 }
2928
2929                 /* work out which of the old attributes we will be removing */
2930                 for (i=0; i<old_msg->num_elements; i++) {
2931                         const struct dsdb_attribute *sa;
2932                         el = &old_msg->elements[i];
2933                         sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2934                         if (!sa) {
2935                                 talloc_free(tmp_ctx);
2936                                 return LDB_ERR_OPERATIONS_ERROR;
2937                         }
2938                         if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2939                                 /* don't remove the rDN */
2940                                 continue;
2941                         }
2942                         if (sa->linkID && sa->linkID & 1) {
2943                                 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
2944                                 if (ret != LDB_SUCCESS) {
2945                                         talloc_free(tmp_ctx);
2946                                         return LDB_ERR_OPERATIONS_ERROR;
2947                                 }
2948                                 continue;
2949                         }
2950                         if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2951                                 continue;
2952                         }
2953                         ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2954                         if (ret != LDB_SUCCESS) {
2955                                 talloc_free(tmp_ctx);
2956                                 ldb_module_oom(module);
2957                                 return ret;
2958                         }
2959                 }
2960                 break;
2961
2962         default:
2963                 break;
2964         }
2965
2966         if (deletion_state == OBJECT_NOT_DELETED) {
2967                 const struct dsdb_attribute *sa;
2968
2969                 /* work out what the new rdn value is, for updating the
2970                    rDN and name fields */
2971                 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2972                 if (new_rdn_value == NULL) {
2973                         talloc_free(tmp_ctx);
2974                         return ldb_operr(ldb);
2975                 }
2976
2977                 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2978                 if (!sa) {
2979                         talloc_free(tmp_ctx);
2980                         return LDB_ERR_OPERATIONS_ERROR;
2981                 }
2982
2983                 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2984                                         &el);
2985                 if (ret != LDB_SUCCESS) {
2986                         talloc_free(tmp_ctx);
2987                         return ret;
2988                 }
2989                 el->flags = LDB_FLAG_MOD_REPLACE;
2990
2991                 el = ldb_msg_find_element(old_msg, "name");
2992                 if (el) {
2993                         ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2994                         if (ret != LDB_SUCCESS) {
2995                                 talloc_free(tmp_ctx);
2996                                 return ret;
2997                         }
2998                         el->flags = LDB_FLAG_MOD_REPLACE;
2999                 }
3000         }
3001
3002         ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3003         if (ret != LDB_SUCCESS) {
3004                 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3005                                        ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3006                 talloc_free(tmp_ctx);
3007                 return ret;
3008         }
3009
3010         if (deletion_state == OBJECT_NOT_DELETED) {
3011                 /* now rename onto the new DN */
3012                 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3013                 if (ret != LDB_SUCCESS){
3014                         DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3015                                  ldb_dn_get_linearized(old_dn),
3016                                  ldb_dn_get_linearized(new_dn),
3017                                  ldb_errstring(ldb)));
3018                         talloc_free(tmp_ctx);
3019                         return ret;
3020                 }
3021         }
3022
3023         talloc_free(tmp_ctx);
3024
3025         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3026 }
3027
3028
3029
3030 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3031 {
3032         return ret;
3033 }
3034
3035 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3036 {
3037         int ret = LDB_ERR_OTHER;
3038         /* TODO: do some error mapping */
3039         return ret;
3040 }
3041
3042
3043 static struct replPropertyMetaData1 *
3044 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3045                                         enum drsuapi_DsAttributeId attid)
3046 {
3047         uint32_t i;
3048         struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3049
3050         for (i = 0; i < rpmd_ctr->count; i++) {
3051                 if (rpmd_ctr->array[i].attid == attid) {
3052                         return &rpmd_ctr->array[i];
3053                 }
3054         }
3055         return NULL;
3056 }
3057
3058
3059 /*
3060    return true if an update is newer than an existing entry
3061    see section 5.11 of MS-ADTS
3062 */
3063 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3064                                    const struct GUID *update_invocation_id,
3065                                    uint32_t current_version,
3066                                    uint32_t update_version,
3067                                    NTTIME current_change_time,
3068                                    NTTIME update_change_time)
3069 {
3070         if (update_version != current_version) {
3071                 return update_version > current_version;
3072         }
3073         if (update_change_time != current_change_time) {
3074                 return update_change_time > current_change_time;
3075         }
3076         return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3077 }
3078
3079 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3080                                                   struct replPropertyMetaData1 *new_m)
3081 {
3082         return replmd_update_is_newer(&cur_m->originating_invocation_id,
3083                                       &new_m->originating_invocation_id,
3084                                       cur_m->version,
3085                                       new_m->version,
3086                                       cur_m->originating_change_time,
3087                                       new_m->originating_change_time);
3088 }
3089
3090
3091 /*
3092   form a conflict DN
3093  */
3094 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3095 {
3096         const struct ldb_val *rdn_val;
3097         const char *rdn_name;
3098         struct ldb_dn *new_dn;
3099
3100         rdn_val = ldb_dn_get_rdn_val(dn);
3101         rdn_name = ldb_dn_get_rdn_name(dn);
3102         if (!rdn_val || !rdn_name) {
3103                 return NULL;
3104         }
3105
3106         new_dn = ldb_dn_copy(mem_ctx, dn);
3107         if (!new_dn) {
3108                 return NULL;
3109         }
3110
3111         if (!ldb_dn_remove_child_components(new_dn, 1)) {
3112                 return NULL;
3113         }
3114
3115         if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3116                                   rdn_name,
3117                                   ldb_dn_escape_value(new_dn, *rdn_val),
3118                                   GUID_string(new_dn, guid))) {
3119                 return NULL;
3120         }
3121
3122         return new_dn;
3123 }
3124
3125
3126 /*
3127   perform a modify operation which sets the rDN and name attributes to
3128   their current values. This has the effect of changing these
3129   attributes to have been last updated by the current DC. This is
3130   needed to ensure that renames performed as part of conflict
3131   resolution are propogated to other DCs
3132  */
3133 static int replmd_name_modify(struct replmd_replicated_request *ar,
3134                               struct ldb_request *req, struct ldb_dn *dn)
3135 {
3136         struct ldb_message *msg;
3137         const char *rdn_name;
3138         const struct ldb_val *rdn_val;
3139         const struct dsdb_attribute *rdn_attr;
3140         int ret;
3141
3142         msg = ldb_msg_new(req);
3143         if (msg == NULL) {
3144                 goto failed;
3145         }
3146         msg->dn = dn;
3147
3148         rdn_name = ldb_dn_get_rdn_name(dn);
3149         if (rdn_name == NULL) {
3150                 goto failed;
3151         }
3152
3153         /* normalize the rdn attribute name */
3154         rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3155         if (rdn_attr == NULL) {
3156                 goto failed;
3157         }
3158         rdn_name = rdn_attr->lDAPDisplayName;
3159
3160         rdn_val = ldb_dn_get_rdn_val(dn);
3161         if (rdn_val == NULL) {
3162                 goto failed;
3163         }
3164
3165         if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3166                 goto failed;
3167         }
3168         if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3169                 goto failed;
3170         }
3171         if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3172                 goto failed;
3173         }
3174         if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3175                 goto failed;
3176         }
3177
3178         ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3179         if (ret != LDB_SUCCESS) {
3180                 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3181                          ldb_dn_get_linearized(dn),
3182                          ldb_errstring(ldb_module_get_ctx(ar->module))));
3183                 return ret;
3184         }
3185
3186         talloc_free(msg);
3187
3188         return LDB_SUCCESS;
3189
3190 failed:
3191         talloc_free(msg);
3192         DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3193                  ldb_dn_get_linearized(dn)));
3194         return LDB_ERR_OPERATIONS_ERROR;
3195 }
3196
3197
3198 /*
3199   callback for conflict DN handling where we have renamed the incoming
3200   record. After renaming it, we need to ensure the change of name and
3201   rDN for the incoming record is seen as an originating update by this DC.
3202  */
3203 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3204 {
3205         struct replmd_replicated_request *ar =
3206                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3207         int ret;
3208
3209         if (ares->error != LDB_SUCCESS) {
3210                 /* call the normal callback for everything except success */
3211                 return replmd_op_callback(req, ares);
3212         }
3213
3214         /* perform a modify of the rDN and name of the record */
3215         ret = replmd_name_modify(ar, req, req->op.add.message->dn);
3216         if (ret != LDB_SUCCESS) {
3217                 ares->error = ret;
3218                 return replmd_op_callback(req, ares);
3219         }
3220
3221         return replmd_op_callback(req, ares);
3222 }
3223
3224 /*
3225   callback for replmd_replicated_apply_add()
3226   This copes with the creation of conflict records in the case where
3227   the DN exists, but with a different objectGUID
3228  */
3229 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3230 {
3231         struct ldb_dn *conflict_dn;
3232         struct replmd_replicated_request *ar =
3233                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3234         struct ldb_result *res;
3235         const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3236         int ret;
3237         const struct ldb_val *rmd_value, *omd_value;
3238         struct replPropertyMetaDataBlob omd, rmd;
3239         enum ndr_err_code ndr_err;
3240         bool rename_incoming_record;
3241         struct replPropertyMetaData1 *rmd_name, *omd_name;
3242
3243         if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3244                 /* call the normal callback for everything except
3245                    conflicts */
3246                 return replmd_op_callback(req, ares);
3247         }
3248
3249         /*
3250          * we have a conflict, and need to decide if we will keep the
3251          * new record or the old record
3252          */
3253         conflict_dn = req->op.add.message->dn;
3254
3255         /*
3256          * first we need the replPropertyMetaData attribute from the
3257          * old record
3258          */
3259         ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3260                                     attrs,
3261                                     DSDB_FLAG_NEXT_MODULE |
3262                                     DSDB_SEARCH_SHOW_DELETED |
3263                                     DSDB_SEARCH_SHOW_RECYCLED, req);
3264         if (ret != LDB_SUCCESS) {
3265                 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3266                          ldb_dn_get_linearized(conflict_dn)));
3267                 goto failed;
3268         }
3269
3270         omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3271         if (omd_value == NULL) {
3272                 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3273                          ldb_dn_get_linearized(conflict_dn)));
3274                 goto failed;
3275         }
3276
3277         ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3278                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3279         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3280                 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3281                          ldb_dn_get_linearized(conflict_dn)));
3282                 goto failed;
3283         }
3284
3285         /*
3286          * and the replPropertyMetaData attribute from the
3287          * new record
3288          */
3289         rmd_value = ldb_msg_find_ldb_val(req->op.add.message, "replPropertyMetaData");
3290         if (rmd_value == NULL) {
3291                 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for new record '%s'\n",
3292                          ldb_dn_get_linearized(conflict_dn)));
3293                 goto failed;
3294         }
3295
3296         ndr_err = ndr_pull_struct_blob(rmd_value, req, &rmd,
3297                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3298         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3299                 DEBUG(0,(__location__ ": Failed to parse new replPropertyMetaData for %s\n",
3300                          ldb_dn_get_linearized(conflict_dn)));
3301                 goto failed;
3302         }
3303
3304         /* we decide which is newer based on the RPMD on the name
3305            attribute.  See [MS-DRSR] ResolveNameConflict */
3306         rmd_name = replmd_replPropertyMetaData1_find_attid(&rmd, DRSUAPI_ATTID_name);
3307         omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3308         if (!rmd_name || !omd_name) {
3309                 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3310                          ldb_dn_get_linearized(conflict_dn)));
3311                 goto failed;
3312         }
3313
3314         rename_incoming_record = !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3315
3316         if (rename_incoming_record) {
3317                 struct GUID guid;
3318                 struct ldb_dn *new_dn;
3319                 struct ldb_message *new_msg;
3320
3321                 guid = samdb_result_guid(req->op.add.message, "objectGUID");
3322                 if (GUID_all_zero(&guid)) {
3323                         DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3324                                  ldb_dn_get_linearized(conflict_dn)));
3325                         goto failed;
3326                 }
3327                 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3328                 if (new_dn == NULL) {
3329                         DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3330                                  ldb_dn_get_linearized(conflict_dn)));
3331                         goto failed;
3332                 }
3333
3334                 DEBUG(1,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3335                          ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3336
3337                 /* re-submit the request, but with a different
3338                    callback, so we don't loop forever. */
3339                 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
3340                 if (!new_msg) {
3341                         goto failed;
3342                         DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3343                                  ldb_dn_get_linearized(conflict_dn)));
3344                 }
3345                 new_msg->dn = new_dn;
3346                 req->op.add.message = new_msg;
3347                 req->callback = replmd_op_name_modify_callback;
3348
3349                 return ldb_next_request(ar->module, req);
3350         } else {
3351                 /* we are renaming the existing record */
3352                 struct GUID guid;
3353                 struct ldb_dn *new_dn;
3354
3355                 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3356                 if (GUID_all_zero(&guid)) {
3357                         DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3358                                  ldb_dn_get_linearized(conflict_dn)));
3359                         goto failed;
3360                 }
3361
3362                 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3363                 if (new_dn == NULL) {
3364                         DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3365                                  ldb_dn_get_linearized(conflict_dn)));
3366                         goto failed;
3367                 }
3368
3369                 DEBUG(1,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3370                          ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3371
3372                 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3373                                          DSDB_FLAG_OWN_MODULE, req);
3374                 if (ret != LDB_SUCCESS) {
3375                         DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3376                                  ldb_dn_get_linearized(conflict_dn),
3377                                  ldb_dn_get_linearized(new_dn),
3378                                  ldb_errstring(ldb_module_get_ctx(ar->module))));
3379                         goto failed;
3380                 }
3381
3382                 /*
3383                  * now we need to ensure that the rename is seen as an
3384                  * originating update. We do that with a modify.
3385                  */
3386                 ret = replmd_name_modify(ar, req, new_dn);
3387                 if (ret != LDB_SUCCESS) {
3388                         goto failed;
3389                 }
3390
3391                 req->callback = replmd_op_callback;
3392
3393                 return ldb_next_request(ar->module, req);
3394         }
3395
3396 failed:
3397         /* on failure do the original callback. This means replication
3398          * will stop with an error, but there is not much else we can
3399          * do
3400          */
3401         return replmd_op_callback(req, ares);
3402 }
3403
3404 /*
3405   this is called when a new object comes in over DRS
3406  */
3407 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3408 {
3409         struct ldb_context *ldb;
3410         struct ldb_request *change_req;
3411         enum ndr_err_code ndr_err;
3412         struct ldb_message *msg;
3413         struct replPropertyMetaDataBlob *md;
3414         struct ldb_val md_value;
3415         unsigned int i;
3416         int ret;
3417
3418         /*
3419          * TODO: check if the parent object exist
3420          */
3421
3422         /*
3423          * TODO: handle the conflict case where an object with the
3424          *       same name exist
3425          */
3426
3427         ldb = ldb_module_get_ctx(ar->module);
3428         msg = ar->objs->objects[ar->index_current].msg;
3429         md = ar->objs->objects[ar->index_current].meta_data;
3430
3431         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3432         if (ret != LDB_SUCCESS) {
3433                 return replmd_replicated_request_error(ar, ret);
3434         }
3435
3436         ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3437         if (ret != LDB_SUCCESS) {
3438                 return replmd_replicated_request_error(ar, ret);
3439         }
3440
3441         ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3442         if (ret != LDB_SUCCESS) {
3443                 return replmd_replicated_request_error(ar, ret);
3444         }
3445
3446         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3447         if (ret != LDB_SUCCESS) {
3448                 return replmd_replicated_request_error(ar, ret);
3449         }
3450
3451         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3452         if (ret != LDB_SUCCESS) {
3453                 return replmd_replicated_request_error(ar, ret);
3454         }
3455
3456         /* remove any message elements that have zero values */
3457         for (i=0; i<msg->num_elements; i++) {
3458                 struct ldb_message_element *el = &msg->elements[i];
3459
3460                 if (el->num_values == 0) {
3461                         DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3462                                  el->name));
3463                         memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3464                         msg->num_elements--;
3465                         i--;
3466                         continue;
3467                 }
3468         }
3469
3470         /*
3471          * the meta data array is already sorted by the caller
3472          */
3473         for (i=0; i < md->ctr.ctr1.count; i++) {
3474                 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3475         }
3476         ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3477                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3478         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3479                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3480                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3481         }
3482         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3483         if (ret != LDB_SUCCESS) {
3484                 return replmd_replicated_request_error(ar, ret);
3485         }
3486
3487         replmd_ldb_message_sort(msg, ar->schema);
3488
3489         if (DEBUGLVL(4)) {
3490                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3491                 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3492                 talloc_free(s);
3493         }
3494
3495         ret = ldb_build_add_req(&change_req,
3496                                 ldb,
3497                                 ar,
3498                                 msg,
3499                                 ar->controls,
3500                                 ar,
3501                                 replmd_op_add_callback,
3502                                 ar->req);
3503         LDB_REQ_SET_LOCATION(change_req);
3504         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3505
3506         /* current partition control needed by "repmd_op_callback" */
3507         ret = ldb_request_add_control(change_req,
3508                                       DSDB_CONTROL_CURRENT_PARTITION_OID,
3509                                       false, NULL);
3510         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3511
3512         return ldb_next_request(ar->module, change_req);
3513 }
3514
3515 /*
3516   handle renames that come in over DRS replication
3517  */
3518 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3519                                            struct ldb_message *msg,
3520                                            struct replPropertyMetaDataBlob *rmd,
3521                                            struct replPropertyMetaDataBlob *omd,
3522                                            struct ldb_request *parent)
3523 {
3524         struct replPropertyMetaData1 *md_remote;
3525         struct replPropertyMetaData1 *md_local;
3526
3527         if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3528                 /* no rename */
3529                 return LDB_SUCCESS;
3530         }
3531
3532         /* now we need to check for double renames. We could have a
3533          * local rename pending which our replication partner hasn't
3534          * received yet. We choose which one wins by looking at the
3535          * attribute stamps on the two objects, the newer one wins
3536          */
3537         md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3538         md_local  = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3539         /* if there is no name attribute then we have to assume the
3540            object we've received is in fact newer */
3541         if (!md_remote || !md_local ||
3542             replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3543                 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3544                          ldb_dn_get_linearized(ar->search_msg->dn),
3545                          ldb_dn_get_linearized(msg->dn)));
3546                 /* pass rename to the next module
3547                  * so it doesn't appear as an originating update */
3548                 return dsdb_module_rename(ar->module,
3549                                           ar->search_msg->dn, msg->dn,
3550                                           DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX, parent);
3551         }
3552
3553         /* we're going to keep our old object */
3554         DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3555                  ldb_dn_get_linearized(ar->search_msg->dn),
3556                  ldb_dn_get_linearized(msg->dn)));
3557         return LDB_SUCCESS;
3558 }
3559
3560
3561 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3562 {
3563         struct ldb_context *ldb;
3564         struct ldb_request *change_req;
3565         enum ndr_err_code ndr_err;
3566         struct ldb_message *msg;
3567         struct replPropertyMetaDataBlob *rmd;
3568         struct replPropertyMetaDataBlob omd;
3569         const struct ldb_val *omd_value;
3570         struct replPropertyMetaDataBlob nmd;
3571         struct ldb_val nmd_value;
3572         unsigned int i;
3573         uint32_t j,ni=0;
3574         unsigned int removed_attrs = 0;
3575         int ret;
3576
3577         ldb = ldb_module_get_ctx(ar->module);
3578         msg = ar->objs->objects[ar->index_current].msg;
3579         rmd = ar->objs->objects[ar->index_current].meta_data;
3580         ZERO_STRUCT(omd);
3581         omd.version = 1;
3582
3583         /* find existing meta data */
3584         omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3585         if (omd_value) {
3586                 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3587                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3588                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3589                         NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3590                         return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3591                 }
3592
3593                 if (omd.version != 1) {
3594                         return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3595                 }
3596         }
3597
3598         /* handle renames that come in over DRS */
3599         ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
3600         if (ret != LDB_SUCCESS) {
3601                 ldb_debug(ldb, LDB_DEBUG_FATAL,
3602                           "replmd_replicated_request rename %s => %s failed - %s\n",
3603                           ldb_dn_get_linearized(ar->search_msg->dn),
3604                           ldb_dn_get_linearized(msg->dn),
3605                           ldb_errstring(ldb));
3606                 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3607         }
3608
3609         ZERO_STRUCT(nmd);
3610         nmd.version = 1;
3611         nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3612         nmd.ctr.ctr1.array = talloc_array(ar,
3613                                           struct replPropertyMetaData1,
3614                                           nmd.ctr.ctr1.count);
3615         if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3616
3617         /* first copy the old meta data */
3618         for (i=0; i < omd.ctr.ctr1.count; i++) {
3619                 nmd.ctr.ctr1.array[ni]  = omd.ctr.ctr1.array[i];
3620                 ni++;
3621         }
3622
3623         ar->seq_num = 0;
3624         /* now merge in the new meta data */
3625         for (i=0; i < rmd->ctr.ctr1.count; i++) {
3626                 bool found = false;
3627
3628                 for (j=0; j < ni; j++) {
3629                         bool cmp;
3630
3631                         if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3632                                 continue;
3633                         }
3634
3635                         cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3636                                                                     &rmd->ctr.ctr1.array[i]);
3637                         if (cmp) {
3638                                 /* replace the entry */
3639                                 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3640                                 if (ar->seq_num == 0) {
3641                                         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3642                                         if (ret != LDB_SUCCESS) {
3643                                                 return replmd_replicated_request_error(ar, ret);
3644                                         }
3645                                 }
3646                                 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
3647                                 found = true;
3648                                 break;
3649                         }
3650
3651                         if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3652                                 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3653                                          msg->elements[i-removed_attrs].name,
3654                                          ldb_dn_get_linearized(msg->dn),
3655                                          GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3656                         }
3657
3658                         /* we don't want to apply this change so remove the attribute */
3659                         ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3660                         removed_attrs++;
3661
3662                         found = true;
3663                         break;
3664                 }
3665
3666                 if (found) continue;
3667
3668                 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3669                 if (ar->seq_num == 0) {
3670                         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3671                         if (ret != LDB_SUCCESS) {
3672                                 return replmd_replicated_request_error(ar, ret);
3673                         }
3674                 }
3675                 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
3676                 ni++;
3677         }
3678
3679         /*
3680          * finally correct the size of the meta_data array
3681          */
3682         nmd.ctr.ctr1.count = ni;
3683
3684         /*
3685          * the rdn attribute (the alias for the name attribute),
3686          * 'cn' for most objects is the last entry in the meta data array
3687          * we have stored
3688          *
3689          * sort the new meta data array
3690          */
3691         ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3692         if (ret != LDB_SUCCESS) {
3693                 return ret;
3694         }
3695
3696         /*
3697          * check if some replicated attributes left, otherwise skip the ldb_modify() call
3698          */
3699         if (msg->num_elements == 0) {
3700                 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3701                           ar->index_current);
3702
3703                 ar->index_current++;
3704                 return replmd_replicated_apply_next(ar);
3705         }
3706
3707         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3708                   ar->index_current, msg->num_elements);
3709
3710         /* create the meta data value */
3711         ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3712                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3713         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3714                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3715                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3716         }
3717
3718         /*
3719          * when we know that we'll modify the record, add the whenChanged, uSNChanged
3720          * and replPopertyMetaData attributes
3721          */
3722         ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3723         if (ret != LDB_SUCCESS) {
3724                 return replmd_replicated_request_error(ar, ret);
3725         }
3726         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3727         if (ret != LDB_SUCCESS) {
3728                 return replmd_replicated_request_error(ar, ret);
3729         }
3730         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3731         if (ret != LDB_SUCCESS) {
3732                 return replmd_replicated_request_error(ar, ret);
3733         }
3734
3735         replmd_ldb_message_sort(msg, ar->schema);
3736
3737         /* we want to replace the old values */
3738         for (i=0; i < msg->num_elements; i++) {
3739                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3740         }
3741
3742         if (DEBUGLVL(4)) {
3743                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3744                 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3745                 talloc_free(s);
3746         }
3747
3748         ret = ldb_build_mod_req(&change_req,
3749                                 ldb,
3750                                 ar,
3751                                 msg,
3752                                 ar->controls,
3753                                 ar,
3754                                 replmd_op_callback,
3755                                 ar->req);
3756         LDB_REQ_SET_LOCATION(change_req);
3757         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3758
3759         /* current partition control needed by "repmd_op_callback" */
3760         ret = ldb_request_add_control(change_req,
3761                                       DSDB_CONTROL_CURRENT_PARTITION_OID,
3762                                       false, NULL);
3763         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3764
3765         return ldb_next_request(ar->module, change_req);
3766 }
3767
3768 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3769                                                    struct ldb_reply *ares)
3770 {
3771         struct replmd_replicated_request *ar = talloc_get_type(req->context,
3772                                                struct replmd_replicated_request);
3773         int ret;
3774
3775         if (!ares) {
3776                 return ldb_module_done(ar->req, NULL, NULL,
3777                                         LDB_ERR_OPERATIONS_ERROR);
3778         }
3779         if (ares->error != LDB_SUCCESS &&
3780             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3781                 return ldb_module_done(ar->req, ares->controls,
3782                                         ares->response, ares->error);
3783         }
3784
3785         switch (ares->type) {
3786         case LDB_REPLY_ENTRY:
3787                 ar->search_msg = talloc_steal(ar, ares->message);
3788                 break;
3789
3790         case LDB_REPLY_REFERRAL:
3791                 /* we ignore referrals */
3792                 break;
3793
3794         case LDB_REPLY_DONE:
3795                 if (ar->search_msg != NULL) {
3796                         ret = replmd_replicated_apply_merge(ar);
3797                 } else {
3798                         ret = replmd_replicated_apply_add(ar);
3799                 }
3800                 if (ret != LDB_SUCCESS) {
3801                         return ldb_module_done(ar->req, NULL, NULL, ret);
3802                 }
3803         }
3804
3805         talloc_free(ares);
3806         return LDB_SUCCESS;
3807 }
3808
3809 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3810
3811 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3812 {
3813         struct ldb_context *ldb;
3814         int ret;
3815         char *tmp_str;
3816         char *filter;
3817         struct ldb_request *search_req;
3818         struct ldb_search_options_control *options;
3819
3820         if (ar->index_current >= ar->objs->num_objects) {
3821                 /* done with it, go to next stage */
3822                 return replmd_replicated_uptodate_vector(ar);
3823         }
3824
3825         ldb = ldb_module_get_ctx(ar->module);
3826         ar->search_msg = NULL;
3827
3828         tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3829         if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3830
3831         filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3832         if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3833         talloc_free(tmp_str);
3834
3835         ret = ldb_build_search_req(&search_req,
3836                                    ldb,
3837                                    ar,
3838                                    NULL,
3839                                    LDB_SCOPE_SUBTREE,
3840                                    filter,
3841                                    NULL,
3842                                    NULL,
3843                                    ar,
3844                                    replmd_replicated_apply_search_callback,
3845                                    ar->req);
3846         LDB_REQ_SET_LOCATION(search_req);
3847
3848         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3849                                       true, NULL);
3850         if (ret != LDB_SUCCESS) {
3851                 return ret;
3852         }
3853
3854         /* we need to cope with cross-partition links, so search for
3855            the GUID over all partitions */
3856         options = talloc(search_req, struct ldb_search_options_control);
3857         if (options == NULL) {
3858                 DEBUG(0, (__location__ ": out of memory\n"));
3859                 return LDB_ERR_OPERATIONS_ERROR;
3860         }
3861         options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3862
3863         ret = ldb_request_add_control(search_req,
3864                                       LDB_CONTROL_SEARCH_OPTIONS_OID,
3865                                       true, options);
3866         if (ret != LDB_SUCCESS) {
3867                 return ret;
3868         }
3869
3870         return ldb_next_request(ar->module, search_req);
3871 }
3872
3873 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3874                                                       struct ldb_reply *ares)
3875 {
3876         struct ldb_context *ldb;
3877         struct replmd_replicated_request *ar = talloc_get_type(req->context,
3878                                                struct replmd_replicated_request);
3879         ldb = ldb_module_get_ctx(ar->module);
3880
3881         if (!ares) {
3882                 return ldb_module_done(ar->req, NULL, NULL,
3883                                         LDB_ERR_OPERATIONS_ERROR);
3884         }
3885         if (ares->error != LDB_SUCCESS) {
3886                 return ldb_module_done(ar->req, ares->controls,
3887                                         ares->response, ares->error);
3888         }
3889
3890         if (ares->type != LDB_REPLY_DONE) {
3891                 ldb_set_errstring(ldb, "Invalid reply type\n!");
3892                 return ldb_module_done(ar->req, NULL, NULL,
3893                                         LDB_ERR_OPERATIONS_ERROR);
3894         }
3895
3896         talloc_free(ares);
3897
3898         return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3899 }
3900
3901 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3902 {
3903         struct ldb_context *ldb;
3904         struct ldb_request *change_req;
3905         enum ndr_err_code ndr_err;
3906         struct ldb_message *msg;
3907         struct replUpToDateVectorBlob ouv;
3908         const struct ldb_val *ouv_value;
3909         const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3910         struct replUpToDateVectorBlob nuv;
3911         struct ldb_val nuv_value;
3912         struct ldb_message_element *nuv_el = NULL;
3913         const struct GUID *our_invocation_id;
3914         struct ldb_message_element *orf_el = NULL;
3915         struct repsFromToBlob nrf;
3916         struct ldb_val *nrf_value = NULL;
3917         struct ldb_message_element *nrf_el = NULL;
3918         unsigned int i;
3919         uint32_t j,ni=0;
3920         bool found = false;
3921         time_t t = time(NULL);
3922         NTTIME now;
3923         int ret;
3924         uint32_t instanceType;
3925
3926         ldb = ldb_module_get_ctx(ar->module);
3927         ruv = ar->objs->uptodateness_vector;
3928         ZERO_STRUCT(ouv);
3929         ouv.version = 2;
3930         ZERO_STRUCT(nuv);
3931         nuv.version = 2;
3932
3933         unix_to_nt_time(&now, t);
3934
3935         instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3936         if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3937                 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3938                          ldb_dn_get_linearized(ar->search_msg->dn)));
3939                 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3940         }
3941
3942         /*
3943          * first create the new replUpToDateVector
3944          */
3945         ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3946         if (ouv_value) {
3947                 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3948                                                (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3949                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3950                         NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3951                         return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3952                 }
3953
3954                 if (ouv.version != 2) {
3955                         return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3956                 }
3957         }
3958
3959         /*
3960          * the new uptodateness vector will at least
3961          * contain 1 entry, one for the source_dsa
3962          *
3963          * plus optional values from our old vector and the one from the source_dsa
3964          */
3965         nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3966         if (ruv) nuv.ctr.ctr2.count += ruv->count;
3967         nuv.ctr.ctr2.cursors = talloc_array(ar,
3968                                             struct drsuapi_DsReplicaCursor2,
3969                                             nuv.ctr.ctr2.count);
3970         if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3971
3972         /* first copy the old vector */
3973         for (i=0; i < ouv.ctr.ctr2.count; i++) {
3974                 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3975                 ni++;
3976         }
3977
3978         /* get our invocation_id if we have one already attached to the ldb */
3979         our_invocation_id = samdb_ntds_invocation_id(ldb);
3980
3981         /* merge in the source_dsa vector is available */
3982         for (i=0; (ruv && i < ruv->count); i++) {
3983                 found = false;
3984
3985                 if (our_invocation_id &&
3986                     GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3987                                our_invocation_id)) {
3988                         continue;
3989                 }
3990
3991                 for (j=0; j < ni; j++) {
3992                         if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3993                                         &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3994                                 continue;
3995                         }
3996
3997                         found = true;
3998
3999                         /*
4000                          * we update only the highest_usn and not the latest_sync_success time,
4001                          * because the last success stands for direct replication
4002                          */
4003                         if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4004                                 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
4005                         }
4006                         break;
4007                 }
4008
4009                 if (found) continue;
4010
4011                 /* if it's not there yet, add it */
4012                 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4013                 ni++;
4014         }
4015
4016         /*
4017          * merge in the current highwatermark for the source_dsa
4018          */
4019         found = false;
4020         for (j=0; j < ni; j++) {
4021                 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
4022                                 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4023                         continue;
4024                 }
4025
4026                 found = true;
4027
4028                 /*
4029                  * here we update the highest_usn and last_sync_success time
4030                  * because we're directly replicating from the source_dsa
4031                  *
4032                  * and use the tmp_highest_usn because this is what we have just applied
4033                  * to our ldb
4034                  */
4035                 nuv.ctr.ctr2.cursors[j].highest_usn             = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4036                 nuv.ctr.ctr2.cursors[j].last_sync_success       = now;
4037                 break;
4038         }
4039         if (!found) {
4040                 /*
4041                  * here we update the highest_usn and last_sync_success time
4042                  * because we're directly replicating from the source_dsa
4043                  *
4044                  * and use the tmp_highest_usn because this is what we have just applied
4045                  * to our ldb
4046                  */
4047                 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
4048                 nuv.ctr.ctr2.cursors[ni].highest_usn            = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4049                 nuv.ctr.ctr2.cursors[ni].last_sync_success      = now;
4050                 ni++;
4051         }
4052
4053         /*
4054          * finally correct the size of the cursors array
4055          */
4056         nuv.ctr.ctr2.count = ni;
4057
4058         /*
4059          * sort the cursors
4060          */
4061         TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4062
4063         /*
4064          * create the change ldb_message
4065          */
4066         msg = ldb_msg_new(ar);
4067         if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4068         msg->dn = ar->search_msg->dn;
4069
4070         ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4071                                        (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4072         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4073                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4074                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4075         }
4076         ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4077         if (ret != LDB_SUCCESS) {
4078                 return replmd_replicated_request_error(ar, ret);
4079         }
4080         nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4081
4082         /*
4083          * now create the new repsFrom value from the given repsFromTo1 structure
4084          */
4085         ZERO_STRUCT(nrf);
4086         nrf.version                                     = 1;
4087         nrf.ctr.ctr1                                    = *ar->objs->source_dsa;
4088         nrf.ctr.ctr1.highwatermark.highest_usn          = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
4089
4090         /*
4091          * first see if we already have a repsFrom value for the current source dsa
4092          * if so we'll later replace this value
4093          */
4094         orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4095         if (orf_el) {
4096                 for (i=0; i < orf_el->num_values; i++) {
4097                         struct repsFromToBlob *trf;
4098
4099                         trf = talloc(ar, struct repsFromToBlob);
4100                         if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4101
4102                         ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4103                                                        (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4104                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4105                                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4106                                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4107                         }
4108
4109                         if (trf->version != 1) {
4110                                 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4111                         }
4112
4113                         /*
4114                          * we compare the source dsa objectGUID not the invocation_id
4115                          * because we want only one repsFrom value per source dsa
4116                          * and when the invocation_id of the source dsa has changed we don't need
4117                          * the old repsFrom with the old invocation_id
4118                          */
4119                         if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4120                                         &ar->objs->source_dsa->source_dsa_obj_guid)) {
4121                                 talloc_free(trf);
4122                                 continue;
4123                         }
4124
4125                         talloc_free(trf);
4126                         nrf_value = &orf_el->values[i];
4127                         break;
4128                 }
4129
4130                 /*
4131                  * copy over all old values to the new ldb_message
4132                  */
4133                 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4134                 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4135                 *nrf_el = *orf_el;
4136         }
4137
4138         /*
4139          * if we haven't found an old repsFrom value for the current source dsa
4140          * we'll add a new value
4141          */
4142         if (!nrf_value) {
4143                 struct ldb_val zero_value;
4144                 ZERO_STRUCT(zero_value);
4145                 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4146                 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4147
4148                 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4149         }
4150
4151         /* we now fill the value which is already attached to ldb_message */
4152         ndr_err = ndr_push_struct_blob(nrf_value, msg,
4153                                        &nrf,
4154                                        (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4155         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4156                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4157                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4158         }
4159
4160         /*
4161          * the ldb_message_element for the attribute, has all the old values and the new one
4162          * so we'll replace the whole attribute with all values
4163          */
4164         nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4165
4166         if (DEBUGLVL(4)) {
4167                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4168                 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4169                 talloc_free(s);
4170         }
4171
4172         /* prepare the ldb_modify() request */
4173         ret = ldb_build_mod_req(&change_req,
4174                                 ldb,
4175                                 ar,
4176                                 msg,
4177                                 ar->controls,
4178                                 ar,
4179                                 replmd_replicated_uptodate_modify_callback,
4180                                 ar->req);
4181         LDB_REQ_SET_LOCATION(change_req);
4182         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4183
4184         return ldb_next_request(ar->module, change_req);
4185 }
4186
4187 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4188                                                       struct ldb_reply *ares)
4189 {
4190         struct replmd_replicated_request *ar = talloc_get_type(req->context,
4191                                                struct replmd_replicated_request);
4192         int ret;
4193
4194         if (!ares) {
4195                 return ldb_module_done(ar->req, NULL, NULL,
4196                                         LDB_ERR_OPERATIONS_ERROR);
4197         }
4198         if (ares->error != LDB_SUCCESS &&
4199             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4200                 return ldb_module_done(ar->req, ares->controls,
4201                                         ares->response, ares->error);
4202         }
4203
4204         switch (ares->type) {
4205         case LDB_REPLY_ENTRY:
4206                 ar->search_msg = talloc_steal(ar, ares->message);
4207                 break;
4208
4209         case LDB_REPLY_REFERRAL:
4210                 /* we ignore referrals */
4211                 break;
4212
4213         case LDB_REPLY_DONE:
4214                 if (ar->search_msg == NULL) {
4215                         ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4216                 } else {
4217                         ret = replmd_replicated_uptodate_modify(ar);
4218                 }
4219                 if (ret != LDB_SUCCESS) {
4220                         return ldb_module_done(ar->req, NULL, NULL, ret);
4221                 }
4222         }
4223
4224         talloc_free(ares);
4225         return LDB_SUCCESS;
4226 }
4227
4228
4229 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4230 {
4231         struct ldb_context *ldb;
4232         int ret;
4233         static const char *attrs[] = {
4234                 "replUpToDateVector",
4235                 "repsFrom",
4236                 "instanceType",
4237                 NULL
4238         };
4239         struct ldb_request *search_req;
4240
4241         ldb = ldb_module_get_ctx(ar->module);
4242         ar->search_msg = NULL;
4243
4244         ret = ldb_build_search_req(&search_req,
4245                                    ldb,
4246                                    ar,
4247                                    ar->objs->partition_dn,
4248                                    LDB_SCOPE_BASE,
4249                                    "(objectClass=*)",
4250                                    attrs,
4251                                    NULL,
4252                                    ar,
4253                                    replmd_replicated_uptodate_search_callback,
4254                                    ar->req);
4255         LDB_REQ_SET_LOCATION(search_req);
4256         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4257
4258         return ldb_next_request(ar->module, search_req);
4259 }
4260
4261
4262
4263 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4264 {
4265         struct ldb_context *ldb;
4266         struct dsdb_extended_replicated_objects *objs;
4267         struct replmd_replicated_request *ar;
4268         struct ldb_control **ctrls;
4269         int ret;
4270         uint32_t i;
4271         struct replmd_private *replmd_private =
4272                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4273
4274         ldb = ldb_module_get_ctx(module);
4275
4276         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4277
4278         objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4279         if (!objs) {
4280                 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4281                 return LDB_ERR_PROTOCOL_ERROR;
4282         }
4283
4284         if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4285                 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4286                           objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4287                 return LDB_ERR_PROTOCOL_ERROR;
4288         }
4289
4290         ar = replmd_ctx_init(module, req);
4291         if (!ar)
4292                 return LDB_ERR_OPERATIONS_ERROR;
4293
4294         /* Set the flags to have the replmd_op_callback run over the full set of objects */
4295         ar->apply_mode = true;
4296         ar->objs = objs;
4297         ar->schema = dsdb_get_schema(ldb, ar);
4298         if (!ar->schema) {
4299                 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4300                 talloc_free(ar);
4301                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4302                 return LDB_ERR_CONSTRAINT_VIOLATION;
4303         }
4304
4305         ctrls = req->controls;
4306
4307         if (req->controls) {
4308                 req->controls = talloc_memdup(ar, req->controls,
4309                                               talloc_get_size(req->controls));
4310                 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4311         }
4312
4313         /* This allows layers further down to know if a change came in over replication */
4314         ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
4315         if (ret != LDB_SUCCESS) {
4316                 return ret;
4317         }
4318
4319         /* If this change contained linked attributes in the body
4320          * (rather than in the links section) we need to update
4321          * backlinks in linked_attributes */
4322         ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4323         if (ret != LDB_SUCCESS) {
4324                 return ret;
4325         }
4326
4327         ar->controls = req->controls;
4328         req->controls = ctrls;
4329
4330         DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4331
4332         /* save away the linked attributes for the end of the
4333            transaction */
4334         for (i=0; i<ar->objs->linked_attributes_count; i++) {
4335                 struct la_entry *la_entry;
4336
4337                 if (replmd_private->la_ctx == NULL) {
4338                         replmd_private->la_ctx = talloc_new(replmd_private);
4339                 }
4340                 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4341                 if (la_entry == NULL) {
4342                         ldb_oom(ldb);
4343                         return LDB_ERR_OPERATIONS_ERROR;
4344                 }
4345                 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4346                 if (la_entry->la == NULL) {
4347                         talloc_free(la_entry);
4348                         ldb_oom(ldb);
4349                         return LDB_ERR_OPERATIONS_ERROR;
4350                 }
4351                 *la_entry->la = ar->objs->linked_attributes[i];
4352
4353                 /* we need to steal the non-scalars so they stay
4354                    around until the end of the transaction */
4355                 talloc_steal(la_entry->la, la_entry->la->identifier);
4356                 talloc_steal(la_entry->la, la_entry->la->value.blob);
4357
4358                 DLIST_ADD(replmd_private->la_list, la_entry);
4359         }
4360
4361         return replmd_replicated_apply_next(ar);
4362 }
4363
4364 /*
4365   process one linked attribute structure
4366  */
4367 static int replmd_process_linked_attribute(struct ldb_module *module,
4368                                            struct la_entry *la_entry,
4369                                            struct ldb_request *parent)
4370 {
4371         struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4372         struct ldb_context *ldb = ldb_module_get_ctx(module);
4373         struct ldb_message *msg;
4374         TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4375         const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4376         int ret;
4377         const struct dsdb_attribute *attr;
4378         struct dsdb_dn *dsdb_dn;
4379         uint64_t seq_num = 0;
4380         struct ldb_message_element *old_el;
4381         WERROR status;
4382         time_t t = time(NULL);
4383         struct ldb_result *res;
4384         const char *attrs[2];
4385         struct parsed_dn *pdn_list, *pdn;
4386         struct GUID guid = GUID_zero();
4387         NTSTATUS ntstatus;
4388         bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
4389         const struct GUID *our_invocation_id;
4390
4391 /*
4392 linked_attributes[0]:
4393      &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
4394         identifier               : *
4395             identifier: struct drsuapi_DsReplicaObjectIdentifier
4396                 __ndr_size               : 0x0000003a (58)
4397                 __ndr_size_sid           : 0x00000000 (0)
4398                 guid                     : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
4399                 sid                      : S-0-0
4400                 __ndr_size_dn            : 0x00000000 (0)
4401                 dn                       : ''
4402         attid                    : DRSUAPI_ATTID_member (0x1F)
4403         value: struct drsuapi_DsAttributeValue
4404             __ndr_size               : 0x0000007e (126)
4405             blob                     : *
4406                 blob                     : DATA_BLOB length=126
4407         flags                    : 0x00000001 (1)
4408                1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
4409         originating_add_time     : Wed Sep  2 22:20:01 2009 EST
4410         meta_data: struct drsuapi_DsReplicaMetaData
4411             version                  : 0x00000015 (21)
4412             originating_change_time  : Wed Sep  2 23:39:07 2009 EST
4413             originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
4414             originating_usn          : 0x000000000001e19c (123292)
4415
4416 (for cases where the link is to a normal DN)
4417      &target: struct drsuapi_DsReplicaObjectIdentifier3
4418         __ndr_size               : 0x0000007e (126)
4419         __ndr_size_sid           : 0x0000001c (28)
4420         guid                     : 7639e594-db75-4086-b0d4-67890ae46031
4421         sid                      : S-1-5-21-2848215498-2472035911-1947525656-19924
4422         __ndr_size_dn            : 0x00000022 (34)
4423         dn                       : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
4424  */
4425
4426         /* find the attribute being modified */
4427         attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
4428         if (attr == NULL) {
4429                 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
4430                 talloc_free(tmp_ctx);
4431                 return LDB_ERR_OPERATIONS_ERROR;
4432         }
4433
4434         attrs[0] = attr->lDAPDisplayName;
4435         attrs[1] = NULL;
4436
4437         /* get the existing message from the db for the object with
4438            this GUID, returning attribute being modified. We will then
4439            use this msg as the basis for a modify call */
4440         ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
4441                                  DSDB_FLAG_NEXT_MODULE |
4442                                  DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
4443                                  DSDB_SEARCH_SHOW_RECYCLED |
4444                                  DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
4445                                  DSDB_SEARCH_REVEAL_INTERNALS,
4446                                  parent,
4447                                  "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
4448         if (ret != LDB_SUCCESS) {
4449                 talloc_free(tmp_ctx);
4450                 return ret;
4451         }
4452         if (res->count != 1) {
4453                 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
4454                                        GUID_string(tmp_ctx, &la->identifier->guid));
4455                 talloc_free(tmp_ctx);
4456                 return LDB_ERR_NO_SUCH_OBJECT;
4457         }
4458         msg = res->msgs[0];
4459
4460         if (msg->num_elements == 0) {
4461                 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
4462                 if (ret != LDB_SUCCESS) {
4463                         ldb_module_oom(module);
4464                         talloc_free(tmp_ctx);
4465                         return LDB_ERR_OPERATIONS_ERROR;
4466                 }
4467         } else {
4468                 old_el = &msg->elements[0];
4469                 old_el->flags = LDB_FLAG_MOD_REPLACE;
4470         }
4471
4472         /* parse the existing links */
4473         ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
4474         if (ret != LDB_SUCCESS) {
4475                 talloc_free(tmp_ctx);
4476                 return ret;
4477         }
4478
4479         /* get our invocationId */
4480         our_invocation_id = samdb_ntds_invocation_id(ldb);
4481         if (!our_invocation_id) {
4482                 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
4483                 talloc_free(tmp_ctx);
4484                 return LDB_ERR_OPERATIONS_ERROR;
4485         }
4486
4487         ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
4488         if (ret != LDB_SUCCESS) {
4489                 talloc_free(tmp_ctx);
4490                 return ret;
4491         }
4492
4493         status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
4494         if (!W_ERROR_IS_OK(status)) {
4495                 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
4496                                        old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
4497                 return LDB_ERR_OPERATIONS_ERROR;
4498         }
4499
4500         ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
4501         if (!NT_STATUS_IS_OK(ntstatus) && active) {
4502                 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
4503                                        old_el->name,
4504                                        ldb_dn_get_linearized(dsdb_dn->dn),
4505                                        ldb_dn_get_linearized(msg->dn));
4506                 return LDB_ERR_OPERATIONS_ERROR;
4507         }
4508
4509         /* re-resolve the DN by GUID, as the DRS server may give us an
4510            old DN value */
4511         ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
4512         if (ret != LDB_SUCCESS) {
4513                 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
4514                          GUID_string(tmp_ctx, &guid),
4515                          ldb_dn_get_linearized(dsdb_dn->dn)));
4516         }
4517
4518         /* see if this link already exists */
4519         pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
4520         if (pdn != NULL) {
4521                 /* see if this update is newer than what we have already */
4522                 struct GUID invocation_id = GUID_zero();
4523                 uint32_t version = 0;
4524                 uint32_t originating_usn = 0;
4525                 NTTIME change_time = 0;
4526                 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
4527
4528                 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
4529                 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
4530                 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
4531                 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
4532
4533                 if (!replmd_update_is_newer(&invocation_id,
4534                                             &la->meta_data.originating_invocation_id,
4535                                             version,
4536                                             la->meta_data.version,
4537                                             change_time,
4538                                             la->meta_data.originating_change_time)) {
4539                         DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4540                                  old_el->name, ldb_dn_get_linearized(msg->dn),
4541                                  GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4542                         talloc_free(tmp_ctx);
4543                         return LDB_SUCCESS;
4544                 }
4545
4546                 /* get a seq_num for this change */
4547                 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4548                 if (ret != LDB_SUCCESS) {
4549                         talloc_free(tmp_ctx);
4550                         return ret;
4551                 }
4552
4553                 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4554                         /* remove the existing backlink */
4555                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4556                         if (ret != LDB_SUCCESS) {
4557                                 talloc_free(tmp_ctx);
4558                                 return ret;
4559                         }
4560                 }
4561
4562                 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4563                                            &la->meta_data.originating_invocation_id,
4564                                            la->meta_data.originating_usn, seq_num,
4565                                            la->meta_data.originating_change_time,
4566                                            la->meta_data.version,
4567                                            !active);
4568                 if (ret != LDB_SUCCESS) {
4569                         talloc_free(tmp_ctx);
4570                         return ret;
4571                 }
4572
4573                 if (active) {
4574                         /* add the new backlink */
4575                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4576                         if (ret != LDB_SUCCESS) {
4577                                 talloc_free(tmp_ctx);
4578                                 return ret;
4579                         }
4580                 }
4581         } else {
4582                 /* get a seq_num for this change */
4583                 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4584                 if (ret != LDB_SUCCESS) {
4585                         talloc_free(tmp_ctx);
4586                         return ret;
4587                 }
4588
4589                 old_el->values = talloc_realloc(msg->elements, old_el->values,
4590                                                 struct ldb_val, old_el->num_values+1);
4591                 if (!old_el->values) {
4592                         ldb_module_oom(module);
4593                         return LDB_ERR_OPERATIONS_ERROR;
4594                 }
4595                 old_el->num_values++;
4596
4597                 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4598                                           &la->meta_data.originating_invocation_id,
4599                                           la->meta_data.originating_usn, seq_num,
4600                                           la->meta_data.originating_change_time,
4601                                           la->meta_data.version,
4602                                           (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4603                 if (ret != LDB_SUCCESS) {
4604                         talloc_free(tmp_ctx);
4605                         return ret;
4606                 }
4607
4608                 if (active) {
4609                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4610                                                   true, attr, false);
4611                         if (ret != LDB_SUCCESS) {
4612                                 talloc_free(tmp_ctx);
4613                                 return ret;
4614                         }
4615                 }
4616         }
4617
4618         /* we only change whenChanged and uSNChanged if the seq_num
4619            has changed */
4620         if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4621                 talloc_free(tmp_ctx);
4622                 return ldb_operr(ldb);
4623         }
4624
4625         if (add_uint64_element(ldb, msg, "uSNChanged",
4626                                seq_num) != LDB_SUCCESS) {
4627                 talloc_free(tmp_ctx);
4628                 return ldb_operr(ldb);
4629         }
4630
4631         old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4632         if (old_el == NULL) {
4633                 talloc_free(tmp_ctx);
4634                 return ldb_operr(ldb);
4635         }
4636
4637         ret = dsdb_check_single_valued_link(attr, old_el);
4638         if (ret != LDB_SUCCESS) {
4639                 talloc_free(tmp_ctx);
4640                 return ret;
4641         }
4642
4643         old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4644
4645         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
4646         if (ret != LDB_SUCCESS) {
4647                 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4648                           ldb_errstring(ldb),
4649                           ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4650                 talloc_free(tmp_ctx);
4651                 return ret;
4652         }
4653
4654         talloc_free(tmp_ctx);
4655
4656         return ret;
4657 }
4658
4659 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4660 {
4661         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4662                 return replmd_extended_replicated_objects(module, req);
4663         }
4664
4665         return ldb_next_request(module, req);
4666 }
4667
4668
4669 /*
4670   we hook into the transaction operations to allow us to
4671   perform the linked attribute updates at the end of the whole
4672   transaction. This allows a forward linked attribute to be created
4673   before the object is created. During a vampire, w2k8 sends us linked
4674   attributes before the objects they are part of.
4675  */
4676 static int replmd_start_transaction(struct ldb_module *module)
4677 {
4678         /* create our private structure for this transaction */
4679         struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4680                                                                 struct replmd_private);
4681         replmd_txn_cleanup(replmd_private);
4682
4683         /* free any leftover mod_usn records from cancelled
4684            transactions */
4685         while (replmd_private->ncs) {
4686                 struct nc_entry *e = replmd_private->ncs;
4687                 DLIST_REMOVE(replmd_private->ncs, e);
4688                 talloc_free(e);
4689         }
4690
4691         return ldb_next_start_trans(module);
4692 }
4693
4694 /*
4695   on prepare commit we loop over our queued la_context structures and
4696   apply each of them
4697  */
4698 static int replmd_prepare_commit(struct ldb_module *module)
4699 {
4700         struct replmd_private *replmd_private =
4701                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4702         struct la_entry *la, *prev;
4703         struct la_backlink *bl;
4704         int ret;
4705
4706         /* walk the list backwards, to do the first entry first, as we
4707          * added the entries with DLIST_ADD() which puts them at the
4708          * start of the list */
4709         for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4710                 prev = DLIST_PREV(la);
4711                 DLIST_REMOVE(replmd_private->la_list, la);
4712                 ret = replmd_process_linked_attribute(module, la, NULL);
4713                 if (ret != LDB_SUCCESS) {
4714                         replmd_txn_cleanup(replmd_private);
4715                         return ret;
4716                 }
4717         }
4718
4719         /* process our backlink list, creating and deleting backlinks
4720            as necessary */
4721         for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4722                 ret = replmd_process_backlink(module, bl, NULL);
4723                 if (ret != LDB_SUCCESS) {
4724                         replmd_txn_cleanup(replmd_private);
4725                         return ret;
4726                 }
4727         }
4728
4729         replmd_txn_cleanup(replmd_private);
4730
4731         /* possibly change @REPLCHANGED */
4732         ret = replmd_notify_store(module, NULL);
4733         if (ret != LDB_SUCCESS) {
4734                 return ret;
4735         }
4736
4737         return ldb_next_prepare_commit(module);
4738 }
4739
4740 static int replmd_del_transaction(struct ldb_module *module)
4741 {
4742         struct replmd_private *replmd_private =
4743                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4744         replmd_txn_cleanup(replmd_private);
4745
4746         return ldb_next_del_trans(module);
4747 }
4748
4749
4750 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4751         .name          = "repl_meta_data",
4752         .init_context      = replmd_init,
4753         .add               = replmd_add,
4754         .modify            = replmd_modify,
4755         .rename            = replmd_rename,
4756         .del               = replmd_delete,
4757         .extended          = replmd_extended,
4758         .start_transaction = replmd_start_transaction,
4759         .prepare_commit    = replmd_prepare_commit,
4760         .del_transaction   = replmd_del_transaction,
4761 };
4762
4763 int ldb_repl_meta_data_module_init(const char *version)
4764 {
4765         LDB_MODULE_CHECK_VERSION(version);
4766         return ldb_register_module(&ldb_repl_meta_data_module_ops);
4767 }